A comprehensive survey of physical adversarial vulnerabilities in autonomous driving systems

Abstract

Autonomous driving systems (ADSs) have attracted wide attention in the machine learning communities. With the help of deep neural networks (DNNs), ADSs have shown both satisfactory performance under significant uncertainties in the environment and the ability to compensate for system failures without external intervention. However, the vulnerability of ADSs has raised concerns since DNNs have been proven vulnerable to adversarial attacks. In this paper, we present a comprehensive survey of current physical adversarial vulnerabilities in ADSs. We first divide the physical adversarial attack methods and defense methods by their restrictions of deployment into three scenarios: the real-world, simulator-based, and digital-world scenarios. Then, we consider the adversarial vulnerabilities that focus on various sensors in ADSs and separate them as camera-based, light detection and ranging (LiDAR) based, and multifusion-based attacks. Subsequently, we divide the attack tasks by traffic elements. For the physical defenses, we establish the taxonomy with reference to input image preprocessing, adversarial example detection, and model enhancement for the DNN models to achieve full coverage of the adversarial defenses. Based on the above survey, we finally discuss the challenges in this research field and provide further outlook on future directions.

1. Introduction

Autonomous driving (AD) systems (ADSs) constitute multiple perception-level tasks that have achieved high precision because of deep learning architectures (Kiran et al., 2022). With the help of artificial intelligence (AI) based self-driving architectures, ADSs can perceive various traffic assignments. To handle real-world scenes through visual complexity, ADSs deploy multiple sensors such as light detection and ranging (LiDAR), radar, and global positioning system (GPS) to assist camera sensors. Moreover, the growing interest in the development of ADSs has introduced new security challenges and vulnerabilities. Besides the usual cyber-attacks (Dibaei et al., 2020), such as denial-of-service (DoS) attack, black-hole attack, and malware attack, the vulnerability of deep neural networks (DNNs) in ADSs needs to be investigated.

DNN predictions can be manipulated by adversarial examples (Szegedy et al., 2014). In the early stage, most adversarial examples are designed in the digital world, which means that the adversarial perturbations are generated in a pixel-to-pixel manner. These digital adversarial samples cannot effectively attack ADSs. Research indicates that digital adversarial attacks perform poorly against ADSs due to two potential reasons: real-world properties and multisensor fusions (MSFs) (Boloor et al., 2019).

Things have changed since Eykholt et al. (2018b) proposed the physical adversarial attack for object detectors. They evaluated the difference between digital and physical adversarial attacks from four perspectives: environmental conditions, spatial restrictions, physical limits on imperceptibility, and fabrication error. The environmental conditions represent the camera in autonomous vehicles taking photos of adversarial examples from diverse angles, distances, and weather conditions. Attackers can manipulate only the “restrictive region” rather than background imagery. The physical limits on imperceptibility impose that physical adversarial perturbations should be stealthy instead of imperceptible so that the camera can perceive perturbations. The fabrication error means that all perturbation values must be valid colors that can be reproduced in the real world. Furthermore, even if a fabrication device such as a printer can produce specific colors, some reproduction errors will occur in the progress of digital-to-physical transformation (Fig. 1). Sensor fusion involves gathering inputs from multiple sensors to interpret environmental conditions with increased detection certainty. The integration of diverse sensor types in ADSs allows them to harness the collective advantages of the sensors, effectively compensating for their limitations. Therefore, the majority of today’s automotive manufacturers commonly use the following sensors in ADSs: visible camera, LiDAR, infrared camera, depth camera, GPS, r