Paper deep dive
TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
Haibo Hu, Jianghuai Deng, Chen Tang, Yang Lou, Qian Xu, Jianping Wang
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.
Tags
Links
- Source: https://arxiv.org/abs/2608.04453v1
- Canonical: https://arxiv.org/abs/2608.04453v1
PDF not stored locally. Use the link above to view on the source site.
Full Text
58,181 characters extracted from source content.
Expand or collapse full text
TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction Haibo Hu1 Jianghuai Deng1 Chen Tang1 Yang Lou1 Qian Xu1 Jianping Wang1 1City University of Hong Kong Equal contributionCorresponding author: yanglou-c@my.cityu.edu.hk Abstract Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18–8.96 percentage points under RSA and 2.84–5.62 points under ETA, while increasing the unreachable-goal rate by 25–28 points and the unsafe-planned-trajectory rate by 19–20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views. Introduction High-definition (HD) maps encode lane boundaries, dividers, pedestrian crossings, and other static road structures that support autonomous-driving prediction and planning (Li et al. 2022; Liao et al. 2025). Unlike traditional offline construction, which requires large-scale data collection, manual annotation, and continuous maintenance, online HD map construction predicts local vectorized maps directly from onboard observations (Li et al. 2022; Liu et al. 2023). Recent models improve map consistency by aggregating structured point sets, geometric relations, and temporal context (Liao et al. 2023, 2025; Yuan et al. 2024; Chen et al. 2024).Beyond point-set representations, recent online mapping methods have explored piecewise curve and pivotal-point parameterizations to improve compactness and geometric precision (Qiao et al. 2023b; Ding et al. 2023). Because their predictions directly guide motion planning, errors induced by physical interference can propagate to safety-critical driving decisions (Hu et al. 2022, 2023; Jiang et al. 2023). Figure 1: Objective-specific boundary roles. In both panels, road-b is the target boundary. Despite the rapid progress of online HD map construction, its security under physical-world interference remains insufficiently understood. Physical adversarial attacks have been studied across image classification, object detection, LiDAR perception, and BEV-based autonomous-driving systems, with recent work emphasizing that digital attack effectiveness does not necessarily translate into physical or driving-level impact (Eykholt et al. 2018; Tu et al. 2020; Zhu et al. 2023; Hingun et al. 2023; Wang et al. 2023). More recently, the first systematic security analysis of online HD map construction reveals a bias toward symmetric predictions in asymmetric road scenes (Lou et al. 2025). At a fork, disrupting geometric cues near the turn can cause a diverging boundary to be predicted as straight, thereby converting an asymmetric fork into a symmetric road structure. Based on this bias, the work introduces a single-position blinding attack and an adversarial-patch attack, including the Road Straightening Attack (RSA), which removes a predicted turn, and the Early Turn Attack (ETA), which shifts the predicted turn toward the ego vehicle. As illustrated in Fig. 1, these map errors can further propagate to motion planning. However, in some scenes, the single-point design leaves complementary boundary cues intact, allowing the model to preserve or recover the original road geometry. Our analysis of unsuccessful cases explains why searching additional candidate positions does not always improve a single-point attack. We call the boundary whose prediction the attacker seeks to change the target boundary. Prior work uses reference boundary for a non-target boundary that provides contextual cues to this prediction. We refine this relation by function: a guiding boundary supports the desired deformation, whereas a compensation boundary preserves the original geometry (Fig. 1). If an attack position perturbs the target boundary but leaves the compensation boundary visible, the model can recover the original turn; we call this behavior the cross-boundary compensation effect. This observation indicates that a reliable attack may require coordinated interference at both the target and compensation boundaries, rather than repeatedly searching for a stronger single-point perturbation. However, such multi-point attacks introduce a practical challenge: deploying multiple visible flashlights or adversarial patches increases the number of physical sources and makes the attack substantially more conspicuous. To preserve the effectiveness of coordinated interference while reducing visual exposure, we explore near-infrared illumination, which is weakly perceived by humans but remains detectable by camera sensors (Wang et al. 2021; Sato et al. 2024). We propose TwinIR, a mechanism-guided, at-most-two-point attack framework. Its objective-conditioned attack-position localization first identifies an attack position on the target boundary and retains a second position on the compensation boundary only when it provides additional attack benefit, while keeping the guiding boundary visible. Its near-infrared realization simulates the camera response during digital search and transfers the retained attack positions to feasible roadside deployment locations using ego-relative coordinates. We evaluate TwinIR on the nuScenes asymmetric-scene subset against MapTR, MGMap, and DAMap under the same query budget as the single-point attack. Compared with clean inputs, TwinIR reduces mAP by 8.18–8.96 percentage points under RSA and by 2.84–5.62 points under ETA. It also increases the unreachable-goal rate by 11–12 points and the unsafe planned trajectory rate by 3–8 points over the single-point attack. In a controlled physical comparison, the near-infrared source produces a clear response in an infrared-sensitive camera with little visible change in full-color views. Our main contributions are summarized as follows: • We identify the cross-boundary compensation effect: existing attacks on online map construction can fail because an unaffected compensation boundary preserves the original road geometry after a single-point attack. • We propose TwinIR, a mechanism-guided attack framework that uses at most two attack positions. TwinIR first localizes an attack position on the target boundary and conditionally retains a second attack position on the objective-specific compensation boundary only when it improves the attack, while keeping the guiding boundary visible. The selected positions are realized using near-infrared illumination to minimize visible-spectrum changes. • We evaluate TwinIR against state-of-the-art online map