Explainability-Aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors
2026-06-29 • Computer Vision and Pattern Recognition
Computer Vision and Pattern RecognitionCryptography and Security
AI summaryⓘ
The authors study how 3D object detectors that use LiDAR data decide where to pay attention in a scene and whether this can be used to trick them more easily. They create a method called Saliency-LiDAR to find the most important areas the detector relies on, then design an attack that only messes with these critical spots instead of the whole object. Their tests show this targeted attack is more efficient and causes detectors to miss more objects. This work reveals that current LiDAR detectors depend heavily on a few key parts of the scene, making them vulnerable to focused attacks.
LiDAR3D object detectionPoint cloudAdversarial attackSaliency mapIntegrated GradientsFrustum attackKITTI datasetnuScenes datasetPointPillars
Authors
Chengzeng You, Binbin Xu, Soteris Demetriou
Abstract
The structural vulnerabilities of point cloud-based 3D object detectors remain poorly understood. Prior work has studied adversarial robustness primarily on isolated 3D object models, while recent LiDAR spoofing attacks target richer and more realistic driving scenes but focus mainly on physical realizability rather than understanding detector behavior or attack efficiency. In this work, we investigate how LiDAR-based detectors rely on spatial evidence in complex scenes and whether these reliance patterns can be exploited to induce failures more efficiently. To this end, we propose an explainability-guided adversarial analysis methodology. We introduce the Saliency-LiDAR (SALL) method, which aggregates Integrated Gradient attributions across scenes to produce universal saliency maps for LiDAR-based 3D object detectors. Guided by these maps, we design the Explainability-aware Frustum Attack (EFA), which selectively perturbs only the most influential frustums rather than uniformly attacking entire object regions. Experiments on KITTI and nuScenes, across detectors such as PointPillars and SECOND, show that EFA reduces detection recall by more than 15 percentage points while requiring 25-50% fewer perturbed frustums than the state-of-the-art non-saliency-aware baseline. These findings reveal that modern 3D detectors concentrate discriminative evidence in a small subset of spatial regions, exposing a structural robustness vulnerability in current LiDAR perception systems. Our code is released at https://github.com/SecMindLab/Saliency_LiDAR.