Autonomous driving (AD) relies on multi-sensor perception to interpret the surrounding environment. However, the robustness of camera--radar fusion under adversarial conditions remains largely unexplored. This paper presents a systematic measurement study of the robustness of camera--radar sensor fusion in AD. We construct a unified evaluation pipeline on the nuScenes dataset that simulates attacks on both sensing modalities, including eight camera-image perturbations and three radar point-cloud perturbations. We evaluate five camera--radar fusion algorithms across two perception tasks, 3D object detection and depth estimation, and quantify their performance under clean and attacked inputs using standard metrics. Our evaluation reveals a clear asymmetry in the robustness of fusion systems. Camera perturbations substantially degrade both object detection and depth estimation, and moderate attack strengths are already sufficient to cause severe performance degradation. In contrast, the evaluated radar perturbations produce smaller and task-dependent effects, with object-detection models showing particularly limited degradation. Our analysis attributes this difference to the strong dependence of existing fusion architectures on dense camera features, together with the filtering, association, and confidence-weighting mechanisms commonly applied to sparse radar measurements. These results demonstrate that sensor fusion does not inherently guarantee robustness and that the contribution and reliability of each sensing modality must be explicitly considered under adversarial conditions. Based on four empirical findings, we derive measurement-guided design implications for future robust camera--radar fusion, including modality-specific reliability estimation, cross-modal consistency checking, adaptive fusion, and graceful failover under severe sensor degradation.
Figures & tables
Figure 1. Overview of robustness evaluation on camera-radar sensor fusion algorithms under different black-box attacks.
Model
Type
Adversarial Strength (Kernel Size)
No Attack
15
45
75
RADIANT
OD
0.363/0.340
0.336/0.322
0.277/0.294
0.272/0.290
CRN
OD
0.473/0.562
0.442/0.540
0.362/0.494
0.3526/0.490
RC-PDA
DE
0.831/2.018 1.279/2.682
1.012/2.355 1.518/3.130
1.433/3.097 1.952/3.728
1.910/3.793 2.450/4.265
Cam&mmWave
DE
2.037/4.548
4.004/7.257
10.146/ 16.286
10.533/16.677
DORN
DE
2.384/5.264
3.061/6.263
3.992/7.789
4.68/9.138
Table 1. The performance of different camera-radar sensor fusion models under the Gaussian blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Kernel Size)
No Attack
20
50
80
RADIANT
OD
0.363/0.340
0.290/0.301
0.272/0.293
0.272/0.292
CRN
OD
0.473/0.562
0.4066/0.519
0.361/0.496
0.3541/0.491
RC-PDA
DE
0.831/2.018 1.279/2.682
1.226/2.691 1.755/3.362
1.750/3.538 2.273/3.825
2.282/4.357 2.760/4.558
Cam&mmWave
DE
2.037/4.548
7.156/12.467
10.029/16.329
10.421/16.809
DORN
DE
2.384/5.264
4.87/9.931
8.261/14.902
10.325/17.305
Table 2. The performance of different camera-radar sensor fusion models under the vertical motion blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Figure 2. Examples of Gaussian Blur attack on various object detection and depth estimation sensor fusion algorithms. The first to the last rows correspond to the object detection algorithms, RADIANT ( Long et al., 2023 ) and CRN ( Kim et al., 2023b ) , and the depth estimation algorithms, RC-PDA ( Long et al., 2021 ) , Cam&mmWave ( Singh et al., 2023 ) , and DORN ( Lo and Vandewalle, 2021 ) .
Figure 3. Examples of Vertical Blur attack on various object detection and depth estimation sensor fusion algorithms. The first to the last rows correspond to the object detection algorithms, RADIANT ( Long et al., 2023 ) and CRN ( Kim et al., 2023b ) , and the depth estimation algorithms, RC-PDA ( Long et al., 2021 ) , Cam&mmWave ( Singh et al., 2023 ) , and DORN ( Lo and Vandewalle, 2021 ) .
Figure 4. Examples of LensAttack on various object detection and depth estimation sensor fusion algorithms. The first to the last rows correspond to the object detection algorithms RADIANT ( Long et al., 2023 ) and CRN ( Kim et al., 2023b ) , and the depth estimation algorithms, RC-PDA ( Long et al., 2021 ) , Cam&mmWave ( Singh et al., 2023 ) , and DORN ( Lo and Vandewalle, 2021 ) .
