Abstract:Adversarial Examples (AEs) can deceive Deep Neural Networks (DNNs) and have received a lot of attention recently. However, majority of the research on AEs is in the digital domain and the adversarial patches are static, which is very different from many real-world DNN applications such as Traffic Sign Recognition (TSR) systems in autonomous vehicles. In TSR systems, object detectors use DNNs to process streaming video in real time. From the view of object detectors, the traffic sign`s position and quality of the video are continuously changing, rendering the digital AEs ineffective in the physical world. In this paper, we propose a systematic pipeline to generate robust physical AEs against real-world object detectors. Robustness is achieved in three ways. First, we simulate the in-vehicle cameras by extending the distribution of image transformations with the blur transformation and the resolution transformation. Second, we design the single and multiple bounding boxes filters to improve the efficiency of the perturbation training. Third, we consider four representative attack vectors, namely Hiding Attack, Appearance Attack, Non-Target Attack and Target Attack. We perform a comprehensive set of experiments under a variety of environmental conditions, and considering illuminations in sunny and cloudy weather as well as at night. The experimental results show that the physical AEs generated from our pipeline are effective and robust when attacking the YOLO v5 based TSR system. The attacks have good transferability and can deceive other state-of-the-art object detectors. We launched HA and NTA on a brand-new 2021 model vehicle. Both attacks are successful in fooling the TSR system, which could be a life-threatening case for autonomous vehicles. Finally, we discuss three defense mechanisms based on image preprocessing, AEs detection, and model enhancing.

Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective

MLIA: modulated LED illumination-based adversarial attack on traffic sign recognition system for autonomous vehicle

Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack

Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Adversarial Attacks on Traffic Sign Recognition: A Survey

Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition

Adaptive Square Attack: Fooling Autonomous Cars with Adversarial Traffic Signs.

An Adversarial Attack on Salient Regions of Traffic Sign

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

Physical Adversarial Attacks on Deep Neural Networks for Traffic Sign Recognition: A Feasibility Study

Practical black-box adversarial attack on open-set recognition: Towards robust autonomous driving

Targeted Attention Attack on Deep Learning Models in Road Sign Recognition

Adversarial Attacks Against Traffic Sign Detection for Autonomous Driving

ITPatch: An Invisible and Triggered Physical Adversarial Patch against Traffic Sign Recognition

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

Defense Against Adversarial Attacks in Traffic Sign Images Identification Based on 5G

Exploring the Physical World Adversarial Robustness of Vehicle Detection