Abstract
To achieve high-level autonomous driving (AD), the AD system in an Autonomous Vehicle (AV) has two key modules: localization, which estimates the real-time position of the AV on a map, and perception, which incorporates sensors such as cameras, radars, and LiDARs [1] to perceive the surrounding environment of the AV. From high-level design, the localization algorithms and perception algorithms appear to be independent of each other. However, in this work, we discover an interesting design consideration that enables an attacker to blind or misguide the perception without tampering the perception sensor inputs themselves.