Trajectory prediction forecasts nearby agents' moves based on their
historical trajectories. Accurate trajectory prediction is crucial for
autonomous vehicles. Existing attacks compromise the prediction model of a
victim AV by directly manipulating the historical trajectory of an attacker AV,
which has limited real-world applicability. This paper, for the first time,
explores an indirect attack approach that induces prediction errors via attacks
against the perception module of a victim AV. Although it has been shown that
physically realizable attacks against LiDAR-based perception are possible by
placing a few objects at strategic locations, it is still an open challenge to
find an object location from the vast search space in order to launch effective
attacks against prediction under varying victim AV velocities.
Through analysis, we observe that a prediction model is prone to an attack
focusing on a single point in the scene. Consequently, we propose a novel
two-stage attack framework to realize the single-point attack. The first stage
of prediction-side attack efficiently identifies, guided by the distribution of
detection results under object-based attacks against perception, the state
perturbations for the prediction model that are effective and
velocity-insensitive. In the second stage of location matching, we match the
feasible object locations with the found state perturbations. Our evaluation
using a public autonomous driving dataset shows that our attack causes a
collision rate of up to 63% and various hazardous responses of the victim AV.
The effectiveness of our attack is also demonstrated on a real testbed car. To
the best of our knowledge, this study is the first security analysis spanning
from LiDAR-based perception to prediction in autonomous driving, leading to a
realistic attack on prediction. To counteract the proposed attack, potential
defenses are discussed.

该研究从激光雷达感知到预测车辆轨迹的角度进行了首次安全分析，提出了一种间接攻击方法，通过对受害者自动驾驶车辆的感知模块进行攻击来诱导轨迹预测错误，以实现可行的、单点式的攻击。实验结果表明，该攻击方法能导致高达 63％的碰撞率和各种危险情况，为自动驾驶的轨迹预测提供了现实的安全威胁。