Abstract:Autonomous driving and advanced driver assistance systems (ADAS) rely on cameras to control the driving. In many prior approaches an attacker aiming to stop the vehicle had to send messages on the specialized and better-defended CAN bus. We suggest an easier alternative: manipulate the IP-based network communication between the camera and the ADAS logic, inject fake images of stop signs or red lights into the video stream, and let the ADAS stop the car safely. We created an attack tool that successfully exploits the GigE Vision protocol. Then we analyze two classes of passive anomaly detectors to identify such attacks: protocol-based detectors and video-based detectors. We implemented multiple detectors of both classes and evaluated them on data collected from our test vehicle and also on data from the public BDD corpus. Our results show that such detectors are effective against naive adversaries, but sophisticated adversaries can evade detection. Finally, we propose a novel class of active defense mechanisms that randomly adjust camera parameters during the video transmission, and verify that the received images obey the requested adjustments. Within this class we focus on a specific implementation, the width-varying defense, which randomly modifies the width of every frame. Beyond its function as an anomaly detector, this defense is also a protective measure against certain attacks: by distorting injected image patches it prevents their recognition by the ADAS logic. We demonstrate the effectiveness of the width-varying defense through theoretical analysis and by an extensive evaluation of several types of attack in a wide range of realistic road driving conditions. The best the attack was able to achieve against this defense was injecting a stop sign for a duration of 0.2 seconds, with a success probability of 0.2%, whereas stopping a vehicle requires about 2.5 seconds.

Adversarial Computer Vision Via Acoustic Manipulation of Camera Sensors

Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

PLA-LiDAR: Physical Laser Attacks Against LiDAR-based 3D Object Detection in Autonomous Vehicle.

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

Challenging AI+Camera Systems with Physical Adversarial Attacks

Why Don't You Clean Your Glasses? Perception Attacks with Dynamic Optical Perturbations

Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

Robust Roadside Physical Adversarial Attack Against Deep Learning in Lidar Perception Modules

Counteracting Adversarial Attacks in Autonomous Driving

Dynamic Adversarial Attacks on Autonomous Driving Systems

GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems

Exploring Adversarial Robustness of LiDAR-Camera Fusion Model in Autonomous Driving

Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving

Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

Partial-Information, Longitudinal Cyber Attacks on LiDAR in Autonomous Vehicles

Modeling Electromagnetic Signal Injection Attacks on Camera-based Smart Systems: Applications and Mitigation

STOP! Camera Spoofing via the in-Vehicle IP Network

Learning When to Use Adaptive Adversarial Image Perturbations against Autonomous Vehicles