SlowPerception: Physical-World Latency Attack against Visual Perception in Autonomous Driving

TL;DR

This paper introduces SlowPerception, a physical-world latency attack on autonomous driving visual perception systems that creates phantom objects to induce significant delays, risking safety and demonstrating a new threat model.

Contribution

The paper presents the first physical-world latency attack on AD perception using projector-based universal perturbations to generate phantom objects, increasing computational load and latency.

Findings

Achieves an average latency of 2.5 seconds in real-world settings.

Induces a 97% vehicle collision rate in system-level impact assessments.

Outperforms existing latency attack methods significantly.

Abstract

Autonomous Driving (AD) systems critically depend on visual perception for real-time object detection and multiple object tracking (MOT) to ensure safe driving. However, high latency in these visual perception components can lead to significant safety risks, such as vehicle collisions. While previous research has extensively explored latency attacks within the digital realm, translating these methods effectively to the physical world presents challenges. For instance, existing attacks rely on perturbations that are unrealistic or impractical for AD, such as adversarial perturbations affecting areas like the sky, or requiring large patches that obscure most of a camera's view, thus making them impossible to be conducted effectively in the real world. In this paper, we introduce SlowPerception, the first physical-world latency attack against AD perception, via generating projector-based universal perturbations. SlowPerception strategically creates numerous phantom objects on various surfaces in the environment, significantly increasing the computational load of Non-Maximum Suppression (NMS) and MOT, thereby inducing substantial latency. Our SlowPerception achieves second-level latency in physical-world settings, with an average latency of 2.5 seconds across different AD perception systems, scenarios, and hardware configurations. This performance significantly outperforms existing state-of-the-art latency attacks. Additionally, we conduct AD system-level impact assessments, such as vehicle collisions, using industry-grade AD systems with production-grade AD simulators with a 97% average rate. We hope that our analyses can inspire further research in this critical domain, enhancing the robustness of AD systems against emerging vulnerabilities.