UniAda: Universal Adaptive Multi-objective Adversarial Attack for End-to-End Autonomous Driving Systems.
Abstract
Adversarial attacks play a pivotal role in testing and improving the reliability of deep learning (DL) systems. Existing literature has demonstrated that subtle perturbations to the input can elicit erroneous outcomes, thereby substantially compromising the security of DL systems. This has emerged as a critical concern in the development of DL-based safetycritical systems like Autonomous Driving Systems (ADSs). The focus of existing adversarial attack methods on End-to-End (E2E) ADSs has predominantly centered on misbehaviors of steering angle, which overlooks speed-related controls or imperceptible perturbations. To address these challenges, we introduce UniAda-a multi-objective white-box attack technique with a core function that revolves around crafting an image-agnostic adversarial perturbation capable of simultaneously influencing both steering and speed controls. UniAda capitalizes on an intricately designed multi-objective optimization function with the Adaptive Weighting Scheme (AWS), enabling the concurrent optimization of diverse objectives. Validated with both simulated and realworld driving data, UniAda outperforms five benchmarks across two metrics, inducing steering and speed deviations from 3.54◦ to 29◦ and 11 km/h to 22 km/h on average. This systematic approach establishes UniAda as a proven technique for adversarial attacks on modern DL-based E2E ADSs. Fig. 1: Overview of Modular ADS pipeline (top) and E2E Deep Learning-Based ADS pipeline (bottom) Index Terms-Adversarial Attacks, White-box Attacks, Multiobjective Optimization, Autonomous Driving, Deep Learning I. I NTRODUCTION UTONOMOUS driving has brought about a transformative shift in the driving experience, showcasing the immense potential to significantly reduce accidents attributed to human errors and alleviate traffic congestion challenges [1]. There are two main approaches to implementing the ADS: modular [2] and End-to-End (E2E) [3]. Fig. 1 gives a simple architecture overview of these two systems. The conventional modular approach decomposes the system into interconnected modules encompassing perception, decision-making, planning, A Manuscript received XX/XX/XX; revised XX/XX/XX;