PaperlayerView exact revision on arXiv

Source-linked AI summary

DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems

Husheng Zhou, Wei Li, Yuankun Zhu, Yuqun Zhang, Bei Yu, Lingming Zhang, Cong Liu

arXiv:1812.10812v1cs.CV

TL;DR

Existing autonomous-driving DNN testing largely emphasizes digital perturbations, leaving physical-world steering tests under changing driving conditions insufficiently addressed. DeepBillboard generates printable adversarial billboards through robust joint optimization across multiple frames, and experiments show effectiveness across steering models and scenes, with physical robustness under varied weather conditions.

  • Problem

    Existing autonomous-driving DNN testing mainly generates digital perturbations, leaving both digital and physical perturbation generation for steering decisions insufficiently addressed.

  • Method

    DeepBillboard jointly optimizes printable billboard perturbations across multiple driving frames while accounting for changing viewpoints, environmental conditions, and pixel printability.

  • Results

    DeepBillboard is effective across steering models and scenes, with digital experiments reporting up to 41.93 degree average steering-angle error and physical tests remaining robust under varied weather conditions.

  • Takeaways & Limitations

    The approach demonstrates realistic, continuous physical-world testing of practical autonomous-driving systems using adversarial roadside billboards.

Abstract

from arXiv · show

Deep Neural Networks (DNNs) have been widely applied in many autonomous systems such as autonomous driving. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, they mostly focus on generating digital adversarial perturbations (particularly for autonomous driving), e.g., changing image pixels, which may never happen in physical world. There is a critical missing piece in the literature on autonomous driving testing: understanding and exploiting both digital and physical adversarial perturbation generation for impacting steering decisions. In this paper, we present DeepBillboard, a systematic physical-world testing approach targeting at a common and practical driving scenario: drive-by billboards. DeepBillboard is capable of generating a robust and resilient printable adversarial billboard, which works under dynamic changing driving conditions including viewing angle, distance, and lighting. The objective is to maximize the possibility, degree, and duration of the steering-angle errors of an autonomous vehicle driving by the generated adversarial billboard. We have extensively evaluated the efficacy and robustness of DeepBillboard through conducting both digital and physical-world experiments. Results show that DeepBillboard is effective for various steering models and scenes. Furthermore, DeepBillboard is sufficiently robust and resilient for generating physical-world adversarial billboard tests for real-world driving under various weather conditions. To the best of our knowledge, this is the first study demonstrating the possibility of generating realistic and continuous physical-world tests for practical autonomous driving systems.

I. INTRODUCTION

DeepBillboard addresses the gap between digital adversarial testing and physical-world testing for autonomous-driving steering decisions. It generates printable billboards designed to induce steering errors across changing driving conditions and evaluates their effectiveness digitally and physically.

  • Autonomous-driving DNNs can make unsafe control decisions and remain vulnerable to intentional adversarial inputs.
  • DeepBillboard targets drive-by roadside billboards as a practical physical-world setting for misleading steering-angle decisions.Billboards are customizable, large, widely available, and exposed to vehicles across varying distances, viewing angles, and lighting conditions.
  • Figure 1 illustrates a customizable roadside billboard and an adversarial example where the Dave steering model diverges.
  • The method jointly optimizes perturbations across sequences of frames rather than a single fixed viewpoint.Its design accounts for changing distance, viewing angle, lighting, driving patterns, environmental conditions, and printability constraints.
  • DeepBillboard introduces physical-world testing, a robust joint optimization method, and evaluation metrics for digital and physical steering tests.
  • 41.93 degree is the reported maximum average steering-angle misdirection in digital experiments across various scenarios.Physical case studies further report robustness and resilience under varied weather conditions.

II. BACKGROUND AND RELATED WORK

The paper focuses on CNN-based steering models that map camera imagery to steering decisions, while distinguishing its physical-world setting from prior adversarial-example studies.

  • Autonomous-driving systems process sensor data with DNNs to produce control decisions, and this paper focuses on camera-based steering angles.
  • CNN steering models make decisions from the currently captured image, unlike RNNs with feedback connections.
  • The paper leaves testing RNN-based steering models for future work.
  • Prior physical attacks often used relatively stable conditions, whereas DeepBillboard targets diverse continuous conditions such as changing distance, angle, and resolution.
  • DeepBillboard targets CNN-based steering models rather than detection or segmentation algorithms.

