Investigation of the Adversarial Robustness of End-to-End Deep Sensor Fusion Models
Bibliographic record
Abstract
Autonomous driving systems increasingly depend on multimodal sensor fusion (deep sensor fusion (DSF)), integrating data from cameras, radar, and LiDAR to improve environmental perception and decision-making. The integration of deep learning models into sensor fusion has significantly enhanced perception capabilities, but it also raises concerns about the robustness of these models when exposed to adversarial attacks. As prior research on the adversarial robustness of TransFuser — one of the most advanced end-to-end transformer-based DSF models for autonomous driving — has been limited to single-modality attacks targeting the camera sensor, this work extends the investigation to assess the robustness of TransFuser under various attack scenarios, including those involving the LiDAR modality. We employed the fast gradient sign method (FGSM) and projected gradient descent (PGD) to perform single-channel adversarial attacks on camera and LiDAR modalities separately, as well as the joint-channel attack. The experiments were conducted in the CARLA simulator using the Town05 Short urban environment, including 32 routes featuring diverse driving scenarios. The results clearly demonstrate the vulnerability of TransFuser to adversarial attacks where transformer-based sensor fusion is utilized, particularly under joint-channel attacks. Our experiments demonstrate that LiDAR-targeted single-channel attacks significantly degrade driving performance, reducing the driving score by 49.87% under FGSM attacks, and by 50.15% and 42.12% under joint FGSM and PGD attacks, respectively. This study informs the design of more robust and secure DSF architectures for end-to-end autonomous driving.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.003 | 0.009 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.000 | 0.001 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.001 | 0.002 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.001 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".