Dynamic Adversarial Attacks on Autonomous Driving Systems

Amirhosein Chahe,Chenan Wang,Abhishek Jeyapratap,Kaidi Xu,Lifeng Zhou

2024-05-15

Abstract:This paper introduces an attacking mechanism to challenge the resilience of autonomous driving systems. Specifically, we manipulate the decision-making processes of an autonomous vehicle by dynamically displaying adversarial patches on a screen mounted on another moving vehicle. These patches are optimized to deceive the object detection models into misclassifying targeted objects, e.g., traffic signs. Such manipulation has significant implications for critical multi-vehicle interactions such as intersection crossing and lane changing, which are vital for safe and efficient autonomous driving systems. Particularly, we make four major contributions. First, we introduce a novel adversarial attack approach where the patch is not co-located with its target, enabling more versatile and stealthy attacks. Moreover, our method utilizes dynamic patches displayed on a screen, allowing for adaptive changes and movement, enhancing the flexibility and performance of the attack. To do so, we design a Screen Image Transformation Network (SIT-Net), which simulates environmental effects on the displayed images, narrowing the gap between simulated and real-world scenarios. Further, we integrate a positional loss term into the adversarial training process to increase the success rate of the dynamic attack. Finally, we shift the focus from merely attacking perceptual systems to influencing the decision-making algorithms of self-driving systems. Our experiments demonstrate the first successful implementation of such dynamic adversarial attacks in real-world autonomous driving scenarios, paving the way for advancements in the field of robust and secure autonomous driving.

Robotics,Computer Vision and Pattern Recognition,Machine Learning

What problem does this paper attempt to address?

This paper introduces a dynamic adversarial attack method for autonomous driving systems. The main objective of the research is to manipulate the decision-making process of autonomous vehicles by dynamically displaying optimized adversarial patches on the screen of another moving vehicle, causing the misidentification of target objects such as traffic signs. This method is of significant practical importance as it can impact critical multi-vehicle interaction scenarios like intersections, which are crucial for safe and efficient autonomous driving systems.

The paper makes four main contributions:
1. It proposes a novel adversarial attack method where the patch is not located at the same position as the target, enhancing the flexibility and concealment of the attack.
2. By using a dynamically displayed patch on the screen, it allows adaptive changes and movements based on the camera and target positions.
3. It designs a Screen Image Transformation Network (SIT-Net) to simulate environment-induced color and contrast transformations on the displayed image, reducing the gap between simulation and the real world.
4. It integrates a position loss term into the adversarial training process to improve the success rate of dynamic attacks, shifting the focus from perception systems to decision-making algorithms of autonomous driving systems.

Experiments demonstrate the successful realization of dynamic adversarial attacks in real-world autonomous driving scenarios for the first time, opening up new research directions for building robust and secure autonomous driving systems.