Looking into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing
Summary
There have been several works that show that it is possible to attack LiDAR-based perception systems of Autonomous Vehicles (AVs) by spoofing LiDAR return signals. More specifically, injecting points into 3D point cloud to elicit fake obstacles (ghost objects) that are detected by 3D object detectors, affecting the AV's driving decision. As point-cloud based 3D object detectors are trained to use point representation as features to identify objects, they are susceptible to point injection attacks. Suggested defenses make strong assumptions on both the presence and integrity of hardware of either homogeneous or heterogeneous sensing modalities. Shadow-Catcher is designed and implemented as an "end-to-end" prototype that is agnostic to the 3D object detector targeted by the adversary and only uses LiDAR measurement data that is already available to the target object detector. Shdaow-Catcher looks into 3D object detectors' blind spots by using objects' 3D shadows as a physical invariant for their verification.
Attack DeMos
Ghost Attack
Ghost Attack is the spoofing of (non-existent) objects by injecting points to fool 3D object detector to recognise attack trace as an obstacle to influence the driving decision of AVs.
In this scene of a road in the neighbourhood with multiple genuine objects (Cars and Cyclists), we injected a fake pedestrian in front of the vehicle in the middle of the road.
We demonstrate how Shadow-Catcher verifies the objects in the scene and detect the injected pedestrian as a ghost (i.e. ghost attack).
Detected Object '0' : Car
Detected Object '1' : Cyclist
Detected Object '7' : Pedestrian
Shadow-Catcher estimates the shadows for the 8 objects identified by the 3D object detector and scores the shadow regions.
Anomalous shadow regions are further processed to extract shadow features used in a binary classifier to identify the type of attack (ghost or invalidation attack).
Shadow-Catcher managed to detect Object 7-Pedestrian as a Ghost Attack
Invalidation Attack
An approach that uses shadows to verify true objects, might incentivise attacks where the adversary’s goal changes from injecting ghost objects to invalidating true objects. Hence, an adversary might try to inject fake points inside the shadow region of a target object to force our object detection validation algorithm to invalidate real objects - we call this an Invalidation Attack. To identify invalidation attack and distinguishing it from a ghost attack is critical as we do not want to erroneously flag a genuine object as an attack just by the scoring mechanism.
We demonstrate an Invalidation Attack by injecting points into the shadow of the target genuine object.
Before Attack
Shadow of Target of Genuine Object (Object ID : 0)
Output of Shadow-Catcher (before Invalidation Attack) :
Under benign scenarios, all the objects identified are labelled by Shadow-Catcher as "Genuine".
After Invalidation Attack
Shadow of Target of Genuine Object (Object ID : 0)
Adversary injects points at region of high scoring to elicit a high score, triggering anomaly detection.
Output of Shadow-Catcher (After Invalidation Attack) :
After an Invalidation Attack where adversary injects points into shadow region of Object 0, the object is flagged as anomalous by the scoring mechanism.
After feature extraction from the points in the anomalous shadow, the features are used by the adversarial shadow classifier to identify the attack. Shadow-Catcher has identified Object 0 as a genuine object being attacked by an adversary that tries to invalidate it as a ghost.
Dataset used for these experiments are obtained from The KITTI Dataset [1].
Supplementary Material
2D Shadow Region Estimation
To compute the shadow region,we first convert a 3D point cloud scene into its 2D birds-eye-view (BEV) compact representation. Next, we compute the boundary lines of the shadow region. We first take the coordinates of the bounding box for the detected object from the 3D object detector. Using the coordinates of the corners of the bounding box, we compute the gradients of the lines from the reference point (position of the LiDAR unit on the vehicle) to each of the corners.
To simulate the fact that LiDAR has a finite range we define a maximum length for shadow regions, which we call the shadow length(l). Intuitively, the shadow length depends on how close the object is to the ray source as well as the height of the object. The shadow length (l) can be derived from the height of the object (h), with respect to the height of the LiDAR unit (H) and furthest distance of object from LiDAR unit (d_obj).
