Countering Adversarial Attacks on Autonomous Vehicles Using Denoising Techniques: A Review

Autonomous vehicle research has grown exponentially over the years with researchers working on different object detection algorithms to realize safe and competent self-driving systems while legal authorities are simultaneously looking into the ways of mitigating the risks posed by fully autonomous vehicles. These advancements can result in a much safer commuting environment, reduced accidents and also eliminate the necessity for human driving. The creation of data and access to data for autonomous driving research is difficult challenge that research communities are facing. Hence, open source simulators such as the CARLA simulator (CAR Learning to Act) help us train and test models and to gain insights into autonomous driving with ease. This paper proposes the application of object detection algorithm on CARLA simulator to derive useful results for autonomous driving research. Further, the comparison of CARLA simulator with other available simulators, key players in the field of autonomous vehicle technology, state-of-the-art algorithms being used for autonomous driving, real time implementation challenges and future technologies are also discussed.

Intelligent transportation systems, especially Autonomous Vehicles (AVs), are emerging as a paradigm with the potential to change modern society. However, with this, there is a strong need to ensure the security and privacy of such systems. AV ecosystems depend on machine learning algorithms to autonomously control their operations. Given the amount of personal information AVs collect, coupled with the distributed nature of such ecosystems, there is a movement to employ federated learning algorithms to develop secure decision-making models. Although federated learning is a viable candidate for data privacy, it is vulnerable to adversarial attacks, particularly data poisoning attacks, where malicious vectors would be injected in the training phase. Additionally, hyperparameters play an important role in establishing an efficient federated learning model that can be resilient against adversarial attacks. In this paper, to address these challenges, we propose a novel Optimized Quantum-based Federated Learning (OQFL) framework to automatically adjust the hyperparameters of federated learning using various adversarial attacks in AV settings. This work is innovative in two ways: first, a quantum-behaved particle swarm optimization technique is used to update the hyperparameters of the learning rate, local and global epochs. Second, the proposed technique is utilized within a cyber defense framework to defend against adversarial attacks. The performance of the proposed framework was evaluated using two benchmark datasets: MINST and Fashion-MINST, where they include images that would be extracted from smart cameras of AVs. This framework is shown to be more resilient against various adversarial attacks compared with peer techniques.

Adversarial attacks can compromise the robustness of real-world detection models. However, evaluating these models under real-world conditions poses challenges due to resource-intensive experiments. Virtual simulations offer an alternative, but the absence of standardized benchmarks hampers progress. Addressing this, we propose an innovative instant-level data generation pipeline using the CARLA simulator. Through this pipeline, we establish the Discrete and Continuous Instant-level (DCI) dataset, enabling comprehensive experiments involving three detection models and three physical adversarial attacks. Our findings highlight diverse model performances under adversarial conditions. YOLO v6 demonstrates remarkable resilience, exhibiting just a marginal 6.59% average drop in average precision (AP). In contrast, the ASA attack yields a substantial 14.51% average AP reduction, twice the effect of other algorithms. We also note that static scenes yield higher recognition AP values, and outcomes remain relatively consistent across varying weather conditions. Intriguingly, our study suggests that advancements in adversarial attack algorithms may be approaching its “limitation”. In summary, our work underscores the significance of adversarial attacks in real-world contexts and introduces the DCI dataset as a versatile benchmark. Our findings provide valuable insights for enhancing the robustness of detection models and offer guidance for future research endeavors in the realm of adversarial attacks.

QCAE-QOC-SVM: A hybrid quantum machine learning model for DoS and Fuzzy attack detection on autonomous vehicle CAN bus.

Adversarial attacks and active defense on deep learning based identification of GaN power amplifiers under physical perturbation

Adversarial attacks on deep neural networks (DNNs) have raised significant concerns, particularly in safety-critical applications such as autonomous driving. Autonomous vehicles rely on both vision and LiDAR sensors to provide accurate 3D visual perception of their surroundings. However, adversarial vulnerabilities in these models pose several risks, as they can lead to misinterpretation of sensor data, ultimately endangering safety. While substantial research has been devoted to image-level adversarial attacks, these efforts are predominantly confined to 2D-pixel spaces, lacking physical realism and applicability in the 3D world. To address these limitations, we introduce AdvNeRF, a groundbreaking approach for generating 3D adversarial meshes that effectively target both vision and LiDAR models simultaneously. AdvNeRF is a Transferable Target Adversarial Attack that leverages Neural Radiance Fields (NeRF) to achieve its objectives. NeRF ensures the creation of high-quality adversarial objects and enhances attack performance by maintaining consistency across unseen viewpoints, making the adversarial examples robust from multiple angles. By integrating NeRF, our method represents a leap forward in improving the robustness and effectiveness of 3D adversarial attacks. Experimental results validate the superior performance of AdvNeRF, demonstrating its ability to degrade the accuracy of 3D object detectors under various conditions. These findings highlight the critical implications of AdvNeRF, emphasizing its potential to consistently undermine the perception systems of autonomous vehicles across different perspectives, thus marking an advancement in the field of adversarial attacks and 3D perception security.

In the last decade, self-driving cars have witnessed a meteoric rise in popularity due to exceptional research in the fields of Edge Computing and Artificial Intelligence. Nowadays, autonomous vehicles use elaborate mathematical models in tandem with sophisticated Deep Learning techniques to navigate safely. PID Controllers have been used ubiquitously by researchers for autonomous vehicles. Deep Learning techniques like YOLO allow autonomous vehicles to be able to detect a wide range of objects in their surroundings leading to better responses. In this paper, a PID controller has been implemented to navigate a vehicle in CARLA Simulator. A Custom Traffic Light detection model has also been integrated with the controller to respond to traffic lights in the path of the vehicle.

We address adversarial attacks on the actuators at the joints of legged robots trained by deep reinforcement learning. The vulnerability to the joint attacks can significantly impact the safety and robustness of legged robots. In this study, we demonstrate that the adversarial perturbations to the torque control signals of the actuators can significantly reduce the rewards and cause walking instability in robots. To find the adversarial torque perturbations, we develop black-box adversarial attacks, where, the adversary cannot access the neural networks trained by deep reinforcement learning. The black box attack can be applied to legged robots regardless of the architecture and algorithms of deep reinforcement learning. We employ three search methods for the black-box adversarial attacks: random search, differential evolution, and numerical gradient descent methods. In experiments with the quadruped robot Ant-v2 and the bipedal robot Humanoid-v2, in OpenAI Gym environments, we find that differential evolution can efficiently find the strongest torque perturbations among the three methods. In addition, we realize that the quadruped robot Ant-v2 is vulnerable to the adversarial perturbations, whereas the bipedal robot Humanoid-v2 is robust to the perturbations. Consequently, the joint attacks can be used for proactive diagnosis of robot walking instability.

Despite the great scientific effort to capture adequately the complex environments in which autonomous vehicles (AVs) operate there are still use-cases that even SoA methods fail to handle. Specifically in odometry problems, on the one hand, geometric solutions operate with certain assumptions that are often breached in AVs, and on the other hand, deep learning methods do not achieve high accuracy. To contribute to that we present CarlaScenes, a large-scale simulation dataset captured using the CARLA simulator. The dataset is oriented to address the challenging odometry scenarios that cause the current state of art odometers to deviate from their normal operations. Based on a case study of failures presented in experiments we distinguished 7 different sequences of data. CarlaScenes besides providing consistent reference poses, includes data with semantic annotation at the instance level for both image and lidar. The full dataset is available at https://github.com/CarlaScenes/CarlaSence.git.

A crucial component of an autonomous vehicle (AV) is the artificial intelligence (AI) is able to drive towards a desired destination. Today, there are different paradigms addressing the development of AI drivers. On the one hand, we find modular pipelines, which divide the driving task into sub-tasks such as perception and maneuver planning and control. On the other hand, we find end-to-end driving approaches that try to learn a direct mapping from input raw sensor data to vehicle control signals. The later are relatively less studied, but are gaining popularity since they are less demanding in terms of sensor data annotation. This paper focuses on end-to-end autonomous driving. So far, most proposals relying on this paradigm assume RGB images as input sensor data. However, AVs will not be equipped only with cameras, but also with active sensors providing accurate depth information ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e.g.</i> , LiDARs). Accordingly, this paper analyses whether combining RGB and depth modalities, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i.e.</i> using RGBD data, produces better end-to-end AI drivers than relying on a single modality. We consider multimodality based on early, mid and late fusion schemes, both in multisensory and single-sensor (monocular depth estimation) settings. Using the CARLA simulator and conditional imitation learning (CIL), we show how, indeed, early fusion multimodality outperforms single-modality.