construction models on the nuScenes dataset and in real-world physical experiments. TwinIR consistently causes greater map deformation and downstream planning disruption than single-point blinding while remaining visually covert. Motivation Study: Cross-Boundary Compensation In some asymmetric road scenes, a single attack point cannot reliably induce the intended map deformation. Although the local turning region is perturbed, other visible boundaries may still preserve sufficient geometric cues for the model to reconstruct the original road structure. This suggests that single-point attacks do not consistently suppress all evidence supporting the target prediction. Why Single-Point Attacks Fail Figure 2 shows a representative failure. The blinding position perturbs one side of the turning road, yet the predicted map still preserves the original turn. Figure 2: A representative failure of a single-point attack. Although the perturbation affects one side of the turning road, the model preserves the original turn using geometric cues from another visible boundary. Across this case and other failures, we observe a recurring pattern: the perturbation removes local cues from the attacked boundary, but a spatially separated boundary remains visible and preserves the curvature or turning-location cues needed to reconstruct the original geometry. Because a single attack position cannot cover both regions, searching additional candidate positions under the same one-point constraint cannot eliminate these residual cues. We refer to the road boundary whose prediction the attacker seeks to alter as the target boundary. Prior work uses the term reference boundary for a non-target boundary that provides contextual cues for predicting the target (Lou et al. 2025). We further distinguish two roles among such boundaries: • A guiding boundary provides geometric cues consistent with the intended deformation and should remain visible. • A compensation boundary provides geometric cues from which the model can reconstruct the original geometry and is therefore a candidate for additional perturbation. In Fig. 2, although the target boundary is perturbed, a visible compensation boundary enables the model to recover the original turn. We call this behavior the cross-boundary compensation effect. It explains why optimizing a single attack position is insufficient when the cues preserving the original prediction lie on another boundary. To examine whether the single-point limitation has a measurable downstream impact, we compare the planning results of single- and dual-point attacks averaged across three victim models. As shown in Table 1, the dual-point variant increases UGR from 41.67% to 53.00% for RSA and UPTR from 26.00% to 31.67% for ETA. These consistent gains indicate that suppressing an additional reference boundary enables more reliable targeted map deformation. Objective Single Point Dual Point Gain (p) RSA (UGR ↑ ) 41.67 53.00 +11.33 ETA (UPTR ↑ ) 26.00 31.67 +5.67 Table 1: Motivating comparison of single- and dual-point attacks. From Cross-Boundary Compensation to Sparse Multi-Point Attacks The cross-boundary compensation effect shifts the attack objective from finding the strongest single position to identifying a small set of positions that suppresses the cues preserving the original geometry. Since each physical source increases deployment cost and visibility, TwinIR adopts a sparse two-point design: it perturbs the target boundary and adds a second point on the compensation boundary only when this further improves the attack, while preserving the guiding boundary. Figure 1 shows how these roles differ across objectives. • RSA. In Fig. 1(a), road-b is the target, curved road-c is the compensation boundary, and straight road-a is the guiding boundary. TwinIR perturbs road-b and road-c while leaving road-a visible to support straightening. • ETA. In Fig. 1(b), road-b is the target, straight road-a is the compensation boundary, and post-turn road-c is the guiding boundary. TwinIR perturbs road-b and road-a while preserving road-c to encourage an earlier turn. Threat Model We adopt the roadside physical scenario. A victim autonomous vehicle approaches an asymmetric road scene, such as a fork or turn, and constructs a local vectorized map from six surround-view cameras. Before the vehicle arrives, the attacker places near-infrared sources at feasible roadside locations with a line of sight to the cameras observing the relevant road boundaries. Problem Formulation and Attack Objectives Problem Formulation Given the multi-view observations ℐ=Icc=1CI=\I^c\_c=1^C, where C=6C=6 in our setting, the victim online map construction model M predicts a local vectorized map ℳ^=M(ℐ) M=M(I). Each map element is represented as an ordered set of bird’s-eye-view points. We consider a targeted attack against a selected road boundary rather than indiscriminately degrading the entire map. Attack Goals The attacker has two ordered objectives: first maximize the targeted map deformation and then minimize the number of attack positions needed to achieve it. For attack objective o, let P be a set of attack positions drawn from the feasible roadside region Ω , and let K be the maximum attack-position budget. Because TwinIR deploys one near-infrared source at each retained attack position, |||P| also equals the number of physical sources. We write ℐI_P for the camera observations after applying the perturbations at positions in P and formulate the problem as ∗=argmin⊆Ω,||≤Klex[ℒo(M(ℐ),T),||],P^*= *arg\,min^lex_P ,\ |P|≤ K [L_o\! (M(I_P),T ),|P| ], (1) where T is the desired boundary geometry and a smaller ℒoL_o denotes a stronger attack. The lexicographic order first minimizes the objective-specific attack loss and then prefers fewer attack positions among configurations with the same attack effect. TwinIR instantiates this formulation with K=2K=2: it first selects a primary attack position on the target boundary and retains a secondary attack position on the compensation boundary only when the two-point configuration further reduces the loss. We consider two targeted objectives. Road Straightening Attack (RSA) makes a curved boundary appear straight and can remove a valid turn from the predicted map. Early Turn Attack (ETA) shifts the predicted turn toward the ego vehicle and can move the planned trajectory across the actual road boundary. Attacker Capabilities and Constraints We follow the offline black-box setting and separate the attacker’s offline access from the constraints on physical deployment. Offline search. The attacker has no real-time access to the victim autonomous vehicle. Before deployment, the attacker has pre-collected sensor data from the target scene and obtains the corresponding clean map prediction from