Adversarial Attacks on Multi-task Visual Perception for Autonomous Driving

Abstract

Deep neural networks (DNNs) have accomplished impressive success in various applications, including autonomous driving perception tasks, in recent years. On the other hand, current deep neural networks are easily fooled by adversarial attacks. This vulnerability raises significant concerns, particularly in safety-critical applications. As a result, research into attacking and defending DNNs has gained much coverage. In this work, detailed adversarial attacks are applied on a diverse multi-task visual perception deep network across distance estimation, semantic segmentation, motion detection, and object detection. The experiments consider both white and black box attacks for targeted and un-targeted cases, while attacking a task and inspecting the effect on all the others, in addition to inspecting the effect of applying a simple defense method. We conclude this paper by comparing and discussing the experimental results, proposing insights and future work. The visualizations of the attacks are available at https://youtu.be/R3JUV41aiPY.

RADA: Robust Adversarial Data Augmentation for Camera Localization in Challenging Weather

“…(4) Untargeted perturbation. Unlike the targeted perturbation approaches [12] (e.g., by turning a sunny image into a rainy image such that the method is robust to the rainy image) which typically fail to adapt to 'unseen' conditions (e.g., snowy conditions), our approach uses untargeted perturbation [27]. Therefore, it can adapt to a wide variety of unseen weather conditions without specifying the target domain.…”

“…One possible solution to improve the robustness of existing deep learning-based localization models is to use basic data augmentation to diversify the training data distribution. For example, [1], [3] shifted the RGB pixel values, [17] used Gaussian noise, and [27] employed blur, HSV shift, and 1 Jialu Wang, Niki Trigoni, and Andrew Markham are with the Department of Computer Science, University of Oxford, UK {jialu.wang, niki.trigoni, andrew.markham}@cs.ox.ac.uk 2 Muhamad Risqi U. Saputra is with the Data Science Department at Monash University Indonesia risqi.saputra@monash.edu 3 Chris Xiaoxuan Lu is with the School of Informatics at the University of Edinburgh, UK xiaoxuan.lu@ed.ac.uk other perturbations to simulate cross weather interference. However, these domain adaptation techniques are data agnostic.…”

“…Gaussian blur) to improve the robustness of steering angle predictions but then they utilize 'adversarial training' to fine-tune the model's hyperparameters (e.g., variance of Gaussian). Recently, [27] evaluated the performance of various adversarial attacks on autonomous driving data, demonstrating the brittleness of many approaches. Inspired by this paper, we take a step further, and explore if these attacks can be used in camera localization so as to achieve greater robustness for crossweather adaptation.…”

RADA: Robust Adversarial Data Augmentation for Camera Localization in Challenging Conditions

“…One possible solution to tackle this problem is to use well-known basic data augmentation techniques, such as shifting RGB pixel values or using Gaussian noise, have been employed [2], [1], [7], [8], [9]. However, these "data agnostic" techniques may corrupt important information by perturbing all image pixels uniformly.…”

“…While GAN has been used for camera localization, it requires some target domain information [16], [17], [18], whereas AT can generalize without prior information of the target domain [13]. Furthermore, some other works also use AT technique, but they focus on different tasks [19], [20], [21], [3], [8].…”