Abstract:Recent research in adversarial machine learning has focused on visual perception in Autonomous Driving (AD) and has shown that printed adversarial patches can attack object detectors. However, it is important to note that AD visual perception encompasses more than just object detection; it also includes Multiple Object Tracking (MOT). MOT enhances the robustness by compensating for object detection errors and requiring consistent object detection results across multiple frames before influencing tracking results and driving decisions. Thus, MOT makes attacks on object detection alone less effective. To attack such robust AD visual perception, a digital hijacking attack has been proposed to cause dangerous driving scenarios. However, this attack has limited effectiveness. In this paper, we introduce a novel physical-world adversarial patch attack, ControlLoc, designed to exploit hijacking vulnerabilities in entire AD visual perception. ControlLoc utilizes a two-stage process: initially identifying the optimal location for the adversarial patch, and subsequently generating the patch that can modify the perceived location and shape of objects with the optimal location. Extensive evaluations demonstrate the superior performance of ControlLoc, achieving an impressive average attack success rate of around 98.1% across various AD visual perceptions and datasets, which is four times greater effectiveness than the existing hijacking attack. The effectiveness of ControlLoc is further validated in physical-world conditions, including real vehicle tests under different conditions such as outdoor light conditions with an average attack success rate of 77.5%. AD system-level impact assessments are also included, such as vehicle collision, using industry-grade AD systems and production-grade AD simulators with an average vehicle collision rate and unnecessary emergency stop rate of 81.3%.

OptiCloak: Blinding Vision-Based Autonomous Driving Systems Through Adversarial Optical Projection

DepthCloak: Projecting Optical Camouflage Patches for Erroneous Monocular Depth Estimation of Vehicles

PLA-LiDAR: Physical Laser Attacks Against LiDAR-based 3D Object Detection in Autonomous Vehicle.

Laser-Based LiDAR Spoofing: Effects Validation, Capability Quantification, and Countermeasures

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

You Cannot Easily Catch Me: A Low-Detectable Adversarial Patch for Object Detectors

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

Building Towards "Invisible Cloak": Robust Physical Adversarial Attack on YOLO Object Detector

ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving

Transient Adversarial 3D Projection Attacks on Object Detection in Autonomous Driving

TPatch: A Triggered Physical Adversarial Patch

Towards a Physical-World Adversarial Patch for Blinding Object Detection Models.

Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches

Physical Strip Attack for Object Detection in Optical Remote Sensing

Infrared Adversarial Car Stickers

Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors.

Learning Coated Adversarial Camouflages for Object Detectors

Dynamic Adversarial Attacks on Autonomous Driving Systems

Camouflaged Adversarial Patch Attack on Object Detector

An Adversarial Patch Attack for Vehicle Detectors in the Physical World