Abstract

In Autonomous Driving (AD) systems, perception is both security and safety-critical. Among different attacks on AD perception, object-hiding adversarial attack is one of the most critical ones due to the direct impact on safety-critical driving decisions such as collision avoidance. However, all of the prior works on physical object-hiding adversarial attacks only study the security of the AI component alone rather than with the entire AD system pipeline with closed-loop control. This thus inevitably raises a critical research question: can these prior works actually achieve system-level effects (e.g., vehicle collisions, traffic rule violation) under real-world AD settings with closed-loop control? To answer this critical question, in this work we take the necessary first step by performing the first measurement study on whether and how effective the existing designs can lead to system-level effects. Our early results find that RP2 and FTE, as two representative examples of prior works, cannot achieve any system-level effect in a representative closed-loop AD setup in common STOP sign-controlled road speeds. In the future, we plan to 1) perform a more comprehensive measurement study using both simulated environments and a real vehicle-sized AD R&D chassis; and 2) analyze the measurement study results and explore new attack designs that can better achieve the system-level effect in AD systems.