the victim model. These observations and predictions are used to optimize the attack configuration. Black-box access. During offline search, the attacker can query the victim online map construction model with digitally perturbed observations and observe its predicted vectorized map. The attacker cannot access the model architecture, parameters, or gradients. Deployment constraints. Before the vehicle arrives, the attacker can place at most K near-infrared sources within the feasible roadside region Ω ; TwinIR uses K=2K=2. Each source must maintain a line of sight to the relevant onboard camera. The attacker cannot modify the vehicle, model, sensor firmware, communication pipeline, or road surface and has no real-time control over the vehicle. Method Figure 3: Physical basis of spectral stealthiness. Human photopic sensitivity drops sharply beyond the visible spectrum, while CMOS sensors remain sensitive to near-infrared light (700700–11001100nm). TwinIR consists of two components. Objective-conditioned attack-position localization solves the sparse attack-position optimization in Eq. 1: it determines attack positions that maximize the targeted map deformation and then minimizes the number of retained attack positions. Near-infrared realization reduces the visibility of multi-point interference by modeling its camera response during digital search and transferring the optimized attack positions to feasible roadside deployment positions. Figure 4 summarizes the attack pipeline. Figure 4: Overview of the TwinIR workflow. Objective-Conditioned Attack-Position Localization For each scene, TwinIR first assigns the relevant road boundaries to the target, compensation, and guiding roles. It then localizes a primary attack position on the target boundary and an optional secondary attack position on the compensation boundary. Boundary-role assignment. The attack objective and clean-map topology determine three boundary roles: the boundary to perturb, the boundary whose cues may restore the original geometry, and the boundary whose cues support the desired deformation. We denote them by BtgtB_tgt, BcmpoB_cmp^o, and BgoB_g^o, respectively. Curvature does not identify the target boundary; it only locates geometric segments after this assignment. Straight segments have near-zero discrete curvature, whereas a sustained rise marks the turn onset and the following nonzero-curvature segment forms the turning region. Together with connectivity, this profile distinguishes the straight, curved, and post-turn boundaries used below. For RSA, the opposite-side straight boundary is the guiding boundary, while the paired curved boundary is the compensation boundary. For ETA, the farther post-turn boundary is the guiding boundary, while the opposite-side straight boundary is the compensation boundary. Algorithm 1 Sequential Objective-Conditioned Attack-Position Selection 0: Images ℐI, victim model M, target boundary BtgtB_tgt, compensation boundary BcmpoB_cmp^o, target specification T, objective o∈RSA,ETAo∈\RSA,ETA\ 0: Selected attack positions ∗P^* 1: 1←VisibleSamples(Btgt)C_1 (B_tgt) 2: p1∗←argminp∈1ℒo(M(IR(ℐ;p)),T)p_1^*← *arg\,min_p _1L_o(M(T_IR(I;p)),T) 3: ℐ1←IR(ℐ;p1∗)I_1 _IR(I;p_1^*), ℒ1←ℒo(M(ℐ1),T)L_1 _o(M(I_1),T) 4: if o=RSAo=RSA then 5: 2←RSACompensationCandidates(Bcmpo,p1∗)C_2 (B_cmp^o,p_1^*) 6: else 7: 2←UniformSample(StraightSegment(Bcmpo))C_2 (StraightSegment(B_cmp^o)) 8: end if 9: if 2=∅C_2= then 10: return p1∗\p_1^*\ 11: end if 12: p2∗←argminp∈2ℒo(M(IR(ℐ1;p)),T)p_2^*← *arg\,min_p _2L_o(M(T_IR(I_1;p)),T) 13: ℒ2←ℒo(M(IR(ℐ1;p2∗)),T)L_2 _o(M(T_IR(I_1;p_2^*)),T) 14: if ℒ2<ℒ1L_2<L_1 then 15: return p1∗,p2∗\p_1^*,p_2^*\ 16: else 17: return p1∗\p_1^*\ 18: end if Attack-loss construction. After assigning the boundary roles, we construct the target specification and attack loss used to rank both primary and secondary candidates. Let B B denote the predicted target boundary under a candidate perturbation. • RSA. We construct a straightened target TRSAT_RSA that preserves BtgtB_tgt up to the turn onset and then follows the straight guiding boundary shifted by the average road width. The loss is the Chamfer distance between the attacked prediction and this target: ℒRSA=ℒchamfer(B^,TRSA).L_RSA=L_chamfer ( B,T_RSA ). (2) • ETA. Let bib_i, cic_i, and b^i b_i, for i=1,…,Ni=1,…,N, be corresponding points on the clean target boundary, its adjacent lane centerline, and the attacked prediction. The outward direction and displacement are i=(bi−ci)/‖bi−ci‖2d_i=(b_i-c_i)/\|b_i-c_i\|_2 and Δi=(b^i−bi)⊤i _i=( b_i-b_i) d_i. The directional loss rewards displacement toward the roadside and penalizes displacement toward the drivable area: ℒETA=1N∑i=1N[−λoutReLU(Δi)+λinReLU(−Δi)].L_ETA= 1N _i=1^N [- _out\,ReLU( _i)+ _in\,ReLU(- _i) ]. (3) Here, λout _out and λin _in balance the outward reward and inward penalty. In the following, ℒoL_o denotes the corresponding loss for objective o∈RSA,ETAo∈\RSA,ETA\. We formulate dual-point localization as a sequential black-box search. For each candidate position, we render the infrared marker, query the victim model, and evaluate the objective-specific loss ℒoL_o, which measures the distance to the desired straightened boundary for RSA and the displacement of the turning position for ETA. The primary point p1∗p_1^* is selected by enumerating the top-K1K_1 visibility-ranked candidates along the target boundary. After fixing p1∗p_1^*, we construct an objective-conditioned secondary candidate set: RSA samples nearby positions on the compensation boundary with similar curvature, whereas ETA samples the straight segment of its reference boundary. The secondary point p2∗p_2^* is then selected by directly evaluating the joint dual-point attack loss, and is retained only when it improves over the single-point result. Primary attack-position localization. We sample camera-visible candidates 1C_1 along the target boundary and query the victim model after rendering each candidate. The primary attack position is the candidate that minimizes the objective-specific loss: p1∗=argminp∈1ℒo(M(IR(ℐ;p))).p_1^*= *arg\,min_p _1L_o (M (T_IR(I;p) ) ). (4) We denote the resulting single-position loss by ℒ1L_1. Thus, the objective-specific loss selects the primary position over the target boundary rather than relying on a manually preferred region. Model Clean Blind (RSA) TwinIR (Ours) Δ mAP (p) Div. Ped. Bound. mAP Div. Ped. Bound. mAP Div. Ped. Bound. mAP Blind-Clean TwinIR-Clean MGMap 65.89 58.49 54.41 59.60 57.75 53.74 46.40 52.63 56.33 55.53 42.39 51.41 -6.97 -8.18 MapTR 54.18 38.17 48.95 47.10 44.12 36.06 40.16 40.11 42.77 34.15 37.51 38.14 -6.99 -8.96 DAMap 69.66 59.13 53.30 60.69 61.64 55.58 45.34 54.18 60.14 53.61 42.08 51.94 -6.51 -8.75 Table 2: Map element AP(%) under RSA attacks on asymmetric scenes. Div.