One of the biggest challenges researchers developing autonomous driving systems have to worry about, say the researchers, is protecting against attacks. A common strategy to secure safety is to check data from separate instruments against one another to make sure their measurements make sense together.

The most common locating technology used by today’s autonomous car companies combines 2D data from cameras and 3D data from LiDAR, which is essentially laser-based radar. This combination has proven very robust against a wide range of attacks that attempt to fool the visual system into seeing the world incorrectly.

然而,研究人员说,他们已经表明this method is still vulnerable at longer distances and only works at short distances, which suggests that adding optical 3D capabilities or the ability to share data with nearby cars may be necessary to fully protect autonomous cars from attacks.

“Our goal is to understand the limitations of existing systems so that we can protect against attacks,” says Miroslav Pajic, the Dickinson Family Associate Professor of Electrical and Computer Engineering at Duke. “This research shows how adding just a few data points in the 3D point cloud ahead or behind of where an object actually is, can confuse these systems into making dangerous decisions.”

新的攻击策略是通过发射激光gun into a car’s LIDAR sensor to add false data points to its perception. If those data points are wildly out of place with what a car’s camera is seeing, previous research has shown that the system can recognize the attack. But the new research shows that 3D LIDAR data points carefully placed within a certain area of a camera’s 2D field of view can fool the system.

This vulnerable area stretches out in front of a camera’s lens in the shape of a frustum — a 3D pyramid with its tip sliced off. In the case of a forward-facing camera mounted on a car, this means that a few data points placed in front of or behind another nearby car can shift the system’s perception of it by several meters.