Recently, multi-agent collaborative (MAC) perception has been proposed and outperformed the traditional single-agent perception in many applications, such as autonomous driving. However, MAC perception is more vulnerable to adversarial attacks than single-agent perception due to the information exchange. The attacker can easily degrade the performance of a victim agent by sending harmful information from a malicious agent nearby. In this paper, we extend adversarial attacks to an important perception task -- MAC object detection, where generic defenses such as adversarial training are no longer effective against these attacks. More importantly, we propose Malicious Agent Detection (MADE), a reactive defense specific to MAC perception that can be deployed by each agent to accurately detect and then remove any potential malicious agent in its local collaboration network. In particular, MADE inspects each agent in the network independently using a semi-supervised anomaly detector based on a double-hypothesis test with the Benjamini-Hochberg procedure to control the false positive rate of the inference. For the two hypothesis tests, we propose a match loss statistic and a collaborative reconstruction loss statistic, respectively, both based on the consistency between the agent to be inspected and the ego agent where our detector is deployed. We conduct comprehensive evaluations on a benchmark 3D dataset V2X-sim and a real-road dataset DAIR-V2X and show that with the protection of MADE, the drops in the average precision compared with the best-case "oracle" defender against our attack are merely 1.28% and 0.34%, respectively, much lower than 8.92% and 10.00% for adversarial training, respectively.

翻译：近年来，多智能体协同感知（MAC）被提出并在自动驾驶等众多应用中超越了传统单智能体感知。然而，由于信息交互，MAC感知比单智能体感知更容易遭受对抗攻击。攻击者可通过附近恶意代理发送有害信息，轻易降低受害代理的性能。本文将对抗攻击扩展到一项重要感知任务——MAC目标检测，其中对抗训练等通用防御手段对这些攻击不再有效。更重要的是，我们提出恶意代理检测（MADE）——一种针对MAC感知的反应式防御机制，每个代理可部署该机制以精确检测并移除本地协作网络中的潜在恶意代理。具体而言，MADE采用基于双假设检验的半监督异常检测器独立检测网络中的每个代理，并通过Benjamini-Hochberg流程控制推理的假阳性率。针对两种假设检验，我们分别提出匹配损失统计量和协同重建损失统计量，两者均基于待检代理与部署检测器的本我代理之间的一致性。我们在基准3D数据集V2X-sim和真实道路数据集DAIR-V2X上进行了全面评估，结果表明，在MADE保护下，针对我们攻击的性能（平均精度）相比最优“神谕”防御者的下降分别仅为1.28%和0.34%，远低于对抗训练的8.92%和10.00%。