Dynamic Attacks

We conducted a series of comparative experiments in the SVL Simulator, including scenarios without any ornament, with the original adversarial ornament, and with our reconstructed adversarial ornament. 

In the scenario without an adversarial ornament, the model successfully detects the target vehicle, and the victim vehicle comes to a stop after the target vehicle. In the scenario with the original adversarial ornament, the model successfully detects the target vehicle, and the victim vehicle exhibits a noticeable deceleration. However, in the scenario with our reconstructed adversarial ornament, the model consistently fails to detect the target vehicle, resulting in a collision between the victim vehicle and the target vehicle. 

Fusion Attacks

Extra Pictures of Section 8.1

We export the Lidar-captured frames and feed them into the perception model. Next, we use bounding boxes to highlight the model's detection results in the input point cloud and capture screenshots from a Top-Down perspective for each frame. Finally, we generate GIFs using these screenshots to demonstrate the track of the target vehicle along with the corresponding detection results. In which the target vehicle with a benign ornament fails to deceive the Lidar-based perception model and our reconstructed adversarial ornament can. It is worth noting that the whole attack process does not need 3D printers, laser transmitters, or other sophisticated devices. The physical reconstructed adversarial ornament is manually cut from cardboards, resulting in a total cost of less than $29.

Extra Pictures of Section 8.2

Extra Pictures of Section 6.4

The LiDAR-captured point cloud of the reconstructed adversarial object is shown in the first row, while the point cloud of the original adversarial object is presented in the second row. From these images, we observe that the point cloud of the reconstructed adversarial object closely resembles the desired adversarial point cloud across all distances. On the other hand, the point cloud of the original adversarial object not only deviates from the desired adversarial point cloud but also exhibits inconsistencies across different distances.