This is the official implementation of 3D-TC2(Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception).
Targeting object spoofing attacks, 3D-TC2 can provide more than 98% attack detection rate with a recall of 91% for detecting spoofed Vehicle (Car) objects, and is able to achieve real-time detection at 41Hz.
[Paper Link] [Presentation Link]
- CUDA >= 9.0
- Python 3
- PyTorch >= 1.1
- pyquaternion, Matplotlib, PIL, numpy, cv2, tqdm, scipy, scikit-image, scikit-learn, ipython and other relevant packages
export PYTHONPATH=/your/home/dir/3D-TC2:$PYTHONPATH
export PYTHONPATH=/your/home/dir/3D-TC2/nuscenes-devkit/python-sdk:$PYTHONPATH
Download Nuscenes dataset to folder: ./data/nuscenes/
. For example, to download Nuscenes mini split:
wget https://www.nuscenes.org/data/v1.0-mini.tgz
-
Attack LiDAR scenes in
./data/nuscenes/mini/sweeps/
and customize your own poisoned LiDAR dataset via any data injection attack methods. -
In our paper, we performed single-frame injection attack and assumed historical scenes are not poisoned. To do that, you can randomly pick some scenes from our Temporally Attacked Dataset.
-
Then replace corresponding benign LiDAR scenes in
./data/nuscenes/mini/sweeps/
. -
Note: If you want to replicate our results, please make sure only the scene at the current timestamp is poisoned and relatively historical scenes(past 20 scenes) are benign.
-
Please feed your poisoned dataset to any kind of 3D object detector and get predictions.
-
Our detection results after running OpenPCDet can be found in
./detection
folder.
-
Download MotionNet pretrained model here.
-
Our preliminary implementation of a 3D-TC2 prototype uses pretrained MotionNet to detect anomalies:
python TC2.py --data ./data/nuscenes/mini/ --version v1.0-mini --modelpath model.pth --net MotionNet --savepath log
- For further details of MotionNet, please refer to the official website here.
There are some potential directions you might want to further explore:
-
Temporal attacks. If you want to perform stress tests on the motion predictor, you can also poison historical scenes to perform consecutive/temporal attacks. To do that, you can select more scenes from our Temporally Attacked Dataset to ensure historical scenes are poisoned to influence motion predictions for the current scene.
-
Other motion predictors. Other motion predictors such as FlowNet3D, PointFlowNet and HPLFlowNet are also good replacements for MotionNet.
If you find this project useful in your research, please cite:
@inproceedings{you2021temporal,
title={Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception},
author={You, Chengzeng and Hau, Zhongyuan and Demetriou, Soteris},
booktitle={Proceedings of the 1st Workshop on Security and Privacy for Mobile AI},
pages={13--18},
year={2021}
}