Pith. sign in

REVIEW 3 major objections 4 minor 48 references

Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Online map construction is biased toward symmetric roads, and a roadside flashlight or patch can turn real forks into false straight roads.

desk verdict First real attack on online HD map construction, with physical-world evidence, but the headline 35% bias rate is computed on scenes selected by an unvalidated pipeline. read the letter →

arxiv 2509.06071 v1 pith:5MCL2GAX submitted 2025-09-07 cs.CR

Yang Lou , Haibo Hu , Qun Song , Qian Xu , Yi Zhu , Rui Tan , Wei-Bin Lee , Jianping Wang This is my paper
classification cs.CR
keywords autonomousdrivingonlinemapconstructionHDadversarialattacksymmetrybiascamerablindingpatchphysical
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Online HD map construction—the module that turns a car's surround-view cameras into vectorized road boundaries, lane dividers, and crossings—has an exploitable failure mode: it prefers symmetric road layouts. The paper shows that in asymmetric scenes such as forks and merges, both MapTR and VectorMapNet often predict a straight boundary that mirrors the opposite side, even without any attack; on 100 clean asymmetric scenes, MapTR misclassified 35 as symmetric. The paper then demonstrates that a single roadside flashlight or printed adversarial patch, positioned using a two-stage optimizer, can reliably trigger this bias in the real world, straightening away turns and shifting other turns early. The consequences are downstream: up to 44% of targeted routes become unreachable and unsafe planned trajectory rates rise by up to 27 percentage points on a public AD dataset, with similar effects on a testbed vehicle. If true, this makes online map construction a practical physical attack surface for autonomous driving, not just a digital robustness curiosity.

What carries the argument

The load-bearing mechanism is the symmetry bias expressed through the BEV-encoder/map-decoder architecture: boundary queries attend to other instance- and point-level queries, so a straight neighboring boundary can dominate a diverging boundary's prediction. The attack machinery is a two-stage pipeline: a curvature-difference classifier plus a vision-language refinement step locates 'asymmetry anchors' (the positions where a boundary begins to deviate); a scoring function ranks roadside positions by inverse-square attack intensity and angular coverage of those anchors; then objective-specific optimization—Chamfer distance to a mirrored target for road straightening, a directional outward-shi

What would settle it

Take a fresh corpus of hand-labeled asymmetric forks and merges that is not filtered by the paper's classifier, run MapTR and VectorMapNet clean on them, and then deploy the optimized flashlight or patch positions on a random subset of those scenes. If clean misclassification of asymmetric scenes is not substantially above that of symmetric scenes, or if optimized positions succeed no more often than random roadside positions, then the symmetry-bias mechanism and its claimed exploitability are refuted.

Watch

Extended reading notes

Core claim

The paper's central discovery is a 'symmetry bias' in online vectorized HD map construction models. Because these models use a BEV encoder and a map decoder that lets each predicted map element attend to nearby elements, a straight reference boundary on one side of the road provides strong contextual pull; when the scene is asymmetric—one boundary turns while the other stays straight—the model often resolves the ambiguity by mirroring the straight side. The paper quantifies this in its Table 1: 35 of 100 asymmetric nuScenes scenes are already misclassified as symmetric in clean conditions, while only 19 of 100 symmetric scenes flip the other way. It then defines two attack targets, road stra

Load-bearing premise

The dataset-level vulnerability numbers all come from 100 asymmetric frames selected by the paper's curvature-plus-vision-language filter, and the real-world validation uses only 8 scenes from that same pipeline; if that filter systematically mislabels which asymmetric scenes are vulnerable, the measured clean misclassification, AP drops, and route-blocking rates may not generalize to real asymmetric road networks.

