Reliable Smart Road Signs

TL;DR

This paper introduces a game-theoretic detection mechanism for smart road signs using error-correction codes to enhance robustness against adversarial attacks, ensuring reliable classification in intelligent transportation systems.

Contribution

It proposes a novel game-theoretic approach combined with error-correction methods for robust detection of smart road signs against large-scale adversarial perturbations.

Findings

Effective detection strategy under worst-case attacks

Robustness demonstrated across various scenarios

Enhanced security for smart transportation systems

Abstract

In this paper, we propose a game theoretical adversarial intervention detection mechanism for reliable smart road signs. A future trend in intelligent transportation systems is ``smart road signs" that incorporate smart codes (e.g., visible at infrared) on their surface to provide more detailed information to smart vehicles. Such smart codes make road sign classification problem aligned with communication settings more than conventional classification. This enables us to integrate well-established results in communication theory, e.g., error-correction methods, into road sign classification problem. Recently, vision-based road sign classification algorithms have been shown to be vulnerable against (even) small scale adversarial interventions that are imperceptible for humans. On the other hand, smart codes constructed via error-correction methods can lead to robustness against small scale intelligent or random perturbations on them. In the recognition of smart road signs, however, humans are out of the loop since they cannot see or interpret them. Therefore, there is no equivalent concept of imperceptible perturbations in order to achieve a comparable performance with humans. Robustness against small scale perturbations would not be sufficient since the attacker can attack more aggressively without such a constraint. Under a game theoretical solution concept, we seek to ensure certain measure of guarantees against even the worst case (intelligent) attackers that can perturb the signal even at large scale. We provide a randomized detection strategy based on the distance between the decoder output and the received input, i.e., error rate. Finally, we examine the performance of the proposed scheme over various scenarios.

Tables

Table 1. TABLE I : Configuration of the RS-Codes

RS-Code	$\#$ distinct road signs	$\#$ bits	$\nu$	$\mu$	$d_o$
${[7,5,3]}_8$	$8^5=32768$	$21$	$17$	$4$	$1$
${[7,3,5]}_8$	$8^3=512$	$21$	$21$	$8$	$2$
${[11,5,7]}_{16}$	${16}^5=1,048,576$	$44$	$47$	$16$	$3$
${[11,3,9]}_{16}$	${16}^3=4096$	$44$	$47$	$32$	$4$
${[15,5,11]}_{16}$	${16}^5=1,048,576$	$60$	$85$	$64$	$5$
${[15,3,13]}_{16}$	${16}^3=4096$	$60$	$81$	$128$	$6$

Table 2. TABLE II : Probability of decoding error/failure for the RS-Codes over Different Channels. Highlighted cells correspond to the error/failure probabilities less than 0.02 0.02 0.02 .

RS-Code	$p_e=0.01$	$p_e=0.05$	$p_e=0.1$	$p_e=0.2$
${[7,5,3]}_8$	$0.0020$	$0.0444$	$0.1497$	$0.4233$
${[7,3,5]}_8$	$0.0000$	$0.0038$	$0.0257$	$0.1480$
${[11,5,7]}_{16}$	$0.0000$	$0.0016$	$0.0185$	$0.1611$
${[11,3,9]}_{16}$	$0.0000$	$0.0001$	$0.0028$	$0.0504$
${[15,5,11]}_{16}$	$0.0000$	$0.0001$	$0.0022$	$0.0611$
${[15,3,13]}_{16}$	$0.0000$	$0.0000$	$0.0003$	$0.0181$

Table 3. TABLE III : The conservative cost if there were no detection mechanism.

RS-Code	$p_e=0.01$	$p_e=0.05$	$p_e=0.1$	$p_e=0.2$
${[7,5,3]}_8$	$9,000$	$36,251$	$55,564$	$61,491$
${[7,3,5]}_8$	$112$	$778$	$1,306$	$1,683$
${[11,5,7]}_{16}$	$257,750$	$980,210$	$1,331,300$	$1,179,500$
${[11,3,9]}_{16}$	$913$	$4,750$	$6,836$	$6,901$
${[15,5,11]}_{16}$	$379,300$	$1,313,600$	$1,628,300$	$1,152,200$
${[15,3,13]}_{16}$	$1,280$	$5,774$	$7,718$	$6,108$

Table 4. TABLE IV : The conservative cost if there were the proposed detection mechanism.

RS-Code	$p_e=0.01$	$p_e=0.05$	$p_e=0.1$	$p_e=0.2$
${[7,5,3]}_8$	$2,246$	$9,579$	$16,167$	$22,847$
${[7,3,5]}_8$	$100$	$112$	$145$	$214$
${[11,5,7]}_{16}$	$279$	$19,394$	$88,599$	$261,270$
${[11,3,9]}_{16}$	$100$	$105$	$160$	$530$
${[15,5,11]}_{16}$	$100$	$5,549$	$39,194$	$145,690$
${[15,3,13]}_{16}$	$100$	$100$	$107$	$262$

Table 5. TABLE V : Probability of False Alarms

RS-Code	$p_e=0.01$	$p_e=0.05$	$p_e=0.1$	$p_e=0.2$
${[7,5,3]}_8$	$0.0657$	$0.2884$	$0.4822$	$0.6724$
${[7,3,5]}_8$	$0.0001$	$0.0296$	$0.1082$	$0.2711$
${[11,5,7]}_{16}$	$0.0002$	$0.0135$	$0.0708$	$0.2259$
${[11,3,9]}_{16}$	$0.0000$	$0.0013$	$0.0150$	$0.1077$
${[15,5,11]}_{16}$	$0.0000$	$0.0052$	$0.0106$	$0.1031$
${[15,3,13]}_{16}$	$0.0000$	$0.0000$	$0.0018$	$0.0406$

Equations

$$d\le n-k+1,$$

$$d_o:=\lfloor \frac{d-1}{2}\rfloor$$

$$\ell(x_{o},y)=\left\{\begin{array}[]{ll}0&\mbox{if }y\in\Sigma^{n}_{d}\mbox{ and }\hat{y}=x_{o}\\ 1&\mbox{otherwise.}\end{array}\right.$$

$$U(\alpha ,\pi )=$$

$$+$$

$$-$$

$$\mathcal{G}:=({\Delta }^{|\mathcal{A}|-1},[0,1{]}^{d_o+1},U,\ell (\cdot ),p(y|x),p(x_o),\{{\gamma }_j\}),$$

$$\underset{\pi \in [0,1{]}^{d_o+1}}{\min }\underset{\alpha \in {\Delta }^{|\mathcal{A}|-1}}{\max }U(\alpha ,\pi ).$$

$$\underset{\alpha \in {\Delta }^{|\mathcal{A}|-1}}{\max }U(\alpha ,\pi )$$

$$p(y|x)=(1-p_e{)}^{n-H(y,x)}{\left(\frac{p_e}{q-1}\right)}^{H(y,x)},$$

$$\sum _{j=0}^{d_o}(1-{\pi }_j)\sum _{\begin{array}{c}y\in {\Sigma }_d^n\\ \ni H(y,\hat{y})=j\end{array}}p(y|a_x$$

$$\sum _{y\in {\Sigma }^n}\ell (a_o,y)p(y|a_x)$$

$$=1-\sum _{t=0}^{d_o}\rho (H(a_o,a_x),t),$$

$${\mathcal{A}}^d=\{(a_o^{\ast },a_x\in {\Sigma }^n)\},$$

$$\displaystyle\max_{a_{o}\in\Sigma^{n}_{o}}\gamma_{2}\Big{(}1-\sum_{t=0}^{d_{o}}\rho(H(a_{o},a_{x}),t)\Big{)}-\gamma_{4}H(a_{o},a_{x}).$$

$${\gamma }_2\sum _{a\in \mathcal{A}}{\alpha }_a\sum _{y\in {\Sigma }^n}\ell (a_o,y)p(y|a_x)-{\gamma }_4\sum _{a\in \mathcal{A}}{\alpha }_{a}H(a_o,a_x)$$

$$=$$

$$r(h(a_x)):=\underset{\hslash \in \{h(a_x)\}}{\max }{\gamma }_2-{\gamma }_4\hslash -{\gamma }_2\sum _{t=0}^{d_o}\rho (\hslash ,t),$$