=divider, Ped.=ped_crossing, Bound.=boundary. Δ mAP is computed in percentage points (p) w.r.t. Clean. Model UGRc Blind (UGRc) TwinIR (Ours) MGMap 26.0 40.0 51.0 MapTR 27.0 44.0 55.0 DAMap 26.0 41.0 53.0 Table 3: Planning impact of RSA on asymmetric scenes, measured by unreachable goal rate (UGR, %). UGRc denotes the clean setting. Secondary attack-position localization. With p1∗p_1^* fixed, this step searches the compensation boundary for the secondary attack position p2∗p_2^* that minimizes the attack loss when combined with p1∗p_1^*. It locates the best secondary candidate but does not yet decide whether a second position is necessary. • RSA. We search the curved compensation boundary for a candidate position that is spatially separated from p1∗p_1^* but has curvature similar to the primary region. Separation avoids repeatedly perturbing the same local region, while curvature similarity focuses the search on cues that can restore the original turn. • ETA. We search the straight segment of the compensation boundary. Perturbing this segment together with the target boundary’s turning region weakens the cues that anchor the original turning position, while the farther post-turn guiding boundary remains visible. Conditional secondary-position selection. Secondary attack-position localization produces the strongest two-point candidate, whereas this final step determines whether it justifies an additional physical position. Let ℒ2L_2 denote the loss obtained by adding p2∗p_2^* to the primary perturbation. If ℒ2≥ℒ1L_2 _1, the secondary attack position is discarded; otherwise, the stronger two-point configuration is retained. This decision implements the lexicographic objective over k∈1,2k∈\1,2\. Algorithm 1 summarizes the procedure. Near-infrared realization Multiple visible-light sources would make the dual-point attack conspicuous. TwinIR therefore uses near-infrared illumination, which is less perceptible to humans but remains detectable by vehicle cameras (Fig. 3). Candidate positions are first evaluated through digital rendering and then mapped to ego-relative physical locations. Digital infrared rendering. For a candidate point projected to image position u, we synthesize a white core with a Gaussian-blurred purple halo. The resulting infrared attack spot is (;u,d)=αD(;u,d)w+βH(;u,d)p,A(x;u,d)=α D(x;u,d)c_w+β H(x;u,d)c_p, (5) where D is a distance-dependent white disk, H is its Gaussian-blurred halo, and wc_w and pc_p denote the white and purple color components, respectively. Ego-relative physical deployment The digital search returns one or two attack positions ∗P^* in the ego-centered BEV frame. Given the ego pose (xe,ye,θe)(x_e,y_e, _e), each selected point pi∗p_i^* is transformed to the physical test field by piw=R(θe)pi∗+[xeye],p_i^w=R( _e)p_i^*+ bmatrixx_e\\ y_e bmatrix, (6) where R(θe)R( _e) is the 2D rotation matrix of the ego heading. For each transformed point, we choose the nearest feasible deployment position in Ωphy _phy, place a near-infrared emitter, and activate all selected emitters simultaneously. The attacked scene is then captured by the same surround-view cameras and processed by the online map model used in digital evaluation. All tests are conducted in a closed field under safety supervision. Experiments Model Clean Blind (ETA) TwinIR (Ours) Δ mAP (p) Div. Ped. Bound. mAP Div. Ped. Bound. mAP Div. Ped. Bound. mAP Blind-Clean TwinIR-Clean MGMap 65.89 58.49 54.41 59.60 67.20 58.12 51.05 58.79 65.59 54.82 49.86 56.76 -0.81 -2.84 MapTR 54.18 38.17 48.95 47.10 52.39 34.54 46.35 44.43 51.44 30.77 44.01 42.08 -2.67 -5.02 DAMap 69.66 59.13 53.30 60.69 65.58 56.41 48.55 56.85 64.43 53.64 47.15 55.07 -3.85 -5.62 Table 4: Map element AP(%) under ETA attacks on asymmetric scenes. Model UPTRc Blind (ETA) TwinIR (Ours) MGMap 13.0 26.0 32.0 MapTR 10.0 27.0 30.0 DAMap 14.0 25.0 33.0 Table 5: Planning impact of ETA on asymmetric scenes, measured by unsafe planned trajectory rate (UPTR, %). UPTRc denotes the clean setting. Experimental Setup Dataset and models. We evaluate our attack on the nuScenes dataset (Caesar et al. 2020) using the same asymmetric-scene subset selected by prior work (Lou et al. 2025). The subset contains 100 frames chosen from 407 asymmetric scenes identified in the nuScenes validation set. We evaluate three camera-based online HD map models: MapTR (Liao et al. 2023), MGMap (Liu et al. 2024), and DAMap (Dong et al. 2025). All models are tested on the same scenes and target boundaries. Detailed information about the hardware, vehicle platform, and other results is provided in the technical supplement. Attack settings. For each model, we compare the clean input, the original single-point attack, and TwinIR, which selects up to two attack positions. All methods use the same candidate regions, attack targets, and query budget. Metrics. For map construction, we report APboundaryAP_boundary, APdividerAP_divider, APpedAP_ped, and their mean mAP. For downstream planning, we report Unreachable Goal Rate (UGR) for RSA and Unsafe Planned Trajectory Rate (UPTR) for ETA. Higher UGR and UPTR indicate stronger attack impact. Main Results on RSA Table 2 reports the RSA results. TwinIR consistently causes a larger mAP reduction than the single-point blinding attack across all three models. The mAP drops by 8.18, 8.96, and 8.75 percentage points on MGMap, MapTR, and DAMap, respectively, compared with 6.97, 6.99, and 6.51 points under Blind. This corresponds to an additional reduction of 1.21–2.24 points, consistent with suppressing compensation-boundary cues that remain after single-point perturbation. The strongest degradation appears in road-boundary prediction, whose AP decreases by 12.02, 11.44, and 11.22 points from the clean setting on the three models. TwinIR also affects divider and pedestrian-crossing predictions, suggesting that the induced boundary deformation propagates to related map elements.As shown in Table 3, TwinIR increases UGR to 51%, 55%, and 53% on MGMap, MapTR, and DAMap, respectively, exceeding Blind by 11–12 percentage points. Thus, the stronger map deformation directly increases the likelihood that valid planning goals become unreachable. Main Results on ETA Table 4 reports the ETA results. TwinIR consistently causes a larger mAP reduction than single-point blinding across all three models. The mAP drops by 2.84, 5.02, and 5.62 percentage points on MGMap, MapTR, and DAMap, respectively, compared with 0.81, 2.67, and 3.85 points under Blind. This corresponds to an additional reduction of 1.78–2.35 points. The strongest degradation appears in road-boundary prediction, whose AP decreases by 4.55, 4.94, and 6.15 points from the clean setting. This shows that perturbing both the target boundary and the straight compensation boundary is more effective than attacking only the original turning region. As shown in Table 5, TwinIR raises UPTR to 32%, 30%, and 33% on MGMap, MapTR, and DAMap, exceeding Blind by 3–8 percentage points. These results also show that a moderate mAP reduction can still produce a substantial increase in unsafe trajectories. Physical-World Infrared Visibility Figure 5: Real-world visibility of infrared interference. (a) The attacked vehicle in a full-color image shows little visible change. (b) The infrared-sensitive camera clearly captures the attack response. (c) The unattacked infrared image serves as the clean baseline. We first examine whether the infrared attack remains inconspicuous in visible images while producing a clear camera response. Figure 5 compares the same vehicle under three imaging conditions. As shown in Fig. 5(a), activating the infrared source causes little visible change in the full-color image. In contrast, the infrared-sensitive camera clearly captures the injected response in Fig. 5(b). Figure 5(c) shows the clean infrared baseline without attack activation. Comparing (b) with (c) confirms that the additional artifact is introduced by the infrared source, while comparing (a) with (b) demonstrates its limited visible-domain appearance. Figure 6: Visualization results of TwinIR in nuScenes. Compared with single-point blinding, our dual-point attack successfully achieves the target deformation for both RSA (left) and ETA (right). Visualization Results Figure 6 presents representative visualization results of our dual-point attack. The left example corresponds to RSA, where the original single-point blinding attack fails to fully remove the turning structure, while our dual-point attack successfully suppresses the complementary boundary evidence and induces the desired straightening effect. The right example corresponds to ETA, where Blind cannot move the turn sufficiently early, but our method further perturbs the reference boundary and successfully shifts the predicted turn toward the ego vehicle. These examples directly mirror the failure cases in the motivation section and show that the secondary attack position effectively improves attack coverage by removing alternative geometric cues used by the model. Figure 7: Controlled physical-world results of TwinIR. From top to bottom: clean input, RSA, and ETA. The six surround-view camera images are shown on the left, and the corresponding online map predictions are shown on the right. Controlled Physical-World Evaluation We further evaluate TwinIR on a real vehicle in a controlled test field. Figure 7 presents the six surround-view camera images and the corresponding online map predictions under the clean, RSA, and ETA settings. The clean scene produces the original road geometry. Under RSA, the infrared interference alters the target boundary and makes the predicted road structure straighter. Under ETA, the predicted turning location is shifted toward the ego vehicle. The infrared responses are clearly captured by the onboard cameras at the ego-relative positions selected during digital optimization. The resulting deformations are also consistent with the corresponding digital attack objectives. Moreover, the attack remains effective after transferring the optimized positions from the digital scene to the physical test field. This indicates that the selected point pairs are not limited to simulation-specific image patterns. These results demonstrate that the digitally selected dual-point positions can be transferred to the physical environment and induce the intended map deformations. References H. Caesar, V. Bankiti, A. H. Lang, S. Vora, V. E. Liong, Q. Xu, A. Krishnan, Y. Pan, G. Baldan, and O. Beijbom (2020) nuScenes: a multimodal dataset for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 11621–11631. Cited by: Dataset and models.. Y. Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li (2021) Invisible for both camera and LiDAR: security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In 2021 IEEE Symposium on Security and Privacy, p. 176–194. External Links: Document Cited by: Appendix A. J. Chen, Y. Wu, J. Tan, H. Ma, and Y. Furukawa (2024) MapTracker: tracking with strided memory fusion for consistent vector HD mapping. In European Conference on Computer Vision, p. 90–107. Cited by: Appendix A, Introduction. W. Ding, L. Qiao, X. Qiu, and C. Zhang (2023) PivotNet: vectorized pivot learning for end-to-end HD map construction. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 3672–3682. Cited by: Appendix A, Introduction. J. Dong, C. Li, Y. Lin, J. Fu, S. Zhou, and N. Zheng (2025) DAMap: distance-aware mapnet for high quality HD map construction. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 5285–5294. Cited by: 2nd item, Dataset and models.. K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song (2018) Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, p. 1625–1634. External Links: Document Cited by: Appendix A, Introduction. R. S. Hallyburton, Y. Liu, Y. Cao, Z. M. Mao, and M. Pajic (2022) Security analysis of Camera-LiDAR fusion against black-box attacks on autonomous vehicles. In 31st USENIX Security Symposium, p. 1903–1920. Cited by: Appendix A. N. Hingun, C. Sitawarin, J. Li, and D. Wagner (2023) REAP: a large-scale realistic adversarial patch benchmark. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 4640–4651. Cited by: Introduction. S. Hu, L. Chen, P. Wu, H. Li, J. Yan, and D. Tao (2022) St-p3: end-to-end vision-based autonomous driving via spatial-temporal feature learning. In European Conference on Computer Vision, p. 533–549. Cited by: Introduction. Y. Hu, J. Yang, L. Chen, K. Li, C. Sima, X. Zhu, S. Chai, S. Du, T. Lin, W. Wang, et al. (2023) Planning-oriented autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 17853–17862. Cited by: Introduction. B. Jiang, S. Chen, Q. Xu, B. Liao, J. Chen, H. Zhou, Q. Zhang, W. Liu, C. Huang, and X. Wang (2023) Vad: vectorized scene representation for efficient autonomous driving. