Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion

• URL: http://arxiv.org/abs/2605.14396v1
• Date: Thu, 14 May 2026 05:21:17 GMT
• Title: Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion
• Abstract summary: We present MIRAGE, a framework for discovery of semantic attacks that bypass adversarial defenses.<n>We demonstrate two attacks: (1) boundary removal, suppressing 57.7% of detections and corrupting 96% of planned trajectories; and (2) boundary injection, the only method that successfully injects fictitious boundaries.
• Score: 12.92794251734044
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Autonomous vehicles depend on online HD map construction to perceive lane boundaries, dividers, and pedestrian crossings -- safety-critical road elements that directly govern motion planning. While existing pixel perturbation attacks can disrupt the mapping, they can be neutralized by standard adversarial defenses. We present MIRAGE, a framework for systematic discovery of semantic attacks that bypass adversarial defenses and degrade mapping predictions by finding plausible environmental variation (e.g. shadows, wet roads). MIRAGE exploits the latent manifold of real-world data learned by diffusion models, and searches for semantically mutated scenes neighboring the ground truth with the same road topology yet mislead the mapping predictions. We evaluate MIRAGE on nuScenes and demonstrate two attacks: (1) boundary removal, suppressing 57.7% of detections and corrupting 96% of planned trajectories; and (2) boundary injection, the only method that successfully injects fictitious boundaries, while pixel PGD and AdvPatch fail entirely. Both attacks remain potent under various adversarial defenses. We use two independent VLM judges to quantify realism, where MIRAGE passes as realistic 80--84% of the time (vs. 97--99% for clean nuScenes), while AdvPatch only 0--9%. Our findings expose a categorical gap in current adversarial defenses: semantic-level perturbations that manifest as legitimate environmental variation are substantially harder to mitigate than pixel-level perturbations.

Related papers

• TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction [15.827537828496657]
  Existing physical attacks against online map construction are limited by a cross-boundary compensation effect.<n>We propose TwinIR, a new mechanism-guided physical attack methodology for online map construction.<n> Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA.
  arXiv  Detail & Related papers  (2026-08-05T05:08:28Z)
• From Stealthy Data Fabrication to Unsafe Driving: Realistic Scenario Attacks on Collaborative Perception [7.889284710970368]
  Collaborative perception allows connected and autonomous vehicles to improve perception by sharing sensory data.<n>Prior work shows that attackers can spoof or remove objects by fabricating shared data, yet the practicality of such attacks in real-world driving remains unclear.<n>We present a stealthy, scenario-realistic data fabrication attack that induces unsafe driving behaviors through end-to-end system effects.
  arXiv  Detail & Related papers  (2026-05-02T07:21:22Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning [2.0391237204597368]
  We present the Causal Multi-Agent Decision Framework (C-MADF) for autonomous cyber defense.<n>C-MADF integrates causal modeling with adversarial dual-policy control.<n>On the real-world CICIoT2023 dataset, C-MADF reduces the false-positive rate from 11.2%, 9.7%, and 8.4% in three cutting-edge literature baselines to 1.8%.
  arXiv  Detail & Related papers  (2026-04-06T05:40:43Z)
• AI Evasion and Impersonation Attacks on Facial Re-Identification with Activation Map Explanations [13.564481603680838]
  This paper introduces a novel framework for generating adversarial patches capable of both evasion and impersonation attacks.<n>We use a conditional encoder-decoder network to synthesize adversarial patches in a single forward pass, guided by multi-scale features from source and target images.<n>Our framework achieves a success rate of 27% on CelebA-HQ, competing with other patch-based methods.
  arXiv  Detail & Related papers  (2026-03-16T15:12:41Z)
• Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving [15.060553970759038]
  We present a systematic vulnerability analysis of online map construction models.<n>In asymmetric scenes like forks or merges, this bias often causes the model to mistakenly predict a straight boundary that mirrors the opposite side.<n>We propose a novel two-stage attack framework capable of manipulating online constructed maps.
  arXiv  Detail & Related papers  (2025-09-07T14:26:21Z)
• DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Models [8.800216228212824]
  State-of-theart object detectors are still vulnerable to adversarial patch attacks.<n>We introduce DIS, the first diffusion-based defense framework for object detection.<n> DIS consistently outperforms state-of-the-art defenses on both hiding attacks and creating attacks.
  arXiv  Detail & Related papers  (2025-09-04T18:20:36Z)
• BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning [85.2564206440109]
  This paper reveals the threats in this practical scenario that backdoor attacks can remain effective even after defenses. We introduce the emphtoolns attack, which is resistant to backdoor detection and model fine-tuning defenses.
  arXiv  Detail & Related papers  (2023-11-20T02:21:49Z)
• Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations [55.2480439325792]
  Federated Learning (FL) facilitates decentralized machine learning model training, preserving data privacy, lowering communication costs, and boosting model performance through diversified data sources. FL faces vulnerabilities such as poisoning attacks, undermining model integrity with both untargeted performance degradation and targeted backdoor attacks. We define a new notion of strong adaptive adversaries, capable of adapting to multiple objectives simultaneously. MESAS is the first defense robust against strong adaptive adversaries, effective in real-world data scenarios, with an average overhead of just 24.37 seconds.
  arXiv  Detail & Related papers  (2023-06-06T11:44:42Z)
• Improving Adversarial Robustness to Sensitivity and Invariance Attacks with Deep Metric Learning [80.21709045433096]
  A standard method in adversarial robustness assumes a framework to defend against samples crafted by minimally perturbing a sample. We use metric learning to frame adversarial regularization as an optimal transport problem. Our preliminary results indicate that regularizing over invariant perturbations in our framework improves both invariant and sensitivity defense.
  arXiv  Detail & Related papers  (2022-11-04T13:54:02Z)
• AdvDO: Realistic Adversarial Attacks for Trajectory Prediction [87.96767885419423]
  Trajectory prediction is essential for autonomous vehicles to plan correct and safe driving behaviors. We devise an optimization-based adversarial attack framework to generate realistic adversarial trajectories. Our attack can lead an AV to drive off road or collide into other vehicles in simulation.
  arXiv  Detail & Related papers  (2022-09-19T03:34:59Z)
• Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks [62.87459235819762]
  In a real-world scenario like autonomous driving, more attention should be devoted to real-world adversarial examples (RWAEs) This paper presents an in-depth evaluation of the robustness of popular SS models by testing the effects of both digital and real-world adversarial patches.
  arXiv  Detail & Related papers  (2021-08-13T11:49:09Z)
• A Self-supervised Approach for Adversarial Robustness [105.88250594033053]
  Adversarial examples can cause catastrophic mistakes in Deep Neural Network (DNNs) based vision systems. This paper proposes a self-supervised adversarial training mechanism in the input space. It provides significant robustness against the textbfunseen adversarial attacks.
  arXiv  Detail & Related papers  (2020-06-08T20:42:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.