DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems

Abstract

Deep Neural Networks (DNNs) have been widely applied in many autonomous systems such as autonomous driving and robotics for their state-of-the-art, even human-competitive accuracy in cognitive computing tasks. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, particularly for autonomous driving, they mostly focus on generating digital adversarial perturbations, e.g., changing image pixels, which may never happen in physical world. Thus, there is a critical missing piece in the literature on autonomous driving testing: understanding and exploiting both digital and physical adversarial perturbation generation for impacting steering decisions. In this paper, we propose a systematic physical-world testing approach, namely DeepBillboard, targeting at a quite common and practical driving scenario: drive-by billboards. DeepBillboard is capable of generating a robust and resilient printable adversarial billboard test, which works under dynamic changing driving conditions including viewing angle, distance, and lighting. The objective is to maximize the possibility, degree, and duration of the steeringangle errors of an autonomous vehicle driving by our generated billboard with adversarial perturbations. We have extensively evaluated the efficacy and robustness of DeepBillboard through conducting both experiments with digital perturbations and physical-world case studies. The digital experimental results show that DeepBillboard is effective for various steering models and scenes. Furthermore, the physical case studies demonstrate that DeepBillboard is sufficiently robust and resilient for generating physical-world adversarial billboard tests for real-world driving under various weather conditions, being able to mislead the average steering angle error up to 26.44 degrees. To the best of our knowledge, this is the first study demonstrating the possibility of generating realistic and continuous physical-world tests for practical autonomous driving systems; moreover, the basic DeepBillboard approach can be directly generalized to a variety of other physical entities/surfaces along the curbside, e.g., a graffiti painted on a wall.

Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles

“…Both the attacks were studied concerning different functional modules needed in vision-based autonomous driving. For example, the perturbation attack was studied regarding sign classification in [7], 2D object detection in [8], semantic segmentation in [9], [24], and monocular depth estimation in [12], [13], while the patch attack was studied regarding lane keeping in [5], optical flow estimation in [6], 2D object detection in [10], [11], and monocular depth estimation in [13]. None of these studies, however, focus directly on the attacks' impact on driving behavior and driving safety of autonomous vehicles.…”

“…Environment perception and other tasks of autonomous driving systems heavily rely on deep learning models. Researchers have demonstrated that adversarial examples, which are originally designed to affect general-purpose deep learning models, can also be used to cause malfunctions in autonomous driving tasks [5]- [14]. In these studies, researchers usually use the decline of accuracy, or the erroneous rate increase of the deep learning models, to measure the effectiveness of attacks.…”

Software Engineering for AI-Based Systems: A Survey

“…[219]), adversarial testing inputs (e.g. [53,217,228]) or increase the coverage of the test suites (e.g. [49,126]).…”

DocTer: Documentation Guided Fuzzing for Testing Deep Learning API Functions

“…Different from these techniques, D2C uses sequential pattern mining to aid the extraction of constraints from API documents to guide input generation for testing DL libraries. Testing DL models: Many fuzzing techniques test the robustness of DL models instead of DL libraries by finding adversarial inputs (e.g., images or natural language texts) for the models [23,28,31,39,43,44,60,63,64,66,68,71,77,79]. Testing DL models alone is insufficient, as DL libraries contain bugs [32,33,51,73,74], which hurt the accuracy and speed of the entire DL system [51].…”