Towards Robust Physical-world Backdoor Attacks on Lane Detection

Xinwei Zhang,Aishan Liu,Tianyuan Zhang,Siyuan Liang,Xianglong Liu

2024-07-01

Abstract:Deep learning-based lane detection (LD) plays a critical role in autonomous driving systems, such as adaptive cruise control. However, it is vulnerable to backdoor attacks. Existing backdoor attack methods on LD exhibit limited effectiveness in dynamic real-world scenarios, primarily because they fail to consider dynamic scene factors, including changes in driving perspectives (e.g., viewpoint transformations) and environmental conditions (e.g., weather or lighting changes). To tackle this issue, this paper introduces BadLANE, a dynamic scene adaptation backdoor attack for LD designed to withstand changes in real-world dynamic scene factors. To address the challenges posed by changing driving perspectives, we propose an amorphous trigger pattern composed of shapeless pixels. This trigger design allows the backdoor to be activated by various forms or shapes of mud spots or pollution on the road or lens, enabling adaptation to changes in vehicle observation viewpoints during driving. To mitigate the effects of environmental changes, we design a meta-learning framework to train meta-generators tailored to different environmental conditions. These generators produce meta-triggers that incorporate diverse environmental information, such as weather or lighting conditions, as the initialization of the trigger patterns for backdoor implantation, thus enabling adaptation to dynamic environments. Extensive experiments on various commonly used LD models in both digital and physical domains validate the effectiveness of our attacks, outperforming other baselines significantly (+25.15% on average in Attack Success Rate). Our codes will be available upon paper publication.

Computer Vision and Pattern Recognition,Artificial Intelligence

What problem does this paper attempt to address?

The paper attempts to address the problem of conducting robust physical-world backdoor attacks on lane detection (LD) in dynamic real-world scenarios. Existing backdoor attack methods have limited effectiveness in dynamic real-world scenarios, primarily because they fail to consider dynamic scene factors such as changes in driving perspective (e.g., viewpoint transformation) and environmental conditions (e.g., weather or lighting changes). To address this issue, the paper proposes a method called BadLANE, which is a dynamic scene-adaptive backdoor attack designed for lane detection, aiming to withstand changes in dynamic scene factors in the real world.

Specifically, the main contributions of the paper include:
1. **Introducing a physically robust backdoor method, BadLANE**: Designing an amorphous trigger that can be activated by various shapes of mud splashes or pollution in the real world.
2. **Ensuring BadLANE's adaptability to varying environmental conditions in the physical world**: Developing a meta-learning framework that incorporates diverse environmental information.
3. **Validating the effectiveness of the attack through extensive experiments**: Conducting experiments on various commonly used lane detection models in both digital and physical domains, with results significantly outperforming other baseline methods (average attack success rate increased by 25.15%).

Additionally, the paper proposes four specific attack strategies, namely Lane Disappearance Attack (LDA), Lane Straightening Attack (LSA), Lane Rotation Attack (LRA), and Lane Offset Attack (LOA), which cause different malicious behaviors in lane detection models.