Towards robust autonomous driving systems through adversarial test set generation

N eural networks have impressive powers in the field of deep learning and have been used in many different applications. Nevertheless, the issue of robustness against deliberate harmful inputs, commonly referred to as adversarial perturbations, continues to be a prominent topic. The presence of these perturbations, which are frequently undetectable by human observers, has the potential to cause erroneous predictions in models, hence presenting potential hazards to crucial domains such as autonomous vehicles or medical diagnostics. The primary objective of this study is to assess the vulnerability of neural networks to adversarial perturbations, ascertain the underlying factors contributing to this susceptibility, and investigate viable solutions for mitigating such vulnerabilities. Various adversarial attack strategies were utilized on diverse neural network topologies, and their performances were assessed. The results of our study suggest that whereas deeper models exhibit enhanced classification abilities, they may not necessarily possess more resilience against hostile inputs. Additionally, it has been found that certain conventional regularization techniques might further amplify susceptibility. In order to address these problems, innovative training techniques and adjustments to the network structures are implemented, resulting in enhanced resilience against adversarial attacks. This study highlights the significance of developing neural networks that possess both accuracy and robustness, hence advancing the frontier of safe deep learning applications.

Due to the vulnerability of deep neural networks to adversarial examples, numerous works on adversarial attacks and defenses have been burgeoning over the past several years. However, there seem to be some conventional views regarding adversarial attacks and object detection approaches that most researchers take for granted. In this work, we bring a fresh perspective on those procedures by evaluating the impact of universal perturbations on object detection at a class-level. We apply it to a carefully curated data set related to autonomous driving. We use Faster-RCNN object detector on images of five different categories: person, car, truck, stop sign and traffic light from the COCO data set, while carefully perturbing the images using Universal Dense Object Suppression algorithm. Our results indicate that person, car, traffic light, truck and stop sign are resilient in that order (most to least) to universal perturbations. To the best of our knowledge, this is the first time such a ranking has been established which is significant for the security of the data sets pertaining to autonomous vehicles and object detection in general.

In recent years, with the widespread application of Vision Transformer (ViT) in visual trackers, their robustness has received increasing attention. However, by focusing on global interactions between image patches, ViT reduces sensitivity to local noise, posing new challenges for adversarial attacks. Meanwhile, existing decision-based adversarial attack methods often overlook the differences in noise sensitivity between different patches, further limiting the compression efficiency of adversarial noise, especially in ViT. In visual tracking, existing adversarial attack methods primarily target Siamese network-based trackers, and research on adversarial attacks against Transformer-based trackers, particularly decision-based black-box attacks, is still relatively limited. To implement effective black-box attacks on Transformer-based trackers, this paper innovatively proposes patch-based adversarial noise compression (PANC), a decision-based adversarial attack method. This method effectively compresses adversarial noise patch by patch, significantly improving compression efficiency and attack concealment. PANC also introduces a noise sensitivity matrix that dynamically adds and reduces adversarial noise, optimizing the spatial distribution of noise while decreasing the number of queries. We validated the effectiveness of the proposed PANC attack method on several Transformer-based trackers, including OSTrack, STARK, TransT, and MixformerV2, and three public large-scale benchmark datasets: GOT-10k, TrackingNet, and LaSOT. Experimental results show that compared to the existing state-of-the-art adversarial attack method, the IoU attack, PANC compresses the noise level to 10%, improving the attack effectiveness by 162% with the number of queries of only 45.7%. Furthermore, PANC can serve as an initialization or post-processing optimization strategy for other adversarial attack methods, providing a more flexible and efficient mechanism for adversarial example generation. Our work reveals the vulnerabilities of existing Transformer-based visual trackers and offers new ideas for further improving the efficiency and concealment of adversarial attacks.

Conventional perception-planning pipelines of autonomous vehicles (AV) utilize deep learning (DL) techniques that typically generate deterministic outputs without explicitly evaluating their uncertainties and trustworthiness. Therefore, the downstream decision-making components may generate unsafe outputs leading to system failure or accidents, if the preceding perception component provides highly uncertain information. To mitigate this issue, this article proposes a coherent safe perception-planning framework that quantifies and transfers DL-based perception uncertainties. Following the Bayesian Deep Learning paradigm, we design a probabilistic 3D object detector that extracts objects from LiDAR point clouds while quantifying the corresponding aleatoric and epistemic uncertainty. A chance-constrained motion planner is designed to formulate an explicit link between DL-based perception uncertainties and operation risk and generate safe and risk-bounding trajectories. The proposed framework is validated through various challenging scenarios in the CARLA simulator. Experiment results demonstrate that our framework can effectively capture the uncertainties in DL, and generate trajectories that bound the risk under DL perception uncertainties. It also outperforms counterpart approaches without explicitly evaluating the uncertainties of DL-based perception.