A. Adversarial Scenarios

DeepBillboard models a drive-by billboard encounter as a sequence of camera frames and seeks to induce steering-angle errors that move the vehicle off its lane path.

  • The target system takes dashcam images as input and outputs steering-angle decisions, with the objective of causing off-tracking from the lane center.
  • Steering-angle error is used for physical-world evaluation because the tester usually cannot control the vehicle’s speed.
  • The physical scenario covers a sequence of frames captured from different distances and viewing angles as the vehicle approaches and passes the billboard.
  • Considering the full dynamic driving process can increase the possibility and degree of misleading steering decisions across driving-by vehicles.

B. Evaluating Matrices

The evaluation metrics measure average steering-angle error and the fraction of frames exceeding a safety-related threshold across an exhaustive set of possible drive-by views.

  • The exhaustive frame set includes images potentially captured under any driving pattern, while an actual vehicle’s frames form a subset of it.
  • M0 measures the mean angle error across every frame in the exhaustive frame set.A larger M0 indicates greater average attack strength over the frame super set.
  • M1 measures the percentage of frames whose angle error exceeds a predefined threshold τ.The threshold can be calculated from physical driving behavior.
  • 16.24 is the example threshold τ for misleading a 40MPH vehicle by one meter within 0.2 seconds.
  • M1 is mainly used in physical case studies because it reflects frames with potentially unacceptable steering decisions under a chosen safety threshold.The paper notes that autonomous vehicles may classify every j-th frame rather than every frame.

C. Challenges

Physical-world attacks must remain effective despite changing environmental conditions and spatial constraints. These constraints can otherwise significantly weaken perturbation effectiveness.

  • C. Challenges: Physical attacks must account for changing physical-world conditions to remain effective against the target system.The paper structures these conditions around billboard classification and notes applicability to other physical learning systems.
  • C. Challenges: Ignoring physical-world constraints can significantly weaken perturbation effectiveness.

D. The Design of DeepBillboard

DeepBillboard generates one printable billboard perturbation by jointly optimizing frame-specific attacks across driving videos and physical conditions. Its pipeline uses gradients, projection, overlap handling, environmental adjustment, and printability control to maximize steering-angle divergence.

  • Joint optimization: DeepBillboard seeks one printable perturbation that misleads steering decisions across every frame captured while driving past a billboard.The billboard appearance varies with viewing angle and distance, motivating joint optimization across frames.
  • Handling overlapped perturbations: DeepBillboard limits overlap by updating a fixed number k of pixels for each frame, reducing interference among perturbations from multiple frames.
  • Printability: The method minimizes nonprintability score so perturbed pixels remain compatible with printer output.NPS measures the maximum distance between a pixel and any printable RGB triple, with larger values indicating lower printing accuracy.
  • Algorithm workflow: The workflow records driving videos with varied behaviors, projects perturbation proposals into frames, greedily accepts beneficial updates, and returns the printable perturbation.Algorithm 1 initializes a printable matrix, processes shuffled image batches, handles overlaps, applies NPS control, and updates scene images.
  • Gradient-based generation: The algorithm computes frame gradients, constrains them to billboard regions, and selects updates that improve the joint adversarial objective.The objective seeks to maximize average steering-angle difference from ground truth while reducing interference among frame-specific perturbations.
  • Environment adaptation: Environmental adjustment corrects color differences caused by lighting before perturbations are projected onto the physical billboard.For example, an observed change from (255,255,0) to (200,200,0) adds (55,55,0) to the projected gradient.

IV. EVALUATION

The evaluation measures DeepBillboard’s efficacy in both digital and physical settings across multiple steering models and road scenes.

  • IV. EVALUATION: DeepBillboard is evaluated digitally and physically for various steering models and road scenes.

A. Experiment Setup

The experiments use four pretrained CNN steering models and multiple driving datasets, with digital and physical tests measuring average steering-angle errors. Physical studies vary driving speeds and weather, while evaluation uses model predictions and recorded driving videos rather than an actual autonomous vehicle.