$$U(\alpha ,\pi )=$$

$$+$$

$$(a_o^{\ast },a_x)\sim ({\tilde{a}}_o^{\ast },{\tilde{a}}_x)\iff h(a_x)=Ph(a_x^{\prime }),$$

$${\gamma }_3\sum _{j=0}^{d_o}{\pi }_j$$

$$={\gamma }_3\sum _{j=0}^{d_o}{\pi }_j\sum _{x_o\in {\Sigma }_o^n}p(x_o)\sum _{{\tilde{x}}_o\in {\Sigma }_o^n}\rho (H({\tilde{x}}_o,x_o),j)$$

$$={\gamma }_3\sum _{j=0}^{d_o}{\pi }_j\sum _{x_o\in {\Sigma }_o^n}p(x_o)\sum _{t=1}^{|{\Sigma }_o^n|}\rho (h_t(x_o),j).$$

$$U(\alpha ,\pi )$$

$$\displaystyle+\sum_{a\in{\cal A}^{d}/\sim}\alpha_{a}\bigg{(}r(h(a_{x}))+\gamma_{1}\sum_{j=0}^{d_{o}}\sum_{t=1}^{|\Sigma^{n}_{o}|}\rho(h_{t}(a_{x}),j)\bigg{)}$$

$$\displaystyle+\sum_{j=0}^{d_{o}}\pi_{j}\bigg{(}\gamma_{3}\sum_{x_{o}\in\Sigma^{n}_{o}}p(x_{o})\sum_{t=1}^{|\Sigma^{n}_{o}|}\rho(h_{t}(x_{o}),j)\bigg{)}.$$

$$U(\alpha ,\pi )$$

$$\displaystyle+\sum_{i=1}^{\kappa}\alpha_{i}\bigg{(}r(h(a_{x}^{i}))+\gamma_{1}\sum_{j=0}^{d_{o}}\sum_{t=1}^{\tau}\rho(h_{t}(a_{x}^{i}),j)\bigg{)}$$

$$\displaystyle+\sum_{j=0}^{d_{o}}\pi_{j}\bigg{(}\gamma_{3}\sum_{x_{o}\in\Sigma^{n}_{o}}p(x_{o})\sum_{t=1}^{\tau}\rho(h_{t}(x_{o}),j)\bigg{)}.$$

$$\sum _{t=1}^{\tau }\rho (h_t(a_x^i),j)\text{mbox}and\sum _{t=1}^{\tau }\rho (h_t(x_o^i),j),$$

$$U(\alpha ,\pi )=-{\gamma }_1{\alpha }^{\prime }\Phi \pi +{\alpha }^{\prime }(r+{\gamma }_1\Phi 1)+{\gamma }_3{p}_o^{\prime }{\Phi }_o\pi ,$$

$$\sum _{t=1}^{\tau }\rho (h_t(a_x^i),j),$$

$$\sum _{t=1}^{\tau }\rho (h_t(a_x^i),j)$$

$$=\sum _{m=0}^n{\delta }_i^m\rho (m,j),$$

Full text

I Introduction

Machine learning is one of the key enabling technologies for autonomous vehicles. An autonomous vehicle can learn how to recognize the surroundings and can base its strategic decisions on the information learnt. It is only a matter of time for autonomous driving to replace of human drivers completely. However, for the time being, there are still important, yet not completely addressed, challenges for autonomous driving. Road-sign classification is one of these challenges. Varying weather conditions, changing lighting throughout the day and occlusion are known to pose challenges to road-sign recognition/classification in real-time [1]. However, recently, it has been shown that there can also be physical adversarial modifications, e.g., stickers or graffiti, on the road signs to mislead the classification algorithms [2].

I-A Prior Literature

In the field of intelligent transportation systems, there have been extensive effort to mitigate the former challenge [3, 4, 5, 6, 7, 8, 9]. In [3], the authors have studied convolutional neural networks trained according to hinge loss stochastic gradient descent to achieve fast and stable convergence rates with substantial recognition performance. In [4] and [5], the authors have proposed text-based detection systems for traffic panels that could include information that can vary substantially. Computational complexity of the recognition algorithms plays a significant role for real-time applications since autonomous vehicles are time-critical systems [6, 7]. In [6], the authors have sought to enhance the performance of convolutional neural networks for faster performance in real-time applications through localization of the traffic-signs in the input images based on their types. In [7], the authors have proposed kernel-based extreme learning machines with deep perceptual features to achieve comparable performance to hinge-loss stochastic gradient based convolutional neural networks (proposed in [3]) with reduced computational complexity. Tree-based hierarchical structures have also been proposed to achieve coarse-to-fine road sign detection [8, 9].

Different from the previous works [3, 4, 8, 5, 6, 9, 7], however, in this paper, we seek to address the latter challenge, i.e., road-sign classification in adversarial environments, where there can be an intelligent attacker modifying road signs physically as exemplified in [2]. Especially for vision-based classification algorithms, it is an important issue that an attacker could craft the input through perturbations that are imperceptible for humans (i.e., a human would still easily classify the input correctly) while the algorithm classifies the input as the attacker’s targeted class [10, 11, 12, 13, 2]. Such an input sample is called adversarial example [10]. Recently, substantial amount of defense methods have been proposed to make machine learning algorithms robust against adversarial scenarios. These defense methods have been developed to provide robustness against certain classes of attacks, and it has been shown that it is possible to bypass them all via small modification of the attacks [12].

I-B Smart Road Signs

Our goal, here, is to achieve reliable identification of road signs by smart vehicles without limiting the solution to learning-based techniques. Particularly, we can view the road-sign classification problem from a wider perspective as a communication problem. The road sign and smart vehicle can be viewed as a transmitter and a receiver, respectively. Then, the message is the type of the road sign, the signal carrying that message is the physical road sign, and the signal received is its digital image taken by the smart vehicle. The relation in between the signals sent and received, i.e., physical road sign and its digital image, can be modeled via a noisy channel that can lead to errors in the transmitted message. Based on this viewpoint, we can reconfigure this information flow by also designing the signal, i.e., the physical road sign, via the well-established tools developed in communication theory.

How we can re-design physical road signs and which medium we can choose to transmit information are only limited by our imagination and the corresponding financial burden to adapt the infrastructure. For example, at each road sign, we could have included road side units that can transmit the message via dedicated short range communication (DSRC) radios [14, 15] although there might also be adversarial interventions on those radio signals [15, 16]. However, the future trend in road signs is to include (e.g., infrared) smart codes that can be read by smart vehicles as illustrated figuratively in Fig. 1(b) [17, 18]. Such smart codes provide flexibility in transmiting more information to smart vehicles instead of just the type of road signs.

Remark*.*

Due to the regularity of smart codes, e.g., see Fig. 1, we can identify them via image processing techniques instead of learning-based techniques. For example, in [19], the authors use a simularity measure to identify the countdown numbers in a traffic light, instead of traditional number recognition algorithms. Furthermore, quick response (QR) codes constitute another example where we can incorporate image processing techniques to identify the underlying code, e.g., [20].

We can attain reliable information transmission with certain formal guarantees when we construct the smart codes via error-correction methods. Particularly, in coding theory, error correction methods introduce redundancy to signals, i.e., codewords, in order to recover the underlying message as accurately as possible when there is a noisy channel that can perturb the signal [21]. Correspondingly, if the amount of perturbation on the smart code, due to some physical modifications as seen in Fig. 1(d), were less than half of the minimum distance between any two codewords, then we could have recovered the underlying codeword without any error. However, this is not the end of the story as explained below.

I-C Motivation

Recall that physical adversarial examples in visual tasks are defined as inputs crafted by an intelligent attacker in order to mislead the classification algorithms while a human can still classify it accurately without any difficulty [2, 13]. This challenge is important to mitigate in order to attain a comparable performance with human drivers. However, such a threat model is not appropriate for smart codes since they will not be visible to humans and even if they were visible, they are not interpretable by humans manually easily. Since humans are out of the loop, there will not be such a constraint limiting the perturbation amount on the attack that we are seeking to defend against. In the literature of communication in adversarial environments [22, 23], it is evident that it will not be sufficient for smart codes to be robust against just small scale perturbations if the adversary is powerful to launch large scale perturbation. Therefore, we introduce a new threat model where the intelligent adversary can also perturb the input at large scale in order to lead to erroneous decoding.

Given a codeword received, our goal is to detect whether there exists an adversarial intervention or not, e.g., as illustrated in Fig. 1(e). Note that the perceived codeword might differ from the original codeword not only due to adversarial intervention but also due to random perturbations that inevitably appear in the process of interpreting the infrared image of the smart code. Indeed, the presence of such random perturbations is the main reason to incorporate error correction methods while constructing the smart codes. Note also that an intelligent attacker attacks by taking the detection mechanisms into account. Correspondingly, while designing the detection strategy, we need to anticipate the reaction of the attacker. However, one-level depth reasoning where the detector designs the strategy by anticipating the reaction of the attacker would not be effective if the attacker has taken this proactive defense into account and has reacted in a way that can undermine it. In [12], the authors have shown this phenomenon by bypassing the state-of-the-art defense mechanisms through strategic modification of the attack (those mechanisms defend against). To mitigate this issue, we propose to design the detection strategies under the solution concept of game theoretical equilibrium [24]. However, this paper is definitely not the first one approaching the adversarial classification (or intervention detection) problem through a game-theoretical lens. In the following, we review these studies.

I-D Game Theoretical Approaches

In [25], the authors have introduced a non-zero sum game between an attacker and a classifier; however, they have not studied any notion of equilibrium. In [26, 27], the authors have studied adversarial prediction problems for a certain class of learners, e.g., support-vector-machines, in terms of Nash and Stackelberg equilibria, respectively. Recently, in [28], the authors have analyzed adversarial binary-classification as a non-zero sum game between an attacker and a classifier. The classifier seeks to detect whether the input is coming from the attacker or from a known benign-distribution. On the other side, the attacker seeks to maximize his reward (which depends on the input) without being detected by the classifier. The authors have shown that the classifier can restrict the strategies to mixtures of classifiers setting threshold on the reward of the attacker without any loss of generality. However, the results in [28] cannot be extended to our problem setting since the codeword attacked can also be perturbed randomly in the process of reading it. Due to that randomness, different attacks with different rewards can lead to the same codeword received. Therefore, given the received codeword, the defender cannot know the attacker’s reward to compare it against such a threshold.

I-E Our Contributions

In this paper, we propose an adversarial intervention detection mechanism for smart road signs in order to ensure reliable recognition by smart vehicles. We model the interaction between the detection mechanism and attackers as a zero-sum Stackelberg game [24] where the detector is the leader. Particularly, attackers can attack road signs by physically modifying their smart codes at large or small scales, as illustrated in Fig. 1(d), while knowing the detection mechanism. The detector seeks to minimize a performance metric that includes cost of losing the opportunity of preventing future attacks by not being able to detect it now, cost of adversary-induced decoding errors or failures, false alarm cost, and easiness of deceptive perturbations. Against the worst-case attacker who seeks to maximize the detector’s performance metric, the detector designs a randomized detection rule based on the distance between the received codeword and the decoder output, i.e., error rate.

The game theoretical solution concept yields that the detector needs to anticipate the attacker’s best reaction to the proposed detection policy. However, large size of the attacker’s strategy space can lead to computational issue while computing the best detection rule offline. To this end, we examine the attacker’s actions and show that the attacker can be viewed as selecting an action from a quotient space of the actual attack space with respect to a certain equivalence relation, which will be described in detail in Subsection IV-A. However, that quotient space can still be large to search over if there are many distinct road signs. Accordingly, we provide a method to relax the attack space to address such computational issues in Subsection IV-C. This conservative relaxation where the attacker is viewed to possess more power than in practice enables us to transform the problem into an efficient linear program (LP) with substantially smaller size. In addition to game theoretical results, we also analyze the performance of the proposed detection mechanism numerically over various scenarios.

Our main contributions are as follows:

• •

To the best of our knowledge, this is the first work in the literature to address adversarial intervention on smart road signs within a game theoretical framework.

• •

The randomized detection rule developed under the solution concept of game theoretical equilibrium ensures robustness against the worst-case attacker that attacks to maximize the cost for the detector while knowing the detection mechanism.

• •

By relaxing the attacker’s strategy space, we provide an efficient (offline) LP-based algorithm to compute the best randomized detection strategy, which can reduce the verification complexity.

The paper is organized as follows: In Section II, we provide preliminary information about error-correction coding. In Section III, we formulate the problem. In Section IV, we analyze the equilibrium of the game. We provide numerical examples in Section V. We conclude the paper and identify possible research directions in Section VI.

Nomenclature

Problem Setting:

${[n,k,d]}_{q}$

linear block code

$n\in\mathbb{Z}$

codeword length

$k\in\mathbb{Z}$

message length

$d\in\mathbb{Z}$

(minimum) distance of the code

$d_{o}=\lfloor(d-1)/2\rfloor$

error-correction diameter

$\Sigma$

alphabet of the symbols

$q=|\Sigma|$

alphabet size

$\Sigma^{n}$

set of all codewords

$\Sigma^{n}_{o}\subset\Sigma^{n}$

set of encoded codewords

$\Sigma^{n}_{d}\subset\Sigma^{n}$

set of decodable codewords

$x_{o}\in\Sigma^{n}_{o}$

encoded codeword

$y\in\Sigma^{n}$

received (noisy) codeword

$\hat{y}\in\Sigma^{n}_{o}$

decoder output for decodable $y$

$p(y|x)$

noisy channel

$p(x_{o}),x_{o}\in\Sigma^{n}_{o}$

probability of $x_{o}\in\Sigma^{n}_{o}$

$p_{e}\in{[0,1]}$

probability of error in a symbol

$H:\Sigma^{n}\times\Sigma^{n}\rightarrow\mathbb{Z}$

Hamming distance

Game Setting:

${\cal G}$

road-sign classification game

$\mathcal{P}_{A}$

Attacker

$\mathcal{P}_{D}$

Detector

$U(\alpha,\pi)$

$\mathcal{P}_{D}$’s cost function

$\pi\in[0,1]^{d_{o}+1}$

$\mathcal{P}_{D}$’s randomized detection rule

$a_{o}\in\Sigma^{n}_{o}$

attacked codeword

$a_{x}\in\Sigma^{n}$

crafted codeword

$a=(a_{o},a_{x})$

$\mathcal{P}_{A}$’s (pure) action

${\cal A}=\Sigma^{n}_{o}\times\Sigma^{n}$

$\mathcal{P}_{A}$’s action space

$\alpha=\{\alpha_{a}\}\in\Delta^{|{\cal A}|-1}$

$\mathcal{P}_{A}$’s mixed strategy

$\ell:\Sigma^{n}_{o}\times\Sigma^{n}\rightarrow\{0,1\}$

loss due to decoding error/failure

$\gamma_{j}\geq 0,j=1,\ldots,4$

multiplicative factors

II Preliminaries in Error Correction Coding

Error correction codes provide certain formal guarantees for the transmission of digital data over noisy channels as long as the deviation on the message sent due to random/intelligent noise is less than a certain threshold with respect to a certain distance metric [21]. Since a smart code can be viewed as a finite-size block and perturbations can be viewed as Boolean operations, e.g., flipped bits, we specifically consider linear block codes, which encode data in blocks. They are called linear because any linear combination of codewords is also a codeword. Formally, a linear block code, denoted by $[n,k,d]_{q}$, operates over a finite alphabet of symbols whose size is denoted by $q\in\mathbb{Z}$, and maps $k\in\mathbb{Z}$ symbols to $n\in\mathbb{Z}$ symbols. The (minimum) distance of a block, denoted by $d\in\mathbb{Z}$, is the minimum number of positions where any two distinct codewords differ, i.e., the Hamming distance [21] in-between the distinct codewords. The abstraction of the code via $[n,k,d]_{q}$ enables us to study all the linear block codes in a unified way.

We emphasize that the Singleton bound [29, 30] that all linear block codes satisfy is given by

[TABLE]

where the equality holds for Reed-Solomon codes [31]. Furthermore, the minimum distance $d$ implies that the block code can detect $d-1$ symbol errors and correct up to

[TABLE]

symbol errors since there exists no other codeword within $d-1$ diameter of each codeword.

Consider that the number of symbol errors, denoted by $e\in\mathbb{Z}$, is more than half of the minimum distance, i.e., $e>d_{o}$. We say that a decoding error exists if the Hamming distance between the received codeword and any other codeword is less than or equal to $d_{o}$, i.e., if we decode it erroneously. Further, we say that a decoding failure exists if the Hamming distance between the received codeword and all the other codewords is more than $d_{o}$, i.e., if the received codeword is not decodable [32].

III Problem Formulation

Consider that road signs are encoded into smart codes via a linear block code $[n,k,d]_{q}$, and there exist two players: an attacker ($\mathcal{P}_{A}$) and a detector ($\mathcal{P}_{D}$), as seen in Fig. 2. Given the encoding-decoding scheme and the underlying statistical profiles, $\mathcal{P}_{D}$ seeks to detect any intervention by $\mathcal{P}_{A}$ while $\mathcal{P}_{A}$ seeks to modify the smart codes physically, as exemplified in Fig. 1(d), in order to lead to decoding error/failure stealthily.

Noise Model. The decoder reads a noisy version of the smart code due to, e.g., lighting-induced blurring or harsh weather conditions. Let $\Sigma^{n}$ denote the codeword space. Then, we model this noise via a probability transition mapping $p(y|x)$ corresponding to the probability of receiving codeword $y\in\Sigma^{n}$ given that the transmitted codeword is $x\in\Sigma^{n}$. We suppose that all the symbol errors by nature are equally likely and independent of each other. We denote the probability that there can be an error in a symbol by $p_{e}\in[0,1]$. We also suppose that the change of the symbol to any other symbol in the alphabet is equally likely in a symbol error.

Remark* (Symbol Error).*

In a codeword, a symbol consists of multiple contiguous bits. A symbol error occurs if at least one of these bits is perturbed. Correspondingly, if random perturbations infect multiple contiguous bits, the number of symbol errors is an appropriate distance measure. This is indeed the case in smart road signs due to possible obfuscation by plants or graffiti or adversarial stickers as studied in [2] or as illustrated in Fig. 1(d). When there are blurring due to lighting throughout a day, fading colors, or weather conditions, we would also expect perturbations on multiple contiguous bits, instead of perturbations on single isolated bits (which may require surgical-like precision due to the relatively small size of a single bit). Furthermore, error-correction codes, e.g., Reed-Solomon codes, provide effective guarantees against symbol errors.

Defense Model. $\mathcal{P}_{D}$ has multiple objectives:

• $O1)$

to minimize the cost of losing the opportunity to prevent future attacks by not being able to detect it now,

• $O2)$

to minimize the cost associated with adversary-induced decoding error/failure,

• $O3)$

to minimize the cost associated with false alarms,

• $O4)$

to maximize the number of symbol errors necessary to deceive the decoder.

We model $\mathcal{P}_{D}$’s cost function as a linear combination of these objectives with certain multiplicative factors, which give flexibility to control the weight of the corresponding objective as desired. This cost function will be defined explicitly in the game model.

We let $\Sigma^{n}_{o}\subset\Sigma^{n}$ denote the set of encoded codewords, i.e., there exists bijective relation in-between $\Sigma^{n}_{o}$ and the set of road signs. We also let $\Sigma^{n}_{d}\subset\Sigma^{n}$ denote the set of decodable codewords that are within $d_{o}$ diameter of a codeword in $\Sigma^{n}_{o}$. If $y\in\Sigma^{n}_{d}$, we denote the decoder output by $\hat{y}\in\Sigma^{n}_{o}$. The loss due to decoding error/failure is given by

[TABLE]

If $y\in\Sigma^{n}_{d}$, $\mathcal{P}_{D}$ can report an issue against the possibility of adversarial intrusion so that further (costly) investigations can take place. To this end, $\mathcal{P}_{D}$ designs a randomized detection rule $\pi\in[0,1]^{d_{o}+1}$, where $\pi_{j}$, $j=0,\ldots,d_{o}$, corresponds to the probability of triggering an alert for $j$ symbol errors. If $y\notin\Sigma^{n}_{d}$, further investigations always take place.

Remark* (Scalable Defense).*

We consider a randomized detection rule depending on the number of symbol errors for scalability. If $\mathcal{P}_{D}$ were to select a (randomized) detection rule based on the received codeword, then $\mathcal{P}_{D}$ would select a vector over the space $[0,1]^{|\Sigma^{n}|}$, which is $q^{n}$ dimensional. Note that $q^{n}$ is exponential in the number of symbols $n$ whereas $d_{o}+1\ll q^{n}$ is linear in $n$.

Threat Model. $\mathcal{P}_{A}$ is the worst case attacker who maximizes $\mathcal{P}_{D}$’s cost function. To this end, $\mathcal{P}_{A}$ can select which road sign to attack. Let $a_{o}\in\Sigma^{n}_{o}$ denote the codeword of the attacked road sign. Then, $\mathcal{P}_{A}$ can craft $a_{o}\in\Sigma^{n}_{o}$ to $a_{x}\in\Sigma^{n}$ by introducing error in order to control the decoder output. The complexity of this crafting is given by the number of symbols changed, i.e., $H(a_{o},a_{x})$. We denote $\mathcal{P}_{A}$’s action space by ${\cal A}:=\Sigma^{n}_{o}\times\Sigma^{n}$ and denote $\mathcal{P}_{A}$’s action by $a:=(a_{o},a_{x})$. $\mathcal{P}_{A}$ can select a mixed strategy $\alpha=\{\alpha_{a}\}$ over ${\cal A}$ such that $\alpha_{a}$ denotes the probability of taking action $a=(a_{o},a_{x})\in{\cal A}$, i.e., attacking the codeword $a_{o}\in\Sigma^{n}_{o}$ and crafting it to $a_{x}\in\Sigma^{n}$.

Game Model. We consider a zero-sum game setting where $\mathcal{P}_{D}$ seeks to minimize the cost function:

[TABLE]

against the worst-case $\mathcal{P}_{A}$ who seeks to maximize (III). We define certain multiplicative factors $\gamma_{j}\geq 0$, $j=1,2,3,4$, corresponding, respectively, to $\mathcal{P}_{D}$’s objectives $O1)-O4)$. Note that minimization of the expected cost due to the uncertainty of the channel $p(y|x)$ is in-line with the expectation-over-transformation framework proposed in [13]. The attackers can generate robust attacks by considering the expected impact of the uncertainties due to the channel [13].

Remark* (Attack Probability).*

If $\mathcal{P}_{D}$ has a priori information $p_{a}\in[0,1]$ corresponding to the probability of adversarial intervention, then we can incorporate this into (III) by selecting the multiplicative factors accordingly. For example, the objectives $O1)$, $O2)$, and $O4)$ matter if there is an adversarial intervention while the objective $O3)$ matters if there is no adversarial intervention. To this end, we can scale up $\gamma_{1}$, $\gamma_{2}$, and $\gamma_{4}$ by $p_{a}$ while scaling up $\gamma_{3}$ by $1-p_{a}$.

We consider a hierarchical setting, where $\mathcal{P}_{A}$ can know (or learn) $\mathcal{P}_{D}$’s randomized detection algorithm, in order to avoid obscurity based defense, which can be bypassed when an advanced attacker learns the information in obscurity. Therefore, this interaction can be modeled as a Stackelberg zero-sum game111$\Delta^{d-1}\subset\mathbb{R}^{d}$ denotes the probability simplex formed by $d$ standard unit vectors.

[TABLE]

where $\mathcal{P}_{D}$ is the leader and $\mathcal{P}_{A}$ is the follower. Since $\mathcal{P}_{A}$ is the follower and reacts to $\mathcal{P}_{D}$’s strategy $\pi\in[0,1]^{d_{o}+1}$, the problem faced by the detector is given by

[TABLE]

The following proposition shows that there exists an equilibrium to the game ${\cal G}$.

Proposition 1** (Existence Result).**

There exists a pair of $\mathcal{P}_{D}$’s strategy and $\mathcal{P}_{A}$’s reaction $(\pi^{*},B(\pi^{*}))$ attaining the Stackelberg equilibrium ${\cal G}$, i.e., satisfying (6).

Proof.

Note that $U(\alpha,\pi)$ is linear, and correspondingly, continuous in the optimization arguments $\alpha\in\Delta^{|{\cal A}|-1}$ and $\pi\in[0,1]^{d_{o}+1}$, and the constraint sets are decoupled. Therefore the maximum theorem [33] yields that

[TABLE]

is a continuous function of $\pi\in[0,1]^{d_{o}+1}$. Then, since $[0,1]^{d_{o}+1}$ is a compact set, the extreme value theorem yields that there exits a solution for (6). ∎

In the following section, we analyze the equilibrium to ${\cal G}$.

IV Adversarial Intervention Detection Across Smart Road Signs

Existence of an equilibrium is guaranteed as shown in Proposition 1. However, computation of the equilibrium can be demanding (even if it is an offline computation) since $\mathcal{P}_{A}$ has a large strategy space, even for short codewords. In this section, our goal is to examine $\mathcal{P}_{A}$’s best response for efficient computation of the best detection rule. To this end, we first seek to formulate certain equivalence classes over $\mathcal{P}_{A}$’s actions such that all the actions in a class lead to the same outcome of the game (see, Subsection IV-A). However, depending on the size of the input space, i.e., $\Sigma^{n}$, computation of the equilibrium may still be demanding for that quotient space. In order to avoid such a computational issue for long codewords that can express relatively larger collection of road signs, we relax the constraints on $\mathcal{P}_{A}$’s action space, which will lead to more powerful attacker than in practice (see, Subsection IV-C). This yields a conservative defense, which leads to lower cost against the actual attacker who is relatively less powerful in run-time applications. Finally, we transform the problem into an efficient LP, rather routinely, in order to apply existing powerful computational tools to compute the best detection rule. We now provide the details of these steps.

Our goal is to compute the best detection rule $\pi^{*}\in[0,1]^{d_{o}+1}$ with respect to the equilibrium (6). To this end, $\mathcal{P}_{D}$ needs to anticipate $\mathcal{P}_{A}$’s reaction to any selected detection rule. However, $\mathcal{P}_{A}$’s action space ${\cal A}$ has dimension $|{\cal A}|=q^{n+k}$, which is exponential in $n+k$. Therefore, finding the best reaction, i.e., a vector in $\Delta^{|{\cal A}|-1}$, for each detection rule is computationally demanding. Accordingly, in the following, we seek to reduce $\mathcal{P}_{A}$’s strategy space without losing the generality.

IV-A Equivalence Classes on $\mathcal{P}_{A}$’s Best Response

Fig. 3 provides a figurative illustration of how $\mathcal{P}_{A}$ can attack. Note that error-correction methods ensure that different encoded codewords are at least a certain number of symbols away from each other. For the code $[7,3,5]_{q}$ in Fig. 3, this minimum distance is $d=5$ symbols as exemplified in between $x_{o}^{1}$ and $x_{o}^{2}$. Any perturbation that can change at most $d_{o}=2$ symbols does not lead to any decoding error or failure. However, at certain directions, perturbations on $3$ symbols can lead to a decoding error, e.g., by carrying $x_{o}^{1}$ to the decodable region of $x_{o}^{2}$, or a decoding failure depending on how and which symbols are perturbed. Correspondingly, if $\mathcal{P}_{A}$ decides to attack on $a_{o}=x_{o}^{1}$, then $\mathcal{P}_{A}$ has several choices while physically damaging the corresponding smart code. In the following, we categorize those choices into four main groups:

• $C0)$

$\mathcal{P}_{A}$ may not attack, i.e., may not introduce any error.

• $C1)$

$\mathcal{P}_{A}$ may introduce relatively smaller amount of symbol error(s) such that the corrupted codeword is still in the decodable region of the associated codeword. Due to the channel, this can still lead to decoding error or failure with certain probabilities.

• $C2)$

$\mathcal{P}_{A}$ may introduce symbol errors such that the corrupted codeword becomes not decodable.

• $C3)$

$\mathcal{P}_{A}$ may introduce relatively larger amount of symbol errors such that the codeword intervened is in the decodable region of another codeword.

Even if there were not any detection rule, in Fig. 3, we observe that not attacking, i.e., $C0)$, or attacking relatively more aggressively, e.g., $C2)$ and $C3)$, are not necessarily more preferable for $\mathcal{P}_{A}$ than $C1)$ due to the noisy perturbations and the trade-off between the amount of perturbation and the gain of $\mathcal{P}_{A}$ by decoding error/failure. In the following, we examine the channel, which can lead to such intriguing results.

Recall that any symbol can be perturbed by the channel with the same probability $p_{e}$ while the symbol perturbed can change to any other symbol in the alphabet with the same probability, i.e., $1/(q-1)$. Then, the probability that $x$ turns into $y$ due to noisy channel can be written as

[TABLE]

which only depends on the distance in-between $y\in\Sigma^{n}$ and $x\in\Sigma^{n}$. Particularly, there are $n-H(y,x)$ symbols that match at $x$ and $y$. There should not be any perturbations on those symbols, which leads to the first multiplicative term on the right-hand-side of (8). For each symbol that does not match, the random perturbation must change the one at $x$ to the corresponding one at $y$ among $q-1$ equally likely alternatives, which leads to the second multiplicative term.

Since $p(y|x)$ only depends on $H(y,x)$, we define an auxiliary metric $\rho:\mathbb{Z}\times\mathbb{Z}\rightarrow[0,1]$, where $\rho(n_{1},n_{2})$ denotes the probability that two codewords that are $n_{1}\in\mathbb{Z}$ symbols away become $n_{2}\in\mathbb{Z}$ symbols away when one of them is randomly perturbed by the channel. Note that we can compute $\rho(\cdot)$ based on combinatorics analytically or using the Monte Carlo method [34] numerically. With this new auxiliary metric, let us take a closer look into the objectives $O1)$ and $O2)$, where the channel and $\mathcal{P}_{A}$ have impact on. Firstly, the term in parenthesis in $O1)$ can be written as

[TABLE]

where the under-braced term corresponds to the total probability that $a_{x}$ moves to $j$ symbols away from an encoded codeword due to the random noise. Similarly, we can write the inner summation in $O2)$ as

[TABLE]

where the first line follows since a detection error or failure occurs if the received codeword $y\in\Sigma^{n}$ is more than $d_{o}\in\mathbb{Z}$ symbols away from the codeword $a_{o}\in\Sigma^{n}_{o}$ before $\mathcal{P}_{A}$ crafts it into $a_{x}\in\Sigma^{n}$. The second line follows by the definition of the new auxiliary metric $\rho(\cdot)$.

Note that $O1)$ written according to (9) depends on the distance between $a_{x}\in\Sigma^{n}$ and all the encoded codewords $x_{o}\in\Sigma^{n}_{o}$. Similarly, only the distance between $a_{o}\in\Sigma^{n}_{o}$ and $a_{x}\in\Sigma^{n}$ has an impact on $O2)$ and $O4)$ while we also have $a_{o}\in\Sigma^{n}_{o}$. Therefore, the attacks that target $a_{o}$ have the same impact on the cost function (III) if the distances between $a_{x}$ and the encoded codewords are the same.

Indeed, there is a strong coupling on how $\mathcal{P}_{A}$ would select $a_{o}$ and $a_{x}$ independent of $\mathcal{P}_{D}$’s strategy. Particularly, (9), and correspondingly $O1)$, do not include $a_{o}\in\Sigma^{n}_{o}$. On the other side, the objectives $O2)$ and $O4)$, which include $a_{o}\in\Sigma^{n}_{o}$, do not include $\pi\in[0,1]^{d_{o}+1}$. Therefore for given $a_{x}\in\Sigma^{n}$, $\mathcal{P}_{A}$ can select $a_{o}\in\Sigma^{n}_{o}$ irrespective of $\mathcal{P}_{D}$’s detection rule. Based on this observation in the following lemma, we eliminate weakly dominated actions of $\mathcal{P}_{A}$ in order to reduce the size of $\mathcal{P}_{A}$’s strategy space.

Lemma 1**.**

In the game ${\cal G}$, without loss of generality, we can restrict $\mathcal{P}_{A}$’s action space ${\cal A}$ into

[TABLE]

where $a_{o}^{*}$ is the maximizer of the optimization problem:

[TABLE]

Proof.

The terms corresponding to $O2)$ and $O4)$ in (III) can be written as

[TABLE]

which follows by (11). Since $\mathcal{P}_{A}$ seeks to maximize the cost (III), for each $a_{x}\in\Sigma^{n}$, we can compute the associated optimal attacked codeword, i.e., $a_{o}^{*}$, via (13), where a solution is guaranteed to exists since the constraint set $\Sigma^{n}_{o}$ is finite. ∎

Note also that (9), (11), and (13) depend only on the distances between $a_{x}\in\Sigma^{n}$ and all the encoded codewords. Therefore, for a given detection rule, any other $\tilde{a}_{x}\in\Sigma^{n}$ that has the same set of distances to the encoded codewords would lead to the same cost (III). Correspondingly, we define another auxiliary function $h:\Sigma^{n}\rightarrow\mathbb{Z}^{|\Sigma^{n}_{o}|}$ such that $h(a_{x})$ is a vector whose $t$th entry, denoted by $h_{t}(a_{x})$, corresponds to the distance in-between $a_{x}$ and the $t$th encoded codeword (with respect to a certain order in $\Sigma^{n}_{o}$). Then, given $h(a_{x})$, (13) can be written as

[TABLE]

where $\{h(a_{x})\}$ denotes the set including the entries of the vector $h(a_{x})$. We can view $r(h(a_{x}))$ as the reward of $\mathcal{P}_{A}$ for $h(a_{x})$. Therefore, by (9), (11), and (15), the cost function $U(\alpha,\pi)$ can be written as

[TABLE]

The following lemma recaps these results to formulate the equivalence classes on $\mathcal{P}_{A}$’s best response.

Lemma 2**.**

Without loss of generality, instead of mixing over ${\cal A}$, $\mathcal{P}_{A}$ can select a mixed strategy across the quotient set ${\cal A}^{d}/\sim$ with respect to the following equivalence relation:

[TABLE]

for some permutation matrix $P\in\{0,1\}^{|\Sigma^{n}_{o}|\times|\Sigma^{n}_{o}|}$.

Proof.

The cost function, as written in the form of (16), depends on $a_{x}\in\Sigma^{n}$ only with respect to the distances between $a_{x}\in\Sigma^{n}$ and the encoded codewords $x_{o}\in\Sigma^{n}_{o}$ while the specific identities of the encoded codewords do not impact the cost function. Correspondingly, any permutation of the distances across the encoded codewords would lead to the same cost. ∎

In order to facilitate the analysis of the equilibrium, we, next, seek to write the cost function (20) in a compact form.

IV-B Equilibrium in Compact Form

Up to now, we have focused on the objectives except $O3)$, on which $\mathcal{P}_{A}$’s strategy does not have direct impact. Similar to (9), via the auxiliary functions $\rho(\cdot)$ and $h(\cdot)$, we can write $O3)$ as

[TABLE]

By including (19) in (16) and invoking Lemma 2, we can write the cost function in a way that confines the impact of the channel into the auxiliary metric $\rho(\cdot)$:

[TABLE]

Consider a certain order over the quotient space ${\cal A}^{d}/\sim$ such that, with a slight abuse of notation, $\alpha_{i}$ corresponds to the mixed strategy for the $i$th action in ${\cal A}^{d}/\sim$. For notational simplicity, we also let $\kappa:=|\,{\cal A}^{d}/\sim|$ and $\tau:=|\Sigma^{n}_{o}|$. Then, (20) can be written as

[TABLE]

which can also be transformed into a compact vectoral form. To this end, we define the vectors $r\in\mathbb{R}^{\kappa}$ and $p_{o}\in\mathbb{R}^{\tau}$, whose $i$th entries are given by $r(h(a_{x}^{i}))$ and $p(x_{o}^{i})$, respectively. We also introduce the matrices $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ and $\Phi_{o}\in\mathbb{R}^{\tau\times(d_{o}+1)}$ whose $i$th row and $(j+1)$th column entries are given by

[TABLE]

respectively. We note the shift at the column entries since we have $\pi_{j}$, $j=0,\ldots,d_{o}$ instead of $1,\ldots,d_{o}+1$. Then, we can write (20) as

[TABLE]

which facilitates the computation of the equilibrium. However, the size of ${\cal A}^{d}/\sim$ can lead to computational issues for long codewords, i.e., large $n$, even though it has relatively smaller size compared to ${\cal A}$ without losing any generality as shown in Lemma 2. To mitigate this issue, in the following, we relax the attack space so that the size of the problem can be reduced further based on the derived equivalence relation (17).

IV-C Relaxing Attack Space at Large Scales

The cost function in the compact form (23) implies that we need to focus on the first and second additive terms that include $\mathcal{P}_{A}$’s mixed strategy in order to reduce $\mathcal{P}_{A}$’s strategy space. Note that on those additive terms, $\alpha$ is multiplied by the matrix $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ and the vector $r\in\mathbb{R}^{\kappa}$. We can seek to exploit certain properties of $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ and $r\in\mathbb{R}^{\kappa}$. To this end, we will first show that the matrix $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ can be written as in (28), where $\delta_{i}\in\mathbb{Z}^{n+1}$ is a vector which can be viewed as the histogram of the distances from $a_{x}^{i}$ to the encoded codewords, i.e., $h(a_{x}^{i})$. Next, we will examine $h(a_{x}^{i})$ in order to formulate necessary conditions on the histogram $\delta_{i}$. By only considering those necessary conditions, we relax $\mathcal{P}_{A}$’s strategy space such that he/she selects a mixed strategy from a strategy space with substantially smaller size. Now, we provide the technical details step by step.

Step-$1$. A Closer Look at the Matrix $\Phi$: Recall that the $i$th row and the $(j+1)$th column entry of $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ is given by

[TABLE]

where the summation is taken across all the encoded codewords. However, we can separate this summation into sub-summations with respect to the distance from $a_{x}^{i}$ to the encoded codewords. In particular, we have

[TABLE]

where $\delta_{i}^{m}\in\mathbb{Z}$ denotes the number of encoded codewords that are $m$ symbols away from $a_{x}^{i}$, and the second line follows since $h_{t}(a_{x}^{i})=m$ for all $t$ that satisfies $H(a_{x}^{i},x_{o}^{t})=m$. Correspondingly, for each $a_{x}^{i}\in\Sigma^{n}$, $i=1,\ldots,\kappa$, we define the following $n+1$ dimensional vector

[TABLE]

Then, (26) and (27) yield that $\Phi\in\mathbb{R}^{\kappa\times(d_{o}+1)}$ can be written as

[TABLE]

Note that all the entries of $\delta_{i}\in\mathbb{Z}^{n+1}$, $i=1,\ldots,\kappa$, are non-negative integers and sum to the number of all encoded codewords $\tau$. However, these are not necessarily sufficient conditions. Note also that we can view the vector $\delta_{i}$ as the histogram of the entries of $h(a_{x}^{i})$. Based on this observation, in the following, we seek for tighter necessary conditions on $\delta_{i}$ by examining $h(a_{x}^{i})$.

Step-$2$. An Upper Bound on $\min h(\cdot)$: We first examine the minimum possible distance between an arbitrary codeword and an encoded codeword. Note that a codeword consists of the message and redundantly added symbols:

[TABLE]

For each message in $\Sigma^{k}$, there exists a unique encoded codeword. Correspondingly the minimum distance between an arbitrary codeword $a_{x}\in\Sigma^{n}$ and encoded codewords, i.e., $\min h(a_{x})$, can be at most $n-k$ since the message part of $a_{x}$ matches with at least one encoded codeword completely. Therefore, formally, we have

[TABLE]

Step-$3$. A Gap in the Ordered $\{h(\cdot)\}$: Since the codewords are encoded such that they are distributed across $\Sigma^{n}$ with maximum distance in between them, if an arbitrary codeword is relatively close to one of the encoded codewords, e.g., if it is inside the decodable region, the distances between that arbitrary codeword and the other encoded codewords are relatively large. In other words, when we list all the distances from that arbitrary codeword to the encoded codewords in ascending order, then there will be a jump between the distance to the closest one and the distance to the second closest one. For example, if $a_{x}=x_{o}$, then there is no other encoded codeword within a diameter of $d-1$ symbols away from $a_{x}$.

Particularly, if $a_{x}\in\Sigma^{n}$ is in a decodable region of an encoded codeword, e.g., $x_{o}\in\Sigma^{n}_{o}$; then $x_{o}$ is the encoded codeword closest to $a_{x}$, i.e., $\min h(a_{x})=H(x_{o},a_{x})$, and there exists only that encoded codeword within $d-\min h(a_{x})-1$ diameter.

Step-$4$. A Contiguousness Assumption on the Ordered $\{h(\cdot)\}$: We have formulated certain necessary conditions on the distance from an arbitrary codeword to the closest and second closest encoded codewords. For the distances to the other encoded codewords, we observe that at large scales, the number of messages $q^{k}$, i.e., the number of encoded codewords, is significantly larger than the length of the codewords $n$. We suppose that if $\min h(a_{x})\leq d_{o}$, then there exists at least one encoded codeword at the distances $d-\min h(a_{x}),\ldots,n$. Otherwise, i.e., if $\min h(a_{x})>d_{o}$, there exists at least one encoded codeword at all the distances starting from the closest one $\min h(a_{x})$ to $n$. In particular, formally, we suppose that

[TABLE]

since $d-\min h(a_{x})\geq\min h(a_{x})$ if $a_{x}$ is in the decodable region of an encoded codeword, i.e., $\min h(a_{x})\leq d_{o}=\lfloor(d-1)/2\rfloor$.

Step-$5$. The Histogram Under Necessary Conditions: Based on the necessary conditions derived in Steps $2$-$4$, in the following, we formulate the necessary conditions on $\delta_{i}$ under two cases depending on $\min h(a_{x}^{i})$. If $a_{x}^{i}\in\Sigma^{n}$ is in a decodable region, i.e., $\min h(a_{x}^{i})\leq d_{o}$, then we have

[TABLE]

where $*$ corresponds to an unspecified positive integer. If $a_{x}^{i}\in\Sigma^{n}$ is not in any decodable region, i.e., $\min h(a_{x}^{i})>d_{o}$, then we have

[TABLE]

Step-$6$. Approximation Under Necessary Conditions: Note that the unspecified entries of $\delta_{i}$ may not necessarily take arbitrary values; however, we will relax this and suppose that the unspecified entries can be set to arbitrary values by $\mathcal{P}_{A}$ as long as they are all positive and all entries sum to $\tau$. As an illustration, when we concatenate $\delta_{i}$ for different scenarios where $\min h(a_{x}^{i})$ varies from [math] to $n-k$, we obtain the following $(n+1)\times(n-k+1)$ matrix:

[TABLE]

where the entry denoted by $0/*$ is [math] if $d$ is even, and is an unspecified positive integer if $d$ is odd. For example, the first column corresponds to $a_{x}^{i}$ whose $\min h(a_{x}^{i})=0$, which yields that the second closest encoded codeword can be as close as $d-\min h(a_{x}^{i})=d$ symbols away.

Step-$7$. $\mathcal{P}_{A}$’s Relaxed Strategy Space: Based on the relaxation that the unspecified entries can take any values, we seek to reduce $\mathcal{P}_{A}$’s strategy space, which is the main reason of all the steps we have taken up to now. To this end, we first recall that the unspecified entries are all positive and add up to a certain number, which is $\tau-1$ if $\min h(a_{x}^{i})\leq d_{o}$, and $\tau$ otherwise. Let us consider an arbitrary column in (34), e.g., $m$th column where $m>d_{o}$. Then, the set of all such possible $\delta_{i}$ is given by

[TABLE]

Correspondingly, the set of extreme points222We say that a point in a convex set is an extreme point if it cannot be expressed as a convex combination of two other points from that set. of this set is given by

[TABLE]

Note that any point in the set (35) can be expressed as a convex combination of its extreme points identified in (36).

Therefore, we can express any convex combination of $\delta_{i}$, $i=1,\ldots,\kappa$, by a convex combination of the columns of the matrix333We suppose that $d$ is odd, i.e., $d_{o}=(d-1)/2$. The matrix for the cases where $d$ is even can be computed accordingly. $\Lambda\in\mathbb{Z}^{(n+1)\times\nu}$ defined in (49), where

[TABLE]

and $n-k\geq d_{o}+1$ by the Singleton bound (1). In other words, under the relaxation, for any given mixed strategy $\alpha$ across ${\cal A}^{d}/\sim$, there exists a mixed strategy $\beta\in\Delta^{\nu-1}$ over the columns of $\Lambda$ such that we have

[TABLE]

which, by (28), yields that

[TABLE]

where $R\in\mathbb{R}^{(n+1)\times(d_{o}+1)}$, as defined in (28).

Step-$8$. A Closer Look at the Vector $r$: Next, we seek to compute the reward $r(a_{x}^{i})$. Recall that the reward for $a_{x}^{i}$ depends only on $\{h(a_{x}^{i})\}$, as defined in (15). However, $\{h(a_{x})\}$ depends only on $\min h(a_{x})$ as shown in Steps $2$-$4$. Therefore, (31) yields that $r(a_{x}^{i})$ depends mainly on the distance to the closest encoded codeword. Based on (15) and (31), we define an auxiliary vector $s\in\mathbb{R}^{n-k+1}$, where $s_{i}\in\mathbb{R}$, for $i=0,\ldots,n-k$, is given by

[TABLE]

where $\vee$ denotes the disjunction operation. This yields that $s_{i}\in\mathbb{R}$ corresponds to the reward when $\min h(a_{x})=i$.

Note that for all $a_{x}^{i}$ that have $\min h(a_{x}^{i})=m$, the associated reward is $s_{m}$. Therefore, with the mixed strategy $\beta\in\Delta^{\nu-1}$ introduced in Step-$7$, we have

[TABLE]

where $S\in\mathbb{R}^{(n-k+1)\times\nu}$, and the dimensions of the vector $\mathbf{1}$ at the $i$th row is $n-d+i$ if $i\leq d_{o}$, and $n-i$ if $i>d_{o}$.

Step-$9$. Transforming $\mathcal{P}_{D}$’s Strategy Space to a Simplex at a Higher Dimensional Space: Our goal, here, is to transform $\mathcal{P}_{D}$’s strategy into a mixed strategy at a higher dimensional space in order to be able to transform the problem into an LP as will be explained in detail later in this section. To this end, we can view $\pi\in[0,1]^{d_{o}+1}$ as $\mathcal{P}_{D}$ selects $d_{o}+1$ mixed strategies over two element sets, e.g., $\{0,1\}$. This yields that $\mathcal{P}_{D}$ selects a mixed strategy over the Cartesian product space of these sets, i.e., $\bigtimes_{i=0}^{d_{o}}\{0,1\}$, which is

[TABLE]

dimensional. For example, for $d_{o}=1$, the corresponding mixed strategy, denoted by $\sigma\in\Delta^{\mu-1}$, is over $\{[1,0,1,0]^{\prime},[1,0,0,1]^{\prime},[0,1,1,0]^{\prime},[0,1,0,1]^{\prime}\}$. This yields that there exists a matrix $\Pi\in\mathbb{R}^{(d_{o}+1)\times\mu}$ such that $\pi=\Pi\sigma$. As an example, for $d_{o}=1$, we have

[TABLE]

Step-$10$. New Compact Form: Eventually, for the relaxed attack strategies, we can write $\mathcal{P}_{D}$’s cost function in the following compact form:

[TABLE]

where $\beta\in\Delta^{\nu-1}$, $\sigma\in\Delta^{\mu-1}$, and

[TABLE]

which follows since we have $\mathbf{1}^{\prime}\beta=1$ and $\mathbf{1}^{\prime}\sigma$, which yields, e.g., $\beta^{\prime}S^{\prime}s=\beta^{\prime}S^{\prime}s\mathbf{1}^{\prime}\sigma$.

In the following lemma, we provide an LP to compute the best detection rule.

Lemma 3**.**

After the relaxation of $\mathcal{P}_{A}$’s strategy space, the best detection rule $\pi_{*}\in[0,1]^{d_{o}+1}$ is given by

[TABLE]

where $\omega_{*}\in\mathbb{R}^{\mu}$ is the solution of the following LP:

[TABLE]

where the positive matrix444We say that a matrix is positive if its all entries are positive. $\Xi_{+}\in\mathbb{R}_{+}^{\nu\times\mu}$ is defined by

[TABLE]

where $\epsilon>0$ and $\xi_{o}\in\mathbb{R}$ is the minimum entry of $\Xi$.

Proof.

Note that by definition, we have

[TABLE]

We are interested in only the upper value since we seek to compute the Stackelberg equilibrium where $\mathcal{P}_{A}$ selects the strategy $\sigma$ by knowing $\mathcal{P}_{D}$’s strategy $\beta$. However, since the objective functions are linear in the optimization arguments while the constraint sets are convex, decoupled, and compact, the minimax theorem [24] shows that

[TABLE]

which implies that the upper and lower values of the game are equal and that we have a saddle-point equilibrium in (45). Therefore, we can apply rather routine transformation of mixed-strategy equilibrium of zero-sum matrix games into an LP [24] in order to compute the best detection rule.

A sketch of the routine transformation of (45) into an LP [24] is as follows: $i)$ we show that the game (45) is strategically equivalent to a game where the game matrix is a positive matrix; $ii)$ we can write (45) as the minimization of $\mathcal{P}_{A}$’s best response; $iii)$ we can obtain a certain necessary condition on $\sigma$ in terms of $\mathcal{P}_{A}$’s best response since $\Delta^{\nu-1}$ is a simplex; $iv)$ through a change of variable, we can obtain the equivalent LP (48). ∎

Corollary 1**.**

The solution for the dual problem of (48), i.e.,

[TABLE]

yields that

[TABLE]

In the following section, we analyze the performance of the proposed detection mechanism numerically for various scenarios.

V Numerical Examples

The proposed framework can be applied to any linear block code since the analytical results are based only on the abstraction of the code, i.e., $[n,k,d]_{q}$. Therefore, in order to compute the detection rule, specific to the underlying encoding-decoding scheme, we need the configuration of the code, i.e., $[n,k,d]_{q}$, and the matrix $R\in\mathbb{R}^{(n+1)\times(d_{o}+1)}$, as defined in (28). At run-time, the detection mechanism triggers an alert based only on the number of mismatched symbols.

As numerical examples, in this section, we examine the performance of the proposed detection mechanisms for the smart codes that are constructed via Reed-Solomon coding [31]. Particularly, Reed-Solomon code (RS-Code) is a maximum distance separable code that maximizes the minimum distance between any two distinct codewords within the general class of linear block codes, and it has widely used applications, e.g., QR codes. The minimum distance of RS-Code $[n,k,d]_{q}$ is given by

[TABLE]

which is the Singleton bound (1) for the linear block codes. In practical implementations, the alphabet size is in general selected a prime power and length of codeword is set $n<q$, e.g., often $n=q-1$.

As illustrative examples, we examine the performance of the proposed detection mechanism for the RS-Codes: $[7,5,3]_{8}$, $[7,3,5]_{8}$, $[11,5,7]_{16}$, $[11,3,9]_{16}$, $[15,5,11]_{16}$, and $[15,3,11]_{16}$ such that the corresponding distances for the decodable regions are given by $d_{o}=1,2,3,4,5,6$, respectively. For each RS-Code, Table I tabulates the maximum number of distinct road signs that can be encoded, the number of bits in the codeword, i.e., $n\times\log_{2}q$ (which can give an idea about the size of the associated smart code), dimensions of the mixed strategies $\beta\in\Delta^{\nu-1}$ and $\sigma\in\Delta^{\mu-1}$, and the decodable distance $d_{o}\in\mathbb{Z}$. The number of distinct road signs that a code can express is not directly related to the decodable distance. For example, $[11,5,7]_{16}$ can encode as much as around $1$ million distinct road signs, but its decodable distance is $3$, which is less than the decodable distance of $[15,3,13]_{16}$, which can encode as much as $4096$ distinct road signs.

In order to examine the performance across a range of relative small to high noise channels, we consider $4$ different channels with probabilities of symbol errors: $p_{e}=0.01,0.05,0.1,0.2$. For each channel, in Table II, we tabulate the probability of decoding error/failure for the RS-Codes. We highlight the error/failure probabilities that are less than $0.02$. Note that a high error rate yields that the associated code is not reliable even when there is no adversarial intervention. Correspondingly, if a code leads to a higher error/failure probability, then we can prefer codes that include more redundancy to improve reliability.

Next, we compare the reliability of the smart road signs with respect to the cost metric (III) for the cases with and without the proposed detection mechanism. For example, we set all the road signs equally likely and we use the Monte Carlo method to compute $R\in\mathbb{R}^{(n+1)\times(d_{o}+1)}$ over $10^{6}$ independent trials. We set the multiplicative factors as

[TABLE]

where we set the weight of the objective $O3)$, i.e., false alarm cost, in order to keep the probability of false alarm at a certain range, e.g., less than $10\%$, for the scenarios where the code has error/failure probability less than $0.02$. In order to solve the LPs numerically, we use CVX, a package for specifying and solving convex programs [35, 36].

In order to compute the (conservative) cost for the scenarios where there is no detection mechanism, we compute

[TABLE]

where

[TABLE]

Particularly, since the right most column of $\Pi\in\mathbb{R}^{(do+1)\times\mu}$ is a zero vector, as exemplified in (44), $\sigma_{o}\in\Delta^{\mu-1}$ yields that $\pi=\Pi\sigma_{o}=\boldsymbol{0}$. In Table III, we tabulate the (conservative) cost of the codes over the channels examined if there were no detection mechanism. Note that we highlight the cells corresponding to the error/failure probabilities less than $0.02$ in order to distinguish the scenarios where the associated RS-Code can be used reliably. In Table IV, we tabulate the conservative cost of the codes if there were the proposed detection mechanism. The corresponding false alarm rates are provided in Table V. A comparison of Tables III and IV shows a substantial decrease in the conservative cost at the expense of a false alarm rate less than $10\%$ in the scenarios where the error/failure probability is less than $0.02$.

Remark*.*

We propose a way to relax certain constraints on the attack space to mitigate the scalability issue. It can be possible to obtain tighter approximations by considering tighter necessary conditions on $\mathcal{P}_{A}$’s actions; however, this would also increase computational complexity.

Furthermore, in Figs 4, 5, and 6, we provide the probability of the number of symbol errors due to channels, the proposed detection rule, and the relax attack strategy, respectively. We observe that $\mathcal{P}_{D}$ triggers alerts if the error rate is relatively high in general, which turns out to restrain the (powerful) attacker to put more weight on the left most columns of $\Lambda\in\mathbb{R}^{(n+1)\times\nu}$, as defined in (49), in his/her (relaxed) attack strategy. Particularly, at the equilibrium, the powerful attacker ends up crafting the smart code relatively more aggressively similar to the choice $C3)$ as discussed in Subsection IV-A. Depending on the channel and the configuration of the code, the optimal detection rules can vary. Through the proposed mechanism, based on a game theoretical analysis, we can compute the best detection rule efficiently and systematically even at scales of around $1$ million distinct road signs using an average personal computer without difficulty.

VI Conclusion

A future trend in intelligent transportation systems is smart road signs equipped with smart codes. In addition to incorporating relatively larger amount of information, smart codes constructed via error-correction methods can provide robustness against small scale perturbations. We have introduced a game theoretical adversarial intervention detection mechanism for reliable smart road signs against threats that can perturb the smart codes at small or large scales intelligently. While designing the detection mechanism, we have considered multiple performance metrics regarding the cost associated with losing the opportunity of preventing future attacks by not being able to detect the attack, the cost associated with adversary-induced decoding error or failure, the false alarm cost, and the ease of a deceptive perturbation. We have designed the detection rule against the worst-case attacker who maximizes the cost metrics by knowing the designed defense, i.e., under the solution concept of Stackelberg equilibrium where the defender is the leader. We have provided a relaxation on the attacker’s strategy space in order to mitigate possible computational issues that might arise while computing the equilibrium when there is a large number of distinct road signs. This has enabled us transform the problem into an LP with considerably small computational complexity. Finally, we have examined the performance numerically over various scenarios.

The proposed game theoretical framework brings in new research directions for the applications of smart road signs in intelligent transportation systems. In the following, we identify some of these future research directions:

• •

We emphasize that sensor fusion where we collect information through several separate sources can lead to more resilient and robust systems [37]. In the future, smart road signs combined with state-of-the-art vision-based road-sign recognition algorithms can provide both reliable and effective recognition by smart vehicles.

• •

A network of smart vehicles can lead to more reliable traffic networks. Particularly, a detection mechanism faces a trade-off between detecting an adversarial intervention and avoiding false alarms. Since a road sign would be encountered by multiple smart vehicles, those vehicles can share the false alarm cost against an attack on the road sign. Similar to herd immunity [38], a herd of smart vehicles can achieve more reliable road sign recognition.

• •

Additionally, this approach can also be a good fit for other classification problems that can be viewed as a signaling problem, where we can incorporate visual smart codes while transmitting information. For example, computer vision for (warehouse) inventory management [39] or intelligent robotic sorting [40] would constitute other interesting applications for the framework developed here.