Fooling a Real Car with Adversarial Traffic Signs

Abstract

The attacks on the neural-network-based classifiers using adversarial images have gained a lot of attention recently. An adversary can purposely generate an image that is indistinguishable from a innocent image for a human being but is incorrectly classified by the neural networks. The adversarial images do not need to be tuned to a particular architecture of the classifier - an image that fools one network can fool another one with a certain success rate.The published works mostly concentrate on the use of modified image files for attacks against the classifiers trained on the model databases. Although there exists a general understanding that such attacks can be carried in the real world as well, the works considering the real-world attacks are scarce. Moreover, to the best of our knowledge, there have been no reports on the attacks against real production-grade image classification systems.In our work we present a robust pipeline for reproducible production of adversarial traffic signs that can fool a wide range of classifiers, both open-source and production-grade in the real world. The efficiency of the attacks was checked both with the neural-network-based classifiers and legacy computer vision systems. Most of the attacks have been performed in the black-box mode, e.g. the adversarial signs produced for a particular classifier were used to attack a variety of other classifiers. The efficiency was confirmed in drive-by experiments with a production-grade traffic sign recognition systems of a real car.

References in corpus (18)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Synthesizing Robust Adversarial Examples
• The Space of Transferable Adversarial Examples
• The History Began from AlexNet: A Comprehensive Survey on Deep Learning Approaches
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Learning with a Strong Adversary
• Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Houdini: Fooling Deep Structured Prediction Models
• Foveation-based Mechanisms Alleviate Adversarial Examples
• Physical Adversarial Examples for Object Detectors
• Enabling Pedestrian Safety using Computer Vision Techniques: A Case Study of the 2018 Uber Inc. Self-driving Car Crash
• Exploring the Space of Black-box Attacks on Deep Neural Networks

Cited by in corpus (6)

• Explainable Artificial Intelligence (XAI) on TimeSeries Data: A Survey
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• To be Robust or to be Fair: Towards Fairness in Adversarial Training
• Dealing with Adversarial Player Strategies in the Neural Network Game iNNk through Ensemble Learning
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification