Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving
For autonomous driving safety, this work addresses the problem of physical adversarial patches that transfer across unseen detectors, which is a critical vulnerability for real-world deployment.
The paper proposes AdvAD, a transfer-based physical adversarial patch attack against object detection in autonomous driving that optimizes patches over multiple detection models to improve transferability, outperforming SOTA attacks in both digital and real-world settings.
Deep learning drives major advances in autonomous driving (AD), where object detectors are central to perception. However, adversarial attacks pose significant threats to the reliability and safety of these systems, with physical adversarial patches representing a particularly potent form of attack. Physical adversarial patch attacks pose severe risks but are usually crafted for a single model, yielding poor transferability to unseen detectors. We propose AdvAD, a transfer-based physical attack against object detection in autonomous driving. Instead of targeting a specific detector, AdvAD optimizes adversarial patches over multiple detection models in a unified framework, encouraging the learned perturbations to capture shared vulnerabilities across architectures. The optimization process adaptively balances model contributions and enforces robustness to physical variations. It further employs data augmentation and geometric transformations to maintain patch effectiveness under diverse physical conditions. Experiments in both digital and real-world settings show that AdvAD consistently outperforms state-of-the-art (SOTA) attacks in performance and transferability.