SABER：面向鸟瞰图检测器的空间一致三维通用对抗物体
SABER: Spatially Consistent 3D Universal Adversarial Objects for BEV Detectors
提出一种非侵入式、环境植入式的通用对抗物体生成流程，并用鸟瞰图空间特征引导优化攻击检测器内部表征；做BEV检测鲁棒性评测或多视角/时序一致对抗样本构造时可直接复用其遮挡感知渲染与特征引导优化思路。
原文依据 we optimize adversarial object appearance using a BEV spatial feature-guided optimization strategy that attacks the detector's internal representations
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论鸟瞰图三维目标检测器的对抗鲁棒性对自动驾驶至关重要。现有的侵入式攻击需要改动目标车辆本身（例如粘贴补丁），这使其不切实际，也难以用于真实世界评测。将对抗物体放置在环境中的非侵入式攻击更为实用，但现有方法仍缺乏物理可信威胁所需的多视角一致性与时序一致性。本文提出首个用于生成通用、非侵入且三维一致的对抗物体的框架，用以揭示鸟瞰图三维目标检测器的根本脆弱性。该方法不改动目标车辆，而是借助遮挡感知模块将渲染物体插入场景，从而在跨视角与跨时间上保证物理合理性。为在跨视角与跨帧条件下保持攻击有效性，我们采用鸟瞰图空间特征引导的优化策略来优化对抗物体的外观，直接攻击检测器的内部表征。大量实验表明，所学习的通用对抗物体能够在多种视角与距离下持续降低多个鸟瞰图检测器的性能。更重要的是，这种新的环境操控攻击范式揭示了模型对上下文线索的过度依赖，并为自动驾驶系统的鲁棒性评测提供了实用的流程。
英文原文摘要 1396 字符
Adversarial robustness of BEV 3D object detectors is critical for autonomous driving (AD). Existing invasive attacks require altering the target vehicle itself (e.g. attaching patches), making them unrealistic and impractical for real-world evaluation. While non-invasive attacks that place adversarial objects in the environment are more practical, current methods still lack the multi-view and temporal consistency needed for physically plausible threats. In this paper, we present the first framework for generating universal, non-invasive, and 3D consistent adversarial objects that expose fundamental vulnerabilities for BEV 3D object detectors. Instead of modifying target vehicles, our method inserts rendered objects into scenes with an occlusion-aware module that enforces physical plausibility across views and time. To maintain attack effectiveness across views and frames, we optimize adversarial object appearance using a BEV spatial feature-guided optimization strategy that attacks the detector's internal representations. Extensive experiments demonstrate that our learned universal adversarial objects can consistently degrade multiple BEV detectors from various viewpoints and distances. More importantly, the new environment-manipulation attack paradigm exposes models' over-reliance on contextual cues and provides a practical pipeline for robustness evaluation in AD systems.