How realistic shadows fool autonomous vehicle mapping systems

Autonomous vehicles rely on online HD map construction to detect lanes and road boundaries for motion planning. Existing pixel-level adversarial attacks can be neutralized by standard defenses. MIRAGE discovers semantic attacks—plausible environmental variations like shadows or wet roads—that corrupt mapping predictions while remaining realistic and harder to defend against. Evaluated on nuScenes, the framework achieves boundary removal (suppressing 57.7% of detections, corrupting 96% of planned trajectories) and boundary injection attacks that succeed where pixel-based methods fail entirely. The attacks pass realism evaluation 80–84% of the time versus 0–9% for conventional adversarial patches, exposing a critical gap in current adversarial defenses.