Abstract:The emergence of Autonomous Vehicles (AVs) has spurred research into testing the resilience of their perception systems, i.e. to ensure they are not susceptible to making critical misjudgements. It is important that they are tested not only with respect to other vehicles on the road, but also those objects placed on the roadside. Trash bins, billboards, and greenery are all examples of such objects, typically placed according to guidelines that were developed for the human visual system, and which may not align perfectly with the needs of AVs. Existing tests, however, usually focus on adversarial objects with conspicuous shapes/patches, that are ultimately unrealistic given their unnatural appearances and the need for white box knowledge. In this work, we introduce a black box attack on the perception systems of AVs, in which the objective is to create realistic adversarial scenarios (i.e. satisfying road design guidelines) by manipulating the positions of common roadside objects, and without resorting to `unnatural' adversarial patches. In particular, we propose TrashFuzz , a fuzzing algorithm to find scenarios in which the placement of these objects leads to substantial misperceptions by the AV -- such as mistaking a traffic light's colour -- with overall the goal of causing it to violate traffic laws. To ensure the realism of these scenarios, they must satisfy several rules encoding regulatory guidelines about the placement of objects on public streets. We implemented and evaluated these attacks for the Apollo, finding that TrashFuzz induced it into violating 15 out of 24 different traffic laws.

What problem does this paper attempt to address?

### What problems does this paper attempt to solve? This paper mainly explores whether the existing road design guidelines are applicable to autonomous vehicles (AVs). Specifically, it attempts to answer the following two key questions: 1. **Are the existing road design guidelines sufficient to ensure that the AV's perception system will not be misled by common roadside objects?** - The paper points out that the existing road design guidelines are mainly formulated for the human visual system and may not fully meet the needs of AVs. For example, the placement of roadside objects such as trash cans, billboards, and green plants may interfere with the AV's perception system. 2. **If the AV's perception system is misled, will it cause serious safety problems, such as violating traffic laws or collisions?** - The paper further explores whether this mislead will cause the AV to perform dangerous operations, such as misjudging the color of traffic lights, thereby violating traffic laws. To answer these questions, the author proposes a black - box attack method named **TrashFuzz**, which generates "natural" adversarial scenarios by manipulating the positions of common roadside objects to test the robustness of the AV perception system. The goal of TrashFuzz is to find those scenarios that can cause the AV to violate traffic laws while ensuring that these scenarios conform to the existing road design guidelines and appear "natural" to humans. ### Key points summary: - **Research background**: With the development of AV technology, ensuring the robustness and safety of its perception system has become crucial. - **Existing challenges**: Existing testing methods usually rely on obvious artificial adversarial samples (such as objects with abnormal patterns), which are unrealistic on actual roads and require white - box knowledge. - **Solution**: TrashFuzz generates adversarial test cases that conform to real - world scenarios by simulating common roadside object position changes to evaluate the performance of AVs in real environments. - **Experimental results**: Through testing on the Baidu Apollo platform, it was found that TrashFuzz can induce the AV to violate 15 different traffic laws without using any special adversarial samples. ### Formula representation: The formulas involved in the paper are mainly used to describe the robustness of the perception system and scene encoding. For example: - **STL formula**: Used to define the logical expressions of traffic laws. For example, `□(speed < 100)` means "the vehicle speed is always less than 100km/h". - **Distance function**: `dis(a, b)` represents the distance between two objects and is used to ensure that object placement conforms to road design guidelines. Through these formulas, the paper precisely defines how to generate and evaluate adversarial scenarios to ensure the effectiveness and realism of the tests. --- Hope this summary can help you understand the core problems and solutions of the paper. If you have more questions or need further explanations, please feel free to let me know!

Are Existing Road Design Guidelines Suitable for Autonomous Vehicles?

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Robust Roadside Physical Adversarial Attack Against Deep Learning in Lidar Perception Modules

Specification-Based Autonomous Driving System Testing

Adversary ML Resilience in Autonomous Driving Through Human Centered Perception Mechanisms

Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack

Runtime unknown unsafe scenarios identification for SOTIF of autonomous vehicles

Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks

Realistic Extreme Behavior Generation for Improved AV Testing

PAFOT: A Position-Based Approach for Finding Optimal Tests of Autonomous Vehicles

Too Afraid to Drive: Systematic Discovery of Semantic DoS Vulnerability in Autonomous Driving Planning under Physical-World Attacks

Simulation-Based Fuzzing for Autonomous Driving Systems:Landscapes,Challenges and Prospects

Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

How Do We Fail? Stress Testing Perception in Autonomous Vehicles

LawBreaker: An Approach for Specifying Traffic Laws and Fuzzing Autonomous Vehicles

Adversarial and Reactive Traffic Agents for Realistic Driving Simulation

VioHawk: Detecting Traffic Violations of Autonomous Driving Systems Through Criticality-guided Simulation Testing

AdvFuzz: Finding More Violations Caused by the EGO Vehicle in Simulation Testing by Adversarial NPC Vehicles

Discovering New Shadow Patterns for Black-Box Attacks on Lane Detection of Autonomous Vehicles