AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving
2026-08-17 • Machine Learning
Machine LearningComputer Vision and Pattern Recognition
AI summaryⓘ
The authors developed AdROD, a software defense that helps self-driving cars detect objects more reliably even when attackers try to fool the cameras. AdROD creates many slightly different detectors very quickly using a lightweight method called low-rank HyperNetworks, making it hard for attackers to predict which one is active. It also uses a special method to keep these detectors different and detects problems by comparing their outputs. The authors tested AdROD in various challenging scenarios and found it works better than other defenses while running fast enough for real-time car safety.
Adversarial AttacksObject DetectionHyperNetworksAutonomous DrivingStochastic EnsembleInput-Space TransformationAdversarial TrainingPhysical Adversarial PatchesReal-Time SystemsOpenCDA Co-Simulator
Authors
Yuting Wu, Dongfang Guo, Xiangzhong Luo, Qun Song, Rui Tan
Abstract
Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.