arXiv:2608.04453cs.CVcs.AI2026-08

提出新型隐形双点攻击,破坏高精地图构建。

TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction

论文配图:TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
图 1 · 摘自论文原文
  • 设计协同隐形攻击,精准控制最少干扰点
  • 实测使地图精度下降超8个百分点,安全轨迹率升19-20%
  • 攻击隐蔽性强,真实车辆测试中仍有效

在线高精地图构建对自动驾驶的预测与规划至关重要。我们发现现有物理攻击受限于跨边界补偿效应:目标边界被扰动后,其他可见边界仍保留足够几何线索,使模型可恢复原始道路结构。基于此,我们提出TwinIR,一种机制引导的新型物理攻击方法。TwinIR联合优化攻击效果与点稀疏性,寻找抑制周围边界补偿线索所需的最少攻击点。为降低多点攻击的可察觉性,TwinIR建模相机对近红外光的响应,并将优化后的攻击点映射到可行物理位置,实现最小可见光谱变化下的视觉干扰。在nuScenes数据集上对多种先进在线地图构建模型的实验表明,TwinIR在RSA下使mAP降低8.18-8.96个百分点,在ETA下降低2.84-5.62个百分点;同时使不可达目标率提升25-28个百分点,不安全轨迹率上升19-20个百分点。该攻击在真实车载测试平台验证成功,能诱导道路直线化与提前转向变形,且在全彩视图中几乎不可察觉。

原文摘要 · Abstract (English)

Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.

自动驾驶地图攻击物理对抗隐性攻击

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。