用特殊材料设计真实可实现的激光雷达后门攻击,成功率超93%。
MOBA: A Material-Oriented Backdoor Attack against LiDAR-based 3D Object Detection Systems
- 基于材料特性设计物理触发器,解决数字到现实的映射问题。
- 在多种模型上实现93.5%攻击成功率,比现有方法高41%以上。
- 适合关注自动驾驶安全与物理级防御的研究者阅读。
基于激光雷达的3D目标检测广泛应用于安全关键系统,但易受训练阶段植入的后门攻击。现有攻击多为纯数字触发,缺乏物理可实现性,因未考虑材料对激光反射的影响;而物理触发器常因优化不足导致效果差或易被发现。本文提出材料导向后门攻击(MOBA),通过显式建模真实触发器的材料属性,解决两个关键挑战:一是选择在多环境条件下稳定的材料,选定二氧化钛(TiO₂)因其高漫反射率和耐久性;二是确保数字模拟与物理行为一致,提出新仿真流程:采用角度无关的Oren-Nayar BRDF近似生成真实激光强度,并引入距离感知缩放机制保持深度变化下的空间一致性。在主流激光雷达及相机-激光雷达融合模型上实验表明,MOBA达到93.50%攻击成功率,较先前方法提升超41%。本工作揭示了一类新型可物理实现的威胁,强调需从材料层面构建现实环境下的防御体系。
原文摘要 · Abstract (English)
LiDAR-based 3D object detection is widely used in safety-critical systems. However, these systems remain vulnerable to backdoor attacks that embed hidden malicious behaviors during training. A key limitation of existing backdoor attacks is their lack of physical realizability, primarily due to the digital-to-physical domain gap. Digital triggers often fail in real-world settings because they overlook material-dependent LiDAR reflection properties. On the other hand, physically constructed triggers are often unoptimized, leading to low effectiveness or easy detectability.This paper introduces Material-Oriented Backdoor Attack (MOBA), a novel framework that bridges the digital-physical gap by explicitly modeling the material properties of real-world triggers. MOBA tackles two key challenges in physical backdoor design: 1) robustness of the trigger material under diverse environmental conditions, 2) alignment between the physical trigger's behavior and its digital simulation. First, we propose a systematic approach to selecting robust trigger materials, identifying titanium dioxide (TiO_2) for its high diffuse reflectivity and environmental resilience. Second, to ensure the digital trigger accurately mimics the physical behavior of the material-based trigger, we develop a novel simulation pipeline that features: (1) an angle-independent approximation of the Oren-Nayar BRDF model to generate realistic LiDAR intensities, and (2) a distance-aware scaling mechanism to maintain spatial consistency across varying depths. We conduct extensive experiments on state-of-the-art LiDAR-based and Camera-LiDAR fusion models, showing that MOBA achieves a 93.50% attack success rate, outperforming prior methods by over 41%. Our work reveals a new class of physically realizable threats and underscores the urgent need for defenses that account for material-level properties in real-world environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。