Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception

Abstract

LiDAR sensors are used widely in Autonomous Vehicles for better perceiving the environment which enables safer driving decisions. Recent work has demonstrated serious LiDAR spoofing attacks with alarming consequences. In particular, model-level LiDAR spoofing attacks aim to inject fake depth measurements to elicit ghost objects that are erroneously detected by 3D Object Detectors, resulting in hazardous driving decisions. In this work, we explore the use of motion as a physical invariant of genuine objects for detecting such attacks. Based on this, we propose a general methodology, 3D Temporal Consistency Check (3D-TC2), which leverages spatiotemporal information from motion prediction to verify objects detected by 3D Object Detectors. Our preliminary design and implementation of a 3D-TC2 prototype demonstrates very promising performance, providing more than 98% attack detection rate with a recall of 91% for detecting spoofed Vehicle (Car) objects, and is able to achieve real-time detection at 41Hz. CCS CONCEPTS• Security and privacy → Intrusion/anomaly detection and malware mitigation; • Computing methodologies → Computer vision; Scene anomaly detection.

SoK: On the Semantic AI Security in Autonomous Driving

“…Timing overhead is one of the most important factors that may limit the deployability of defense for real-time systems such as AD systems. Among the existing defenses, 4 have negligible or no timing overhead by design or shown in evaluation [57,81,105,107], 1 fails to catch up with the camera and LiDAR frame rate in evaluation [104]. For the remaining ones, we cannot conclude their timeliness from their papers (e.g., no timing overhead evaluation).…”

“…Consistency checking is a general attack detection technique that cross-checks the attacked information either with other (ideally independent) measurement sources, or with invariant properties of itself. For example, prior works use the detected objects from stereo cameras [104] and object trajectory from prediction models [107] to crosscheck LiDAR object detection results. Li et al [103] and Nassi et al [57] Table II.…”

“…The requirement of model training imposes extra deployment burdens. Among the defenses that require extra ML models, only one [107] uses public pretrained models without fine-tuning.…”

“…[107] '21 S Trajectory consistency checking D ? Field: S = Security, V = Computer Vision, M = ML/AI, O = Others, e.g., Robotics, arXiv; Defense goal: D = detection, M = mitigation, ?…”

Monitoring of Perception Systems: Deterministic, Probabilistic, and Learning-based Fault Detection and Identification

“…Another line of works leverages spatio-temporal information to detect failures. You et al [57] use spatio-temporal information from motion prediction to verify 3D object detection results. Balakrishnan et al [44,58] propose the Timed Quality Temporal Logic (TQTL) to reason about desiderable spatio-temporal properties of a perception algorithm.…”