Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel functional diversity mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Figures & tables
Fig. 1 : Large parameter spaces and training memory requirements of HyperNetworks for three YOLO versions.
Fig. 2 : Illustration of the trade-off between robustness and FPR under an adversarial attack on a stop sign. Raising the confidence threshold removes an undesired false positive (left) but hinders the recovery of the victim stop sign that would otherwise be detected at the lower threshold (right). Bounding boxes for other correct detections are omitted for readability.
Fig. 3 : AdROD training overview. The green circles in the YOLO architecture indicate weights updated by the low-rank HyperNetworks ( BA ), while the yellow circles represent the original weights ( Θ ) retained from the base detector.
Fig. 4 : Low-rank HyperNetworks achieve lower training detection loss compared with standard HyperNetworks.
Fig. 5 : Comparison of ensemble detection performance under affirmative (aff.) fusion and the fusion of AdROD-I. Incorporating functional diversity (func. div.) improves robustness compared with using weight diversity only, while AdROD-I further mitigates benign detection accuracy degradation.
Fig. 6 : Top: Permutation orders and permutation process for P =2. Bottom: Effects of pixel shuffling for P =4 and P =8.
Fig. 7 : AdROD-I workflow.
Fig. 8 : Distributions of uncertainty rank and detection confidence for benign FPs and victim objects.
Fig. 9 : Result trace of undefended YOLO when the vehicle approaches a stop sign with an adversarial patch. The patch is digitally applied to maximize attack effectiveness.
Fig. 10 : Computational overhead of defenses. The execution time ratio is normalized relative to the vanilla model, with lower values indicating lower overhead.
Method
Dep.
Precision
Recall
mAP50
mAP50:95
Vanilla
–
0.666
0.515
0.562
0.371
LGS [ 8 ]
–
0.613
0.436
0.472
0.301
JPEG [ 17 ]
–
0.656
0.492
0.537
0.348
ObjectSeeker [ 18 ]
–
0.662
0.520
0.557
0.369
SAC [ 9 ]
∘
0.667
0.513
0.558
0.369
AdvTrain-Person
∙
0.642
0.499
0.539
0.344
TABLE I : Benign detection accuracy.
Overhead ( ×λ )
Component
AdROD-I
AdROD-II (On)
AdROD-II (Off)
Weight generation
0.169K
0.169k
–
Input transform
0.041K
0.041k
–
Ensemble inference
0.938K
1.000k
–
Anomaly detection
–
0.03
0.03
Result merge
1.63
1.00
1.00
TABLE II : Overhead breakdown of AdROD-I and AdROD-II.
Fig. 11 : (a–c) illustrate how increasing K affects accuracy, robustness, and runtime overhead, while (d–e) show how varying Q influences accuracy and robustness in AdROD-I.
Defense Variant
ASR
mAP50
Training-free Baselines
Vanilla
0.728
0.562
Vanilla + Image transform
0.834
0.132
Weight and Functional Diversity
None
0.705
0.562
Functional diversity only ( P=4 )
0.498
0.476
TABLE III : Ablation study on weight and functional diversity against stop-sign-targeted SysAdv attack. Affirmative fusion, which retains any detection, is applied for the best robustness.
Fig. 12 : ASR of defense methods against SysAdv attack.
Fig. 13 : Physical experiment against SysAdv. The attack becomes effective from Frame 126 to the vanilla YOLO.
Fig. 14 : Experiment in the vehicle security challenge.
Fig. 15 : Adversarial patch attacks with different attack targets and characteristics. The callouts show zoomed-in patches.
No Defense
Baseline Defenses
Ours
Object
Data
Attack Type
Vanilla
JPEG [ 17 ]
LGS [ 8 ]
SAC [ 9 ]
Jedi [ 19 ]
ObjSeeker [ 18 ]
AdvTrain-Stopsign
AdROD-I
Stop sign
COCO
RP2
0.701
0.682
0.490
0.701
0.678
0.602
0.153
0.180
FTE
0.851
0.808
0.644
0.851
0.789
0.759
0.187
0.218
SysAdv
0.728
0.751
0.521
0.728
0.655
0.651
0.190
0.195
SysAdv-smooth
0.375
0.360
0.414
0.375
0.483
0.287
0.093
0.153
Person
COCO
Rectangle
0.685
0.674
0.563
0.635
0.587
0.524
0.676
0.172
TABLE IV : ASR of attacks against baseline defense methods and AdROD-I.
Fig. 16 : ASR of global masking attacks targeting stop signs. Evaluated on the stop sign images from the outdoor testbed.
Meric
No def.
AdROD-I
AdROD-II
vanilla
K=2
K=3
K=4
K=2
K=3
K=4
ASR
0.635
0.090
0.098
0.090
0.137
0.122
0.071
mAP50
0.252
0.223
0.222
0.222
–
TABLE V : Performance (ASR and mAP50) of Faster R-CNN and AdROD defense variants under outdoor SysAdv attack.
Case
Attacker Knowledge
Vanilla ASR
AdROD ASR
Θ0
Θ
G
S=2
S=10
S=2
S=10
3
✓
✓
✓
0.628
0.234
0.245
0.169
2
✓
✓
0.621
0.222
0.257
0.153
1
✓
✓
0.625
0.326
0.241
0.184
0
✓
0.728
0.195
TABLE VI : ASR of component-aware adaptive attack.
αdis
0
0.1
0.5
1
5
10
100
Vanilla ASR
0.621
0.617
0.590
0.582
0.602
0.594
0.245
AdROD ASR
0.257
0.218
0.215
0.207
0.222
0.215
0.165
TABLE VII : ASR under uncertainty-aware adaptive attack.
Fig. 17 : Stop outcomes in front of an adversarial stop sign. Bars show the percentages of safe , marginal , and missed stops. Values below the x-axis give the mean signed distance to the stop line, where positive values indicate stopping before the line and negative values indicate stopping beyond it. n denotes the number of trials per bar.
Fig. 18 : Impact of reduced perception update frequency due to computational constraints on stopping outcomes. Solid lines denote the rate of missed stops; shaded bands represent the rate of marginal stops. n denotes the number of trials per data point.