Abstract:Recent research in adversarial machine learning has focused on visual perception in Autonomous Driving (AD) and has shown that printed adversarial patches can attack object detectors. However, it is important to note that AD visual perception encompasses more than just object detection; it also includes Multiple Object Tracking (MOT). MOT enhances the robustness by compensating for object detection errors and requiring consistent object detection results across multiple frames before influencing tracking results and driving decisions. Thus, MOT makes attacks on object detection alone less effective. To attack such robust AD visual perception, a digital hijacking attack has been proposed to cause dangerous driving scenarios. However, this attack has limited effectiveness. In this paper, we introduce a novel physical-world adversarial patch attack, ControlLoc, designed to exploit hijacking vulnerabilities in entire AD visual perception. ControlLoc utilizes a two-stage process: initially identifying the optimal location for the adversarial patch, and subsequently generating the patch that can modify the perceived location and shape of objects with the optimal location. Extensive evaluations demonstrate the superior performance of ControlLoc, achieving an impressive average attack success rate of around 98.1% across various AD visual perceptions and datasets, which is four times greater effectiveness than the existing hijacking attack. The effectiveness of ControlLoc is further validated in physical-world conditions, including real vehicle tests under different conditions such as outdoor light conditions with an average attack success rate of 77.5%. AD system-level impact assessments are also included, such as vehicle collision, using industry-grade AD systems and production-grade AD simulators with an average vehicle collision rate and unnecessary emergency stop rate of 81.3%.

Feasibility and Suppression of Adversarial Patch Attacks on End-to-End Vehicle Control

Adversarial Computer Vision Via Acoustic Manipulation of Camera Sensors

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Driving into Danger: Adversarial Patch Attack on End-to-End Autonomous Driving Systems Using Deep Learning

Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision

Adversarial Driving: Attacking End-to-End Autonomous Driving

Attacking vision-based perception in end-to-end autonomous driving models

Dynamic Adversarial Attacks on Autonomous Driving Systems

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving

Finding Physical Adversarial Examples for Autonomous Driving with Fast and Differentiable Image Compositing

Attack End-to-End Autonomous Driving through Module-Wise Noise

Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures

Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systems

Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks

Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles

Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

Adversary ML Resilience in Autonomous Driving Through Human Centered Perception Mechanisms

Demo: Security of Camera-based Perception for Autonomous Driving under Adversarial Attack

Robust Roadside Physical Adversarial Attack Against Deep Learning in Lidar Perception Modules

STOP! Camera Spoofing via the in-Vehicle IP Network