They See Me Rollin’: Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors

Köhler, Sebastian; Lovisotto, Giulio; Birnbach, Simon; Baker, Richard; Martinovic, Ivan

doi:10.1145/3485832.3488016

Cited by 16 publications

(16 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The attack is remote and does not require any firmware access or information about the images captured by the camera in the victim CAV. However, we assume the attacker has access to, or can purchase, a similar camera, and can empirically study and infer the properties of the camera as in previous work [14], [58]. We assume that the attacker has knowledge of the traffic sign recognition model used by the victim CAV and has black-box access to it as an oracle (for example, by reverse-engineering the vehicle communication [59]).…”

Section: Threat Model and Attacker Capabilitiesmentioning

confidence: 99%

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

Sato,

Bhupathiraju,

Clifford

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

All vehicles must follow the rules that govern traffic behavior, regardless of whether the vehicles are human-driven or Connected Autonomous Vehicles (CAVs). Road signs indicate locally active rules, such as speed limits and requirements to yield or stop. Recent research has demonstrated attacks, such as adding stickers or projected colored patches to signs, that cause CAV misinterpretation, resulting in potential safety issues. Humans can see and potentially defend against these attacks. But humans can not detect what they can not observe. We have developed an effective physical-world attack that leverages the sensitivity of filterless image sensors and the properties of Infrared Laser Reflections (ILRs), which are invisible to humans. The attack is designed to affect CAV cameras and perception, undermining traffic sign recognition by inducing misclassification. In this work, we formulate the threat model and requirements for an ILR-based traffic sign perception attack to succeed. We evaluate the effectiveness of the ILR attack with real-world experiments against two major traffic sign recognition architectures on four IR-sensitive cameras. Our black-box optimization methodology allows the attack to achieve up to a 100% attack success rate in indoor, static scenarios and a ≥80.5% attack success rate in our outdoor, moving vehicle scenarios. We find the latest state-of-the-art certifiable defense is ineffective against ILR attacks as it mis-certifies ≥33.5% of cases. To address this, we propose a detection strategy based on the physical properties of IR laser reflections which can detect 96% of ILR attacks.

show abstract

Section: Threat Model and Attacker Capabilitiesmentioning

confidence: 99%

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

Sato,

Bhupathiraju,

Clifford

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Prior works use such attack vector to project malicious light spots in the camera image such that it can misguide the camera localization [67] or object detection [67,72]. Moreover, some prior works also use it to cause camera effects such as lens flare [58] and rolling shutter effect [68] in order to fool the object detection. • Acoustic signal has been shown to disrupt or control the outputs of Inertial Measurement Units (IMUs) [99,100].…”

Section: Sensor Attack Vectorsmentioning

confidence: 99%

“…This is the most restrictive setting where the attacker cannot access any of the internals in the AD vehicle. Prior works that belong to this category are either transferbased attacks [66,69], which generate attack inputs based on local white-box models, or the ones that do not require any model-level knowledge in attack generation [68,81].…”

Section: Sensor Attack Vectorsmentioning

confidence: 99%

SoK: On the Semantic AI Security in Autonomous Driving

Shen¹,

Wang²,

Wan³

et al. 2022

Preprint

View full text Add to dashboard Cite

Autonomous Driving (AD) systems rely on AI components to make safety and correct driving decisions. Unfortunately, today's AI algorithms are known to be generally vulnerable to adversarial attacks. However, for such AI component-level vulnerabilities to be semantically impactful at the system level, it needs to address non-trivial semantic gaps both (1) from the system-level attack input spaces to those at AI component level, and (2) from AI component-level attack impacts to those at the system level. In this paper, we define such research space as semantic AI security as opposed to generic AI security. Over the past 5 years, increasingly more research works are performed to tackle such semantic AI security challenges in AD context, which has started to show an exponential growth trend. However, to the best of our knowledge, so far there is no comprehensive systematization of this emerging research space.In this paper, we thus perform the first systematization of knowledge of such growing semantic AD AI security research space. In total, we collect and analyze 53 such papers, and systematically taxonomize them based on research aspects critical for the security field such as the attack/defense targeted AI component, attack/defense goal, attack vector, attack knowledge, defense deployability, defense robustness, and evaluation methodologies. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels. To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS, for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

show abstract

“…Targeted Component Component-level System-level Lu et al [27] object detection ✓ Eykholt et al [12] object detection ✓ Chen et al [7] object detection ✓ Zhao et al [48] object detection ✓ Xiao et al [44] object detection ✓ Zhang et al [47] object detection ✓ Nassi et al [30] object detection ✓ ✓ Man et al [28] object detection ✓ Hong et al [17] object detection ✓ Huang et al [19] object detection ✓ Wu et al [43] object detection ✓ Xu et al [45] object detection ✓ Hu et al [18] object detection ✓ Hamdi et al [16] object detection ✓ Ji et al [21] object detection ✓ Lovisotto et al [26] object detection ✓ Köhler et al [23] object detection ✓ Wang et al [40] object detection ✓ Zolfi et al [51] object detection ✓ Wang et al [41] object detection ✓ Zhu et al [50] object detection ✓ Wang et al [42] Traffic light detection ✓ Tang et al [39] Traffic light detection ✓ those in Table I), a component-level success rate of up to 98% can still be not enough to affect object tracking results. Thus, we believe that such current general lack of systemlevel evaluation is a critical scientific methodology-level gap that should be addressed as soon as possible.…”

Section: Papermentioning

confidence: 99%

PASS: A System-Driven Evaluation Platform for Autonomous Driving Safety and Security

Hu¹,

Shen²,

Guo³

et al. 2022

Proceedings Fourth International Workshop on Automotive and Autonomous Vehicle Security

View full text Add to dashboard Cite

Safety and security play critical roles for the success of Autonomous Driving (AD) systems. Since AD systems heavily rely on AI components, the safety and security research of such components has also received great attention in recent years. While it is widely recognized that AI component-level (mis)behavior does not necessarily lead to AD system-level impacts, most of existing work still only adopts component-level evaluation. To fill such critical scientific methodology-level gap from component-level to real system-level impact, a system-driven evaluation platform jointly constructed by the community could be the solution. In this paper, we present P ASS (Platform for Auto-driving Safety and Security), a system-driven evaluation prototype based on simulation. By sharing our platform building concept and preliminary efforts, we hope to call on the community to build a uniform and extensible platform to make AI safety and security work sufficiently meaningful at the system level.

show abstract

They See Me Rollin’: Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors

Cited by 16 publications

References 44 publications

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

SoK: On the Semantic AI Security in Autonomous Driving

PASS: A System-Driven Evaluation Platform for Autonomous Driving Safety and Security

Contact Info

Product

Resources

About