Adversarial attacks against monocular depth estimation (MDE) systems pose significant challenges, particularly in safety-critical applications such as autonomous driving. Existing patch-based adversarial attacks for MDE are confined to the vicinity of the patch, making it difficult to affect the entire target. To address this limitation, we propose a physics-based adversarial attack on monocular depth estimation, employing a framework called Attack with Shape-Varying Patches (ASP), aiming to optimize patch content, shape, and position to maximize effectiveness. We introduce various mask shapes, including quadrilateral, rectangular, and circular masks, to enhance the flexibility and efficiency of the attack. Furthermore, we propose a new loss function to extend the influence of the patch beyond the overlapping regions. Experimental results demonstrate that our attack method generates an average depth error of 18 meters on the target car with a patch area of 1/9, affecting over 98\% of the target area.

翻译：针对单目深度估计系统的对抗攻击构成重大挑战，在自动驾驶等安全关键应用中尤为突出。现有基于补丁的MDE对抗攻击仅局限于补丁邻近区域，难以影响整个目标对象。为突破此限制，我们提出一种基于物理原理的单目深度估计对抗攻击方法，采用名为"形状可变补丁攻击"的框架，通过优化补丁内容、形状与位置实现攻击效能最大化。我们引入四边形、矩形及圆形等多种掩模形状以提升攻击的灵活性与效率。此外，我们提出新的损失函数以扩展补丁在重叠区域之外的影响范围。实验结果表明，在补丁面积仅占1/9的条件下，本攻击方法可使目标车辆产生平均18米的深度估计误差，影响范围覆盖超过98%的目标区域。