Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbation
2026-06-01 • Computer Vision and Pattern Recognition
Computer Vision and Pattern Recognition
AI summaryⓘ
The authors studied how robots that use deep learning to figure out their location can be tricked. They created a method that changes the robot’s visual input data slightly to confuse the system when it tries to find matching places in its memory. This method focuses on a part called Product Quantization, which helps the robot quickly compare images. Their tests showed that these small changes can cause the robot to get really wrong location results, which could be dangerous. The authors highlight important weaknesses in current robot localization technology.
Robot localizationAdversarial attacksDeep learningProduct QuantizationVisual localizationFeature encodingQuery perturbationAutonomous navigationRetrieval process
Authors
Zhenyu Li, Tianyi Shang
Abstract
Robot localization systems are critical for autonomous navigation and safety. Adversarial perturbations can mislead these systems, resulting in mislocalization, navigation errors, or unsafe interactions, especially in mission-critical scenarios. This paper investigates the vulnerability of deep learning based localization pipelines to adversarial attacks. We propose a novel framework for generating adversarial queries that specifically target Product Quantization (PQ) in visual localization systems. Our method employs a Lightweight Product Quantization Network (LPQN) to perturb query feature encodings, misleading the retrieval process by returning semantically irrelevant database entries. Adversarial queries are generated via a two-phase procedure: a forward pass that perturbs feature distributions and a backward pass that refines the perturbation through optimization. The lightweight design of LPQN allows the creation of subtle yet highly effective perturbations with minimal computational overhead. Extensive experiments in both controlled and real-world robotic environments demonstrate that our approach substantially degrades PQN performance, exposing critical vulnerabilities in practical applications.