GhostBuster: Looking Into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing
share
LiDAR-driven 3D sensing allows new generations of vehicles to achieve advanced levels of situation awareness. However, recent works have demonstrated that physical adversaries can spoof LiDAR return signals and deceive 3D object detectors to erroneously detect "ghost" objects. In this work, we introduce GhostBuster, a set of new techniques embodied in an end-to-end prototype to detect ghost object attacks on 3D detectors. GhostBuster is agnostic of the 3D detector targeted, and only uses LiDAR data that is already available to the target object detector. It considers the 3D object detectors' blind spots by examining the objects' 3D shadows. Ray optics is used to estimate the shadow regions and an exponential decay approach minimizes the importance of noisy points. GhostBuster identifies anomalous regions and then analyzes their 3D point cluster densities to distinguish between shadows of ghost objects, and genuine object shadows. We conduct an extensive empirical evaluation on the KITTI dataset and find that GhostBuster consistently achieves more than 94 accuracy in identifying anomalous shadows, which it can attribute with 96 accuracy to ghost attacks. We introduce a new class of "invalidation" attacks where adversaries can target shadows of genuine objects aiming to invalidate them and we show that GhostBuster remains robust to these attacks. Finally we show that GhostBuster can achieve real-time detection, requiring only between 0.003s-0.021s on average to process an object in a 3D point cloud on a commodity machine.
READ FULL TEXT