Source-linked AI summary
PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
Zelun Kong, Junfeng Guo, Ang Li, Cong Liu
TL;DR
Vision-based autonomous-driving systems remain vulnerable to adversarial inputs, while existing methods provide limited support for realistic, continuous physical-world attacks. PhysGAN uses a GAN-based framework to generate one visually indistinguishable roadside-sign example that continuously misleads steering models. Digital and physical evaluations report average steering-angle deviations of up to 21.85 and 19.17 degrees, respectively.
Problem
Existing attacks largely target digital inputs or static physical scenes, leaving realistic continuous attacks on autonomous-driving steering models insufficiently addressed.
Method
PhysGAN uses a GAN-based framework with 3D-tensor inputs to generate one visually indistinguishable, physical-world-resilient adversarial roadside sign from driving-frame information.
Results
21.85 degrees digitally and 19.17 degrees physically: PhysGAN misleads average steering angle by up to these amounts across evaluated scenarios.
Takeaways & Limitations
PhysGAN demonstrates that a single realistic roadside-sign adversarial example can continuously affect autonomous steering across driving frames in digital and physical-world evaluations.
Takeaways & Limitations
The target autonomous-driving model is assumed to be pre-trained with fixed parameters, and the generator can access those parameters during training.
Abstract
from arXiv · showhide
Although Deep neural networks (DNNs) are being pervasively used in vision-based autonomous driving systems, they are found vulnerable to adversarial attacks where small-magnitude perturbations into the inputs during test time cause dramatic changes to the outputs. While most of the recent attack methods target at digital-world adversarial scenarios, it is unclear how they perform in the physical world, and more importantly, the generated perturbations under such methods would cover a whole driving scene including those fixed background imagery such as the sky, making them inapplicable to physical world implementation. We present PhysGAN, which generates physical-world-resilient adversarial examples for mislead-ing autonomous driving systems in a continuous manner. We show the effectiveness and robustness of PhysGAN via extensive digital and real-world evaluations. Digital experiments show that PhysGAN is effective for various steer-ing models and scenes, which misleads the average steer-ing angle by up to 23.06 degrees under various scenarios. The real-world studies further demonstrate that PhysGAN is sufficiently resilient in practice, which misleads the average steering angle by up to 19.17 degrees. We compare PhysGAN with a set of state-of-the-art baseline methods including several of our self-designed ones, which further demonstrate the robustness and efficacy of our approach. We also show that PhysGAN outperforms state-of-the-art baseline methods To the best of our knowledge, PhysGANis probably the first technique of generating realistic and physical-world-resilient adversarial examples for attacking common autonomous driving scenarios.
1. Introduction
PhysGAN targets the gap between digital adversarial attacks and practical autonomous-driving attacks by generating realistic roadside-sign examples that continuously mislead steering models. The framework uses a GAN-based design for physical deployment and is evaluated in both digital and real-world settings.
- Motivation: Digital attacks alter pixels across the driving scene, including fixed background imagery, limiting their applicability to realistic physical-world scenarios.Prior physical attacks also focus on static scenes, visible perturbations, or classification models rather than continuous steering.
- Evaluation: 21.85 degrees: PhysGAN misleads the average steering angle by up to this amount across digital steering models and scenarios.The study evaluates effectiveness and robustness using multiple steering models and datasets.
- Evaluation: 19.17 degrees: Physical case studies show that PhysGAN can mislead the average steering angle by up to this amount.The results are also compared against a comprehensive set of baseline methods.
- Contribution: PhysGAN is presented as the first technique, to the authors’ knowledge, for realistic and physical-world-resilient attacks on common autonomous steering systems.The authors position the method as contributing to safety research in autonomous driving.
- Approach: PhysGAN generates visually indistinguishable adversarial examples for roadside traffic or advertising signs that mislead autonomous-driving steering models.The generated example is intended to replace the corresponding original roadside object in the physical world.
- Approach: A 3D-tensor GAN architecture addresses the challenge of using one adversarial example to continuously mislead steering throughout driving.The framework considers multiple frames and extracts features through an encoder based on the target model’s CNN.
2. Related Works
Prior work largely addresses digital attacks or physical attacks on static objects and classification systems. PhysGAN instead targets roadside signs for continuous steering attacks while restricting perturbations to the sign and preserving visual realism.