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 8340–8350. Cited by: Introduction. P. Jing, Q. Tang, Y. Du, L. Xue, X. Luo, T. Wang, S. Nie, and S. Wu (2021) Too good to be safe: tricking lane detection in autonomous driving with crafted perturbations. In 30th USENIX Security Symposium, p. 3237–3254. Cited by: Appendix A. Q. Li, Y. Wang, Y. Wang, and H. Zhao (2022) HDMapNet: an online HD map construction and evaluation framework. In Proceedings of the IEEE International Conference on Robotics and Automation, p. 4628–4634. External Links: Document Cited by: Appendix A, Introduction. T. Li, P. Jia, B. Wang, L. Chen, K. Jiang, J. Yan, and H. Li (2024) LaneSegNet: map learning with lane segment perception for autonomous driving. In International Conference on Learning Representations, Cited by: Appendix A. B. Liao, S. Chen, X. Wang, T. Cheng, Q. Zhang, W. Liu, and C. Huang (2023) MapTR: structured modeling and learning for online vectorized HD map construction. In International Conference on Learning Representations, Cited by: Appendix A, 1st item, Introduction, Dataset and models.. B. Liao, S. Chen, Y. Zhang, B. Jiang, Q. Zhang, W. Liu, C. Huang, and X. Wang (2025) MapTRv2: an end-to-end framework for online vectorized HD map construction. International Journal of Computer Vision 133, p. 1352–1374. External Links: Document Cited by: Appendix A, Introduction. X. Liu, S. Wang, W. Li, R. Yang, J. Chen, and J. Zhu (2024) MGMap: mask-guided learning for online vectorized HD map construction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 14812–14821. Cited by: 3rd item, Dataset and models.. Y. Liu, T. Yuan, Y. Wang, Y. Wang, and H. Zhao (2023) VectorMapNet: end-to-end vectorized HD map learning. In Proceedings of the 40th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 202, p. 22352–22369. Cited by: Appendix A, Introduction. Y. Lou, H. Hu, Q. Song, Q. Xu, Y. Zhu, R. Tan, W. Lee, and J. Wang (2025) Asymmetry vulnerability and physical attacks on online map construction for autonomous driving. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, p. 3251–3265. External Links: Document Cited by: Appendix A, Introduction, Why Single-Point Attacks Fail, Dataset and models.. L. Qiao, W. Ding, X. Qiu, and C. Zhang (2023a) End-to-end vectorized HD-map construction with piecewise bézier curve. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 13218–13228. Cited by: Appendix A. L. Qiao, W. Ding, X. Qiu, and C. Zhang (2023b) End-to-end vectorized hd-map construction with piecewise bezier curve. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 13218–13228. Cited by: Introduction. T. Sato, S. H. V. Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi (2024) Invisible reflections: leveraging infrared laser reflections to target traffic sign perception. In Network and Distributed System Security Symposium, External Links: Document Cited by: Introduction. T. Sato, J. Shen, N. Wang, Y. Jia, X. Lin, and Q. A. Chen (2021) Dirty road can attack: security of deep learning based automated lane centering under physical-world attack. In 30th USENIX Security Symposium, p. 3309–3326. Cited by: Appendix A. J. Sun, Y. Cao, Q. A. Chen, and Z. M. Mao (2020) Towards robust LiDAR-based perception in autonomous driving: general black-box adversarial sensor attack and countermeasures. In 29th USENIX Security Symposium, p. 877–894. Cited by: Appendix A. J. Tu, M. Ren, S. Manivasagam, M. Liang, B. Yang, R. Du, F. Cheng, and R. Urtasun (2020) Physically realizable adversarial examples for LiDAR object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 13716–13725. External Links: Document Cited by: Appendix A, Introduction. C. Wang, R. Song, R. Muller, J. Monteuuis, J. Petit, Z. B. Celik, R. Gerdes, and M. F. Li (2026) Systematic discovery of semantic attacks in online map construction through conditional diffusion. arXiv preprint arXiv:2605.14396. External Links: 2605.14396 Cited by: Appendix A. N. Wang, Y. Luo, T. Sato, K. Xu, and Q. A. Chen (2023) Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack. In Proceedings of the IEEE/CVF international conference on computer vision, p. 4412–4423. Cited by: Introduction. W. Wang, Y. Yao, X. Liu, X. Li, P. Hao, and T. Zhu (2021) I can see the light: attacks on autonomous vehicles using invisible lights. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, p. 1930–1944. External Links: Document Cited by: Introduction. T. Yuan, Y. Liu, Y. Wang, Y. Wang, and H. Zhao (2024) StreamMapNet: streaming mapping network for vectorized online HD map construction. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 7356–7365. External Links: Document Cited by: Appendix A, Introduction. Z. Zhang, Y. Zhang, X. Ding, F. Jin, and X. Yue (2024) Online vectorized HD map construction using geometry. In European Conference on Computer Vision, p. 73–90. External Links: Document Cited by: Appendix A. Z. Zhu, Y. Zhang, H. Chen, Y. Dong, S. Zhao, W. Ding, J. Zhong, and S. Zheng (2023) Understanding the robustness of 3d object detection with bird’s-eye-view representations in autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 21600–21610. Cited by: Introduction. Appendix A Related Work Online Vectorized HD Map Construction Online HD map construction predicts local road maps directly from onboard sensor observations. Early approaches, such as HDMapNet, first generate bird’s-eye-view semantic maps and then convert them into vectorized elements through post-processing (Li et al. 2022). More recent methods perform end-to-end vectorized prediction. VectorMapNet autoregressively generates map-element polylines (Liu et al. 2023), while MapTR and MapTRv2 represent each element as a structured point set and jointly learn instance- and point-level correspondences (Liao et al. 2023, 2025). Other approaches introduce stronger geometric and structural priors, including B’ezier-curve representations (Qiao et al. 2023a), pivotal-point modeling (Ding et al. 2023), geometry-aware relation learning (Zhang et al. 2024), and lane-segment representations that combine paired boundaries, centerlines, and topology (Li et al. 2024). Temporal methods further exploit historical observations to improve mapping consistency. StreamMapNet propagates map queries across frames (Yuan et al. 2024), while MapTracker maintains temporal memories of map elements (Chen et al. 2024). Although these methods improve robustness to occlusion and incomplete observations, their reliance on paired boundaries, geometric relations, and temporal context also enables a corrupted map element to be reconstructed from residual geometric cues. Our work investigates how such structural dependencies affect the effectiveness of physical attacks. Adversarial Attacks on Autonomous Driving Physical-world adversarial attacks have been extensively studied for autonomous-driving perception. Adversarial stickers can manipulate traffic-sign recognition (Eykholt et al. 2018), road-surface perturbations can mislead lane-detection and lane-centering systems (Jing et al. 2021; Sato et al. 2021), and adversarial objects or spoofed signals can compromise LiDAR-based detectors (Tu et al. 2020; Sun et al. 2020). Multi-sensor fusion systems are also vulnerable when attacks preserve consistency across camera and LiDAR observations (Cao et al. 2021; Hallyburton et al. 2022). Attacks on Online HD Map Construction Lou et al. identify a symmetry bias in online HD map construction: when critical geometric cues in an asymmetric scene are disrupted, the prediction may follow cues from an opposite or reference