NeurIPS 2026

BEVCA

Towards Effective and Transferable Physical Camouflage against Multi-View BEV-based 3D Perception in Autonomous Driving

Linye Lyu · Jiawei Zhou · Daojing He · Yu Li

Harbin Institute of Technology, Shenzhen
Zhejiang University

Paper ↗Code ↗BibTeX ↓

SIMULATION → REAL WORLDPHYSICAL EVALUATION

One camouflage.
Multiple views.51.18%Mean physical black-box ASR

Studying the shared vulnerabilities of multi-view perception.

Explore the research ↓

01 / Overview

A different view of perception robustness.

Multi-view systems see a vehicle from several cameras. BEVCA studies their shared bird’s-eye-view representation to expose vulnerabilities that transfer beyond a single detector.

Simulation comparison showing normal paint, AdvPatch, FCA, DTA, ACTIVE, RAUCA, CNCA and BEVCA, with corresponding 3D detection results — FIG. 01 A photo-realistic simulation example. BEVCA evades detection in this example, while the compared textures remain detected. *Click any figure to enlarge ↗*

Read the abstract +

Modern autonomous driving systems widely adopt multi-view Bird’s-Eye-View (BEV) based 3D perception models due to their superior performance. Despite their success, the robustness of these models against adversarial camouflage attacks remains largely unexplored. Existing camouflage attacks primarily target single-view 2D detectors, limiting their effectiveness in multi-view 3D perception settings. To address this gap, we propose BEVCA, a novel adversarial camouflage generation framework tailored for multi-view BEV-based 3D perception. Our framework integrates a BEV-feature-based adversarial loss with a multi-view neural rendering module, enabling effective and transferable camouflage attacks across different models and tasks. Extensive experiments in both digital and physical settings demonstrate that BEVCA outperforms state-of-the-art baselines and exhibits strong robustness under real-world conditions.

6Ego-mounted camera views

2Tasks: detection & segmentation

51.18%Mean physical black-box ASR

02 / The method

Target the shared BEV representation.

Multi-view neural rendering and a mask-enhanced feature objective connect a physical vehicle’s appearance to its representation in BEV space.

BEVCA framework: multi-view neural rendering and mask-enhanced BEV feature attack — FIG. 02 Overview of the BEVCA framework.

Consistent across cameras

A multi-view renderer produces geometrically consistent images of the textured vehicle from the ego vehicle’s six cameras, incorporating environmental appearance.

Focus on relevant features

A dedicated BEV mask locates feature regions associated with the target vehicle, helping focus the objective on texture-sensitive areas.

Transfer across tasks

Targeting the shared BEV representation supports transfer from a detection surrogate to other detectors and BEV segmentation models.

03 / Digital evaluation

Beyond the optimization model.

The camouflage is optimized on BEVFormer-base and evaluated across five detection configurations and three segmentation models.

Vehicle AP ↓ · lower means a stronger attack

Source: main comparison table in the camera-ready manuscript. Base is the white-box optimization model; the remaining configurations evaluate transfer. Values are perception metrics, not attack success rates.

04 / Physical evaluation

From simulation to a full-size car.

A printed camouflage applied to an Audi, evaluated using a multi-camera data collection platform following the nuScenes camera setup.

Real-world camouflaged Audi observed from different camera viewpoints, with detection outputs — FIG. 03 Successful physical attack examples from multiple camera viewpoints.

Black-box transfer

51.18%

Average attack success rate across four victim models.

Physical attack success rate (%, higher indicates a stronger attack)
Victim model	CNCA	BEVCA
BEVFormer-base	30.00	49.60
BEVFormer-small	29.49	46.99
BEVDet-R50	42.80	64.41
BEVDet-R50-CBGS	34.99	42.13

Reported under the paper’s experimental setup; these results do not establish performance in all driving conditions.

05 / Ablations & sensitivity

What makes BEVCA effective?

The main loss ablation isolates the role of the BEV mask. Appendix experiments then examine texture regularization and mask-parameter sensitivity.

The role of the mask

BEV features alone
are not enough.

Without masking, the vehicle AP is 0.612—close to the normal-paint baseline of 0.618. Adding the proposed mask brings it to 0.191. The paper attributes this difference to focusing optimization on car-texture-sensitive regions rather than the whole scene.

Source: main-paper loss ablation. This panel shows the optimization model; cross-model results are in the paper.

Loss ablation · BEVFormer-base vehicle AP ↓
Optimization objective	Vehicle AP
Detection scores	0.564
Image-encoder features	0.392
Detection-head features	0.471
Whole BEV, without mask	0.612
BEV features + mask (BEVCA)	0.191

Appendix / Hyperparameter analysis

Texture regularization and mask size.

