TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction

2026-08-05

AI Summary

This work addresses the vulnerability of existing online high-definition map construction methods to cross-boundary geometric compensation effects, which can diminish the efficacy of physical adversarial attacks. To overcome this limitation, the authors propose TwinIR, a novel mechanism-guided dual-point collaborative attack strategy that jointly optimizes attack point locations and sparsity to suppress boundary compensation cues. The approach integrates near-infrared illumination modeling, camera response mapping, and geometry-aware optimization to generate physically realizable perturbations with low visual visibility. Evaluated on the nuScenes dataset, TwinIR reduces mAP by 8.18–8.96 under RSA and 2.84–5.62 under ETA, increases target unreachability by 25–28%, and raises unsafe trajectory rates by 19–20%. Real-world experiments demonstrate successful induction of road geometry deformation while maintaining visual stealth.

Abstract

Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.

Problem

• online HD map construction
• physical attacks
• cross-boundary compensation
• geometric cues
• autonomous driving

Innovation

• TwinIR
• physical attack
• online HD map construction
• infrared camouflage
• geometric compensation suppression