Discovering New Shadow Patterns for Black-Box Attacks on Lane Detection of Autonomous Vehicles

2024-09-26

arXiv.org

AI Summary

Physical-world adversarial attacks on autonomous driving lane detection systems face challenges in stealth, legality, and real-world deployability. Method: This paper proposes a novel black-box physical-domain attack termed “negative shadow”: strategically occluding sunlight to cast bright, human-imperceptible patterns onto road surfaces—patterns misclassified by vision models as genuine lane markings. The approach integrates photometric modeling, road geometry constraints, and black-box optimization to generate end-to-end shadow patterns. Contribution/Results: It introduces the first formalization of “negative shadow,” achieving high stealth (16.4% human detection rate) and regulatory compliance (no infrastructure modification or traffic law violation). Experiments demonstrate 100% lane departure at ≥10 mph within 20 m; collision success rates of 60–100% beyond 30 m. Results are rigorously validated via human-subject studies and real-vehicle safety violation testing, overcoming key deployment barriers of conventional adversarial examples.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Security and Privacy: Large-scale security measurements

Abstract

Ensuring autonomous vehicle (AV) security remains a critical concern. An area of paramount importance is the study of physical-world adversarial examples (AEs) aimed at exploiting vulnerabilities in perception systems. However, most of the prevailing research on AEs has neglected considerations of stealthiness and legality, resulting in scenarios where human drivers would promptly intervene or attackers would be swiftly detected and punished. These limitations hinder the applicability of such examples in real-life settings. In this paper, we introduce a novel approach to generate AEs using what we term negative shadows: deceptive patterns of light on the road created by strategically blocking sunlight, which then cast artificial lane-like patterns. These shadows are inconspicuous to a driver while deceiving AV perception systems, particularly those reliant on lane detection algorithms. By prioritizing the stealthy nature of attacks to minimize driver interventions and ensuring their legality from an attacker's standpoint, a more plausible range of scenarios is established. In multiple scenarios, including at low speeds, our method shows a high safety violation rate. Using a 20-meter negative shadow, it can direct a vehicle off-road with a 100% violation rate at speeds over 10 mph. Other attack scenarios, such as causing collisions, can be performed with at least 30 meters of negative shadow, achieving a 60-100% success rate. The attack also maintains an average stealthiness of 83.6% as measured through a human subject experiment, ensuring its efficacy in covert settings.

Problem

• Novel physical-world attack on AV lane detection using negative shadows
• Exploits intensity-based heuristics to misclassify shadows as lane markings
• Proposes lightweight defense to mitigate attack success by 87%

Innovation

• Passive sunlight-redirecting negative shadows attack
• Exploits intensity heuristics in lane detection
• Luminosity Filter Pre-processing defense