Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision

Ji, Xiaoyu; Cheng, Yushi; Zhang, Yuepeng; Wang, Kai; Chen, Yan; Xu, Wenyuan; Fu, Kevin

doi:10.1109/sp40001.2021.00091

Cited by 31 publications

(29 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Prior work [65] used this attack vector to attack the camera stabilization system, which has built-in IMUs, to manipulate the camera object detection results. • Translucent patch refer to sticking translucent films with color spots on camera lens.…”

Section: Sensor Attack Vectorsmentioning

confidence: 99%

“…Prior gray-box attacks all assume the lack of knowledge of AI model internals such as weights. However, some works still require confidence scores in the model outputs [56,[63][64][65]71,79,83,84], and some require detailed sensor parameters [65,67,89].…”

Section: Sensor Attack Vectorsmentioning

confidence: 99%

“…Another interesting trend in recent sensor attack works is that they often model the attack capability in the digital space for large-scale evaluation. For example, Man et al [58] modeled the camera lens flare effect caused by attacker's light beams in digital images, Ji et al [65] modeled the image blurry effect caused by adversarial acoustic signals on the camera stabilization system; Cao et al [19] models the LiDAR spoofing capability as the number of points that can be injected to the point cloud; Shen et al [92] models GPS spoofing as arbitrary GPS position that can be controlled by the attacker. Since these modelings are either validated in the physical-world experiments or backed up by the literature, sharing such code will greatly ease the reproduction in future works.…”

Section: F Community: Substantial Lack Of Open Sourcing Scientific Gapmentioning

confidence: 99%

See 2 more Smart Citations

SoK: On the Semantic AI Security in Autonomous Driving

Shen¹,

Wang²,

Wan³

et al. 2022

Preprint

View full text Add to dashboard Cite

Autonomous Driving (AD) systems rely on AI components to make safety and correct driving decisions. Unfortunately, today's AI algorithms are known to be generally vulnerable to adversarial attacks. However, for such AI component-level vulnerabilities to be semantically impactful at the system level, it needs to address non-trivial semantic gaps both (1) from the system-level attack input spaces to those at AI component level, and (2) from AI component-level attack impacts to those at the system level. In this paper, we define such research space as semantic AI security as opposed to generic AI security. Over the past 5 years, increasingly more research works are performed to tackle such semantic AI security challenges in AD context, which has started to show an exponential growth trend. However, to the best of our knowledge, so far there is no comprehensive systematization of this emerging research space.In this paper, we thus perform the first systematization of knowledge of such growing semantic AD AI security research space. In total, we collect and analyze 53 such papers, and systematically taxonomize them based on research aspects critical for the security field such as the attack/defense targeted AI component, attack/defense goal, attack vector, attack knowledge, defense deployability, defense robustness, and evaluation methodologies. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels. To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS, for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

show abstract

Section: Sensor Attack Vectorsmentioning

confidence: 99%

Section: Sensor Attack Vectorsmentioning

confidence: 99%

Section: F Community: Substantial Lack Of Open Sourcing Scientific Gapmentioning

confidence: 99%

See 1 more Smart Citation

SoK: On the Semantic AI Security in Autonomous Driving

Shen¹,

Wang²,

Wan³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…), and then causes the launch of AP4 ( ). For example, an adversary can destabilize a vehicle and blur its perceived images, causing incorrect object detection results [72]. • AP7 ( !"#$#%#"&#""!…”

Section: B Attack Pathsmentioning

confidence: 99%

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

Xu¹,

Han²,

Deng³

et al. 2022

Preprint

View full text Add to dashboard Cite

Robotic Vehicles (RVs) have gained great popularity over the past few years. Meanwhile, they are also demonstrated to be vulnerable to sensor spoofing attacks. Although a wealth of research works have presented various attacks, some key questions remain unanswered: are these existing works complete enough to cover all the sensor spoofing threats? If not, how many attacks are not explored, and how difficult is it to realize them?This paper answers the above questions by comprehensively systematizing the knowledge of sensor spoofing attacks against RVs. Our contributions are threefold. (1) We identify seven common attack paths in an RV system pipeline. We categorize and assess existing spoofing attacks from the perspectives of spoofer property, operation, victim characteristic and attack goal. Based on this systematization, we identify 4 interesting insights about spoofing attack designs. (2) We propose a novel action flow model to systematically describe robotic function executions and sensor spoofing vulnerabilities. With this model, we successfully discover 104 spoofing attack vectors, 25 of which have been verified by prior works, while 55 attacks are practical but never considered. (3) We design two novel attack methodologies to verify the feasibility of newly discovered spoofing attack vectors.

show abstract

“…Researchers investigated the threats and defense methods of electromagnetic attacks on sensing and control systems [5], [37], [38], [39], [40]. Recent works explored signal injection attacks on cameras [41], [42], [43], [44], [45] to spoof computer vision systems. Researchers also studied attacks on LiDAR systems to deceive the perception in autonomous vehicles [46], [47], [48].…”

Section: Related Workmentioning

confidence: 99%

Towards Adversarial Control Loops in Sensor Attacks: A Case Study to Control the Kinematics and Actuation of Embedded Systems

Tu¹,

Rampazzi²,

Hei³

2022

Preprint

View full text Add to dashboard Cite

Recent works investigated attacks on sensors by influencing analog sensor components with acoustic, light, and electromagnetic signals. Such attacks can have extensive security, reliability, and safety implications since many types of the targeted sensors are also widely used in critical process control, robotics, automation, and industrial control systems.While existing works advanced our understanding of the physical-level risks that are hidden from a digital-domain perspective, gaps exist in how the attack can be guided to achieve system-level control in real-time, continuous processes. This paper proposes an adversarial control loop-based approach for real-time attacks on process and actuation control systems relying on sensors. We study how to utilize the system feedback extracted from physical-domain signals to guide the attacks. In the attack process, injection signals are adjusted in real time based on the extracted feedback to exert targeted influence on a victim control system that is continuously affected by the injected perturbations and applying changes to the physical environment. In our case study, we investigate how an external adversarial control system can be constructed over sensor-actuator systems and demonstrate the attacks with program-controlled processes to manipulate the victim system without accessing its internal statuses.

show abstract

Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision

Cited by 31 publications

References 40 publications

SoK: On the Semantic AI Security in Autonomous Driving

SoK: On the Semantic AI Security in Autonomous Driving

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

Towards Adversarial Control Loops in Sensor Attacks: A Case Study to Control the Kinematics and Actuation of Embedded Systems

Contact Info

Product

Resources

About