Topology-aware universal adversarial attack on 3D object tracking

Abstract

3D object tracking based on deep neural networks has a wide range of potential applications, such as autonomous driving and robotics. However, deep neural networks are vulnerable to adversarial examples. Traditionally, adversarial examples are generated by applying perturbations to individual samples, which requires exhaustive calculations for each sample and thereby suffers from low efficiency during malicious attacks. Hence, the universal adversarial perturbation has been introduced, which is sample-agnostic. The universal perturbation is able to make classifiers misclassify most samples. In this paper, a topology-aware universal adversarial attack method against 3D object tracking is proposed, which can lead to predictions of a 3D tracker deviating from the ground truth in most scenarios. Specifically, a novel objective function consisting of a confidence loss, direction loss and distance loss generates an atomic perturbation from a tracking template, and aims to fail a tracking task. Subsequently, a series of atomic perturbations are iteratively aggregated to derive the universal adversarial perturbation. Furthermore, in order to address the characteristic of permutation invariance inherent in the point cloud data, the topology information of the tracking template is employed to guide the generation of the universal perturbation, which imposes correspondences between consecutively generated perturbations. The generated universal perturbation is designed to be aware of the topology of the targeted tracking template during its construction and application, thus leading to superior attack performance. Experiments on the KITTI dataset demonstrate that the performance of 3D object tracking can be significantly degraded by the proposed method.