LiDAR systems are one of the key components of many self-driving vehicles around the world.\u00a0\n\nLiDAR works much like radar, but instead of sending out radio waves it emits pulses of infrared light, which are invisible to naked eye. It then measures how long this emitted pulses takes to come back after hitting nearby objects. LiDar systems though popular with modern autonomous systems, \u00a0 come under scanner as experts began to back the cheaper camera-based system for stereoscopic vision in autonomous vehicles.\n\n"LiDAR is a fool's errand," Tesla\u2019s Elon Musk said in April. "Anyone relying on lidar is doomed.\u201d\n\nRecent studies show that a \u201cphysically adversarial Stop Sign\u201d can be synthesized such that the autonomous driving cars will misidentify.\n\nHowever, these image-based adversarial examples cannot easily alter 3D scans such as widely equipped LiDAR or radar on autonomous vehicles.\u00a0\n\nIn this paper, the team at the University of Michigan in collaboration with Baidu research and the University of Illinois, make an attempt to expose the shortcomings of LiDAR-based autonomous driving detection systems.\n\nThe authors propose an optimization-based approach LiDAR-Adv to generate real-world adversarial objects that can escape the LiDAR-based detection systems under various conditions.\n\nTo expose the setbacks in LiDar based systems, the researchers use an evolution-based blackbox attack algorithm. And, then propose a strong attack strategy,\u00a0 using a gradient-based approach LiDAR-Adv.\u00a0\u00a0\n\nChecking For Adversities\n\n\n\nAs can be seen in the picture above, in the first step,\u00a0 a sensor fires off an array of laser beams consecutive in horizontal and vertical directions.\u00a0\n\nThis sensor then captures the intensity of light that has been reflected back of those surfaces. And, then it calculates the time that photons have travelled along each beam.\n\nSince LiDar systems are good at detecting the intensity of light, the authors wrote that it is unclear how adversarial algorithms that are designed for natural lighting in image space can be adapted to invisible laser beams used as light sources.\u00a0\n\nA LiDAR sensor scans the surrounding environment and generates a point cloud with 3D coordinates. The previous raw point cloud goes through a preprocessing phase to form a feature map. The raw point cloud X is first transformed and filtered based on a High Definition Map. Deep Neural Networks (DNNs) are used to process the H \u00d7 W \u00d7 8 feature map, and then output the metrics for each one of the H \u00d7 W cells.\n\nThe team behind this work has also 3D-printed\u00a0 the adversarial objects and performed physical experiments with LiDAR equipped cars to illustrate the effectiveness of LiDAR-Adv.\n\nThe generated adversarial objects are tested on the Baidu Apollo autonomous driving platform to demonstrate whether physical systems are vulnerable to the\u00a0 proposed attacks.\u00a0\u00a0\n\nBlackbox Attack And LiDar-Adv\n\n\n\nThe hidden adversarial object initialized as a resampled 3D cube-shaped CAD model using MeshLab.\n\nFor rendering, a fully differential LiDAR simulator is implemented with predefined laser beam ray directions extracted from a real scene.\n\nThe researchers generated adversarial objects in different size (50cm and 75cm in edge length). For each object, 45 different position and orientation pairs were selected for evaluation. This is to mimic the \u00a0 scenario where a well-classified object can still confuse the detection system when it is presented in a different angle.\n\nThe experimental results show that the attacks orchestrated in this method were indeed successful and that even the object\u2019s label can be changed with these attacks.\n\n\n\nThe above picture shows the car mounted with LiDAR system and the adversarial object on the right. This object is inserted into the simulated environment where the detection system was tested.\u00a0\n\nThe successful transfer of adversity to a deployed detection model raises concerns about large scale deployment of such systems. LiDar based systems are facing stiff competition from camera-based systems like that of Tesla and these adversarial experiments can be another nail in the coffin not to forget how expensive and space-consuming they are for an autonomous vehicle.\n\nCheck the full work here.