Editorial extensions

If this is right

  • Online map construction should be treated as an adversarial component of the driving stack: a single static roadside installation can affect every passing vehicle with line of sight, not just one victim.
  • Road straightening attacks create concrete denial-of-service outcomes: 44% of evaluated asymmetric scenes become partially unreachable, meaning entrances and turns can be effectively blocked without touching the road.
  • Early-turn attacks create collision outcomes: unsafe planned trajectory rates rise to 27% with camera blinding and 21% with adversarial patches, and even small map-accuracy drops translate into large planning shifts.
  • The vulnerability transfers beyond the exact victim model: configurations optimized on MapTR degrade VectorMapNet, and GeMap, MapQR, and a LiDAR-camera fusion variant remain partially vulnerable, so architecture changes alone do not remove the bias.
  • Fine-tuning on asymmetric data improves robustness—road-boundary AP rises 5.2 points in clean conditions and unreachable-goal rate drops 11 points under the blinding road-straightening attack—giving model owners a practical partial defense.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A defensive use of the same pipeline is implied but not developed: the curvature-plus-VLM scene detector could serve as a continuous safety monitor that flags predicted maps in asymmetric scenes for extra planner conservatism or human review.
  • Because the bias is attributed to data imbalance and cross-element attention, it likely affects any query-based vectorized map learner trained mostly on symmetric roads; the vulnerability may be a general property of the task rather than of MapTR specifically.
  • The 35/100 clean misclassification rate suggests a passive threat: even without active interference, a nontrivial fraction of asymmetric scenes may already be misread by such models, so AVs approaching forks could be making decisions on distorted maps before any attacker acts.
  • A testable extension would make the effect persist beyond a single frame: the paper lists continuous, tracking flashlights and cross-frame patch optimization as future work, and combined with its finding that temporary occlusion alone can trigger the bias, such persistent interference could attack an entire turn maneuver.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper reports a systematic vulnerability analysis of online HD map construction models (MapTR, VectorMapNet, and others), claiming that these models exhibit an inherent bias toward predicting symmetric road structures in asymmetric scenes (forks, merges, turns). The authors propose a two-stage attack framework: first, asymmetric scenes are identified using a rule-based curvature classifier plus GPT-4o VLM refinement; second, attack configurations (flashlight position or adversarial patch position/pattern) are optimized for either road straightening or early-turn objectives. Evaluation on the nuScenes dataset reports clean-condition misclassification of asymmetric scenes, AP degradation, unreachable route rates, and unsafe trajectory rates, with real-world validation on a testbed vehicle for eight asymmetric scenes. The paper also analyzes root causes and proposes asymmetric-data fine-tuning as a defense.

Significance. If the central claim holds, this is a useful and timely contribution: it is the first vulnerability assessment of online map construction models and demonstrates a physically realizable attack with real-world validation. The paper's strengths include the two-stage attack design, black-box and white-box optimization, transferability to several modern models (GeMap, MapQR, VAD), and a testbed evaluation with both flashlight and adversarial patch attacks. The proposed defense and root-cause analysis, while preliminary, are reasonable additions. However, the validity of the quantitative claims hinges on the scene-selection procedure and on the consistency of the reported numbers, both of which have issues that need to be addressed.

major comments (3)
  1. [Sec. 5.3 / Sec. 6.1 / Tables 1-5] All dataset-level results are computed on 100 asymmetric frames selected by the authors' two-step pipeline (rule-based curvature threshold, Eq. (2), plus GPT-4o VLM refinement). This pipeline is never validated against human labels or an independent ground-truth criterion; the curvature threshold is empirical and the VLM output is non-deterministic. If the pipeline preferentially selects frames where MapTR fails for reasons unrelated to symmetry (e.g., incomplete annotations, occlusions, or ambiguous geometry), the 35/100 clean misclassification rate and the attack results in Tables 2-5 may not generalize. The real-world experiments (Sec. 7) also use the same pipeline to select the eight scenes, so they do not independently break this dependence. The authors should validate the classifier (precision/recall on a random sample with human labels), report results on the full set of 2,095 val
  2. [Table 1 and abstract/introduction] There is a direct numerical inconsistency in the central evidence. Table 1 shows that for MapTR, 31 out of 100 ground-truth asymmetric scenes are predicted as symmetric, with 69 predicted as asymmetric. However, the text (Sec. 3.1.1) and the abstract state that '35 out of 100 asymmetric scenes were misclassified as symmetric.' One of these numbers is wrong. Since this 35/100 (or 31/100) figure is the headline evidence for the 'inherent symmetry bias' claim, the authors must correct the discrepancy and ensure all mentions agree.
  3. [Tables 2-5 and Sec. 6.2] The attack effectiveness results are reported for a single run on a single 100-frame subset, without confidence intervals, standard deviations, or significance tests. Some differences against the PSO baseline are modest (e.g., Table 2: RSA mAP 40.2 vs. PSO 42.8 for blinding; Table 5: ETA UPTR 21 vs. PSO 14 for patch is larger but still one run). Given the selection pipeline and the relatively small evaluation set, the authors should provide error bars, multiple random subsets, or a statistical comparison to support the claim that their optimization outperforms random sampling and PSO under the same query budget.
minor comments (4)
  1. [Table 13] The clean-condition mAP values differ between the two columns (62.5 vs. 52.5) for the same fine-tuned model; this appears to be a typo and should be corrected.
  2. [Sec. 6.2.2] The planner is inconsistently named: 'Hybrid A*-planner' in Sec. 6.1 and 'Hyper A*-planner' in Sec. 6.2.2. Please unify.
  3. [Sec. 5.3.2 / Appendix Fig. 13] The VLM refinement uses GPT-4o, but the paper does not report the API version, temperature, or number of repeated queries. Since the VLM is non-deterministic, this affects reproducibility; please state the exact configuration.
  4. [Fig. 9] The 'Success ratio' labels in the subcaptions are ambiguous. For clean conditions, 'Success ratio: 1/8' in (b) could be misread as the model being correct; clarify that this is the attack success rate (fraction of scenes in which the attack goal is achieved).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the symmetry-bias claim is an empirical measurement against ground truth, not a consequence of the attack objective or a self-citation chain.

