Source-linked AI summary
Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses
Yao Deng, Tiehua Zhang, Guannan Lou, Xi Zheng, Jiong Jin, Qing-Long Han
TL;DR
Deep learning-based ADSs face physical, cyber, and adversarial attacks that threaten their safety and security. This survey examines attacks and defenses throughout the ADS workflow, concluding that adversarial attacks are effective and require additional defense research.
Problem
Deep learning-based ADSs are vulnerable to physical, cyber, and adversarial attacks, creating a need to understand their mechanisms, damage, and defenses.
Method
The paper conducts a comprehensive survey of ADS workflows, attacks, state-of-the-art defenses, and future security research directions.
Results
The survey finds that physical attacks are limited and cyberattacks are difficult to launch at large scale, whereas adversarial attacks are effective and need more defenses.
Takeaways & Limitations
Improving ADS security requires stronger robustness methods, testing and verification, and real-time anomaly detection suited to autonomous-driving systems.
Abstract
from arXiv · showhide
The rapid development of artificial intelligence, especially deep learning technology, has advanced autonomous driving systems (ADSs) by providing precise control decisions to counterpart almost any driving event, spanning from anti-fatigue safe driving to intelligent route planning. However, ADSs are still plagued by increasing threats from different attacks, which could be categorized into physical attacks, cyberattacks and learning-based adversarial attacks. Inevitably, the safety and security of deep learning-based autonomous driving are severely challenged by these attacks, from which the countermeasures should be analyzed and studied comprehensively to mitigate all potential risks. This survey provides a thorough analysis of different attacks that may jeopardize ADSs, as well as the corresponding state-of-the-art defense mechanisms. The analysis is unrolled by taking an in-depth overview of each step in the ADS workflow, covering adversarial attacks for various deep learning models and attacks in both physical and cyber context. Furthermore, some promising research directions are suggested in order to improve deep learning-based autonomous driving safety, including model robustness training, model testing and verification, and anomaly detection based on cloud/edge servers.
I. INTRODUCTION
Deep learning-based ADSs support perception and real-time decision-making, but their safety and security remain threatened by diverse attacks. This survey reviews attacks across the ADS workflow, analyzes defenses, and proposes future directions for improving robustness.
- Motivation: Safety issues remain a major barrier to the broader development and industrialization of autonomous vehicles.The paper cites the need to address safety before full-scale industrialization.
- ADS workflow: Deep learning-based ADSs use sensor and HD-map data for perception, followed by deep or reinforcement learning models for real-time decisions.The workflow includes sensing, perception, decision, and cloud service components.
- Survey scope: The survey addresses the vulnerability, attack mechanisms, potential damage, and defenses of deep learning-based ADSs.The authors identify a gap in prior work focused on general vehicle safety or image classification rather than ADS security.
- Contributions: It reviews and analyzes attacks targeting the deep learning-based ADS pipeline and comprehensively elucidates state-of-the-art attacks and defending methods.The survey is organized around attacks, corresponding defenses, and future research directions.
- Future directions: Future research directions include new attacks, stronger ADS robustness, model testing and verification, and cloud- or edge-based anomaly detection.These directions are presented as ways to secure and improve deep learning-based ADSs.
A. The sensing layer
The sensing layer collects heterogeneous environmental and localization data through GPS/IMU, cameras, LiDAR, radar, and ultrasonic sensors. These data support perception, localization, object detection, and route-planning functions.
- Sensor composition: The sensing layer uses GPS/IMU, cameras, LiDAR, radar, and ultrasonic sensors to collect surrounding information.GPS and IMU provide positioning and motion-related information, while cameras and LiDAR support environmental understanding.
- Perception inputs: Camera images and LiDAR point clouds are widely processed by deep learning models for localization, object detection, and semantic segmentation.These tasks extract semantic information from raw sensor data in the perception layer.
- Localization: Localization fuses GPS, IMU, LiDAR point clouds, and HD maps for odometry estimation and map reconstruction.The resulting estimates help determine the vehicle’s current location and understand its surroundings.
- Object detection: Road object detection must identify lanes, traffic signs, vehicles, and pedestrians correctly in real time under changing environments.Representative models discussed include Faster RCNN, YOLO, VoxelNet, and PointRCNN.
3) Semantic segmentation:
Semantic segmentation assigns image regions to classes such as vehicles, pedestrians, and ground, supporting several autonomous-driving perception and mapping tasks. The section also situates this task within broader planning, decision, and ADS attack analyses.
- Semantic segmentation: Semantic segmentation assigns different image regions to classes such as vehicles, pedestrians, and ground.This provides a semantic representation of the driving scene.
- Applications: Semantic segmentation supports vehicle localization, object detection, lane marking, and map reconstruction.These functions connect scene parsing with downstream autonomous-driving tasks.
- Representative models: FCN and PSPNet are representative semantic-segmentation models discussed for autonomous driving.FCN modifies a fully connected layer into a convolutional layer, while PSPNet uses pyramid pooling to extract information.
- Planning and decision: Path planning determines a route between a starting location and destination, while trajectory prediction estimates perceived obstacles’ future paths.The paper also discusses inverse reinforcement learning and deep reinforcement learning for planning and control.
