Illusion of Depth: Revealing Hidden Stereo Vision Vulnerabilities in Depth Estimation

• URL: http://arxiv.org/abs/2609.16336v1
• Date: Mon, 14 Sep 2026 20:51:49 GMT
• Title: Illusion of Depth: Revealing Hidden Stereo Vision Vulnerabilities in Depth Estimation
• Abstract summary: We reveal an intrinsic vulnerability in stereo cameras that stems from their pixel sampling and calibration processes.<n>Attackers can achieve fine-grained control over the estimated depth of real obstacles using simple repeating patterns.<n>Our work highlights vulnerabilities hidden in stereo matching and deep learning depth estimation models, addressing critical limitations in autonomous system deployments.
• Score: 5.959942963741855
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Stereo cameras are integrated into autonomous systems such as self-driving cars, drones, and robots to offer precise depth estimation in a cost-effective manner compared to LiDAR technology. In this work, we reveal an intrinsic vulnerability in stereo cameras that stems from their pixel sampling and calibration processes, which can influence the outputs of stereo matching algorithms. Attackers can achieve fine-grained control over the estimated depth of real obstacles using simple repeating patterns, without relying on sophisticated adversarial machine learning techniques. Furthermore, deep learning-based depth estimation models exhibit a similar vulnerability. We evaluate the impact of this attack on two widely used stereo matching algorithms (BM and SGBM), three deep learning models (PSMNet, MoCha-Stereo, and UniMatch), a stereo-LiDAR fusion model (SGM-DDC), and two popular commercial stereo cameras, the ZED2 and Intel RealSense D435. For example, in the ZED2 camera, an attacker can displace obstacles up to 20~meters farther or 12~meters closer. In our real-world evaluation in a driving setting, a brief 0.5~second attack can trigger emergency braking in a popular autonomous driving framework. We further demonstrate the feasibility at driving speeds up to 40~km/h using CARLA. Finally, we confirm the ineffectiveness of state-of-the-art defenses, and we propose a novel strategy that leverages similarity scores to dynamically detect and suppress the depth discrepancies. Our work highlights vulnerabilities hidden in stereo matching and deep learning depth estimation models, addressing critical limitations in autonomous system deployments.

Related papers

• Instance-level Visual Active Tracking with Occlusion-Aware Planning [61.982298426203165]
  Visual Active Tracking (VAT) aims to control cameras to follow a target in 3D space.<n>VAT faces two key bottlenecks in real-world deployment: confusion from visually similar distractors and severe failure under occlusions.<n>We propose OA-VAT, a unified pipeline with three complementary modules.
  arXiv  Detail & Related papers  (2026-04-23T09:11:50Z)
• AD$^2$: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systems [7.505610942484861]
  In this work, we conduct a closed-loop evaluation of state-of-the-art autonomous driving agents under black-box adversarial threat models in CARLA.<n>We consider three representative attack vectors on the visual perception pipeline: (i) a physics-based blur attack induced by acoustic waves, (ii) an electromagnetic interference attack that distorts captured images, and (iii) a digital attack that adds ghost objects as carefully crafted bounded perturbations on images.<n>Our experiments on two advanced agents, Transfuser and Interfuser, reveal severe vulnerabilities to such attacks, with driving scores dropping by up to 99%
  arXiv  Detail & Related papers  (2026-02-10T05:13:37Z)
• Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving [6.935448042598928]
  We propose the first texture-enabled physical adversarial attack against stereo matching models in the context of autonomous driving.<n>Our method employs a 3D PAE with global camouflage texture rather than a local 2D patch-based one.<n>To cope with the disparity effect of these cameras, we also propose a new 3D stereo matching rendering module.
  arXiv  Detail & Related papers  (2025-11-18T11:45:46Z)
• DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches [52.797945735414665]
  Adversarial attacks against stereo depth estimation can help reveal vulnerabilities before deployment.<n>In this work, we discover that introducing regular intervals among the repeated textures, creating a grid structure, significantly enhances the patch's attack performance.<n>Our generated adversarial patches can be inserted into any scenes and successfully attack advanced stereo depth estimation methods.
  arXiv  Detail & Related papers  (2025-06-20T02:22:21Z)
• SDGE: Stereo Guided Depth Estimation for 360$^\circ$ Camera Sets [65.64958606221069]
  Multi-camera systems are often used in autonomous driving to achieve a 360$circ$ perception. These 360$circ$ camera sets often have limited or low-quality overlap regions, making multi-view stereo methods infeasible for the entire image. We propose the Stereo Guided Depth Estimation (SGDE) method, which enhances depth estimation of the full image by explicitly utilizing multi-view stereo results on the overlap.
  arXiv  Detail & Related papers  (2024-02-19T02:41:37Z)
• StereoVoxelNet: Real-Time Obstacle Detection Based on Occupancy Voxels from a Stereo Camera Using Deep Neural Networks [32.7826524859756]
  Obstacle detection is a safety-critical problem in robot navigation, where stereo matching is a popular vision-based approach. This paper proposes a computationally efficient method that leverages a deep neural network to detect occupancy from stereo images directly. Our approach detects obstacles accurately in the range of 32 meters and achieves better IoU (Intersection over Union) and CD (Chamfer Distance) scores with only 2% of the computation cost of the state-of-the-art stereo model.
  arXiv  Detail & Related papers  (2022-09-18T03:32:38Z)
• R4Dyn: Exploring Radar for Self-Supervised Monocular Depth Estimation of Dynamic Scenes [69.6715406227469]
  Self-supervised monocular depth estimation in driving scenarios has achieved comparable performance to supervised approaches. We present R4Dyn, a novel set of techniques to use cost-efficient radar data on top of a self-supervised depth estimation framework.
  arXiv  Detail & Related papers  (2021-08-10T17:57:03Z)
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving [87.3492357041748]
  In this paper, we showcase practical susceptibilities of multi-sensor detection by placing an adversarial object on top of a host vehicle. Our experiments demonstrate that successful attacks are primarily caused by easily corrupted image features. Towards more robust multi-modal perception systems, we show that adversarial training with feature denoising can boost robustness to such attacks significantly.
  arXiv  Detail & Related papers  (2021-01-17T21:15:34Z)
• Physically Realizable Adversarial Examples for LiDAR Object Detection [72.0017682322147]
  We present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demonstrate that placing an adversarial object on the rooftop of any target vehicle to hide the vehicle entirely from LiDAR detectors with a success rate of 80%. This is one step closer towards safer self-driving under unseen conditions from limited training data.
  arXiv  Detail & Related papers  (2020-04-01T16:11:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.