Towards Effective and Transferable Physical Camouflage against Multi-View BEV-based 3D Perception in Autonomous Driving

Linye Lyu; Jiawei Zhou; Daojing He; Yu Li

cs.CVOct 23, 2026

Towards Effective and Transferable Physical Camouflage against Multi-View BEV-based 3D Perception in Autonomous Driving

Authors: Linye Lyu, Jiawei Zhou, Daojing He, Yu Li

Abstract

Modern autonomous driving systems widely adopt multi-view Bird's-Eye-View (BEV) based 3D perception models due to their superior performance. Despite their success, the robustness of these models against adversarial camouflage attacks remains largely unexplored. Existing camouflage attacks primarily target single-view 2D detectors, limiting their effectiveness in multi-view 3D perception settings. To address this gap, we propose BEVCA, a novel adversarial camouflage generation framework tailored for multi-view BEV-based 3D perception. Our framework integrates a BEV-feature-based adversarial loss with a multi-view neural rendering module, enabling effective and transferable camouflage attacks across different models and tasks. Extensive experiments in both digital and physical settings demonstrate that BEVCA outperforms state-of-the-art baselines and exhibits strong robustness under real-world conditions. Our code is available at https://github.com/WAVE-AT-IDEA/BEVCA.

Figures & tables

Figure 1: Comparison of 3D detection results using different textures on the photo-realistic simulation environment, where only the adversarial camouflage generated by our BEVCA framework successfully evades detection. (a) A vehicle with normal painting; (b) AdvPatch [ 19 ] . (c)-(g) are the top-performed methods against 2D detection: FCA [ 18 ] , DTA [ 14 ] , ACTIVE [ 15 ] , RAUCA [ 24 ] , and CNCA [ 9 ] respectively; (h) Our method BEVCA.

Figure 2: The overview of BEVCA. Our framework consists of multi-view neural rendering and BEV-feature-based attack modules. The multi-view neural rendering outputs the multi-view camouflage vehicle images from the ego vehicle perspective. The BEV-feature-based attack locates the BEV feature regions that are highly associated with the target vehicle with a designed mask. The combination of both modules enables effective and transferable camouflage attacks against multi-view 3D perception models.

Figure 3: Examples of BEV difference feature and corresponding vehicle ground truth images. We can observe a strong correlation between BEV regions relevant to the target vehicle (marked by the red circles) and vehicle ground truth position (marked by the yellow points).

Methods	3D Detection					BEV Segmentation
Methods	Base	Small	Tiny	Base-Seg-Det	Small-Seg-Det	LSS	CVT	SinBEVT
Normal	0.618	0.721	0.514	0.750	0.634	0.509	0.609	0.570
FCA	0.593	0.696	0.512	0.721	0.595	0.442	0.505	0.489
DTA	0.578	0.663	0.469	0.684	0.591	0.372	0.480	0.449
ACTIVE	0.559	0.664	0.433	0.682	0.588	0.367	0.481	0.436
RAUCA	0.562	0.682	0.479	0.689	0.576	0.380	0.459	0.427

Table 1: Comparison of the effectiveness of attacks across various 3D detection and BEV segmentation models. The metrics for 3D detection and BEV segmentation are AP and IoU of the vehicle class, respectively.

Methods	BEVFormer base	BEVFormer small	BEVDet-r50	BEVDet-r50-cbgs
CNCA	30.00%	29.49%	42.80%	34.99%
BEVCA	49.60%	46.99%	64.41%	42.13%

Table 2: Attack success rates (ASR %) by methods and models in the physical world evaluation.

Figure 4: Visualization of our camouflage successful attack examples against 3D object detection in the physical world from different camera viewpoints.

Methods	3D Detection					BEV Segmentation
Methods	Base	Small	Tiny	Base-Seg-Det	Small-Seg-Det	LSS	CVT	SinBEVT
$L_{det}$	0.564	0.683	0.498	0.728	0.597	0.450	0.505	0.467
$L_{enc}$	0.392	0.564	0.428	0.528	0.529	0.380	0.371	0.333
$L_{head}$	0.471	0.603	0.485	0.601	0.529	0.367	0.426	0.347
$L_{bev}$	0.612	0.704	0.508	0.735	0.585	0.498	0.588	0.574
$L_{bev}+\mathcal{M}_{bev}$	0.191	0.285	0.381	0.329	0.329	0.253	0.307	0.258

Table 3: The attack performance of different adversarial loss functions across various 3D detection and BEV segmentation models.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: The physical experiment setup: (a) full size camouflaged car; (b) multi-view camera data collection platform.

Panel of Figure 6 — Figure 6: Visualization results of our camouflage attack against 3D object detection tasks. We can observe that the camouflaged vehicle leads to inaccurate bounding boxes or complete “disappearance” from the detector compared to the ground truths.

Panel of Figure 7 — Figure 7: Additional visualization results of our camouflage attack against 3D object detection tasks in the physical world.