full rationale

The paper's central claim is that online map construction models exhibit an inherent bias toward predicting symmetric road structures. This claim is supported by Table 1, which compares ground-truth scene classifications with classifications of model predictions on 100 symmetric and 100 asymmetric scenes; the 35/100 clean misclassification rate for asymmetric scenes is an empirical observation, not a quantity defined by the attack framework. The attack objective in Eq. 8 does minimize Chamfer distance to a mirrored target boundary, but that is the definition of the road-straightening goal, not evidence for the bias; the paper separately provides clean-condition and real-world evidence of the bias. The asymmetric-scene classifier in Sec. 5.3 is used both to select evaluation scenes and to label predictions, which introduces a potential selection effect, but this is a validity concern, not circularity: the reported metrics (AP, UGR, UPTR) are measured against ground-truth maps and planning outcomes, not against the classifier's own labels. The only self-citation found is reference [37] for lens-flare simulation in Sec. 5.5.1; it is an implementation detail, not load-bearing for the central claim, and it is validated by real-world experiments. No derivation step reduces to its inputs by construction, and no self-citation chain forces the conclusion. The paper is self-contained against the nuScenes benchmark and its own testbed experiments, so the circularity score is 0.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

No new physical entities, forces, particles, or dimensions are postulated. Operational constructs such as asymmetry anchors, reference boundaries, and target boundaries are geometric definitions used by the attack, not independent empirical posits.

free parameters (7)
  • Curvature difference threshold (delta_k_thre) = 0.3
    Rule-based asymmetric scene classifier threshold in Sec 5.3.1; directly determines which frames are labeled asymmetric and enter all attack evaluations.
  • Directional loss weights alpha, beta = not reported
    Balance outward and inward displacement in Eq. 9 of the early-turn objective; values are omitted, so ETA results are not fully reproducible.
  • Maximum influence angle phi_max = not reported
    Cutoff in the position scoring function Eq. 3; meant to reflect flashlight beam angle and patch effective range, but no numeric value is given.
  • Attack query budget = 400
    Fixed query count in Sec 6.2 used to compare optimizers; attack effectiveness depends on this budget.
  • Flashlight brightness and beam angle = 3000 lumens, 40 degree beam
    Commercial upper-limit parameters fixed for camera-blinding simulation and real-world deployment (Sec 6.1, Sec 7.1).
  • Adversarial patch size = 3m x 2m dataset; 1m x 1m real-world
    Deployment constraint; chosen for visibility, and real-world experiments use a smaller patch that still works (Sec 6.1, Sec 7.1).
  • Sliding-window size for regional curvature = not reported
    Curvature averaging in Sec 5.3.1 uses sliding windows, but window length is not specified, affecting asymmetry classification.
assumptions (6)
  • domain assumption nuScenes ground-truth map annotations correctly represent road boundaries and are complete for the selected valid frames.
    Used to classify scenes and compute AP, UGR, UPTR (Sec 6.1); incomplete intersection annotations or labeling errors would shift scene selection and metrics.
  • domain assumption Pinhole projection plus Gaussian blur adequately approximates physical flashlight lens-flare effects.
    Camera blinding simulation in Sec 5.5.1 rests on this; real-world validation reduces but does not eliminate the simulation gap.
  • ad hoc to paper GPT-4o VLM refinement provides accurate asymmetry classification.
    VLM stage in Sec 5.3.2 filters rule-based candidates; no accuracy evaluation is reported, so VLM errors change the scene set and all downstream results.
  • domain assumption The MapTR + Hybrid A* stack is representative of a realistic victim AD system.
    Dataset and real-world evaluations use this stack (Sec 6.1, Sec 7.1); commercial systems may use other architectures, sensor fusion, or map validation that mitigate or alter attacks.
  • standard math Monte Carlo dropout uncertainty is a valid proxy for model confidence in root-cause analysis.
    Sec 8 Cause 1 interprets lower dropout uncertainty on wrong symmetric predictions as overconfidence; this interpretation depends on dropout-as-uncertainty assumptions.
  • standard math The plane-curve curvature formula is a valid geometric asymmetry signal.
    Eq. 2 in Sec 5.3.1 defines asymmetry from regional curvature differences; the threshold is empirical but the formula is standard.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving." pith.science (2026). https://pith.science/paper/5MCL2GAX