Figure 5. Depth error visualization of RC-PDA under Gaussian Blur attack, Vertical Blur attack, and LensAttack with increasing adversarial strength.
Model
Type
Adversarial Strength (Focal Length)
No Attack
5
10
15
RADIANT
OD
0.363/0.340
0.311/0.310
0.276/0.293
0.270/0.291
CRN
OD
0.473/0.562
0.434/0.537
0.390/0.508
0.366/0.495
RC-PDA
DE
0.831/2.018 1.279/2.682
1.099/2.485 1.611/3.243
1.467/3.111 2.042/3.871
1.750/3.520 2.191/3.961
Cam&mmWave
DE
2.037/4.548
3.836/7.354
6.515/11.652
7.738/13.318
DORN
DE
2.384/5.264
3.165/6.426
3.756/7.462
4.199/8.356
Table 3. The performance of different camera-radar sensor fusion models under the LensAttack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Kernel Size)
No Attack
15
45
75
RADIANT
OD
0.363/0.340
0.291/0.302
0.272/ 0.293
0.271/0.292
CRN
OD
0.473/0.562
0.411/0.5242
0.353/0.490
0.353/0.490
RC-PDA
DE
0.831/2.018 1.279/2.682
1.145/2.607 1.645/3.317
1.792/3.633 2.458/4.304
2.428/4.373 2.973/4.808
Cam&mmWave
DE
2.037/4.548
5.516/9.864
10.786/17.013
10.137/16.222
DORN
DE
2.384/5.264
3.331/6.794
4.377/8.547
5.043/9.592
Table 4. The performance of different camera-radar sensor fusion models under the Median blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Kernel, Color, Space)
No Attack
[15,75,75]
[45,150,150]
[75,250,250]
RADIANT
OD
0.363/0.340
0.338/0.324
0.303/0.307
0.285/0.298
CRN
OD
0.473/0.562
0.444/0.542
0.3995/0.5156
0.3725/0.5006
RC-PDA
DE
0.831/2.018 1.279/2.682
0.948/2.204 1.335/2.747
1.457/3.181 1.935/3.710
1.987/3.842 2.564/4.317
Cam&mmWave
DE
2.037/4.548
3.051/6.112
4.815/8.917
5.797/10.248
DORN
DE
2.384/5.264
2.928/6.101
3.502/7.188
4.167/8.471
Table 5. The performance of different camera-radar sensor fusion models under the Bilateral blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Kernel Size)
No Attack
20
50
80
RADIANT
OD
0.363/0.340
0.310/0.310
0.276/0.294
0.271/0.292
CRN
OD
0.473/0.562
0.4055/0.5181
0.356/0.490
0.3528/0.4893
RC-PDA
DE
0.831/2.018 1.279/2.682
1.197/2.730 1.779/3.546
1.629/3.481 2.160/3.973
1.901/3.822 2.490/4.300
Cam&mmWave
DE
2.037/4.548
5.015/9.122
8.494/14.180
9.109/14.893
DORN
DE
2.384/5.264
3.516/7.364
4.624/8.898
5.361/9.747
Table 6. The performance of different camera-radar sensor fusion models under the Horizontal blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Angle, Scale)
No Attack
[1, 5]
[1, 10]
[1, 15]
RADIANT
OD
0.363/0.340
0.276/0.294
0.271/0.292
0.271/0.292
CRN
OD
0.473/0.562
0.370/0.497
0.354/0.4905
0.354/0.490
RC-PDA
DE
0.831/2.018 1.279/2.682
1.670/2.532 3.424/4.345
2.259/4.127 3.043/4.899
2.851/4.826 3.541/5.594
Cam&mmWave
DE
2.037/4.548
8.398/13.934
9.691/15.474
9.858/15.616
DORN
DE
2.384/5.264
5.001/9.573
5.708/10.272
6.051/10.694
Table 7. The performance of different camera-radar sensor fusion models under the Radial blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Adversarial Strength (Angle)
No Attack
10
15
20
RADIANT
OD
0.363/0.340
0.279/0.295
0.273/0.293
0.271/0.292
CRN
OD
0.473/0.562
0.376/0.502
0.3644/0.4957
0.3575/0.4924
RC-PDA
DE
0.831/2.018 1.279/2.682
1.874/3.862 2.854/4.618
2.110/4.075 3.208/4.944
2.415/4.578 3.521/5.397
Cam&mmWave
DE
2.037/4.548
7.063/12.621
8.259/14.128
9.031/15.038
DORN
DE
2.384/5.264
8.733/15.545
10.095/17.200
10.799/17.991
Table 8. The performance of different camera-radar sensor fusion models under the Rotational blur attack with various adversarial strengths. OD Metrics: mAP/NDS. DE Metrics: MAE/RMSE.
