DARTS: Deceiving Autonomous Cars with Toxic Signs

Abstract

Sign recognition is an integral part of autonomous cars. Any misclassification of traffic signs can potentially lead to a multitude of disastrous consequences, ranging from a life-threatening accident to even a large-scale interruption of transportation services relying on autonomous cars. In this paper, we propose and examine security attacks against sign recognition systems for Deceiving Autonomous caRs with Toxic Signs (we call the proposed attacks DARTS). In particular, we introduce two novel methods to create these toxic signs. First, we propose Out-of-Distribution attacks, which expand the scope of adversarial examples by enabling the adversary to generate these starting from an arbitrary point in the image space compared to prior attacks which are restricted to existing training/test data (In-Distribution). Second, we present the Lenticular Printing attack, which relies on an optical phenomenon to deceive the traffic sign recognition system. We extensively evaluate the effectiveness of the proposed attacks in both virtual and real-world settings and consider both white-box and black-box threat models. Our results demonstrate that the proposed attacks are successful under both settings and threat models. We further show that Out-of-Distribution attacks can outperform In-Distribution attacks on classifiers defended using the adversarial training defense, exposing a new attack vector for these defenses.

Submitted to ACM CCS 2018; Extended version of [1801.02780] Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

References in corpus (14)

• End to End Learning for Self-Driving Cars
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Poisoning Attacks against Support Vector Machines
• Houdini: Fooling Deep Structured Prediction Models
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Adversarial Examples that Fool Detectors
• Evasion and Hardening of Tree Ensemble Classifiers
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Adversarial Examples for Semantic Image Segmentation
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• PinMe: Tracking a Smartphone User around the World

Cited by in corpus (37)

• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Benchmarking Adversarial Patch Against Aerial Detection
• Towards robust sensing for Autonomous Vehicles: An adversarial perspective
• EPMF: Efficient Perception-aware Multi-sensor Fusion for 3D Semantic Segmentation
• Safeguarding connected autonomous vehicle communication: Protocols, intra- and inter-vehicular attacks and defenses
• Adversarial Deep Reinforcement Learning for Improving the Robustness of Multi-agent Autonomous Driving Policies
• StegaStamp: Invisible Hyperlinks in Physical Photographs
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos
• Unadversarial Examples: Designing Objects for Robust Vision
• MobilBye: Attacking ADAS with Camera Spoofing
• Fooling a Real Car with Adversarial Traffic Signs
• Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• Adversarial Robustness via Label-Smoothing
• Who is in Control? Practical Physical Layer Attack and Defense for mmWave based Sensing in Autonomous Vehicles
• Addressing Security and Privacy Challenges in Internet of Things
• Developing Future Human-Centered Smart Cities: Critical Analysis of Smart City Security, Interpretability, and Ethical Challenges
• Resilience of Autonomous Vehicle Object Category Detection to Universal Adversarial Perturbations
• DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Customizing an Adversarial Example Generator with Class-Conditional GANs
• Class-Aware Robust Adversarial Training for Object Detection
• Defending against substitute model black box adversarial attacks with the 01 loss
• Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
• Applying Tensor Decomposition to image for Robustness against Adversarial Attack
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• Detecting Adversarial Examples in Learning-Enabled Cyber-Physical Systems using Variational Autoencoder for Regression
• Robust binary classification with the 01 loss
• Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models
• A Model-Based Derivative-Free Approach to Black-Box Adversarial Examples: BOBYQA
• Universal Physical Camouflage Attacks on Object Detectors
• Comparing the Machine Readability of Traffic Sign Pictograms in Austria and Germany
• Towards Robust Classification with Image Quality Assessment
• Embedded Policing and Policy Enforcement based Security in the era of Digital-Physical Convergence for Next-Generation Vehicular Electronics
• Strategies to architect AI Safety: Defense to guard AI from Adversaries