BadLiDet: A Simple Backdoor Attack against LiDAR Object Detection in Autonomous Driving

Autonomous vehicles (AVs) widely deploy LiDAR-based 3D object detection to accurately perceive and understand the surrounding environment. The mainstream LiDAR detection systems primarily adopt deep neural networks (DNNs) to achieve satisfactory performance. However, annotating large amounts of LiDAR data and training complex LiDAR detection models are time-consuming and resource-intensive. A common practice for some individual developers and self-driving companies is to outsource data annotation or model training tasks to third-party platforms, which could expose a natural attack injection point. In this paper, we propose BadLiDet, a simple yet effective backdoor attack against LiDAR object detection in autonomous driving. Specifically, we present a model-agnostic attack strategy that enables an attacker to inject a shape-independent backdoor into the victim model by poisoning its training data. Afterward, the attacker can choose an ordinary object in different shapes as the trigger and place it around a specific location to easily deceive the LiDAR detection system. Our extensive experiments on five representative models and a public dataset demonstrate that BadLiDet can achieve a high attack success rate while preserving the utility of victim models. We further show the effectiveness of BadLiDet on the continuous attack scenario collected from a high-fidelity simulator. Moreover, the end-to-end simulation evaluation on an open-source self-driving platform shows that BadLiDet can cause a 100% vehicle collision rate.