Model
Type
Depth Estimation Error
No Attack
50%
100%
200%
RADIANT
OD
0.609/0.380
0.611/0.377
0.612/0.373
0.617/0.365
CRN
OD
0.416/0.575
0.424/0.569
0.438/0.551
0.453/0.530
RC-PDA
DE
0.884/2.183
0.889/2.188
0.926/2.241
1.069/2.524
Cam&mmWave
DE
2.037/4.548
2.045/4.561
2.102/4.646
2.307/4.901
DORN
DE
2.258/4.913
2.265/4.919
2.305/4.964
2.637/5.228
Table 9. The performance of different camera-radar sensor fusion models under the radar attacks with various levels of depth estimation error. OD Metrics: MATE/MAP. DE Metrics: MAE/RMSE.
Model
Type
Target Disappearance
No Attack
30%
50%
70%
RADIANT
OD
0.609/0.380
0.609/0.375
0.611/0.371
0.613/0.370
CRN
OD
0.416/0.575
0.418/0.572
0.421/0.566
0.426/0.559
RC-PDA
DE
0.884/2.183
0.887/2.186
0.896/2.198
0.920/2.231
Cam&mmWave
DE
2.037/4.548
2.045/4.559
2.060/4.576
2.091/4.611
DORN
DE
2.258/4.913
2.263/4.919
2.275/4.935
2.307/4.981
Table 10. The performance of different camera-radar sensor fusion models under the radar attacks with various levels of target disappearing. OD Metrics: MATE/MAP. DE Metrics: MAE/RMSE.
Model
Type
Ghost Target
No Attack
10%
30%
50%
RADIANT
OD
0.609/0.380
0.604/0.386
0.607/0.386
0.615/0.372
CRN
OD
0.416/0.575
0.413/0.582
0.424/0.561
0.445/0.537
RC-PDA
DE
0.884/2.183
0.887/2.187
0.899/2.194
0.906/2.196
Cam&mmWave
DE
2.037/4.548
2.042/4.556
2.059/4.565
2.072/4.581
DORN
DE
2.258/4.913
2.263/4.922
2.278/4.940
2.291/4.957
Table 11. The performance of different camera-radar sensor fusion models under the radar attacks with various levels of ghost target. OD Metrics: MATE/MAP. DE Metrics: MAE/RMSE.
Figure 6. Examples of depth estimation error in RC-PDA ( Long et al., 2021 ) . The first row illustrates depth estimation errors, while the second row shows the corresponding attack strength visualizations
Figure 7. Examples of target disappearance in RC-PDA ( Long et al., 2021 ) . The first row illustrates depth estimation errors, while the second row shows the corresponding attack strength visualizations.
Figure 8. Examples of ghost target in RC-PDA ( Long et al., 2021 ) . The first row illustrates depth estimation errors, while the second row shows the corresponding attack strength visualizations.
Measurement Finding
Observed Cause
Design Implication
Camera attacks substantially degrade both object detection and depth estimation.
Current fusion models rely heavily on dense camera features, while radar generally provides supplementary geometric information.
Explicitly estimate camera reliability and dynamically reduce its contribution when camera observations become unreliable.
Moderate camera perturbations can already cause severe performance degradation.
Fixed fusion behavior cannot respond to gradual sensor-quality degradation before severe perception failure occurs.
Reliability estimation should operate continuously and support progressive reweighting rather than only binary attack detection.
Radar attacks have a comparatively smaller effect, particularly for object detection.
Radar measurements are sparse and are often filtered, confidence-weighted, or discarded when inconsistent with camera predictions.
Generalize filtering and uncertainty-aware weighting principles to both sensing modalities rather than treating camera information as implicitly reliable.
