Path Planning Under Malicious Injections and Removals of Perceived Obstacles: A Probabilistic Programming Approach

An autonomous mobile robot may encounter adversarial environments in which an attacker tries to influence its decisions. Through physical or software-level attacks, some of the robot's sensors might be compromised-a special concern for self-driving vehicles. Motivated by this scenario, this letter introduces and studies the problem of planning kinematically feasible (and possibly efficient) paths with bounded collision probability in adversarial settings where the obstacles perceived online by the robot display two layers of uncertainty. The first is the “usual” Gaussian uncertainty one would obtain from a standard object tracker (e.g., an Extended Kalman Filter); the second is an additional layer of uncertainty that captures possible sensor attacks and describes the actual existence of groups of obstacles in the environment. We study the complexity of the problem and propose a general sampling-based solution framework that uses the Sequential Probability Ratio Test (SPRT) to check collision probability constraints along the computed trajectory. We also show how probabilistic programming languages (PPLs) can simplify programming common algorithms (such as RRT and Hybrid A*) for mixed uncertainty. In addition to providing an easy-to-use programming framework, our approach is shown to plan safer paths compared to a Naive Monte Carlo baseline when both approaches are allowed to use at most the same given number of samples to perform collision checks.

I. Introduction

Since the dawn of mobile robotics, much research has aimed to increase robot autonomy. Classically, it is assumed that all the sensors the robot has at its disposal are not malicious, and that the only source of uncertainty for the robot is random noise in the sensor readings. Motivated by safety issues arising in autonomous vehicles applications—above all, self-driving cars—recent research has shown that an attacker might easily tamper with the robots’ perception pipeline [1]. For example, attackers might make the robot collide with obstacles by setting all its lidar readings to very large values. Or they might trap the robot at its current spot by surrounding it with fake obstacles.