Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack

Abstract

Automated Lane Centering (ALC) systems are convenient and widely deployed today, but also highly security and safety critical. In this work, we are the first to systematically study the security of state-of-the-art deep learning based ALC systems in their designed operational domains under physical-world adversarial attacks. We formulate the problem with a safety-critical attack goal, and a novel and domain-specific attack vector: dirty road patches. To systematically generate the attack, we adopt an optimization-based approach and overcome domain-specific design challenges such as camera frame inter-dependencies due to attack-influenced vehicle control, and the lack of objective function design for lane detection models. We evaluate our attack on a production ALC using 80 scenarios from real-world driving traces. The results show that our attack is highly effective with over 97.5% success rates and less than 0.903 sec average success time, which is substantially lower than the average driver reaction time. This attack is also found (1) robust to various real-world factors such as lighting conditions and view angles, (2) general to different model designs, and (3) stealthy from the driver's view. To understand the safety impacts, we conduct experiments using software-in-the-loop simulation and attack trace injection in a real vehicle. The results show that our attack can cause a 100% collision rate in different scenarios, including when tested with common safety features such as automatic emergency braking. We also evaluate and discuss defenses.

arXiv commentAccepted to Usenix Security '21

References in corpus (15)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• A study of the effect of JPG compression on adversarial images
• Spatial As Deep: Spatial CNN for Traffic Scene Understanding
• On Adversarial Examples for Character-Level Neural Machine Translation
• LaneNet: Real-Time Lane Detection Networks for Autonomous Driving
• Key Points Estimation and Point Instance Segmentation Approach for Lane Detection
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• Batch Normalization is a Cause of Adversarial Vulnerability
• A Commute in Data: The comma2k19 Dataset
• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors

Cited by in corpus (1)

• Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data