boundary (Lou et al. 2025). They exploit this bias with camera blinding and adversarial patches placed at a single optimized position. Wang et al. propose MIRAGE, which uses conditional diffusion to discover plausible semantic variations, such as shadows and wet roads, that preserve road topology while inducing boundary removal or injection (Wang et al. 2026). These studies expose complementary threats, but they do not examine coordinated multi-point physical illumination. Building on the observation that one boundary can influence another, we analyze unsuccessful single-point attacks and find that the same cross-boundary dependence can preserve the correct geometry: an unaffected compensation boundary retains geometric cues for the original turn and compensates for the perturbed region. TwinIR therefore perturbs the target boundary and conditionally suppresses the compensation boundary with objective-conditioned two-point near-infrared illumination while preserving the guiding boundary. Appendix B Hardware for Controlled Physical Experiments This section describes the hardware used in the controlled physical experiments. The setup consisted of a test vehicle equipped with six surround-view cameras, auxiliary obstacle-detection sensors, and one or two near-infrared laser emitters powered independently of the vehicle. All tests were conducted in a restricted test field without public-road traffic or uninvolved road users. Test Vehicle and Camera System The test vehicle comprised a TongLing W102 drive-by-wire chassis and an in-house-fabricated upper structure. The vehicle platform was capable of autonomous driving, although its speed did not exceed 10kmh−110\,km\,h^-1 during the experiments. The platform used six LRCP10620 USB cameras, supplied by a third-party vendor and equipped with Sony 1/2.71/2.7-inch CMOS sensors, to collect the surround-view images evaluated by the online HD map construction system. The front and lateral cameras targeted in the physical experiments were mounted approximately 1.51.5 m above the ground. Each camera recorded 640×480640× 480 8-bit images at 10 frames per second. The pixel size was 3.0μm×3.0μm3.0\, × 3.0\, , the signal-to-noise ratio was 39 dB, and the dynamic range was 69 dB. The nominal fields of view were 75∘75 for the front and lateral cameras and 100∘100 for the rear cameras. All cameras used rolling shutters with automatic exposure and gain control. No IR-cut filter was installed; therefore, the observed near-infrared response arose from the native spectral sensitivity of the CMOS sensors. Onboard computing and data logging. The vehicle carried an industrial computer with an Intel Core i9-14900 CPU, an NVIDIA GeForce RTX 4060 Ti GPU, 32 GB of memory, and a 1-TB SATA solid-state drive. A separate 2-TB NVMe solid-state drive connected over PCIe 4.0 was used for sensor data collection and logging. During the experiments reported in this work, the onboard computer served only as a data-acquisition platform and was not used for model training, online model inference, or attack optimization. Auxiliary safety sensors. The vehicle was additionally equipped with one 32-channel RoboSense Helios 32 LiDAR, three 32-channel RoboSense RS-Bpearl blind-spot LiDARs, and 12 ultrasonic sensors. These sensors provided an auxiliary obstacle-detection safety layer. When the safety controller detected an obstacle in the vehicle’s direction of travel, it automatically issued an emergency-stop command to the drive-by-wire chassis to prevent a collision during the experiments. These auxiliary sensors were used solely for operational safety and were not used as inputs to the camera-based online HD map construction models evaluated in this work. Figure 8: Tested AV Near-Infrared Illumination System Each physical attack position was implemented using one OXlasers near-infrared laser-diode emitter. Each emitter had a center wavelength of 808 nm and a manufacturer-rated optical power of 500 mW; the emitted optical power was not independently measured. Each emitter was driven through a 0–5-V pulse-width-modulation (PWM) interface supporting frequencies below 18 kHz. During the attacked recordings, the duty cycle was set to 100%, yielding effectively continuous output at the maximum configured level. Therefore, phase synchronization with the cameras was unnecessary. The spot diameter was approximately 30 cm at a source-to-target distance of 10 m. Each emitter was mounted on a hydraulic tripod at approximately 0.35 m above the ground, and the source-to-target distance ranged from 3 to 10 m. One emitter was used for a retained one-point configuration, whereas two identical emitters were activated simultaneously for a retained two-point TwinIR configuration. The emitters were powered independently of the test vehicle using a portable power station. Each laser unit incorporated separate power-on and operating-status indicators. The wiring harness remained physically disconnected until the system was ready for controlled activation. Infrared alignment and observation camera. During the controlled physical attacks, a separate USB 2.0 infrared camera was used to assist in aiming the laser emitters at the target regions and observing the resulting infrared response. The camera was fitted with an 800–950-nm band-pass filter to limit the detected spectrum primarily to the near-infrared range. This camera was used only as physical-attack instrumentation; it was not involved in model training or attack-position optimization and was not an input to the victim online HD map construction models. The visible-light image in Fig. 5(a) was captured using a consumer smartphone camera, whereas the attacked and clean infrared images in Figs. 5(b) and 5(c), respectively, were captured using this infrared camera. Figure 9: Attacking Component Deployment and Safety Protocol For each scene, we fixed the vehicle pose and transformed the retained ego-frame attack positions into the test-field coordinate system using the ego-to-world coordinate transformation described in the main paper. We then placed the emitters at the closest feasible deployment positions and oriented them toward the designated regions of the vehicle. Clean and attacked recordings used the same vehicle pose and camera configuration, with automatic exposure and gain control enabled under both conditions. For experimental safety management, the emitters were treated as Class 3B laser devices; this classification was not independently verified. The emitters were operated only within a restricted test area. Before power was applied, all participating personnel withdrew from the designated hazardous area and confirmed that it was clear. Consequently, no participating personnel were present in the beam path while the laser emitters were