@misc{pith2026250906071,
  author       = {Pith},
  title        = {Pith review of: Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5MCL2GAX}},
  note         = {Machine review of arXiv:2509.06071}
}
read the original abstract

High-definition maps provide precise environmental information essential for prediction and planning in autonomous driving systems. Due to the high cost of labeling and maintenance, recent research has turned to online HD map construction using onboard sensor data, offering wider coverage and more timely updates for autonomous vehicles. However, the robustness of online map construction under adversarial conditions remains underexplored. In this paper, we present a systematic vulnerability analysis of online map construction models, which reveals that these models exhibit an inherent bias toward predicting symmetric road structures. In asymmetric scenes like forks or merges, this bias often causes the model to mistakenly predict a straight boundary that mirrors the opposite side. We demonstrate that this vulnerability persists in the real-world and can be reliably triggered by obstruction or targeted interference. Leveraging this vulnerability, we propose a novel two-stage attack framework capable of manipulating online constructed maps. First, our method identifies vulnerable asymmetric scenes along the victim AV's potential route. Then, we optimize the location and pattern of camera-blinding attacks and adversarial patch attacks. Evaluations on a public AD dataset demonstrate that our attacks can degrade mapping accuracy by up to 9.9%, render up to 44% of targeted routes unreachable, and increase unsafe planned trajectory rates, colliding with real-world road boundaries, by up to 27%. These attacks are also validated on a real-world testbed vehicle. We further analyze root causes of the symmetry bias, attributing them to training data imbalance, model architecture, and map element representation. To the best of our knowledge, this study presents the first vulnerability assessment of online map construction models and introduces the first digital and physical attack against them.

Figures

Figures reproduced from arXiv: 2509.06071 by the authors.

Figure 1
Figure 1. By placing a flashlight or adversarial patch at the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Real-world vulnerability experiments in symmet [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack Opportunities. The green curve indicates [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Overview of our two-stage attack framework for identifying effective configurations to launch camera blinding and [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Simulation of (a) camera blinding attack and (b) [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Examples of Road Straightening Attacks using cam [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Examples of Early Turn Attacks using camera blind [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Real-world Experiment Setup. models, the attack still achieves up to 27% Unreachable Goal Rate and 18% Unsafe Planned Trajectory Rate on GeMap with LiDAR￾camera fusion. This indicates that camera inputs—susceptible to our attacks—remain critical for map element recogni…
Figure 9
Figure 9. Figure 9: Two real-world attack scenarios. Top row: Road Straightening Attacks; Bottom row: Early Turn Attacks. [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Example map results under successful attacks on [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: VLM refinement example. The VLM corrects a mis [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]
Figure 12
Figure 12. Figure 12: Early turn attack objective design. Pesé. 2024. Discovering New Shadow Patterns for Black-Box Attacks on Lane Detection of Autonomous Vehicles. arXiv preprint arXiv:2409.18248 (2024). [22] Ben Nassi, Yisroel Mirsky, Dudi Nassi, Raz Ben-Netanel, Oleg Drokin, and Yuval …
Figure 13
Figure 13. Figure 13: VLM system prompt. all settings (clean, untargeted, and scene-specific attacks). For in￾stance, under scene-specific adversarial patch attacks, AP on road boundary prediction drops to 39.2% for asymmetric scenes, com￾pared to 49.4% and 59.1% for random and symmetric s…
Figure 14
Figure 14. Figure 14: Example of incorrect map prediction under clean [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Attack examples under different weather conditions. Left to right: multi-view camera inputs, clean map prediction, [PITH_FULL_IMAGE:figures/full_fig_p018_15.png]
Figure 16
Figure 16. Figure 16: Attack examples in complex traffic conditions. Left to right: multi-view camera inputs, clean map prediction, and [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: Root cause analysis of network design: deep feature interactions in the map decoder allow nearby map elements and [PITH_FULL_IMAGE:figures/full_fig_p018_17.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 40 canonical work pages

