Abstract
Adversarial attacks in 3D environments have emerged as a critical threat to the reliability of visual perception systems, particularly in safety-sensitive applications such as identity verification and autonomous driving. These attacks employ adversarial patches and 3D objects to manipulate deep neural network (DNN) predictions by exploiting vulnerabilities within complex scenes. Existing defense mechanisms, such as adversarial training and purification, primarily employ passive strategies to enhance robustness. However, these approaches often rely on pre-defined assumptions about adversarial tactics, limiting their adaptability in dynamic 3D settings. To address these challenges, we introduce Reinforced Embodied Active Defense (Rein-EAD), a proactive defense framework that leverages adaptive exploration and interaction with the environment to improve perception robustness in 3D adversarial contexts. By implementing a multi-step objective that balances immediate prediction accuracy with predictive entropy minimization, Rein-EAD optimizes defense strategies over a multi-step horizon. Additionally, Rein-EAD involves an uncertainty-oriented reward-shaping mechanism that facilitates efficient policy updates, thereby reducing computational overhead and supporting real-world applicability without the need for differentiable environments. Comprehensive experiments validate the effectiveness of Rein-EAD, demonstrating a substantial reduction in attack success rates while preserving standard accuracy across diverse tasks. Notably, Rein-EAD exhibits robust generalization to unseen and adaptive attacks, making it suitable for real-world complex tasks, including 3D object classification, face recognition and autonomous driving.
Abstract (translated)
在三维环境中，对抗性攻击已成为视觉感知系统可靠性的关键威胁，特别是在身份验证和自动驾驶等安全敏感应用中。这些攻击利用对抗性贴纸和3D物体来操纵深度神经网络（DNN）的预测，并通过利用复杂场景中的漏洞进行操作。现有的防御机制，如对抗训练和净化，主要采用被动策略来增强系统的鲁棒性。然而，这些方法往往依赖于对敌手战术的预定义假设，从而限制了它们在动态3D环境中的适应能力。 为了解决这些问题，我们引入了一种名为强化嵌入式主动防御（Reinforced Embodied Active Defense, Rein-EAD）的框架。该框架采用自适应探索和与环境互动的方式，以提高三维对抗场景下的感知鲁棒性。通过实施一个多步目标，平衡即时预测准确性和预测熵最小化，Rein-EAD可以在多步规划范围内优化防御策略。此外，Rein-EAD涉及一种不确定性导向的奖励塑造机制，促进了高效的政策更新，从而减少了计算开销，并支持在非可微环境中实现现实世界的适用性。 综合实验验证了Rein-EAD的有效性，显示其能够在保持标准准确性的前提下显著降低攻击成功率。值得注意的是，Rein-EAD表现出对未见过和适应性攻击的鲁棒泛化能力，使其适用于包括3D物体分类、面部识别及自动驾驶在内的现实世界复杂任务。
URL
https://arxiv.org/abs/2507.18484
