Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

Abstract

We propose a new real-world attack against the computer vision based systems of autonomous vehicles (AVs). Our novel Sign Embedding attack exploits the concept of adversarial examples to modify innocuous signs and advertisements in the environment such that they are classified as the adversary's desired traffic sign with high confidence. Our attack greatly expands the scope of the threat posed to AVs since adversaries are no longer restricted to just modifying existing traffic signs as in previous work. Our attack pipeline generates adversarial samples which are robust to the environmental conditions and noisy image transformations present in the physical world. We ensure this by including a variety of possible image transformations in the optimization problem used to generate adversarial samples. We verify the robustness of the adversarial samples by printing them out and carrying out drive-by tests simulating the conditions under which image capture would occur in a real-world scenario. We experimented with physical attack samples for different distances, lighting conditions and camera angles. In addition, extensive evaluations were carried out in the virtual setting for a variety of image transformations. The adversarial samples generated using our method have adversarial success rates in excess of 95% in the physical as well as virtual settings.

Extended abstract accepted for the 1st Deep Learning and Security Workshop; 5 pages, 4 figures

References in corpus (2)

• Synthesizing Robust Adversarial Examples
• DARTS: Deceiving Autonomous Cars with Toxic Signs

Cited by in corpus (10)

• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• Physical Adversarial Attacks on Deep Neural Networks for Traffic Sign Recognition: A Feasibility Study
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Size-Invariant Graph Representations for Graph Classification Extrapolations
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Addressing Security and Privacy Challenges in Internet of Things
• Towards a Science of Resilient Robotic Autonomy