3DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Driving

Abstract

Camera-based perception in connected and autonomous vehicles remains exposed to physical adversarial attacks. Prior attacks often either optimize image-plane textures, weakening cross-view consistency, or rely on shape modifications that are difficult to fabricate and deploy. Both cases limit their value for security and safety assessment of camera-based perception. This paper introduces a fabrication-first framework that learns view-consistent, geometry-preserving adversarial wraps for vehicles. The method performs three-dimensional multi-view optimization with a 3D Gaussian splatting surrogate to enforce consistency under an expectation over viewpoint, illumination, and occlusion, while the final artifact is constrained to print-only textures that keep vehicle geometry unchanged. We evaluate the framework through matched CARLA simulations, controlled miniature-vehicle physical evidence, and tests on multiple modern detectors. The wraps produce substantial and stable reductions in detection confidence and average precision across views while maintaining perceptual realism. Ablation studies isolate the effects of physical filtering, physical augmentation, and shape-consistency regularization, while efficiency analyses report convergence time and memory profiles. Additional experiments report ASR, mIoU-based segmentation degradation, cross-detector transfer against physical attack baselines, perturbation-area fairness diagnostics, and robustness under common input preprocessing defenses. By coupling three-dimensional optimization with a geometry-preserving realization, the study supports a practical pathway to systematically stress-test camera perception in safety-critical autonomous driving systems and provides evidence that can inform defense design and evaluation protocols in information forensics and security.