Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel functional diversity mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Figures & tables
Fig. 1 : Large parameter spaces and training memory requirements of HyperNetworks for three YOLO versions.
Fig. 2 : Illustration of the trade-off between robustness and FPR under an adversarial attack on a stop sign. Raising the confidence threshold removes an undesired false positive (left) but hinders the recovery of the victim stop sign that would otherwise be detected at the lower threshold (right). Bounding boxes for other correct detections are omitted for readability.
Fig. 3 : AdROD training overview. The green circles in the YOLO architecture indicate weights updated by the low-rank HyperNetworks ( BA ), while the yellow circles represent the original weights ( Θ ) retained from the base detector.
Fig. 4 : Low-rank HyperNetworks achieve lower training detection loss compared with standard HyperNetworks.
Fig. 5 : Comparison of ensemble detection performance under affirmative (aff.) fusion and the fusion of AdROD-I. Incorporating functional diversity (func. div.) improves robustness compared with using weight diversity only, while AdROD-I further mitigates benign detection accuracy degradation.
Fig. 6 : Top: Permutation orders and permutation process for P =2. Bottom: Effects of pixel shuffling for P =4 and P =8.
Fig. 7 : AdROD-I workflow.
Fig. 8 : Distributions of uncertainty rank and detection confidence for benign FPs and victim objects.
Fig. 9 : Result trace of undefended YOLO when the vehicle approaches a stop sign with an adversarial patch. The patch is digitally applied to maximize attack effectiveness.
Fig. 10 : Computational overhead of defenses. The execution time ratio is normalized relative to the vanilla model, with lower values indicating lower overhead.
Method
Dep.
Precision
Recall
mAP50
mAP50:95
Vanilla
–
0.666
0.515
0.562
0.371
LGS [ 8 ]
–
0.613
0.436
0.472
0.301
JPEG [ 17 ]
–
0.656
0.492
0.537
0.348
ObjectSeeker [ 18 ]
–
0.662
0.520
0.557
0.369
SAC [ 9 ]
∘
0.667
0.513
0.558
0.369
AdvTrain-Person
∙
0.642
0.499
0.539
0.344
TABLE I : Benign detection accuracy.
Overhead ( ×λ )
Component
AdROD-I
AdROD-II (On)
AdROD-II (Off)
Weight generation
0.169K
0.169k
–
Input transform
0.041K
0.041k
–
Ensemble inference
0.938K
1.000k
–
Anomaly detection
–
0.03
0.03
Result merge
1.63
1.00
1.00
TABLE II : Overhead breakdown of AdROD-I and AdROD-II.
Fig. 11 : (a–c) illustrate how increasing K affects accuracy, robustness, and runtime overhead, while (d–e) show how varying Q influences accuracy and robustness in AdROD-I.
Defense Variant
ASR
mAP50
Training-free Baselines
Vanilla
0.728
0.562
Vanilla + Image transform
0.834
0.132
Weight and Functional Diversity
None
0.705
0.562
Functional diversity only ( P=4 )
0.498
0.476
TABLE III : Ablation study on weight and functional diversity against stop-sign-targeted SysAdv attack. Affirmative fusion, which retains any detection, is applied for the best robustness.
Fig. 12 : ASR of defense methods against SysAdv attack.
Fig. 13 : Physical experiment against SysAdv. The attack becomes effective from Frame 126 to the vanilla YOLO.
Fig. 14 : Experiment in the vehicle security challenge.
Fig. 15 : Adversarial patch attacks with different attack targets and characteristics. The callouts show zoomed-in patches.
No Defense
Baseline Defenses
Ours
Object
Data
Attack Type
Vanilla
JPEG [ 17 ]
LGS [ 8 ]
SAC [ 9 ]
Jedi [ 19 ]
ObjSeeker [ 18 ]
AdvTrain-Stopsign
AdROD-I
Stop sign
COCO
RP2
0.701
0.682
0.490
0.701
0.678
0.602
0.153
0.180
FTE
0.851
0.808
0.644
0.851
0.789
0.759
0.187
0.218
SysAdv
0.728
0.751
0.521
0.728
0.655
0.651
0.190
0.195
SysAdv-smooth
0.375
0.360
0.414
0.375
0.483
0.287
0.093
0.153
Person
COCO
Rectangle
0.685
0.674
0.563
0.635
0.587
0.524
0.676
0.172
TABLE IV : ASR of attacks against baseline defense methods and AdROD-I.
Fig. 16 : ASR of global masking attacks targeting stop signs. Evaluated on the stop sign images from the outdoor testbed.
Meric
No def.
