3D object detection is an essential perception task in autonomous driving to understand the environments. The Bird's-Eye-View (BEV) representations have significantly improved the performance of 3D detectors with camera inputs on popular benchmarks. However, there still lacks a systematic understanding of the robustness of these vision-dependent BEV models, which is closely related to the safety of autonomous driving systems. In this paper, we evaluate the natural and adversarial robustness of various representative models under extensive settings, to fully understand their behaviors influenced by explicit BEV features compared with those without BEV. In addition to the classic settings, we propose a 3D consistent patch attack by applying adversarial patches in the 3D space to guarantee the spatiotemporal consistency, which is more realistic for the scenario of autonomous driving. With substantial experiments, we draw several findings: 1) BEV models tend to be more stable than previous methods under different natural conditions and common corruptions due to the expressive spatial representations; 2) BEV models are more vulnerable to adversarial noises, mainly caused by the redundant BEV features; 3) Camera-LiDAR fusion models have superior performance under different settings with multi-modal inputs, but BEV fusion model is still vulnerable to adversarial noises of both point cloud and image. These findings alert the safety issue in the applications of BEV detectors and could facilitate the development of more robust models.

翻译：3D目标检测是自动驾驶中理解环境的关键感知任务。基于鸟瞰图（BEV）的表征方法在主流基准测试中显著提升了采用摄像头输入的3D检测器性能。然而，目前对这类视觉依赖型BEV模型的鲁棒性仍缺乏系统性理解——该特性与自动驾驶系统的安全性密切相关。本文在广泛场景下评估了多种代表性模型的自然鲁棒性与对抗鲁棒性，以充分理解显式BEV特征相较于非BEV方法对其行为的影响。除经典设置外，我们提出了一种3D一致性补丁攻击方法，通过在三维空间施加对抗补丁保证时空一致性，更贴合自动驾驶实际场景。通过大量实验，我们得出以下发现：1）由于富有表达力的空间表征能力，BEV模型在不同自然条件与常见干扰下比传统方法更稳定；2）BEV模型更易受对抗噪声影响，主要源于冗余的BEV特征；3）基于相机-激光雷达融合的多模态模型在不同设置下表现更优，但BEV融合模型仍易受点云与图像的对抗噪声攻击。这些发现警示了BEV检测器应用中的安全问题，并有助于推动更鲁棒模型的发展。