  1. [1]

    Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. 2020. nuscenes: A multimodal dataset for autonomous driving. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 11621–11631

    2020

  2. [2]

    Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. 2021. Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In2021 IEEE symposium on security and privacy (SP). IEEE, 176–194

    work page 2021

  3. [3]

    Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Ram- pazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019. Adversarial sensor attack on lidar-based perception in autonomous driving. InProceedings of the 2019 ACM SIGSAC conference on computer and communications security. 2267–2281

    work page 2019

  4. [4]

    Pengxin Chen, Xiaoqi Jiang, Yingjun Zhang, Jiahao Tan, and Rong Jiang. 2024. MapCVV: On-cloud Map Construction Using Crowdsourcing Visual Vectorized Elements towards Autonomous Driving.IEEE Robotics and Automation Letters (2024)

    work page 2024

  5. [5]

    Zhiyuan Cheng, Hongjun Choi, Shiwei Feng, James Chenhao Liang, Guanhong Tao, Dongfang Liu, Michael Zuzak, and Xiangyu Zhang. 2024. Fusion is Not Enough: Single Modal Attack on Fusion Models for 3D Object Detection. InThe Twelfth International Conference on Learning Representations

    work page 2024

  6. [6]

    Yarin Gal and Zoubin Ghahramani. 2016. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. Ininternational conference on machine learning. PMLR, 1050–1059

    2016

  7. [7]

    Dongfang Guo, Yuting Wu, Yimin Dai, Pengfei Zhou, Xin Lou, and Rui Tan. 2024. Invisible optical adversarial stripes on traffic sign against autonomous vehicles. InProceedings of the 22nd Annual International Conference on Mobile Systems, Applications and Services. 534–546

    work page 2024

  8. [8]

    Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, and Tianwei Zhang. 2022. Physical backdoor attacks to lane detection systems in autonomous driving. InProceedings of the 30th ACM International Conference on Multimedia. 2957–2968

    work page 2022

Show all 48 references
  1. [9]

    Xiaoshuai Hao, Mengchuan Wei, Yifan Yang, Haimei Zhao, Hui Zhang, Yi Zhou, Qiang Wang, Weiming Li, Lingdong Kong, and Jing Zhang. 2024. Is your hd map constructor reliable under sensor corruptions?arXiv preprint arXiv:2406.12214 (2024)

    2024 arXiv

  2. [10]

    Bo Jiang, Shaoyu Chen, Qing Xu, Bencheng Liao, Jiajie Chen, Helong Zhou, Qian Zhang, Wenyu Liu, Chang Huang, and Xinggang Wang. 2023. VAD: Vectorized Scene Representation for Efficient Autonomous Driving.ICCV(2023)

    2023

  3. [11]

    Zizhi Jin, Xiaoyu Ji, Yushi Cheng, Bo Yang, Chen Yan, and Wenyuan Xu. 2023. Pla- lidar: Physical laser attacks against lidar-based 3d object detection in autonomous vehicle. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 1822–1839

    2023

  4. [12]

    Pengfei Jing, Qiyi Tang, Yuefeng Du, Lei Xue, Xiapu Luo, Ting Wang, Sen Nie, and Shi Wu. 2021. Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations. In30th USENIX Security Symposium (USENIX Security 21). 3237–3254

    2021

  5. [13]

    James Kennedy and Russell Eberhart. 1995. Particle swarm optimization. In Proceedings of ICNN’95-international conference on neural networks, Vol. 4. ieee, 1942–1948

    1995

  6. [14]

    Qi Li, Yue Wang, Yilun Wang, and Hang Zhao. 2022. Hdmapnet: An online hd map construction and evaluation framework. In2022 International Conference on Robotics and Automation (ICRA). IEEE, 4628–4634