  • Datasets and steering models: Four pretrained CNN steering models are evaluated: Dave V1, Dave V2, Dave V3, and Epoch.Dave V1 is NVIDIA’s original Dave architecture; Dave V2 and V3 modify that architecture, while Epoch is trained from Udacity instructions.
  • Datasets and steering models: The experiments use Udacity, Dave testing, and Kitti datasets containing 101,396, 45,568, and 14,999 images, respectively.
  • Experiment design: Physical case studies use tachograph videos of a vehicle driving past a roadside billboard, with steering-model outputs treated as ground truth.
  • Experiment design: Average Angle Errors across all frames measure algorithm efficacy in both digital and physical experiments.
  • Digital tests: Digital tests select seven scenes containing straight and curved lanes, label billboard corners frame by frame, and compare patched-image predictions with ground-truth steering decisions.
  • Evaluation metrics: The inference steering angle is the comparison baseline, and average and percentage statistics summarize deviations because datasets may lack ground-truth angles.
  • Physical tests: Physical tests record drives beginning approximately 100 ft from the billboard and include sunny, cloudy, and dusk weather conditions.
  • Evaluation boundary: The physical evaluation substitutes prerecorded driving videos for actual autonomous-vehicle testing because actual autonomous vehicles were unavailable.

B. Digital Perturbation Results

Digital experiments show that DeepBillboard produces substantial steering-angle divergence across steering models and scenes, with errors generally increasing as the billboard occupies more image space.

  • More than 16.7° average divergence occurs for Dave V2 across all scenes, while Dave V3 ranges from 0.44° to 25.01°.Dave V3’s smaller divergence is attributed to dropout and augmented training data; Epoch also has relatively small errors but lacks Dave V3’s cropping augmentation.
  • Steering-angle errors usually increase as billboard size grows, although some scenes produce large divergences even when the billboard is small.The paper attributes the usual trend to stronger perturbation activation from larger billboards, while noting exceptions such as middle frames in one scene.

C. Parameter Tuning

Parameter and training-frame choices affect convergence and the final average angle error, but no single batch-size or gradient-update strategy consistently dominates.

  • Parameter tuning: Starting from a yellow billboard converges better overall than starting from green, while y(5,max) and y(10,sum) outperform other tested settings.The experiments compare initialization color, batch size, and max-versus-sum gradient updating; the second experiment runs to 1000 iterations.
  • Parameter tuning: Careful initial-color selection improves convergence speed and final results, but the experiments show no clear best choice between larger or smaller batches or max versus sum updates.
  • Training-set selection: The selected training frames affect the final objective: the first 40 frames converge to lower AAE, whereas the last 40 frames achieve better results than the other subsets.
  • Training-set selection: Larger billboard regions and larger k values usually improve results and convergence, except when small billboards make aggressive pixel updates interfere across frames.

D. Physical Case Study

Physical tests evaluate printable adversarial billboards during driving under multiple conditions. The billboards steer vehicles left or right and produce substantial errors across sunny, cloudy, and dusk settings.

  • Experimental setup: The physical study records training videos at 10 mph and testing videos at 20 mph while driving from 100 ft away until passing the billboard.
  • Metrics: Exp AAE measures expected training-video error, Test AAE measures testing-video error, and M1 records the percentage of frames exceeding the steering-error threshold.The threshold is set according to driving speed to represent at least one-meter off-tracking.
  • Sunny physical results: Bright and dark adversarial billboards steer left and right, respectively, whereas the empty white billboard produces nearly straight steering across distances.The steering direction is controlled through the gradient flag.
  • Cross-condition results: More than 19% of frames exceed the predefined mis-steering threshold in 4 of 6 scenarios, reaching 100% in some cases; 268 of 900 frames show large errors overall.Across sunny, cloudy, and dusk conditions, Test AAE is often only slightly below Exp AAE.
  • Per-frame behavior: Figure 6 compares left-misleading and right-misleading billboard tests by frame index and steering angle under sunny conditions.Positive steering denotes left steering and negative steering denotes right steering.

V. CONCLUSION

DeepBillboard provides systematic physical-world testing for autonomous driving by generating billboard perturbations that induce consistent mis-steering across changing viewpoints. Experiments demonstrate efficacy across steering models and digital and physical-world scenarios.

  • DeepBillboard systematically tests autonomous driving systems in the physical world using adversarial perturbations patched onto roadside billboards.
  • Its perturbations consistently cause mis-steering across multiple frames with different viewing distances and angles.
  • Extensive experiments demonstrate DeepBillboard’s efficacy across various steering models and digital and physical-world scenarios.
Loading 1812.10812v1…