Abstract:Autonomous driving and advanced driver assistance systems (ADAS) rely on cameras to control the driving. In many prior approaches an attacker aiming to stop the vehicle had to send messages on the specialized and better-defended CAN bus. We suggest an easier alternative: manipulate the IP-based network communication between the camera and the ADAS logic, inject fake images of stop signs or red lights into the video stream, and let the ADAS stop the car safely. We created an attack tool that successfully exploits the GigE Vision protocol. Then we analyze two classes of passive anomaly detectors to identify such attacks: protocol-based detectors and video-based detectors. We implemented multiple detectors of both classes and evaluated them on data collected from our test vehicle and also on data from the public BDD corpus. Our results show that such detectors are effective against naive adversaries, but sophisticated adversaries can evade detection. Finally, we propose a novel class of active defense mechanisms that randomly adjust camera parameters during the video transmission, and verify that the received images obey the requested adjustments. Within this class we focus on a specific implementation, the width-varying defense, which randomly modifies the width of every frame. Beyond its function as an anomaly detector, this defense is also a protective measure against certain attacks: by distorting injected image patches it prevents their recognition by the ADAS logic. We demonstrate the effectiveness of the width-varying defense through theoretical analysis and by an extensive evaluation of several types of attack in a wide range of realistic road driving conditions. The best the attack was able to achieve against this defense was injecting a stop sign for a duration of 0.2 seconds, with a success probability of 0.2%, whereas stopping a vehicle requires about 2.5 seconds.

ADGAN: Protect Your Location Privacy in Camera Data of Auto-Driving Vehicles

Privacy-Preserving Auto-Driving: A GAN-Based Approach to Protect Vehicular Camera Data

GANs Based Density Distribution Privacy-Preservation on Mobility Data

$\Mathrm{p}^{3}$: A Privacy-Preserving Perception Framework for Building Vehicle-Edge Perception Networks Protecting Data Privacy

Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection.

DeepClean: A Robust Deep Learning Technique for Autonomous Vehicle Camera Data Privacy

CE-GAN : A Camera Image Enhancement Generative Adversarial Network for Autonomous Driving

Generative Adversarial Network Based Image Privacy Protection Algorithm

Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directions

Generative Adversarial Networks Enhanced Location Privacy in 5G Networks.

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

A Privacy Preserving Generative Adversarial Network for Image Data

Affine Disentangled GAN for Interpretable and Robust AV Perception

PPUP-GAN: A GAN-based privacy-protecting method for aerial photography

Privacy preservation for image data: A GAN‐based method

Towards Autonomous Driving Model Resistant to Adversarial Attack

Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack

Traj-MergeGAN: A Trajectory Privacy Preservation Model Based on Generative Adversarial Network

STOP! Camera Spoofing via the in-Vehicle IP Network

GAAD: GAN-enabled Autoencoder for Real-Time Sensor Anomaly Detection and Recovery in Autonomous Driving

PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving