Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarios

Choi, Jung Im; Tian, Qing

doi:10.1109/iv51971.2022.9827222

Cited by 27 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Much research focuses on assessing and improving AV's abilities to recognize and respond to their environments (Hoss et al, 2022). Current efforts predominantly utilize adversarial attacks to test perception modules, identifying deficiencies in traffic participant recognition (Tang et al, 2023), such as tests targeting visual recognition (Chen et al, 2019;Zhao et al, 2019b;Im Choi and Tian, 2022), LiDAR detection (Li et al, 2021;Zhu et al, 2021a,b), and perception fusion (Zhong et al, 2022). Other perception module tests include metamorphic testing (Zhou and Sun, 2019;Wang et al, 2021;Ramanagopal et al, 2018) and combinatorial testing (Gladisch et al, 2020;Cheng et al, 2018), involving sensor data processing and analysis, and vehicular responses to different traffic scenarios, obstacles, and environmental factors.…”

Section: Perception Testingmentioning

confidence: 99%

TM-fuzzer: fuzzing autonomous driving systems through traffic management

Lin,

Chen,

et al. 2024

Preprint

View full text Add to dashboard Cite

Simulation testing of Autonomous Driving Systems (ADS) is crucial for ensuring the safety of autonomous vehicles. Currently, scenarios searched by ADS simulation testing tools are less likely to expose ADS issues and highly similar. In this paper, we propose TM-fuzzer, a novel approach for searching ADS test scenarios, which utilizes real-time traffic management and diversity analysis to search security-critical and unique scenarios within the infinite scenario space. TM-fuzzer dynamically manages traffic flow by manipulating non-player characters near autonomous vehicle throughout the simulation process to enhance the efficiency of test scenarios. Additionally, the TM-fuzzer utilizes clustering analysis on vehicle trajectory graphs within scenarios to increase the diversity of test scenarios. Compared to the baseline, the TM-fuzzer identified 29 unique violated scenarios more than four times faster and enhanced the incidence of ADS-caused violations by 26.26%. Experiments suggest that the TM-fuzzer demonstrates improved efficiency and accuracy.

show abstract

Section: Perception Testingmentioning

confidence: 99%

TM-fuzzer: fuzzing autonomous driving systems through traffic management

Lin,

Chen,

et al. 2024

Preprint

View full text Add to dashboard Cite

show abstract

“…Nassi et al [37] used a projector to project misleading traffic signs, which caused the ADSs to recognize the deceptive signs as real. Similarly, many other researchers focused on different modules to attack, such as road sign recognition [38,39], image recognition [40,41], object detection [42,43], and traffic sign recognition [44][45][46]. Other than the adversarial attacks mentioned above, false data injection [47] and denial of service attacks [48] are well-known attacks on autonomous driving systems.…”

Section: Adversarial Attacks On Autonomous Driving Systemsmentioning

confidence: 99%

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Hussain,

Hong

2023

MAKE

View full text Add to dashboard Cite

The perception system is a safety-critical component that directly impacts the overall safety of autonomous driving systems (ADSs). It is imperative to ensure the robustness of the deep-learning model used in the perception system. However, studies have shown that these models are highly vulnerable to the adversarial perturbation of input data. The existing works mainly focused on studying the impact of these adversarial attacks on classification rather than regression models. Therefore, this paper first introduces two generalized methods for perturbation-based attacks: (1) We used naturally occurring noises to create perturbations in the input data. (2) We introduce a modified square, HopSkipJump, and decision-based/boundary attack to attack the regression models used in ADSs. Then, we propose a deep-autoencoder-based adversarial attack detector. In addition to offline evaluation metrics (e.g., F1 score and precision, etc.), we introduce an online evaluation framework to evaluate the robustness of the model under attack. The framework considers the reconstruction loss of the deep autoencoder that validates the robustness of the models under attack in an end-to-end fashion at runtime. Our experimental results showed that the proposed adversarial attack detector could detect square, HopSkipJump, and decision-based/boundary attacks with a true positive rate (TPR) of 93%.

show abstract

“…One of the most commonly used object-detection models is You Only Look Once (YOLO) (Redmon et al, 2016), which is based on a single convolutional neural network (CNN) that simultaneously predicts the class and location of objects in an image. Several studies have shown that YOLO is vulnerable to adversarial attacks (Liu et al, 2018;Im Choi & Tian, 2022;Thys et al, 2019;Hu et al, 2021). For example, targeted perturbation attacks can be used to modify an input image in a way that causes YOLO to misidentify or fail to detect certain objects.…”

Section: Previous Workmentioning

confidence: 99%

Patch of Invisibility: Naturalistic Black-Box Adversarial Attacks on Object Detectors

Lapid¹,

Sipper²

2023

Preprint

View full text Add to dashboard Cite

Adversarial attacks on deep-learning models have been receiving increased attention in recent years. Work in this area has mostly focused on gradient-based techniques, so-called "whitebox" attacks, wherein the attacker has access to the targeted model's internal parameters; such an assumption is usually unrealistic in the real world. Some attacks additionally use the entire pixel space to fool a given model, which is neither practical nor physical (i.e., real-world). On the contrary, we propose herein a gradient-free method that uses the learned image manifold of a pretrained generative adversarial network (GAN) to generate naturalistic physical adversarial patches for object detectors. We show that our proposed method works both digitally and physically.

show abstract

Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarios

Cited by 27 publications

References 12 publications

TM-fuzzer: fuzzing autonomous driving systems through traffic management

TM-fuzzer: fuzzing autonomous driving systems through traffic management

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Patch of Invisibility: Naturalistic Black-Box Adversarial Attacks on Object Detectors

Contact Info

Product

Resources

About