- Adversarial Attacks: Earlier adversarial-attack research primarily studies white-box digital attacks such as FGSM and targeted classification attacks.These methods update image pixels using network gradients and target classification outcomes.
- Generating Physical Adversarial Examples: Early physical-attack studies examine static objects, physical road signs, or classification under changing camera distance and angle.These works do not address the continuous steering problem across an entire driving process.
- Generating Physical Adversarial Examples: PhysGAN generates perturbations only for roadside traffic or advertising signs, rather than for other scene areas.This distinguishes it from approaches that alter the broader captured scene.
- Generating Physical Adversarial Examples: PhysGAN addresses continuous steering attacks while producing realistic examples resilient to physical conditions and visually indistinguishable from the original sign.The method is designed for the one-to-many challenge of one example affecting multiple driving frames.
3. Our Approach: PhysGAN
PhysGAN generates a single visually indistinguishable roadside-sign adversarial example from driving-video features, aiming to continuously mislead a fixed steering model across changing views and physical conditions. Its training balances attack effectiveness against visual similarity while mapping the generated sign into each video frame.
- Problem Definition: PhysGAN targets continuous steering misdirection with one adversarial roadside sign replacing the original sign during a drive-by scenario.The target model is pretrained and fixed, while the generated sign is applied throughout the driving process.
- Challenges: The one-to-many challenge requires a single sample to mislead the steering model across frames with changing distance, view angle, pixels, and background.Physical attacks are also restricted to the roadside-object region rather than the entire image.
- Architecture: PhysGAN uses an encoder, generator, discriminator, and fixed target model; the encoder extracts features from the observed video slice for generator input.The video slice is represented as a 3D tensor, allowing the generator to account for multiple frames.
- Objective: The adversarial loss maximizes the target model’s prediction error, while the GAN loss encourages the generated sign to remain visually similar to the original.The adversarial video slice is formed by replacing the original sign with the generated sign in every frame.
- Physical Deployment: PhysGAN uses perspective mapping to place the rectangular generated sign onto the original sign’s quadrilateral region in each frame.This handles frame-to-frame changes in the roadside sign’s projected shape.
- Optimization: Training alternates discriminator optimization with generator optimization using adversarial and GAN losses, while the target model parameters remain fixed.For deployment, the adversarial example is printed at the same size as the target roadside sign.
4. Experiments
Experiments evaluate PhysGAN across steering models, datasets, scenes, metrics, and digital and physical-world settings. Results show realistic, continuous steering misdirection and stronger physical-world performance than comparable physically applicable baselines.
- Experiment Setup: Experiments cover NVIDIA Dave-2, Udacity Cg23, and Udacity Rambo steering models across seven straight and curved-lane scenes.The study adapts image-based CNNs into 3D CNNs trained on 20-frame video slices and labels or tracks roadside-sign corners across frames.
- Experiment Setup: PhysGAN is evaluated using steering angle MSE and maximum steering angle error, where larger values indicate stronger attack efficacy.Steering angle MSE averages squared prediction errors, while MSAE is the maximum error across frames in a video slice.
- Results: PhysGAN generates realistic adversarial sign replacements that remain visually indistinguishable from original objects and affect steering across nearly all frames.The attack remains noticeable even in early frames, when the adversarial sample occupies relatively little of the background.
- Results: A single printable PhysGAN example misleads the driving model continuously, with steering error generally increasing as the adversarial sign occupies more of each frame.Original roadside signs produce almost negligible steering error under the same frame-by-frame evaluation.
- Comparison against Baseline Approaches: PhysGAN outperforms PhysFGSM under physical-world constraints, while FGSM achieves stronger digital attacks only by modifying the entire scene.Random noise and original signs produce trivial or negligible angle errors in digital and physical comparisons.
- Online Driving Case Studies: Online driving case studies show PhysGAN outperforms other baselines and is the only tested attack that drives the vehicle onto the roadside curb.The online evaluation manually controls steering in real time and is intended as a proxy for an actual autonomous vehicle rather than a simulator.
5. Conclusion
PhysGAN generates physical-world-resilient adversarial examples that continuously mislead autonomous steering systems. Experiments demonstrate its efficacy and robustness in digital and physical-world settings.
- PhysGAN generates a single adversarial example that continuously misleads the driving model throughout the entire trajectory.