AdROD-I
AdROD-II
vanilla
K=2
K=3
K=4
K=2
K=3
K=4
ASR
0.635
0.090
0.098
0.090
0.137
0.122
0.071
mAP50
0.252
0.223
0.222
0.222
–
TABLE V : Performance (ASR and mAP50) of Faster R-CNN and AdROD defense variants under outdoor SysAdv attack.
Case
Attacker Knowledge
Vanilla ASR
AdROD ASR
Θ0
Θ
G
S=2
S=10
S=2
S=10
3
✓
✓
✓
0.628
0.234
0.245
0.169
2
✓
✓
0.621
0.222
0.257
0.153
1
✓
✓
0.625
0.326
0.241
0.184
0
✓
0.728
0.195
TABLE VI : ASR of component-aware adaptive attack.
αdis
0
0.1
0.5
1
5
10
100
Vanilla ASR
0.621
0.617
0.590
0.582
0.602
0.594
0.245
AdROD ASR
0.257
0.218
0.215
0.207
0.222
0.215
0.165
TABLE VII : ASR under uncertainty-aware adaptive attack.
Fig. 17 : Stop outcomes in front of an adversarial stop sign. Bars show the percentages of safe , marginal , and missed stops. Values below the x-axis give the mean signed distance to the stop line, where positive values indicate stopping before the line and negative values indicate stopping beyond it. n denotes the number of trials per bar.
Fig. 18 : Impact of reduced perception update frequency due to computational constraints on stopping outcomes. Solid lines denote the rate of missed stops; shaded bands represent the rate of marginal stops. n denotes the number of trials per data point.
Deep learning drives major advances in autonomous driving (AD), where object detectors are central to perception. However, adversarial attacks pose significant threats to the reliability and safety of these systems, with physical adversarial patches representing a particularly potent form of attack. Physical adversarial patch attacks pose severe risks but are usually crafted for a single model, yielding poor transferability to unseen detectors. We propose AdvAD, a transfer-based physical attack against object detection in autonomous driving. Instead of targeting a specific detector, AdvAD optimizes adversarial patches over multiple detection models in a unified framework, encouraging the learned perturbations to capture shared vulnerabilities across architectures. The optimization process adaptively balances model contributions and enforces robustness to physical variations. It further employs data augmentation and geometric transformations to maintain patch effectiveness under diverse physical conditions. Experiments in both digital and real-world settings show that AdvAD consistently outperforms state-of-the-art (SOTA) attacks in performance and transferability.
Deep Neural Networks (DNNs) have found successful deployment in numerous vision perception systems. However, their susceptibility to adversarial attacks has prompted concerns regarding their practical applications, specifically in the context of autonomous driving. Existing defenses often suffer from cost inefficiency, rendering their deployment impractical for resource-constrained applications. In this work, we propose an efficient and effective adversarial attack detection scheme leveraging the multi-task perception within a complex vision system. Adversarial perturbations are detected by the inconsistencies between the inference outputs of multiple vision tasks, e.g., object detection and instance segmentation. To this end, we developed a consistency score metric to measure the inconsistency between vision tasks. Next, we designed an approach to select the best model pairs for detecting inconsistencies effectively. Finally, we evaluated our defense against PGD attacks across multiple vision models on the BDD100k validation dataset. The experimental results demonstrated that our defense achieved a ROC-AUC performance of 99.9% detection within the considered attacker model.
Cong Chen, Jean-Philippe Monteuuis, Jonathan Petit
Qualcomm Technologies, Inc. San Diego, CA 92121, USA
Object detection models are critical components of automated systems, such as autonomous vehicles and perception-based robots, but their sensitivity to adversarial attacks poses a serious security risk. Progress in defending these models lags behind classification, hindered by a lack of standardized evaluation. It is nearly impossible to thoroughly compare attack or defense methods, as existing work uses different datasets, inconsistent efficiency metrics, and varied measures of perturbation cost. This paper addresses this gap by investigating three key questions: (1) How can we create a fair benchmark to impartially compare attacks? (2) How well do modern attacks transfer across different architectures, especially from Convolutional Neural Networks to Vision Transformers? (3) What is the most effective adversarial training strategy for robust defense? To answer these, we first propose a unified benchmark framework focused on digital, non-patch-based attacks. This framework introduces specific metrics to disentangle localization and classification errors and evaluates attack cost using multiple perceptual metrics. Using this benchmark, we conduct extensive experiments on state-of-the-art attacks and a wide range of detectors. Our findings reveal two major conclusions: first, modern adversarial attacks against object detection models show a significant lack of transferability to transformer-based architectures. Second, we demonstrate that the most robust adversarial training strategy leverages a dataset composed of a mix of high-perturbation attacks with different objectives (e.g., spatial and semantic), which outperforms training on any single attack.