Autonomous vehicles (AVs) rely on accurate and robust sensor observations for safety-critical decision making in a variety of conditions. The fundamental building blocks of such systems are sensors and classifiers that process ultrasound, radar, GPS, lidar, and camera signals [1]. It is of primary importance that the resulting decisions are robust to perturbations, which can take the form of different types of nuisances and data transformations and can even be adversarial perturbations (APs).