Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbation

2026-06-01

AI Summary

This work proposes a novel adversarial attack framework driven by a lightweight Product Quantization Network (LPQN) to expose critical vulnerabilities in deep learning–based visual localization systems. By strategically concentrating perturbations on the product quantization module, the method employs a two-stage mechanism—forward feature distribution perturbation followed by backward optimization refinement—to generate low-overhead, highly imperceptible adversarial examples. These perturbations effectively disrupt the image retrieval process, causing the system to return semantically irrelevant database entries and thereby inducing severe localization errors and navigation failures. Extensive experiments in both simulated and real-world robotic environments demonstrate that the proposed approach substantially degrades localization performance, revealing a fundamental weakness in current visual localization pipelines under adversarial conditions.

Abstract

Robot localization systems are critical for autonomous navigation and safety. Adversarial perturbations can mislead these systems, resulting in mislocalization, navigation errors, or unsafe interactions, especially in mission-critical scenarios. This paper investigates the vulnerability of deep learning based localization pipelines to adversarial attacks. We propose a novel framework for generating adversarial queries that specifically target Product Quantization (PQ) in visual localization systems. Our method employs a Lightweight Product Quantization Network (LPQN) to perturb query feature encodings, misleading the retrieval process by returning semantically irrelevant database entries. Adversarial queries are generated via a two-phase procedure: a forward pass that perturbs feature distributions and a backward pass that refines the perturbation through optimization. The lightweight design of LPQN allows the creation of subtle yet highly effective perturbations with minimal computational overhead. Extensive experiments in both controlled and real-world robotic environments demonstrate that our approach substantially degrades PQN performance, exposing critical vulnerabilities in practical applications.

Problem

• adversarial attacks
• robot localization
• deep feature perturbation
• product quantization
• visual localization

Innovation

• adversarial attack
• product quantization
• robot localization
• feature perturbation
• lightweight network