Towards Robust Physical-world Backdoor Attacks on Lane Detection

TL;DR

This paper presents BadLANE, a novel backdoor attack on lane detection systems that adapts to dynamic real-world scene factors like viewpoint changes and environmental conditions, significantly improving attack success rates.

Contribution

Introduces a dynamic scene adaptation backdoor attack for lane detection using amorphous triggers and meta-learning to handle viewpoint and environmental variations.

Findings

Achieves over 25% higher attack success rate compared to baselines.

Effective in both digital and physical domains.

Outperforms existing backdoor attack methods on lane detection models.

Abstract

Deep learning-based lane detection (LD) plays a critical role in autonomous driving systems, such as adaptive cruise control. However, it is vulnerable to backdoor attacks. Existing backdoor attack methods on LD exhibit limited effectiveness in dynamic real-world scenarios, primarily because they fail to consider dynamic scene factors, including changes in driving perspectives (e.g., viewpoint transformations) and environmental conditions (e.g., weather or lighting changes). To tackle this issue, this paper introduces BadLANE, a dynamic scene adaptation backdoor attack for LD designed to withstand changes in real-world dynamic scene factors. To address the challenges posed by changing driving perspectives, we propose an amorphous trigger pattern composed of shapeless pixels. This trigger design allows the backdoor to be activated by various forms or shapes of mud spots or pollution on the road or lens, enabling adaptation to changes in vehicle observation viewpoints during driving. To mitigate the effects of environmental changes, we design a meta-learning framework to train meta-generators tailored to different environmental conditions. These generators produce meta-triggers that incorporate diverse environmental information, such as weather or lighting conditions, as the initialization of the trigger patterns for backdoor implantation, thus enabling adaptation to dynamic environments. Extensive experiments on various commonly used LD models in both digital and physical domains validate the effectiveness of our attacks, outperforming other baselines significantly (+25.15% on average in Attack Success Rate). Our codes will be available upon paper publication.