Securing Autonomous Vehicles Visual Perception: Adversarial Patch Attack and Defense Schemes With Experimental Validations

Autonomous vehicles (AVs) heavily depend on machine learning-based algorithms for the purpose of environmental perception. However, extensively utilized deep learning-based visual perception methods are susceptible to adversarial visual sensor attacks, thereby introducing latent risks to vehicle driving safety. In this paper, we first investigate a novel adversarial patch attack method for the DNN-based visual object detection method widely used in AVs. The proposed adversarial attack strategy contains an evasion attack mode and a misclassified attack mode. For each mode, the corresponding adversarial patch generation method is designed by a dedicated optimization process. In addition, we propose an adversarial attack defense method based on texture feature and local denoising. According to the texture features, the method can detect the locations of the possible adversarial patches in the image, and then the image is denoised locally from the detection results. The attack effects of the generated adversarial patch are validated on the KITTI dataset and in real driving scenes, respectively. The results show that the average accuracy of car and pedestrian detection under evasion attacks decreases by 56% and 68%, respectively, while under misclassification attacks, the average accuracy decreases by 35% and 85% for car and pedestrian, respectively. The proposed method can effectively mislead the target detection model which seriously affects the perception module. This paper conduct a defense experiment using data generated by the adversarial patch, resulting in a 92% increase in mean average precision for detecting cars and pedestrians, with detection time reduced to 17% of its original value. The experimental results demonstrate the defensive effectiveness and efficiency of the proposed defense method.