Illusion of Depth: Revealing Hidden Stereo Vision Vulnerabilities in Depth Estimation
Simple repeating patterns let attackers shift stereo-camera depth estimates by up to 20 meters, triggering emergency braking in autonomous driving frameworks at 40 km/h.
The paper reveals an intrinsic vulnerability in stereo cameras stemming from pixel sampling and calibration processes, letting attackers finely control estimated depth of real obstacles using simple repeating patterns without adversarial ML techniques. The attack was evaluated against BM and SGBM stereo matching algorithms, deep learning models PSMNet, MoCha-Stereo, and UniMatch, the stereo-LiDAR fusion model SGM-DDC, and commercial cameras ZED2 and Intel RealSense D435; on ZED2, obstacles can be displaced up to 20 meters farther or 12 meters closer. A 0.5-second attack triggered emergency braking in a popular autonomous driving framework, with feasibility confirmed at driving speeds up to 40 km/h using CARLA. State-of-the-art defenses proved ineffective, and the authors propose a similarity-score strategy to dynamically detect and suppress depth discrepancies.
- Repeating patterns displace ZED2 depth estimates up to 20 meters
- 0.5-second attack triggers emergency braking in autonomous driving framework
- Affects BM, SGBM, PSMNet, MoCha-Stereo, UniMatch, SGM-DDC, ZED2, RealSense D435
- Feasible at driving speeds up to 40 km/h in CARLA
- State-of-the-art defenses ineffective; similarity-score detection and suppression proposed
Full article232 words · extracted from arxiv.org · click to collapse
Stereo cameras are integrated into autonomous systems such as self-driving cars, drones, and robots to offer precise depth estimation in a cost-effective manner compared to LiDAR technology. In this work, we reveal an intrinsic vulnerability in stereo cameras that stems from their pixel sampling and calibration processes, which can influence the outputs of stereo matching algorithms. Attackers can achieve fine-grained control over the estimated depth of real obstacles using simple repeating patterns, without relying on sophisticated adversarial machine learning techniques. Furthermore, deep learning-based depth estimation models exhibit a similar vulnerability. We evaluate the impact of this attack on two widely used stereo matching algorithms (BM and SGBM), three deep learning models (PSMNet, MoCha-Stereo, and UniMatch), a stereo-LiDAR fusion model (SGM-DDC), and two popular commercial stereo cameras, the ZED2 and Intel RealSense D435. For example, in the ZED2 camera, an attacker can displace obstacles up to 20~meters farther or 12~meters closer. In our real-world evaluation in a driving setting, a brief 0.5~second attack can trigger emergency braking in a popular autonomous driving framework. We further demonstrate the feasibility at driving speeds up to 40~km/h using CARLA. Finally, we confirm the ineffectiveness of state-of-the-art defenses, and we propose a novel strategy that leverages similarity scores to dynamically detect and suppress the depth discrepancies. Our work highlights vulnerabilities hidden in stereo matching and deep learning depth estimation models, addressing critical limitations in autonomous system deployments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.16336