Abstract:Real-world traffic sign recognition is an important step toward building autonomous vehicles, most of which highly dependent on deep neural networks (DNNs). Recent studies demonstrated that DNNs are surprisingly susceptible to adversarial examples. Many attack methods have been proposed to understand and generate adversarial examples, such as gradient-based attack, score-based attack, decision-based attack, and transfer-based attacks. However, most of these algorithms are ineffective in real-world road sign attack, because 1) iteratively learning perturbations for each frame is not realistic for a fast moving car and 2) most optimization algorithms traverse all pixels equally without considering their diverse contribution. To alleviate these problems, this article proposes the targeted attention attack (TAA) method for real-world road sign attack. Specifically, we have made the following contributions: 1) we leverage the soft attention map to highlight those important pixels and skip those zero-contributed areas—this also helps to generate natural perturbations; 2) we design an efficient universal attack that optimizes a single perturbation/noise based on a set of training images under the guidance of the pretrained attention map; 3) we design a simple objective function that can be easily optimized; and 4) we evaluate the effectiveness of TAA on real-world data sets. Experimental results validate that the TAA method improves the attack successful rate (nearly 10%) and reduces the perturbation loss (about a quarter) compared with the popular RP<sub>2</sub> method. Additionally, our TAA also provides good properties, e.g., transferability and generalization capability. We provide code and data to ensure the reproducibility: https://github.com/AdvAttack/RoadSignAttack.

SITAR: Evaluating the Adversarial Robustness of Traffic Light Recognition in Level-4 Autonomous Driving

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

RoLMA: A Practical Adversarial Attack Against Deep Learning-Based LPR Systems.

Robust Roadside Physical Adversarial Attack Against Deep Learning in Lidar Perception Modules

Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective

On Robustness of Lane Detection Models to Physical-World Adversarial Attacks in Autonomous Driving

A Comprehensive Study of the Robustness for LiDAR-Based 3D Object Detectors Against Adversarial Attacks

Evaluating the Robustness of LiDAR Point Cloud Tracking Against Adversarial Attack

Exploring Adversarial Robustness of LiDAR Semantic Segmentation in Autonomous Driving

Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarios

Adversary ML Resilience in Autonomous Driving Through Human Centered Perception Mechanisms

Targeted Attention Attack on Deep Learning Models in Road Sign Recognition

Evaluating the Robustness of LiDAR-based 3D Obstacles Detection and Its Impacts on Autonomous Driving Systems

Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

A Survey on Adversarial Robustness of LiDAR-based Machine Learning Perception in Autonomous Vehicles

Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition

Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures

Exploring the Physical World Adversarial Robustness of Vehicle Detection

LiRTest: Augmenting LiDAR Point Clouds for Automated Testing of Autonomous Driving Systems

Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles