Enhancing the Transferability of Adversarial Attacks for End-to-End Autonomous Driving Systems.
Abstract
Adversarial attacks play an important role in testing and enhancing the reliability of deep learning (DL) systems. Most existing attacks for DL-based autonomous driving systems (ADSs) demonstrate strong performance under the white-box setting but struggle with black-box transferability, while blackbox attacks are more practical in real-world scenarios as they operate without full model access. Numerous transferabilityenhancement techniques have been proposed in other fields (e.g., image classification), however, they remain unexplored for endto-end (E2E) ADSs. Our study fills the gap by conducting the first comprehensive empirical analysis of nine transferability-enhancement methods on E2E ADSs, covering two types: three input transformation enhancements and six attack objective enhancements. We evaluate their effectiveness on two datasets with four steering models. Our findings reveal that, out of nine enhancements, Resizing+Translation delivers the best black-box transferability, producing up to 9.39○ increase in MAE. Pred+Attn serves as the best objective enhancement, producing a maximum of 5.55○ (white-box) and 6.21○ (black-box) increase in MAE. Through attention heatmap visualizations, we discover that different models focus on similar regions when predicting, thereby enhancing the transferability of attention-based attacks. In conclusion, our study provides valuable results and insights into the transferability-enhancement techniques for E2E ADSs, which also serve as a robust benchmark for further advancements in the autonomous driving field. Index Terms-Software Testing, Adversarial Attacks, Crossmodel Transferability, Autonomous Driving, Deep Learning I. I NTRODUCTION The great success of Deep Neural Networks (DNNs) has led to dramatic performance improvement in many autonomous systems. One such domain is autonomous driving, where the current state-of-the-art Autonomous Driving Systems (ADSs) can be categorized into two types: multi-module and E2E [1]-[3]. Multi-modular ADSs decompose the whole system into interconnected modules (e.g., perception, decision). E2E ADSs, on the other hand, combine multiple modules into a single DNN that directly maps sens