Lower vehicle AP indicates a stronger attack in both plots.

Left: AP versus TV weight beta for BEVFormer base, small and tiny. Right: mask parameter grid with lowest AP 0.191 at delta r and delta theta equal to 15. — FIG. 04 Original appendix figure: TV-weight sensitivity and BEV-mask grid search.

Total variation matters

Increasing β from 0 to 1,000 lowers AP across all three BEVFormer variants. BEVFormer-base reaches its best tested value at β = 1,000; larger weights do not consistently improve all variants.

A focused mask works best

The tested 3 × 3 grid reaches its lowest AP of 0.191 at Δr = 15 and Δθ = 15. The remaining settings range from 0.205 to 0.228.

06 / Further appendix experiments

Probe the limits. Improve robustness.

Additional evaluations examine viewpoint sensitivity, lightweight defenses, and the potential of adversarial training to restore perception performance.

01 / Viewpoint & distance

Performance varies with the vehicle’s position.

The appendix evaluates six azimuths and four distances, with 40 samples per combination across different CARLA towns. The full grid makes the variation visible: AP ranges from 0.001 to 0.641.

Explore all 24 position settings Vehicle AP ↓

Position sensitivity · BEVFormer-base vehicle AP ↓
Azimuth	10 m	15 m	25 m	40 m
0°	0.278	0.129	0.468	0.376
60°	0.005	0.184	0.311	0.278
120°	0.206	0.332	0.167	0.218
180°	0.123	0.641	0.404	0.001
240°	0.242	0.293	0.300	0.195
300°	0.088	0.282	0.347	0.197

Source: appendix “Multi-view robust attack.” The reported overall normal-paint AP is 0.618; per-position clean baselines are not supplied, so these values do not measure position-matched degradation.

02 / Simple defenses

Smoothing and compression leave a substantial gap.

Across the tested settings, the difference between normal and attacked mAP remains 0.329–0.507. Input smoothing at σ = 2.0 raises attacked mAP to 0.283, but does not close the gap. Strong BEV feature smoothing also reduces clean performance.

Compare all defense settings Normal vs. attacked mAP

Simple defenses · BEVFormer-base mAP, as reported in the appendix
Defense	Setting	Normal	BEVCA	Gap
No defense	—	0.618	0.191	0.427
BEV feature smoothing	σ = 0.5	0.616	0.189	0.427
BEV feature smoothing	σ = 1.0	0.594	0.175	0.419
BEV feature smoothing	σ = 2.0	0.482	0.121	0.361
Input smoothing	σ = 0.5	0.617	0.171	0.446
Input smoothing	σ = 1.0	0.614	0.165	0.449
Input smoothing	σ = 2.0	0.612	0.283	0.329
JPEG compression	QF = 75	0.615	0.150	0.465
JPEG compression	QF = 50	0.620	0.136	0.484
JPEG compression	QF = 25	0.620	0.113	0.507

Gap = normal mAP − BEVCA mAP. Higher attacked mAP indicates better perception under attack. JPEG compression lowers attacked mAP in the reported results; it does not show recovery. Source: appendix “Robustness Against Simple Defenses.”

03 / Adversarial training

Use the exposed vulnerability to improve perception.

The authors fine-tune models on 500 adversarial samples collected with camera configurations different from the test set. Every listed model improves relative to its attacked baseline, although the degree of recovery varies.

BEVFormer-base · vehicle AP0.191 → 0.615

Normal-paint reference: 0.618

CVT · vehicle IoU0.307 → 0.567

Normal-paint reference: 0.609

View recovery across all eight models Vehicle AP / IoU ↑

Adversarial training · vehicle AP / IoU ↑
Model	Metric	Normal	Under attack	After training
BEVFormer-base	AP	0.618	0.191	0.615
BEVFormer-small	AP	0.721	0.285	0.479
BEVFormer-tiny	AP	0.514	0.381	0.416
Base-Seg-Det	AP	0.750	0.329	0.683
Small-Seg-Det	AP	0.634	0.331	0.599
LSS	IoU	0.509	0.253	0.614
CVT	IoU	0.609	0.307	0.567
SinBEVT	IoU	0.570	0.273	0.549

Source: appendix “Enhancing Model Robustness via Adversarial Training.” “Normal” is the original normal-paint reference; “After training” reports the adversarial-training evaluation.

07 / Citation

Build on this work.

If you find this research useful, please cite our paper.

BibTeX

@inproceedings{lyu2026bevca,
  title={Towards Effective and Transferable Physical Camouflage
         against Multi-View BEV-based 3D Perception
         in Autonomous Driving},
  author={Lyu, Linye and Zhou, Jiawei and He, Daojing and Li, Yu},
  booktitle={Advances in Neural Information Processing Systems},
  year={2026}
}