Methods	3D Detection					BEV Segmentation
Methods	Base	Small	Tiny	Base-Seg-Det	Small-Seg-Det	LSS	CVT	SinBEVT
Normal	0.618	0.721	0.514	0.750	0.634	0.509	0.609	0.570
BEVCA	0.191	0.285	0.381	0.329	0.331	0.253	0.307	0.273
AdvTrain	0.615	0.479	0.416	0.683	0.599	0.614	0.567	0.549

Appendix

Table 4: Performance comparison of BEV-based perception models under normal painting (without attack), BEVCA attack, and after adversarial training. The metrics for 3D detection and BEV segmentation are AP and IoU of the vehicle class, respectively.

Azimuth ( ∘ )	Distance				Avg
Azimuth ( ∘ )	10	15	25	40	Avg
0	0.278	0.129	0.468	0.376	0.313
60	0.005	0.184	0.311	0.278	0.195
120	0.206	0.332	0.167	0.218	0.231
180	0.123	0.641	0.404	0.001	0.292
240	0.242	0.293	0.300	0.195	0.258

Appendix

Table 5: The attack performance for multi-azimuth and multi-distance. Notice the AP of the normal painted car is 0.618.

Figure 8: Hyperparameter analysis: (a) Effect of $\beta$ on attack performance; (b) Grid search over mask parameters $\Delta r$ and $\Delta\theta$ .

Defense Method	Parameter	Normal mAP	BEVCA mAP	Performance Gap
No Defense	-	0.618	0.191	0.427
BEV Feature Smoothing	$\sigma=0.5$	0.616	0.189	0.427
	$\sigma=1.0$	0.594	0.175	0.419
	$\sigma=2.0$	0.482	0.121	0.361
Input Smoothing	$\sigma=0.5$	0.617	0.171	0.446
	$\sigma=1.0$	0.614	0.165	0.449

Appendix

Table 6: Performance of BEVFormer-base under BEVCA attack when employing various simple defense mechanisms. The Performance Gap indicates the difference between Normal mAP and BEVCA mAP.

Methods	3D Detection					BEV Segmentation
Methods	Base	Small	Tiny	Base-Seg-Det	Small-Seg-Det	LSS	CVT	SinBEVT
Normal	0.309	0.324	0.243	0.321	0.333	0.209	0.234	0.238
FCA	0.306	0.336	0.263	0.32	0.337	0.204	0.200	0.208
DTA	0.260	0.296	0.249	0.294	0.318	0.175	0.168	0.195
ACTIVE	0.236	0.264	0.220	0.265	0.292	0.178	0.183	0.195
RAUCA	0.259	0.29	0.204	0.295	0.295	0.162	0.157	0.164

Appendix

Table 7: Comparison of the effectiveness of attacks across various original 3D detection and BEV segmentation models. The metrics for 3D detection and BEV segmentation are AP and IoU of the vehicle class, respectively.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 444 papers

RESBev: Making BEV Perception More Robust
Mar 10, 2026Lifeng Zhuo, Kefan Jin, Zhe Liu +1Autonomous Driving Perception Adversarial Robustness
Shanghai Jiao Tong University
Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving
May 12, 2026Shuo Ju, Qingzhao Zhang, Huashan Chen +6Adversarial Attacks Autonomous Driving Perception
Institute of Information Engineering, Chinese Academy of Sciences · The University of Arizona · Beijing Jiaotong University +1
Bi-Level Routing and Sparse Spatial Attention based Multi-View BEV 3D Object Detection for Autonomous Driving
Sep 12, 2026Jing Zhang, Jiaqi Liu, Zibo WangMulti-View 3D Object Detection Efficient Object Detection
Stuart Weitzman School of Design University of Pennsylvania Philadelphia, USA · Courant Institute of Mathematical Science New York University New York, USA

Mar 10, 2026J/K move · Enter open · S save

RESBev: Making BEV Perception More Robust

Lifeng Zhuo, Kefan Jin, Zhe Liu, Hesheng Wang

Shanghai Jiao Tong University

Autonomous Driving Perception Adversarial Robustness Bird's-Eye-View Representation

Open paper AskPDF arXiv

Bird's-eye-view (BEV) perception has emerged as a cornerstone of autonomous driving systems, providing a structured, ego-centric representation critical for downstream planning and control. However, real-world deployment faces challenges from sensor degradation and adversarial attacks, which can cause severe perceptual anomalies and ultimately compromise the safety of autonomous driving systems. To address this, we propose a resilient and plug-and-play BEV perception method, RESBev, which can be easily applied to existing BEV perception methods to enhance their robustness to diverse disturbances. Specifically, we reframe perception robustness as a latent semantic prediction problem. A latent world model is constructed to extract spatiotemporal correlations across sequential BEV observations, thereby learning the underlying BEV state transitions to predict clean BEV features for reconstructing corrupted observations. The proposed framework operates at the semantic feature level of the Lift-Splat-Shoot pipeline, enabling recovery that generalizes across both natural disturbances and adversarial attacks without modifying the underlying backbone. Extensive experiments on the nuScenes dataset demonstrate that, with few-shot fine-tuning, RESBev significantly improves the robustness of existing BEV perception models against various external disturbances and adversarial attacks.

Abstract

Adversarial Attacks

Explore similar work

RESBev: Making BEV Perception More Robust

Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving

Bi-Level Routing and Sparse Spatial Attention based Multi-View BEV 3D Object Detection for Autonomous Driving