ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception
Quick Take
ATLAS introduces a large-scale evaluation benchmark for LiDAR perception models under black-box sensor attacks, revealing that high-performing models are more vulnerable to point injection attacks despite better resilience to point removal attacks. This highlights a critical gap in current training practices that can lead to architecture-agnostic robustness failures.
Key Points
- ATLAS simulates point injection and removal attacks on real driving sequences.
- High-performing LiDAR models show surprising vulnerability to injection attacks.
- Current training practices induce architecture-agnostic robustness failures.
- The benchmark aims to improve black-box sensor robustness in future LiDAR systems.
- ATLAS generation code is released for reproducible evaluations as attack methods evolve.
Article Content
From source RSS / original summaryarXiv:2606. 02924v1 Announce Type: new Abstract: Autonomous driving perception is typically evaluated on clean benchmark data, yet real-world deployment requires robustness to rare, structured, and potentially adversarial sensor anomalies. This gap is especially critical for LiDAR, where external actors can physically manipulate the sensing process to induce black-box perception failures without accessing the model. Existing LiDAR benchmarks provide little visibility into this failure mode.
Prior adversarial LiDAR studies have largely centered on attack hardware, geometric and algorithmic defenses, and early-generation detectors, leaving the robustness of modern perception systems unexplored.
To address this evaluation gap, we introduce ATLAS (Adversarial Temporal LiDAR Attack Suite), the first large-scale, physically grounded evaluation benchmark for LiDAR perception models under black-box sensor attacks, simulating the two primary attack modes -- point injection and point removal -- across real driving sequences.
Evaluating a broad cross-section of current state-of-the-art LiDAR perception models, ATLAS reveals a surprising robustness asymmetry: models with stronger performance on standard benchmarks tend to better withstand removal attacks, yet are actually more vulnerable to injection attacks than weaker models.
We trace this vulnerability to standard object database sampling augmentations, revealing how current training practices can induce architecture-agnostic robustness failures, and study initial directions for mitigating both attack modes. We release the ATLAS generation code to support extensible, reproducible evaluations as attack capabilities evolve, helping make black-box sensor robustness an explicit consideration in future LiDAR perception development.
Reader Mode unavailable (could not extract clean content).
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.CV
See more →Plan2Map: A Multimodal Benchmark for Document-Grounded Geospatial Boundary Reconstruction from Planning Records
Plan2Map introduces a 208-case benchmark for reconstructing geospatial boundaries from UK planning documents. The GeoPlanAgent system achieves a mean IoU of 0.736, significantly outperforming baseline models, highlighting the challenges in localization and map registration.