    2022

  7. [15]

    Zhiqi Li, Wenhai Wang, Hongyang Li, Enze Xie, Chonghao Sima, Tong Lu, Yu Qiao, and Jifeng Dai. 2022. Bevformer: Learning bird’s-eye-view representa- tion from multi-camera images via spatiotemporal transformers. InEuropean conference on computer vision. Springer, 1–18

    2022

  8. [16]

    Bencheng Liao, Shaoyu Chen, Xinggang Wang, Tianheng Cheng, Qian Zhang, Wenyu Liu, and Chang Huang. 2023. MapTR: Structured Modeling and Learning for Online Vectorized HD Map Construction. InInternational Conference on Learning Representations

    2023

  9. [17]

    Bencheng Liao, Shaoyu Chen, Yunchi Zhang, Bo Jiang, Qian Zhang, Wenyu Liu, Chang Huang, and Xinggang Wang. 2024. Maptrv2: An end-to-end framework for online vectorized hd map construction.International Journal of Computer Vision(2024), 1–23

    2024

  10. [18]

    Yicheng Liu, Tianyuan Yuan, Yue Wang, Yilun Wang, and Hang Zhao. 2023. Vectormapnet: End-to-end vectorized hd map learning. InInternational Conference on Machine Learning. PMLR, 22352–22369

    2023

  11. [19]

    Zihao Liu, Xiaoyu Zhang, Guangwei Liu, Ji Zhao, and Ningyi Xu. 2024. Leveraging Enhanced Queries of Point Sets for Vectorized Map Construction. InEuropean Conference on Computer Vision

    2024

  12. [20]

    Mobileye. 2024. REM™Technology - Crowdsourced HD Mapping for Safer Driving. https://www.mobileye.com/technology/rem/

    2024

  13. [21]

    Yang et al

    Pedram MohajerAnsari, Alkim Domeke, Jan de Voor, Arkajyoti Mitra, Grace Johnson, Amir Salarpour, Habeeb Olufowobi, Mohammad Hamad, and Mert D CCS ’25, October 13–17, 2025, Taipei, Taiwan. Yang et al. (a) A symmetric scene incorrectly clas- sified as asymmetric by the Rule-base...

    2025

  14. [22]

    Ben Nassi, Yisroel Mirsky, Dudi Nassi, Raz Ben-Netanel, Oleg Drokin, and Yuval Elovici. 2020. Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks. InProceedings of the 2020 ACM SIGSAC conference on computer and communications secu...

    2020

  15. [23]

    Jonathan Petit, Bas Stottelaar, Michael Feiri, and Frank Kargl. 2015. Remote attacks on automated vehicles sensors: Experiments on camera and lidar.Black Hat Europe11, 2015 (2015), 995

    2015

  16. [24]

    Jonah Philion and Sanja Fidler. 2020. Lift, splat, shoot: Encoding images from arbitrary camera rigs by implicitly unprojecting to 3d. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIV 16. Springer, 194–210

    2020

  17. [25]

    Tong Qin, Haihui Huang, Ziqiang Wang, Tongqing Chen, and Wenchao Ding

  18. [26]

    2024.Autonomous Driving Map Industry Report, 2024

    ResearchInChina. 2024.Autonomous Driving Map Industry Report, 2024. Technical Report. ResearchInChina. https://www.giiresearch.com/report/rinc1400761- autonomous-driving-map-industry-report.html

    2024

  19. [27]

    Atsushi Sakai, Daniel Ingram, Joseph Dinius, Karan Chawla, Antonin Raffin, and Alexis Paques. 2018. Pythonrobotics: a python code collection of robotics algorithms.arXiv preprint arXiv:1808.10703(2018)

    2018 arXiv

  20. [28]

    Takami Sato, Sri Hrushikesh Varma Bhupathiraju, Michael Clifford, Takeshi Sugawara, Qi Alfred Chen, and Sara Rampazzi. 2024. Invisible reflections: Lever- aging infrared laser reflections to target traffic sign perception.arXiv preprint arXiv:2401.03582(2024)

    2024 arXiv

  21. [29]

    Takami Sato, Junjie Shen, Ningfei Wang, Yunhan Jia, Xue Lin, and Qi Alfred Chen

  22. [30]