- End-to-end driving: The section’s ADS context includes an end-to-end model that combines perception and decision processes to predict steering angle and speed.DAVE-2 is described as using front-facing camera images to predict steering angle.
A. Physical attacks on sensors
Physical sensor attacks target the sensing layer by degrading or fabricating collected data, which can impair perception and decision-making. The main forms described are jamming and spoofing, though their physical proximity requirements limit their range.
- Threat model: Attackers target the sensing layer by adding noise or fabricating signals that degrade sensor data and influence vehicle behavior.Compromised sensing data can affect both perception and decision layers.
- Attack types: Physical sensor attacks use external hardware to disturb collected data or inject fabricated signals.The section identifies jamming and spoofing as the two common physical attack types.
- Jamming attacks: Jamming adds environmental noise to degrade sensor data and can make objects undetectable.Camera blinding uses intense light to overexpose images, while GPS jamming can adversely affect navigation.
- Spoofing attacks: Spoofing fabricates or injects sensor signals, potentially causing abnormal autonomous-vehicle behavior.Examples include LiDAR spoofing, relaying attacks that create ghost walls, and projected traffic signs.
B. Cyberattacks on cloud services
Cloud services and deep learning models expose ADSs to cyberattacks and adversarial attacks across communication, training, and inference. The survey distinguishes attack capabilities and reviews how these attacks can manipulate data, models, or outputs.
- Cloud-service attacks: Sybil, message falsification, DoS, DDoS, and OTA hijacking attacks target cloud–vehicle communications and HD-map updates.Sybil attacks create fake drivers and GPS information, while DoS/DDoS can exhaust V2X resources and OTA attacks can inject malware.
- Cloud-service attacks: Cloud attacks can disrupt navigation, perception services, network availability, or vehicle software through manipulated or unavailable communications.The resulting effects include inaccurate HD-map access, high latency, network unavailability, and malware delivery.
- Adversarial attacks: Adversarial examples add imperceptible perturbations that can cause deep learning models to produce incorrect predictions despite visually similar inputs.Their relevance to ADSs follows from deep learning models being used in both perception and decision layers.
- Attack models: White-box attacks use model details and gradients, while black-box approaches use transferability, output scores, or final decisions to craft examples.The survey emphasizes physical black-box evasion attacks because ADS sensors operate under varying angles, lighting, and distances.
- Adversarial attacks: Evasion attacks occur during inference, whereas poisoning attacks inject triggered data and misleading labels during training to induce targeted errors later.Poisoning attacks are also described as Trojan or backdoor attacks.
2) Adversarial evasion attacks on ADSs:
Adversarial evasion attacks can operate in simulation and the physical world by altering objects or scenes encountered by ADS perception and driving models. Reported examples include vehicle-recognition failures, traffic-sign attacks, and substantial steering deviations.
- Simulation experiments: DeepBillboard caused steering-angle predictions to deviate by up to 23 degrees across two end-to-end driving models, three datasets, and varied billboard placements.The attack replaced roadside billboards with adversarial perturbations generated through optimization.
- Physical-world attacks: Physical-world examples include adversarial vehicle textures, stickers on stop signs, and billboards placed in real driving environments.The figures show recognition failures across altered vehicles and stop signs, while PhysGAN generates and deploys adversarial billboards.
- Physical-world attacks: ShapeShifter achieved targeted and non-targeted attack success rates of 87% and 93%, respectively, against Faster RCNN traffic-sign detection.The perturbations were optimized for robustness across viewing angles and lighting conditions, then printed on physical traffic signs.
- Physical-world attacks: PhysGAN generated realistic adversarial billboards that changed E2E driving-model steering predictions by up to 19.17 degrees.The billboards were designed to resemble original billboards while causing vehicles to deviate from their original routes.
3) Adversarial poisoning attacks on ADSs:
Adversarial poisoning attacks compromise ADS models during training by inserting malicious triggered examples and misleading labels. The resulting models can produce incorrect predictions when the trigger appears during inference.
- Poisoning mechanism: Poisoning attacks inject malicious data containing triggers and misleading labels into training data so models learn trigger-specific patterns.The survey relates this attack class to Trojan and backdoor attacks.
D. Analysis of attacks
The survey characterizes physical attacks as constrained by proximity, cyberattacks as potentially broad but difficult to execute, and adversarial attacks as effective threats in real-world ADS settings. It reviews redundancy, filtering, randomness, fusion, encryption, authentication, and detection as defenses, while noting practical limitations.
- Attack analysis: Physical attacks are straightforward but range-limited, whereas cloud cyberattacks can affect many V2X-connected vehicles but require data fabrication or large botnets.Encryption and cloud detection systems can hinder or mitigate some cyberattacks.
- Attack analysis: Adversarial evasion attacks pose considerable real-world risks because perturbations can affect deep learning models used in ADSs.The survey contrasts their effectiveness with the practical constraints of physical proximity and cyberattack execution.
- Physical-attack defenses: Sensor redundancy can defend jamming by allowing unaffected sensors to provide data, but it increases financial cost and makes data fusion difficult.Near-infrared-cut filters, photochromic lenses, and related sensor-specific measures are also discussed.