3D Shadow Region Estimation
We propose and evaluate two different ways for estimating 3D shadow regions. The figure on the right helps visualize the intuition
behind these approaches. In the former case (a) the height of the shadow is calculated using ray optics; while in the latter
(b) we use a uniform height across the length of the shadow.
Challenges of shadow Estimation
The figure on the right illustrates representative cases which render shadow region estimation challenging. The challenging scenarios depicted are:
(a) An object is located in the shadow of another object, thus the shadow of the object is indistinguishable from the shadow that the object is within.
(b) Objects are clustered together (e.g. cars parked together along the side-walk) resulting in a large region of void from the overlapping shadows.
(c) An object is in front of a higher object (e.g. car in front of wall) and hence its shadow overlaps with the shadow of the high object.
(d) Objects are too far away from the LiDAR unit, where the resolution of LiDAR is poorer. It becomes difficult to obtain the shape of the shadow due to sparsity in measurements.
Detailed Correspondence Metrics by Object Types
The table provides a break down of the correspondence metrics for shadows of the various objects in the KITTI dataset. Shadow-Catcher’s shadow region estimation was used to generate shadows for objects in the 120 random scenes and the generated shadows were compared with their manually labelled shadow regions. We observe that for all objects (with the exception of Sitting Pedestrian), we obtain good results for IoU and Shape Similarity and Scale scores (i.e. median values are close to 1). The large variance in metrics is due to challenging scenarios and noisy artifacts that makes it difficult to provide proper manual labelling of shadow regions, resulting in some discrepancies in some corner cases.
Anomaly Detection performance
To evaluate Shadow-Catcher’s ability to detect anomalous shadows we used the Receiver OperatingCharacteristic (ROC) Curve, the Area Under Curve of ROC curve (AUC-ROC), F1 score and Accuracy. The ROC curve shows the discriminatory ability of the detector. It shows the trade-off between True Positive Rate (TPR) vs False Positive Rate (FPR) at various threshold values. The AUC-ROC summarises the performance of the detector and can be interpreted as the probability of the detector providing an accurate prediction. The F1 score is the harmonic mean of precision and recall where the value of 1 indicates perfect precision and re-call. Lastly, Accuracy shows the fraction of the predictions that the detector got right.
Overall, we found that 3D shadows, with uniform height of 0.2m above the ground and an anomaly score threshold of 0.2 provide the best overall trade-off of TPR vs FPR for all injected objects. In particular, with the above configuration, we obtain an overall accuracy of 0.93, TPR of 0.94 and FPR of 0.069 for anomalous shadow regions due to Ghost Attacks.
We then took a closer look into the sources of errors. The false negatives (ghost objects not detected by Shadow-Catcher) in the dataset are found to be attributed to injected objects being implanted in regions that are already void of points due to incomplete LiDAR measurements (Last Figure (a)). Note that this is due to LiDAR’s failure to take measurements of the ground level. As LiDAR technology gets better, our approach’s accuracy will also improve. The false positives (real objects flagged as potential ghosts by Shadow-Catcher) are due to their shadows having point measurements from other larger objects behind them (Last Figure (b)). This may (very rarely) happen although the safety repercussions are less important in this case since the second object (right behind the first) will be correctly validated.
[1] Geiger, A., Lenz, P., Stiller, C., & Urtasun, R. (2013). Vision meets robotics: The kitti dataset. The International Journal of Robotics Research, 32(11), 1231-1237.
To Cite this work
Hau, Z., Demetriou, S., Muñoz-González, L., & Lupu, E. C. (2020). Shadow-catcher: Looking into shadows to detect ghost objects in autonomous vehicle 3D sensing. 26th European Symposium on Research in Computer Security (ESORICS) (2021).
BIBTEX
@INPROCEEDINGS{
Hau2021Shadow,
author = {Hau, Zhongyuan and Demetriou, Soteris and Mu{\~n}ozGonz{\'a}lez, Luis and Lupu, Emil C},
title = {Shadow-catcher: Looking into shadows to detect ghost objects in autonomous vehicle 3D sensing},
booktitle = {26th European Symposium on Research in Computer Security (ESORICS)},
year = {2021}
}