Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack

TL;DR

This paper demonstrates that physically realizable dirty road patches can effectively attack deep learning-based automated lane centering systems, causing high success rates and potential safety hazards, highlighting critical security vulnerabilities.

Contribution

It introduces a novel physical-world attack vector for ALC systems, formulates an optimization-based attack method, and evaluates its effectiveness and safety implications in real-world scenarios.

Findings

Over 97.5% attack success rate in real-world scenarios

Attack causes 100% collision rate in simulated and real tests

Attack remains effective under various lighting and view conditions

Abstract

Automated Lane Centering (ALC) systems are convenient and widely deployed today, but also highly security and safety critical. In this work, we are the first to systematically study the security of state-of-the-art deep learning based ALC systems in their designed operational domains under physical-world adversarial attacks. We formulate the problem with a safety-critical attack goal, and a novel and domain-specific attack vector: dirty road patches. To systematically generate the attack, we adopt an optimization-based approach and overcome domain-specific design challenges such as camera frame inter-dependencies due to attack-influenced vehicle control, and the lack of objective function design for lane detection models. We evaluate our attack on a production ALC using 80 scenarios from real-world driving traces. The results show that our attack is highly effective with over 97.5% success rates and less than 0.903 sec average success time, which is substantially lower than the average driver reaction time. This attack is also found (1) robust to various real-world factors such as lighting conditions and view angles, (2) general to different model designs, and (3) stealthy from the driver's view. To understand the safety impacts, we conduct experiments using software-in-the-loop simulation and attack trace injection in a real vehicle. The results show that our attack can cause a 100% collision rate in different scenarios, including when tested with common safety features such as automatic emergency braking. We also evaluate and discuss defenses.