AdROD randomises detectors to resist physical patch attacks

Problem

Modern camera‑based object detectors used in autonomous driving are vulnerable to physical adversarial patches that can suppress, misclassify or mislocalise genuine objects, creating safety risks. Existing defences such as adversarial training and input purification often overfit to specific attack types and fail against adaptive attackers who can optimise patches to bypass deployed defences. The paper studies how to defend real‑time vehicle perception against such physical attacks while remaining practical for embedded platforms.

Approach

AdROD is a software defence that generates a stochastic per‑frame ensemble of detectors using parameter‑efficient low‑rank HyperNetworks. Rather than replacing full model weights, the HyperNetwork produces low‑rank updates to a pretrained base detector, reducing parameter footprint to about 1.6% of standard HyperNetworks for a YOLO‑small base and improving training stability. AdROD also enforces functional diversity by coupling weight randomness with input‑space transformations implemented as block‑wise pixel shuffling (block size P=4 in the paper) driven by the same noise vector. Two serving modes balance robustness and runtime: AdROD‑I runs the ensemble continuously and uses objectness variance across ensemble members to select uncertain low‑confidence candidates and to merge ensemble results with the base detector; AdROD‑II is an on‑demand mode that activates the ensemble only when a Kalman‑filter based tracker detects abrupt, sustained disappearances of tracked objects. Training is performed on benign images only and evaluation spans synthetic benchmarks, printed physical patches and end‑to‑end simulation in the OpenCDA pipeline.

Key Findings

• Low‑rank HyperNetworks: Using LoRA‑style low‑rank updates (rank r=4) reduces HyperNetwork parameters for YOLO‑small from about 635 million to ≈10 million and attains 45.9% lower detection loss than standard HyperNetworks while remaining trainable on benign data.
• Functional diversity improves robustness: Adding pixel‑shuffling input transforms to weight diversity lowers attack success rates substantially (average reduction of 26.3 percentage points in one reported setting) but can reduce benign mAP (about a 10.5 percentage point drop under affirmative fusion), motivating the uncertainty‑aware fusion in AdROD‑I.
• Serving modes and performance: AdROD‑I with ensemble size K=10 achieves strong robustness but incurs a static overhead of 13.11λ, yielding 5.4 FPS on a Jetson AGX Xavier. AdROD‑II keeps near‑baseline overhead in benign conditions (1.03λ, ≈68.7 FPS) and, when activated, averages 5.08λ (≈13.9 FPS), enough to meet a 100 ms perception deadline in tested scenarios.
• Practical effectiveness: In outdoor physical tests with printed patches and in an end‑to‑end stop sign scenario, AdROD substantially reduces attack success rates compared with five baselines and preserves safe stopping behaviour across a range of speeds where an undefended detector fails.
• Resistance to adaptive attacks: Component‑aware and uncertainty‑aware adaptive optimisation that attempt to approximate the ensemble or to reduce objectness variance produced only moderate gains for the attacker; in many cases the conflicting optimisation objectives made patch creation harder and reduced attack transferability.

Limitations

AdROD targets hiding attacks against existing objects and bounding‑box detectors and does not address attacks that fabricate phantom objects. AdROD‑II can fail if an object first appears already suppressed so no prior track exists to trigger activation. Ensemble fusion degrades benign accuracy under affirmative rules unless mitigated, and nondeterministic runtime behaviour raises considerations for safety certification and potential new attack surfaces if HyperNetwork components or historical weights are exposed.

Implications

From an offensive standpoint, attackers may attempt to build surrogate ensembles or obtain historical HyperNetwork outputs to better approximate the defended distribution, or they may optimise patches to minimise ensemble disagreement. The paper shows that increasing surrogate ensemble size complicates optimisation and that explicitly adding disagreement minimisation can conflict with hiding objectives, but exposure of HyperNetwork components would make stronger adaptive attacks more feasible. Timing and nondeterminism also matter: an attacker with knowledge of deployment cadence might try to exploit windows before a new per‑frame detector is sampled. These avenues represent practical attack strategies that defenders should consider when deploying stochastic ensemble defences.