energized. After each recording, the emitters were de-energized before personnel re-entered the restricted area. Figure 10: Physical deployment of TwinIR, where the infrared device is concealed by roadside objects while maintaining a clear line of sight to the attacked vehicle. Stealthiness of Physical Deployment Figure 10 illustrates the physical deployment of TwinIR. To reduce visual exposure, the infrared device is placed behind existing roadside objects and vegetation, while only the emitter is directed toward the attacked vehicle. The attack point is deployed using a small roadside tripod at the optimized position, requiring no physical contact with or modification to the vehicle. From the vehicle and normal roadside viewing directions, most supporting hardware is therefore occluded by the surrounding environment. This setup demonstrates that TwinIR can be integrated into an ordinary roadside scene with limited visible infrastructure, while still maintaining a clear line of sight between the infrared emitter and the target cameras. Model #Points k Divider Ped. Bound. mAP MGMap 1 57.75 53.74 46.40 52.63 2 56.33 55.53 42.39 51.41 3 55.91 55.96 41.85 51.24 4 56.29 55.19 41.41 50.96 5 56.68 54.41 41.41 50.83 DAMap 1 61.64 55.58 45.34 54.18 2 60.14 53.61 42.08 51.94 3 60.61 52.56 42.06 51.74 4 61.25 51.84 41.73 51.61 5 60.19 51.38 42.14 51.24 MapTR 1 44.12 36.06 40.16 40.11 2 42.77 34.15 37.51 38.14 3 42.38 33.49 38.04 37.97 4 42.46 33.01 37.82 37.77 5 41.69 33.21 37.71 37.54 Table 6: Multi-point RSA attack. k denotes the number of light points. Values are AP(%) and mAP(%). Effect of the Number of Attack Points Tables 6 and 7 study the effect of increasing the number of infrared attack points from one to five. Across both objectives and all victim models, the largest marginal degradation is consistently obtained when increasing the number of points from one to two. Under RSA, adding the second point further reduces mAP by 1.22, 2.24, and 1.97 percentage points on MGMap, DAMap, and MapTR, respectively. In contrast, increasing the number of points from two to five provides only an additional reduction of 0.58–0.70 points. A similar trend is observed under ETA. The second attack point decreases mAP by 3.62 points on MGMap, 2.08 points on DAMap, and 1.42 points on MapTR. However, adding three more points after k=2k=2 reduces mAP by only 0.69–0.71 additional points. Therefore, although three to five points occasionally achieve slightly lower absolute mAP, their marginal benefits are substantially smaller than that of the second point. These results indicate that the attack effect becomes largely saturated after two points. The first point perturbs the target boundary, while the second suppresses the complementary geometric cues provided by the compensation boundary. Once these two major sources of road-geometry evidence are jointly disrupted, additional points mainly perturb overlapping local features and provide limited further benefit. The consistent saturation trend across different model architectures and attack objectives also suggests that this behavior is not specific to a single victim model. Considering that additional emitters increase deployment, calibration, and concealment costs, k=2k=2 provides the best trade-off between attack effectiveness and physical practicality. This observation supports the at-most-two-point design of TwinIR. Model #Points k Divider Ped. Bound. mAP MGMap 1 64.88 56.07 50.84 57.27 2 59.21 53.78 47.96 53.65 3 58.92 53.83 47.06 53.27 4 58.10 54.77 46.61 53.16 5 57.80 54.57 46.48 52.95 DAMap 1 64.80 55.49 47.83 56.04 2 63.68 51.80 46.39 53.96 3 64.11 51.86 45.50 53.82 4 62.89 51.67 45.82 53.46 5 63.42 51.24 45.09 53.25 MapTR 1 51.86 35.34 46.08 44.43 2 50.07 33.38 45.57 43.01 3 49.22 33.71 45.77 42.90 4 48.30 34.11 45.36 42.59 5 48.84 33.25 44.87 42.32 Table 7: Multi-point ETA invisible-dual attack. k denotes the number of light points. Values are AP(%) and mAP(%). Implementation Details Hardware. All experiments are conducted on a workstation equipped with a single NVIDIA RTX A4000 GPU (16 GB), an Intel Core i7-12700 CPU (20 logical cores), and 62 GB of system memory. Inference and attack optimization are executed under CUDA with PyTorch in the corresponding model environments (MapTR/DAMap share one environment; MGMap uses a separate environment). Unless otherwise specified, each attack run uses one GPU with batch size 1. Victim models. We evaluate three representative camera-based online HD map constructors with publicly released checkpoints and keep their official architectures, BEV settings, and pretrained weights unchanged: • MapTR (Liao et al. 2023): tiny variant with ResNet-50 backbone, BEV pooling, trained for 24 epochs. The perception range is [−15,15]×[−30,30][-15,15]×[-30,30] m on the ground plane, with BEV resolution H×W=200×100H×W=200×100, N=50N=50 map queries, and a single-frame temporal queue (q=1q=1). Clean mAP on our asymmetric NuScenes subset is 47.10%. • DAMap (Dong et al. 2025): MapTRv2-based tiny model with ResNet-50 backbone, trained for 24 epochs. Clean mAP is 60.69%. • MGMap (Liu et al. 2024): ResNet-50 camera-only model trained for 30 epochs. Clean mAP is 59.60%. For all models, map elements are decoded into divider, pedestrian-crossing, and boundary polylines and scored by Chamfer-distance mAP at thresholds 0.5,1.0,1.5\0.5,1.0,1.5\ m. Attack rendering and search hyperparameters. Physical light effects are rendered as additive purple–white lens flares in image space. Unless stated otherwise, the flare power is P=3000P=3000, the emitter height is fixed at z=−1.84z=-1.84 m, and candidate visibility is scored with a maximum beam angle of 40∘40 . For Blind (single-point) search, we sample up to 400400 candidate locations at interval 0.50.5 m, with 44 discrete heights, local resampling (22 samples per location within a 1.01.0 m range), and lateral lane offset 0.30.3 m. For Invisible Dual, Stage 1 reuses the strongest Blind location as L1L_1; Stage 2 evaluates N2=400N_2=400 candidates for L2L_2. RSA places L2L_2 on the edge touched by the straightened target and uses up to two adaptive expansion rounds (initial radius 2222 m, expansion factor 1.51.5), with a minimum inter-light distance of 3.03.0 m. ETA samples L2L_2 over the complete reference edge without expansion and does not enforce the same minimum spacing. A dual-point configuration is accepted only when its attack loss strictly improves over the Blind baseline; otherwise the Blind solution is retained. Multi-point ablations vary the number of lights k∈1,2,3,4,5k∈\1,2,3,4,5\ under the same rendering and evaluation protocol, with k=2k=2 as the default operating point. Downstream planning uses Hybrid A∗ with a collision threshold of 0.50.5 m; RSA is evaluated by UGR and ETA by UPTR.