The adversarial robustness of a model is its ability to resist adversarial attacks in the form of small perturbations to input data. Universal adversarial attack methods such as Fast Sign Gradient Method (FSGM) and Projected Gradient Descend (PGD) are popular for LiDAR object detection, but they are often deficient compared to task-specific adversarial attacks. Additionally, these universal methods typically require unrestricted access to the model's information, which is difficult to obtain in real-world applications. To address these limitations, we present a black-box Scaling Adversarial Robustness (ScAR) method for LiDAR object detection. By analyzing the statistical characteristics of 3D object detection datasets such as KITTI, Waymo, and nuScenes, we have found that the model's prediction is sensitive to scaling of 3D instances. We propose three black-box scaling adversarial attack methods based on the available information: model-aware attack, distribution-aware attack, and blind attack. We also introduce a strategy for generating scaling adversarial examples to improve the model's robustness against these three scaling adversarial attacks. Comparison with other methods on public datasets under different 3D object detection architectures demonstrates the effectiveness of our proposed method.

通过分析KITTI、Waymo和nuScenes等3D物体检测数据集的统计特征，我们发现模型对3D实例的缩放非常敏感，为此，我们提出了一种黑盒Scaling Adversarial Robustness (ScAR)方法用于LiDAR物体检测，并引入了针对可用信息的三种黑盒缩放对抗攻击方法，即模型感知攻击、分布感知攻击和盲攻击，同时提出了一种生成缩放对抗样本的策略以提高模型对这三种缩放对抗攻击的鲁棒性，通过在不同的3D物体检测架构下在公共数据集上与其他方法进行比较，验证了我们提出方法的有效性。

ScAR: LiDAR物体检测的对抗鲁棒性扩展