MIRAGE systematically discovers semantic attacks in online HD map construction via conditional diffusion models

The research team proposes the MIRAGE framework, which uses a conditional diffusion model to search, on the latent manifold of real data, for semantic perturbations that preserve road topology yet mislead online HD map construction, and validated two types of attacks on nuScenes. The boundary removal attack suppressed 57.7% of detections and corrupted 96% of planned trajectories; the boundary injection attack was the only method to successfully inject fabricated boundaries, while pixel PGD and AdvPatch failed completely. Both types of attacks remained effective under multiple adversarial defenses. Two independent VLM judges gave realism scores of 80–84%, compared with 97–99% for clean nuScenes and only 0–9% for AdvPatch. The authors argue that semantic-level perturbations that appear as plausible environmental changes are harder to mitigate than pixel-level perturbations.