TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction

• URL: http://arxiv.org/abs/2608.04453v1
• Date: Wed, 05 Aug 2026 05:08:28 GMT
• Title: TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
• Abstract summary: Existing physical attacks against online map construction are limited by a cross-boundary compensation effect.<n>We propose TwinIR, a new mechanism-guided physical attack methodology for online map construction.<n> Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA.
• Score: 15.827537828496657
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.

Related papers

• MapTCL: Temporal Consistency Learning via Bidirectional Alignment for Vectorized HD Map Construction [13.437125894280541]
  We propose MapTCL, a training strategy that formulates temporal consistency loss between current and past frames.<n>By jointly training with these dual losses, MapTCL improves the temporal stability of generated HD maps.
  arXiv  Detail & Related papers  (2026-08-05T08:53:26Z)
• The Spectrum Strikes Back: Infrared POV Attacks on Traffic Sign Classification [2.0747783609522754]
  Traffic sign classification is a crucial task for autonomous vehicles.<n>We propose a persistence-of-vision-based attack that operates in the near-infrared light spectrum.<n>With the possibility of showing dynamic, remotely triggered content, this allows a stealthy physical adversarial attack against traffic sign classification.
  arXiv  Detail & Related papers  (2026-06-29T11:29:13Z)
• Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion [12.92794251734044]
  We present MIRAGE, a framework for discovery of semantic attacks that bypass adversarial defenses.<n>We demonstrate two attacks: (1) boundary removal, suppressing 57.7% of detections and corrupting 96% of planned trajectories; and (2) boundary injection, the only method that successfully injects fictitious boundaries.
  arXiv  Detail & Related papers  (2026-05-14T05:21:17Z)
• A Graph Attention Network-Based Framework for Reconstructing Missing LiDAR Beams [0.0]
  This paper proposes a Graph Attention Network framework that reconstructs missing vertical channels using only the current LiDAR frame.<n>A multi-layer GAT learns adaptive attention weights over local geometric neighborhoods and directly regresses the missing elevation (z) values at dropout locations.<n>Inference takes 14.65 seconds per frame on a single GPU, and reconstruction quality remains stable for different neighborhood sizes.
  arXiv  Detail & Related papers  (2025-12-13T17:50:57Z)
• RAP: 3D Rasterization Augmented End-to-End Planning [104.52778241744522]
  Imitation learning for end-to-end driving trains policies only on expert demonstrations.<n>We propose 3D Rasterization, which replaces costly rendering with lightweightization of annotated primitives.<n>RAP achieves state-of-the-art closed-loop and long-tail robustness, ranking first on four major benchmarks.
  arXiv  Detail & Related papers  (2025-10-05T19:31:24Z)
• Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving [15.060553970759038]
  We present a systematic vulnerability analysis of online map construction models.<n>In asymmetric scenes like forks or merges, this bias often causes the model to mistakenly predict a straight boundary that mirrors the opposite side.<n>We propose a novel two-stage attack framework capable of manipulating online constructed maps.
  arXiv  Detail & Related papers  (2025-09-07T14:26:21Z)
• Stealthy Patch-Wise Backdoor Attack in 3D Point Cloud via Curvature Awareness [52.780853311462636]
  Backdoor attacks pose a severe threat to deep neural networks (DNNs)<n>Existing 3D point cloud backdoor attacks rely on sample-wise global modifications.<n>We propose the Stealthy Patch-Wise Backdoor Attack (SPBA), the first patch-wise backdoor attack framework for 3D point clouds.
  arXiv  Detail & Related papers  (2025-03-12T12:30:59Z)
• TopoSD: Topology-Enhanced Lane Segment Perception with SDMap Prior [70.84644266024571]
  We propose to train a perception model to "see" standard definition maps (SDMaps) We encode SDMap elements into neural spatial map representations and instance tokens, and then incorporate such complementary features as prior information. Based on the lane segment representation framework, the model simultaneously predicts lanes, centrelines and their topology.
  arXiv  Detail & Related papers  (2024-11-22T06:13:42Z)
• Unified Adversarial Patch for Cross-modal Attacks in the Physical World [11.24237636482709]
  We propose a unified adversarial patch to fool visible and infrared object detectors at the same time via a single patch. Considering different imaging mechanisms of visible and infrared sensors, our work focuses on modeling the shapes of adversarial patches. Results show that our unified patch achieves an Attack Success Rate (ASR) of 73.33% and 69.17%, respectively.
  arXiv  Detail & Related papers  (2023-07-15T17:45:17Z)
• To Make Yourself Invisible with Adversarial Semantic Contours [47.755808439588094]
  Adversarial Semantic Contour (ASC) is an estimate of a Bayesian formulation of sparse attack with a deceived prior of object contour. We show that ASC can corrupt the prediction of 9 modern detectors with different architectures. We conclude with cautions about contour being the common weakness of object detectors with various architecture.
  arXiv  Detail & Related papers  (2023-03-01T07:22:39Z)
• PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examples [63.84378007819262]
  We propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones. We show that PointCA can cause a performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01.
  arXiv  Detail & Related papers  (2022-11-22T14:15:41Z)
• Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection [89.08832589750003]
  We propose a Parallel Rectangle Flip Attack (PRFA) via random search to avoid sub-optimal detection near the attacked region. Our method can effectively and efficiently attack various popular object detectors, including anchor-based and anchor-free, and generate transferable adversarial examples.
  arXiv  Detail & Related papers  (2022-01-22T06:00:17Z)
• Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks [62.87459235819762]
  In a real-world scenario like autonomous driving, more attention should be devoted to real-world adversarial examples (RWAEs) This paper presents an in-depth evaluation of the robustness of popular SS models by testing the effects of both digital and real-world adversarial patches.
  arXiv  Detail & Related papers  (2021-08-13T11:49:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.