- Physical-attack defenses: Randomized data collection and data fusion can defend spoofing by making signal timing harder to predict and cross-checking sensor information.PyCRA is identified as a spoofing detection system based on randomized collection.
- Limitations: Existing sensor attacks often require external hardware near the vehicle, and visible attacks may still permit human intervention to avoid accidents.The survey therefore retains a role for an onboard security guard even at high automation levels.
- Cyberattack defenses: HD-map updates require authenticity, integrity, and confidentiality protections, including encryption and authentication for GPS transmission.These measures target message falsification and unauthorized alteration or theft of map data.
C. Defense against adversarial evasion attacks
The survey organizes defenses against adversarial evasion into proactive methods that improve model robustness and reactive methods that detect or transform adversarial inputs. It reviews training, distillation, regularization, ensembles, certification, detection, and transformation, while noting uneven effectiveness across attacks and tasks.
- Proactive defenses: Adversarial training combines original data with adversarial examples, but reported benefits may remain limited to one-step or known attacks.Combining multiple attacks for training failed to improve robustness against unseen attacks.
- Proactive defenses: Defensive distillation uses original-model probability logits as soft labels to reduce gradient sensitivity, although optimization-based attacks can bypass it.
- Proactive defenses: Network regularization, including Jacobian-based regularizers and Lipschitz control, increased robustness against FGSM on CIFAR-10/CIFAR-100.
- Proactive defenses: Ensembling aggregates predictions from multiple models, while certified defenses seek provable robustness under specified threat models.
- Reactive defenses: Reactive methods include classifiers for detecting adversarial examples and input transformations that partially defend against several attacks.The reviewed transformation results were only partially effective against FGSM, I-FGSM, DeepFool, and C&W attacks.
D. Defense against adversarial poisoning attacks
The survey reviews poisoning defenses that detect triggered inputs or identify and remove backdoors from models. It also emphasizes practical constraints, including sensor-defense costs and substantial resource demands for autonomous-driving models.
- Poisoning defenses either detect hijacked images containing triggers or identify and remove the corresponding model backdoors.
- STRIP compares predictions on an input and a version superimposed with another clean training image to detect trigger-related behavior.
- A model-level mitigation removed neurons activated by detected triggers and reduced some poisoning attack success rates from over 90% to 0%.
- Physical-defense constraints: Redundant sensing can defend physical sensor attacks effectively, but it requires numerous same-type sensors, substantial expenditure, and data-fusion handling.
- Defense limitations: Adversarial training, distillation, and ensembles impose resource overhead, while regularization methods require further validation on autonomous-driving settings.Training autonomous-driving models requires large datasets and significant training time.
- Defense limitations: Transformation defenses may degrade performance on normal inputs, creating an unacceptable risk for safety-critical autonomous vehicles.
A. Potential attacks in future research
Future research should address attacks that span multiple sensors, models, and ADS layers rather than isolated targets. The survey proposes a robustness framework combining hardware redundancy, robust training, model testing and verification, and anomaly detection.
- Cross-layer attacks: Attacking one sensor or model may not alter final control decisions when ADSs fuse multimodal inputs across layers.
- Cross-layer attacks: Future attacks should target multimodal models and full-stack ADSs because isolated attacks do not necessarily affect final recognition or control.
- Emerging attack directions: Semantic adversarial attacks manipulate attributes such as lighting and clarity, highlighting mistakes that can arise under real-world conditions without an adversary.
- Emerging attack directions: Reverse-engineering research can construct metamodels for black-box classifiers or recover neural-network parameters through side-channel analysis.
- Robustness strategies: The proposed robustness framework identifies hardware redundancy, robust model training, model testing and verification, and anomaly detection as four future strategies.
- Robustness strategies: Fusing vehicle sensor data with information from V2X clients is presented as a way to make perceived environmental information more robust.
2) Model robustness training:
The survey identifies robustness training, model testing and verification, and real-time attack detection as complementary directions for strengthening deep learning-based ADSs against adversarial threats.
- 2) Model robustness training:: Robustness training aims to produce autonomous driving models that are naturally resistant to adversarial examples.Network regularization and surrogate-loss methods are discussed as approaches in this direction.
- 2) Model robustness training:: Testing and verification should measure trained models’ performance against adversarial examples after training.The survey notes that deep learning models are difficult to evaluate with traditional software-engineering test methods.
- 2) Model robustness training:: Real-time adversarial attack detection is needed as a last-line defense before deploying robust ADSs.Detection methods should identify abnormal behavior without imposing substantial resource overhead on resource-constrained vehicles.
- 2) Model robustness training:: Cloud/Edge anomaly detection can use greater computational power to monitor and analyze data uploaded by autonomous vehicles.The survey presents server-based monitoring as a possible direction alongside vehicle-side detection.
- 2) Model robustness training:: The survey concludes that model robustness training, testing and verification, and real-time adversarial-attack detection require further study to improve ADS robustness.It also identifies adversarial attacks on LiDAR and deep reinforcement models, as well as reverse-engineering attacks, as future research topics.