Camera and radar provide complementary geometric and semantic information.
Corruption of one modality can create cross-modal disagreement in depth, object location, motion, or BEV occupancy.
Explicitly model camera–radar consistency and use disagreement as a runtime reliability signal.
Cross-modal disagreement indicates abnormal sensing but does not always reveal which modality is responsible.
Either camera corruption or radar corruption can create camera–radar inconsistency.
Temporal predictive consistency can provide an optional additional cue for identifying which modality deviates from expected scene evolution.
Table 12. From empirical findings to design implications for robust camera–radar fusion.
Figure 9. Measurement-guided design framework for future robust camera–radar fusion. The core design path uses modality-specific reliability and cross-modal consistency to guide adaptive fusion and, under severe degradation, gated failover. Temporal predictive consistency is shown as an optional extension that may provide additional evidence when cross-modal disagreement alone cannot identify the unreliable modality. The framework summarizes design implications derived from our measurements and is not an evaluated defense method in this work.
Accurate 3D object detection for autonomous driving requires complementary sensors. Cameras provide dense semantics but unreliable depth, while millimeter-wave radar offers precise range and velocity measurements with sparse geometry. We propose MMF-BEV, a radar-camera BEV fusion framework that leverages deformable attention for cross-modal feature alignment on the View-of-Delft (VoD) 4D radar dataset [1]. MMF-BEV builds a BEVDepth [2] camera branch and a RadarBEVNet [3] radar branch, each enhanced with Deformable Self-Attention, and fuses them via a Deformable Cross-Attention module. We evaluate three configurations: camera-only, radar-only, and hybrid fusion. A sensor contribution analysis quantifies per-distance modality weighting, providing interpretable evidence of sensor complementarity. A two-stage training strategy - pre-training the camera branch with depth supervision, then jointly training radar and fusion modules stabilizes learning. Experiments on VoD show that MMF-BEV consistently outperforms unimodal baselines and achieves competitive results against prior fusion methods across all object classes in both the full annotated area and near-range Region of Interest.
In autonomous driving, camera-radar fusion offers complementary sensing and low deployment cost. Existing methods perform fusion through input mixing, feature map mixing, or query-based feature sampling. We propose a new fusion paradigm, termed heterogeneous query interaction, and present ConFusion, a camera-radar 3D object detector. ConFusion combines image queries, radar queries, and learnable world queries distributed in 3D space to improve query initialization and object coverage. To encourage cross-type interaction among heterogeneous queries, we introduce heterogeneous query mixing (QMix), which performs dedicated cross-type attention after feature sampling to consolidate complementary object evidence. We further propose interactive query swap sampling (QSwap), which improves feature sampling by allowing related queries to exchange informative feature tokens under attention and geometric constraints. Experiments on the nuScenes dataset show that ConFusion achieves state-of-the-art performance, reaching 59.1 mAP and 65.6 NDS on the validation set, and 61.6 mAP and 67.9 NDS on the test set.
Jialong Wu, Yihan Wang, Matthias Rottmann
1Osnabrück University · 3Aptiv Services Deutschland GmbH · University of Wuppertal
Robust 3D object detection in adverse weather conditions is challenging due to sensor limitations. Although combining complementary modalities such as LiDAR and 4D RADAR has shown promise, the sparsity of these sensors becomes apparent in adverse weather with reduced reflections, leading to objects with few or no point cloud returns. To address this limitation, camera sensors provide visual cues even when LiDAR and RADAR signals are weakened. However, cameras themselves are also vulnerable to adverse weather, where some regions become unreliable due to snow or rain occluding the camera lens. While some camera-fusion methods designed for adverse weather learn to weigh image regions via confidence maps, these maps receive no direct supervision and are learned solely through the detection loss. We introduce Reliability-Aware Fusion (RAF), which explicitly supervises per-pixel reliability estimation and provides a direct learning signal for identifying and suppressing unreliable visual cues. Our framework leverages pretrained LiDAR-RADAR networks, keeping their backbones frozen while only training the added camera branch, BEV fusion encoder, and detection head. Extensive experiments on the K-Radar and VoD datasets demonstrate that integrating RAF consistently improves detection accuracy over LiDAR-RADAR baselines, achieving up to +6.5 APBEV and +7.4 AP3D gains. Code is available at https://github.com/parkie0517/RAF.