Investigation of the Adversarial Robustness of End-to-End Deep Sensor Fusion Models
Why this work is in the frame
A frame that forgets how it found something cannot be audited. These are the routes that admitted this work.
Bibliographic record
Abstract
Autonomous driving systems increasingly depend on multimodal sensor fusion (deep sensor fusion (DSF)), integrating data from cameras, radar, and LiDAR to improve environmental perception and decision-making. The integration of deep learning models into sensor fusion has significantly enhanced perception capabilities, but it also raises concerns about the robustness of these models when exposed to adversarial attacks. As prior research on the adversarial robustness of TransFuser — one of the most advanced end-to-end transformer-based DSF models for autonomous driving — has been limited to single-modality attacks targeting the camera sensor, this work extends the investigation to assess the robustness of TransFuser under various attack scenarios, including those involving the LiDAR modality. We employed the fast gradient sign method (FGSM) and projected gradient descent (PGD) to perform single-channel adversarial attacks on camera and LiDAR modalities separately, as well as the joint-channel attack. The experiments were conducted in the CARLA simulator using the Town05 Short urban environment, including 32 routes featuring diverse driving scenarios. The results clearly demonstrate the vulnerability of TransFuser to adversarial attacks where transformer-based sensor fusion is utilized, particularly under joint-channel attacks. Our experiments demonstrate that LiDAR-targeted single-channel attacks significantly degrade driving performance, reducing the driving score by 49.87% under FGSM attacks, and by 50.15% and 42.12% under joint FGSM and PGD attacks, respectively. This study informs the design of more robust and secure DSF architectures for end-to-end autonomous driving.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.000 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.000 |
| Bibliometrics | 0.000 | 0.001 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.000 |
| Open science | 0.001 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from it