FlowCraft: Unveiling adversarial robustness of LiDAR scene flow estimation

With the arrival of deep learning and advanced sensor technologies, the autonomous vehicle domain has gained increased research interest. In particular, deep learning networks developed based on 3D LiDAR sensing data for perception and planning in autonomous vehicles demonstrate remarkable performance. However, recent research reveals vulnerabilities in LiDAR-based perception tasks, such as 3D object detection and segmentation, to intentionally crafted adversarial perturbations. Yet, the adversarial robustness of LiDAR-based regression tasks like scene flow estimation, remains largely unexplored. Therefore, this study introduces a novel point perturbation attack named FlowCraft, based on two loss functions, along with a critical analysis of selecting the adversarial objective against scene flow estimation. In particular, evaluations are conducted on trainable, runtime optimization, supervised, and self-supervised, scene flow estimation methods using the Argoverse 2 and Waymo datasets in both black-box and white-box settings. Experimental results on the Argoverse 2 benchmark dataset and the DeFlow network show that FlowCraft achieves a relative endpoint error increment of 2.9, while demonstrating a higher endpoint error increase of 5.5 per unit change in Chamfer Distance compared to PGD and CosPGD attacks. Furthermore, our results demonstrate that the performance of point perturbation attacks against runtime optimization methods involves a trade-off between their success rate and overall imperceptibility. • Explain why adding perturbations to the point cloud at t=t+1 is more effective for evaluations. • Introduce the FlowCraft attack against scene flow estimation, which is based on dual loss functions. • The white-box version of the FlowCraft attack against the DeFlow network on the Argoverse 2 dataset achieves a relative endpoint error increment of 2.9, and a relative endpoint error increment of 1.7 on the Waymo dataset. • Evaluate the black-box transferability of FlowCraft against supervised, self-supervised methods, trainable and run-time optimization-based methods, using the Argoverse 2 and Waymo datasets. • FlowCraft outperforms PGD and CosPGD attacks in terms of attack effectiveness and imperceptibility under trainable approaches.