Physical Backdoor Attacks to Lane Detection Systems in Autonomous Driving

Han, Xingshuo; Xu, Guowen; Zhou, Yuan; Yang, Xuehuan; Li, Jiwei; Zhang, Tianwei

doi:10.1145/3503161.3548171

Cited by 23 publications

(17 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The work [101] developed a novel color stripe pattern trigger, which could be generated and projected onto real faces through a flickering LED in a specialized waveform. Besides, the work [78] explored the physical backdoor attack against the lane-detection model, which played a critical role in autonomous driving systems. It designed a set of two traffic cones with specific shapes and positions as the trigger, and changed the output lane in poisoned samples.…”

Section: Backdoor Attacks With Different Triggersmentioning

confidence: 99%

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

Liu¹,

Zhu²,

Liu³

et al. 2023

Preprint

View full text Add to dashboard Cite

Adversarial machine learning (AML) studies the adversarial phenomenon of machine learning, which may make inconsistent or unexpected predictions with humans. Some paradigms have been recently developed to explore this adversarial phenomenon occurring at different stages of a machine learning system, such as training-time adversarial attack (i.e., backdoor attack), deployment-time adversarial attack (i.e., weight attack), and inference-time adversarial attack (i.e., adversarial example). However, although these paradigms share a common goal, their developments are almost independent, and there is still no big picture of AML. In this work, we aim to provide a unified perspective to the AML community to systematically review the overall progress of this field. We firstly provide a general definition about AML, and then propose a unified mathematical framework to covering existing attack paradigms. According to the proposed unified framework, we can not only clearly figure out the connections and differences among these paradigms, but also systematically categorize and review existing works in each paradigm.

show abstract

Section: Backdoor Attacks With Different Triggersmentioning

confidence: 99%

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

Liu¹,

Zhu²,

Liu³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…1) General Physical Attack Methods: Adversarial patches [27] are widely used for physical attacks, such as face recognition [28]- [30], object detection [24], [25], [31]- [33], autonomous driving [34], [35], etc. We review the related work according to application domains as follows:…”

Section: B Physical Attackmentioning

confidence: 99%

“…Autonomous driving: Cheng et al [35] proposed an optimization-based method to generate stealthy physicalobject-oriented adversarial patches to attack depth estimation. In [34], the authors realized the first physical backdoor attacks on the lane detection system, including two attack methodologies (poison-annotation and clean-annotation) to generate poisoned samples. [35] adopt an optimization-based approach to craft stealthy physical-object-oriented adversarial patches to fool depth estimation algorithms.…”

Section: B Physical Attackmentioning

confidence: 99%

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

Lian¹,

Wang²,

Su³

et al. 2023

Preprint

View full text Add to dashboard Cite

Patch-based physical attacks have increasingly aroused concerns. However, most existing methods focus on obscuring targets captured on the ground, and some of these methods are simply extended to deceive aerial detectors. They smear the targeted objects in the physical world with the elaborated adversarial patches, which can only slightly sway the aerial detectors' prediction and with weak attack transferability. To address the above issues, we propose to perform Contextual Background Attack (CBA), a novel physical attack framework against aerial detection, which can achieve strong attack efficacy and transferability in the physical world even without smudging the interested objects at all. Specifically, the targets of interest, i.e. the aircraft in aerial images, are adopted to mask adversarial patches. The pixels outside the mask area are optimized to make the generated adversarial patches closely cover the critical contextual background area for detection, which contributes to gifting adversarial patches with more robust and transferable attack potency in the real world. To further strengthen the attack performance, the adversarial patches are forced to be outside targets during training, by which the detected objects of interest, both on and outside patches, benefit the accumulation of attack efficacy. Consequently, the sophisticatedly designed patches are gifted with solid fooling efficacy against objects both on and outside the adversarial patches simultaneously. Extensive proportionally scaled experiments are performed in physical scenarios, demonstrating the superiority and potential of the proposed framework for physical attacks. We expect that the proposed physical attack method will serve as a benchmark for assessing the adversarial robustness of diverse aerial detectors and defense methods. The code has been released at https://github.com/JiaweiLian/CBA.

show abstract

“…The proposed method involves placing target objects onto a universal background image and manipulating the local pixel data surrounding the target objects in a way that renders them unrecognizable by object detectors. The focus of the study [196] is on the lane detection system, a crucial component in numerous autonomous driving applications, such as navigation and lane switching. The researchers design and realize the first physical backdoor attacks on such systems.…”

Section: Black-box Attacksmentioning

confidence: 99%

Benchmarking Adversarial Patch Against Aerial Detection

Lian

Mei

Zhang

et al. 2022

IEEE Trans. Geosci. Remote Sensing

View full text Add to dashboard Cite

Deep neural networks (DNNs) have found widespread applications in interpreting remote sensing (RS) imagery. However, it has been demonstrated in previous works that DNNs are vulnerable to different types of noises, particularly adversarial noises. Surprisingly, there has been a lack of comprehensive studies on the robustness of RS tasks, prompting us to undertake a thorough survey and benchmark on the robustness of image classification and object detection in RS. To our best knowledge, this study represents the first comprehensive examination of both natural robustness and adversarial robustness in RS tasks. Specifically, we have curated and made publicly available datasets that contain natural and adversarial noises. These datasets serve as valuable resources for evaluating the robustness of DNNs-based models. To provide a comprehensive assessment of model robustness, we conducted meticulous experiments with numerous different classifiers and detectors, encompassing a wide range of mainstream methods. Through rigorous evaluation, we have uncovered insightful and intriguing findings, which shed light on the relationship between adversarial noise crafting and model training, yielding a deeper understanding of the susceptibility and limitations of various models, and providing guidance for the development of more resilient and robust models

show abstract

Physical Backdoor Attacks to Lane Detection Systems in Autonomous Driving

Cited by 23 publications

References 31 publications

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

Benchmarking Adversarial Patch Against Aerial Detection

Contact Info

Product

Resources

About