    Juyeb Shin, Hyeonjun Jeong, Francois Rameau, and Dongsuk Kum. 2025. In- stagram: Instance-level graph modeling for vectorized hd map learning.IEEE Transactions on Intelligent Transportation Systems(2025)

    2025

  23. [31]

    TomTom. 2025. A new dimension for ADAS maps: TomTom Orbis Maps 3D. https://www.tomtom.com/newsroom/product-focus/a-new-dimension-for- adas-maps/

    2025

  24. [32]

    Rohith Reddy Vennam, Ish Kumar Jain, Kshitiz Bansal, Joshua Orozco, Puja Shukla, Aanjhan Ranganathan, and Dinesh Bharadia. 2023. mmspoof: Resilient spoofing of automotive millimeter-wave radars using reflect array. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 1807–1821

    2023

  25. [33]

    Wei Wang, Yao Yao, Xin Liu, Xiang Li, Pei Hao, and Ting Zhu. 2021. I can see the light: Attacks on autonomous vehicles using invisible lights. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 1930–1944

    2021

  26. [34]

    Deguo Xia, Weiming Zhang, Xiyan Liu, Wei Zhang, Chenting Gong, Jizhou Huang, Mengmeng Yang, and Diange Yang. 2024. DuMapNet: An End-to-End Vectorization System for City-Scale Lane-Level Map Generation. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and ...

    2024

  27. [35]

    Xuan Xiong, Yicheng Liu, Tianyuan Yuan, Yue Wang, Yilun Wang, and Hang Zhao. 2023. Neural map prior for autonomous driving. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 17535–17544

    2023

  28. [36]

    Yi Yu, Weizhen Han, Libing Wu, Bingyi Liu, Enshu Wang, and Zhuangzhuang Zhang. 2025. Enduring, Efficient and Robust Trajectory Prediction Attack in Autonomous Driving via Optimization-Driven Multi-Frame Perturbation Frame- work. InProceedings of the Computer Vision and Pattern...

    2025

  29. [37]

    Jindi Zhang, Yifan Zhang, Kejie Lu, Jianping Wang, Kui Wu, Xiaohua Jia, and Bin Liu. 2020. Detecting and identifying optical signal attacks on autonomous driving systems.IEEE Internet of Things Journal8, 2 (2020), 1140–1153

    2020

  30. [38]

    Tianyuan Zhang, Lu Wang, Hainan Li, Yisong Xiao, Siyuan Liang, Aishan Liu, Xianglong Liu, and Dacheng Tao. 2024. Lanevil: Benchmarking the robustness of lane detection to environmental illusions. InProceedings of the 32nd ACM International Conference on Multimedia. 5403–5412

    2024

  31. [39]

    Xinwei Zhang, Aishan Liu, Tianyuan Zhang, Siyuan Liang, and Xianglong Liu

  32. [40]

    Zhixin Zhang, Yiyuan Zhang, Xiaohan Ding, Fusheng Jin, and Xiangyu Yue

  33. [41]

    Zhihao Zheng, Xiaowen Ying, Zhen Yao, and Mooi Choo Chuah. 2023. Robustness of Trajectory Prediction Models Under Map-Based Attacks. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV). 4541–4550

    2023

  34. [42]

    Brady Zhou and Philipp Krähenbühl. 2022. Cross-view transformers for real-time map-view semantic segmentation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 13760–13769

    2022

  35. [43]

    Yi Zhu, Chenglin Miao, Hongfei Xue, Yunnan Yu, Lu Su, and Chunming Qiao

  36. [44]

    Online Vectorized HD Map Construction using Geometry.arXiv preprint arXiv:2312.03341(2023)

    2023 arXiv

  37. [48]

    fork", "turn

    Malicious attacks against multi-sensor fusion in autonomous driving. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. 436–451. Appendix A Supplementary Experiments A.1 Robustness Across Symmetric, Asymmetric, and Random Scenes. In ...

    2025

  38. [2021]

    In30th USENIX security symposium (USENIX Security 21)

    Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World} attack. In30th USENIX security symposium (USENIX Security 21). 3309–3326

  39. [2023]

    Traffic flow-based crowdsourced mapping in complex urban scenario.IEEE Robotics and Automation Letters8, 8 (2023), 5077–5083

    2023

  40. [2024]

    In Proceedings of the 32nd ACM International Conference on Multimedia

    Towards robust physical-world backdoor attacks on lane detection. In Proceedings of the 32nd ACM International Conference on Multimedia. 5131–5140

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.