Security of Deep Learning based Lane Keeping System under Physical-World Adversarial Attack
Lane-Keeping Assistance System (LKAS) is convenient and widely available today, but also extremely security and safety critical. In this work, we design and implement the first systematic approach to attack real-world DNN-based LKASes. We identify dirty road patches as a novel and domain-specific threat model for practicality and stealthiness. We formulate the attack as an optimization problem, and address the challenge from the inter-dependencies among attacks on consecutive camera frames. We evaluate our approach on a state-of-the-art LKAS and our preliminary results show that our attack can successfully cause it to drive off lane boundaries within as short as 1.3 seconds.
We identify malicious road patches as the attack vector, since they are realizable in the physical world and can normally appear around traffic lanes. For stealthiness, we restrict these road patches to not cover the original lane lines and their color to be on the gray scale to pretend to be benign but dirty. The attacker can print the malicious input perturbations on asphalt, rubber, or poster, and then place it on the road.
This demo video is synthesized from the transformed camera image via the car motion model base input generation. More specifically, we place our malicious road patch on the BEV (Bird-Eye View) image, generated the camera inputs from the BEV, and then update the next frame state based on the bicycle model. More details are in our research paper.