Security of Deep Learning based Lane Keeping System under Physical-World Adversarial Attack--Technology Innovation--Media Center--China Automotive Cyber Security Summit 2020|ADAS|CAMP|EVITA|OEMs|SHE|Tier-1s|V2X|Vehicle-Intrusion|automotive-cyber-security|autonomous-cars|china|conference|cybersecurity-attacks|ecure-Vehicle-Architecture|event|exhibition|obd|ota|summit|t-box|vulnerabilities

Media Center

Security of Deep Learning based Lane Keeping System under Physical-World Adversarial Attack

Release Date：2020-04-06

Summary

Lane-Keeping Assistance System (LKAS) is convenient and widely available today, but also extremely security and safety critical. In this work, we design and implement the first systematic approach to attack real-world DNN-based LKASes. We identify dirty road patches as a novel and domain-specific threat model for practicality and stealthiness. We formulate the attack as an optimization problem, and address the challenge from the inter-dependencies among attacks on consecutive camera frames. We evaluate our approach on a state-of-the-art LKAS and our preliminary results show that our attack can successfully cause it to drive off lane boundaries within as short as 1.3 seconds.

Novel & Domain-Specific Threat Model: Dirty Road Patch

We identify malicious road patches as the attack vector, since they are realizable in the physical world and can normally appear around traffic lanes. For stealthiness, we restrict these road patches to not cover the original lane lines and their color to be on the gray scale to pretend to be benign but dirty. The attacker can print the malicious input perturbations on asphalt, rubber, or poster, and then place it on the road.

Attack Target: OpenPilot

OpenPilot is a state-of-the-art open-source LKAS, which is reported to have similar performance as Tesla Autopilot and GM Super Cruise, and better than all other manufacturers. It can retrofit to support LKAS after adding a smartphone-like device on your car.

Attack Demo

This demo video is synthesized from the transformed camera image via the car motion model base input generation. More specifically, we place our malicious road patch on the BEV (Bird-Eye View) image, generated the camera inputs from the BEV, and then update the next frame state based on the bicycle model. More details are in our research paper.