Towards Dynamic Backdoor Attacks against LiDAR Semantic Segmentation in Autonomous Driving

LiDAR perception is widely deployed in high-level autonomous vehicles (AVs) to gain accurate information about the driving environment, where 3D semantic segmentation plays a critical role as it can provide more fine-grained scene understanding than other tasks. The mainstream LiDAR perception systems mainly adopt deep neural networks (DNNs) to achieve good performance. However, densely annotating LiDAR point clouds and training complex LiDAR segmentation models are time-consuming and resource-intensive. It is common for ordinary self-driving developers to outsource the data annotation or model training task to third-party platforms, which could inevitably expose a natural attack injection point. In this paper, we propose BadLiSeg, the first work to investigate backdoor attacks against LiDAR semantic segmentation. Specifically, we present a general attack strategy based on which the attacker can inject a dynamic backdoor into the victim model by constructing a trigger pattern pool and a location pool. Afterward, the attacker can choose a common physical object (e.g., drone and traffic sign) as the trigger and place it around an arbitrary location in a selected area to easily fool the backdoored LiDAR segmentation model. Our extensive experiments on five representative segmentation models and one public dataset demonstrate that BadLiSeg can not only achieve a high attack success rate but also maintain the normal segmentation performance of the backdoored model. We further show the effectiveness of BadLiSeg on some practical attack scenarios collected from a high-fidelity simulator.