Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles

Abstract

In recent years, many deep learning models have been adopted in autonomous driving. At the same time, these models introduce new vulnerabilities that may compromise the safety of autonomous vehicles. Specifically, recent studies have demonstrated that adversarial attacks can cause a significant decline in detection precision of deep learning-based 3D object detection models. Although driving safety is the ultimate concern for autonomous driving, there is no comprehensive study on the linkage between the performance of deep learning models and the driving safety of autonomous vehicles under adversarial attacks. In this paper, we investigate the impact of two primary types of adversarial attacks, perturbation attacks and patch attacks, on the driving safety of vision-based autonomous vehicles rather than the detection precision of deep learning models. In particular, we consider two state-of-the-art models in visionbased 3D object detection, Stereo R-CNN and DSGN. To evaluate driving safety, we propose an end-to-end evaluation framework with a set of driving safety performance metrics. By analyzing the results of our extensive evaluation experiments, we find that (1) the attack's impact on the driving safety of autonomous vehicles and the attack's impact on the precision of 3D object detectors are decoupled, and (2) the DSGN model demonstrates stronger robustness to adversarial attacks than the Stereo R-CNN model. In addition, we further investigate the causes behind the two findings with an ablation study. The findings of this paper provide a new perspective to evaluate adversarial attacks and guide the selection of deep learning models in autonomous driving.

How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses

“…PRACTICAL APPLICATIONS Autonomous Driving. Zhang et al [225] proposes an endto-end driving safety evaluation framework with designed performance metrics for the assessment of driving safety, suggesting that it is desirable to evaluate the robustness of deep learning models in terms of driving safety instead of model precision. Rossolini et al [226] focuses on evaluating the robustness of segmentation models to real-world adversarial attacks and demonstrates that these already have a threshold of robustness.…”

Leveraging Self-Paced Semi-Supervised Learning with Prior Knowledge for 3D Object Detection on a LiDAR-Camera System

“…However, in deep learning, w contains lots of parameters, so it is difficult to directly optimize Equation (3). As the modern deep neural network (DNN) is trained with a batch of data the size of B l + B u [49], the loss of SPSL-3D is simplified as:…”

“…Its task is to identify the classification and predict the 3D bounding box of a targeted object a the traffic scenario. In a word, 3D object detection performance affects the traffic safety of intelligent driving [3]. As 3D object detection requires spatial information from the environment, light detection and ranging (LiDAR) is a suitable sensor because it can generate a 3D point cloud in real-time [4].…”

Cybersecurity of Autonomous Vehicles: A Systematic Literature Review of Adversarial Attacks and Defense Models

“…In other words, an attacker may design specific attacks to deceive the AI systems by disseminating carefully crafted patterns in the environment and thus induce unexpected behavior of the AV [17]. These deliberate patterns, often referred to as perturbations, are imperceptible to AV users but intense enough to deceive the AI model time and time again [18], [19], [20], and [21]. So, defensive tactics against adversarial attacks have also been the subject of extensive research [22].…”