Abstract:Recent research in adversarial machine learning has focused on visual perception in Autonomous Driving (AD) and has shown that printed adversarial patches can attack object detectors. However, it is important to note that AD visual perception encompasses more than just object detection; it also includes Multiple Object Tracking (MOT). MOT enhances the robustness by compensating for object detection errors and requiring consistent object detection results across multiple frames before influencing tracking results and driving decisions. Thus, MOT makes attacks on object detection alone less effective. To attack such robust AD visual perception, a digital hijacking attack has been proposed to cause dangerous driving scenarios. However, this attack has limited effectiveness. In this paper, we introduce a novel physical-world adversarial patch attack, ControlLoc, designed to exploit hijacking vulnerabilities in entire AD visual perception. ControlLoc utilizes a two-stage process: initially identifying the optimal location for the adversarial patch, and subsequently generating the patch that can modify the perceived location and shape of objects with the optimal location. Extensive evaluations demonstrate the superior performance of ControlLoc, achieving an impressive average attack success rate of around 98.1% across various AD visual perceptions and datasets, which is four times greater effectiveness than the existing hijacking attack. The effectiveness of ControlLoc is further validated in physical-world conditions, including real vehicle tests under different conditions such as outdoor light conditions with an average attack success rate of 77.5%. AD system-level impact assessments are also included, such as vehicle collision, using industry-grade AD systems and production-grade AD simulators with an average vehicle collision rate and unnecessary emergency stop rate of 81.3%.

MobilBye: Attacking ADAS with Camera Spoofing

All Your GPS Are Belong to Us: Towards Stealthy Manipulation of Road Navigation Systems.

STOP! Camera Spoofing via the in-Vehicle IP Network

Laser-Based LiDAR Spoofing: Effects Validation, Capability Quantification, and Countermeasures

A Practical GPS Location Spoofing Attack in Road Navigation Scenario.

PLA-LiDAR: Physical Laser Attacks Against LiDAR-based 3D Object Detection in Autonomous Vehicle.

bAdvertisement: Attacking Advanced Driver-Assistance Systems Using Print Advertisements

Adversarial Computer Vision Via Acoustic Manipulation of Camera Sensors

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving

Dynamic Adversarial Attacks on Autonomous Driving Systems

Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack

Finding Physical Adversarial Examples for Autonomous Driving with Fast and Differentiable Image Compositing

Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking

Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures