{"id":"1a7216db-8275-4a7c-970b-185643e57080","arxiv_id":"2505.11532","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Adversarial attacks shift OpenPilot distance estimates by tens of meters and cut YOLOv8 stop sign recall sharply, while tested defenses trade off gains against new failure modes.","lead":"This paper tests six adversarial attacks and four defense methods against two self-driving perception models: YOLOv8 for stop sign detection and OpenPilot's Supercombo for distance estimation. It finds that the most damaging attacks shift distance estimates by tens of meters, and that no single defense is effective across all attack types.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Regression results compare attacked outputs to clean-model predictions, not to physical distance; if Supercombo's clean estimates are inaccurate or distance-biased, the reported close-range attack errors do not establish safety degradation.","rationale":"The reader's weakest-assumption analysis identifies exactly the condition that must hold for the paper's central regression claims to be meaningful: the clean model's output must be a trustworthy proxy for physical distance. The paper explicitly defines its regression error metric as the difference between attacked and clean predictions, so the clean model is not just a comparison point but the sole reference for safety-relevant error. This is more fundamental than the other issues mentioned in the reader's rationale, such as missing error bars or the CAP/RP2 conflation, because even perfect error bars would not tell us whether a 34 m deviation from the clean output indicates a 34 m physical misestimation. The proposed test is concrete and settles the question: compare clean and attacked predictions against ground-truth distance on a modest sampled subset. Given that the finding is conditional and the test is feasible, keeping the reader's CONDITIONAL verdict is appropriate; the concern does not force rejection because the paper's output-level observations may still be reproducible and useful, but they cannot support safety-oriented conclusions without ground-truth validation. I agree with the reader rather than introducing a separate concern, since this baseline assumption is the least secure link in the argument chain from experiments to the stated conclusion.","tokens_in":12930,"tokens_out":8039,"duration_ms":92213,"concrete_test":"Select a random subset of Comma2k19 frames spanning the same distance bins (0-20, 20-40, 40-60, 60-80 m) and annotate true lead-vehicle distance manually or, if unavailable, generate an equivalent synthetic scene in CARLA with known ego-lead distances. Run the clean Supercombo model on these frames and compute per-bin mean absolute error against true distance. Then re-run the full attack pipeline and compute errors against true distance instead of clean outputs. If the clean model's mean absolute error is small (e.g., below roughly 2 m) and flat across bins relative to the Table I shifts, the concern does not land. If clean errors are comparable in size to the attack-induced shifts, or if they vary strongly by distance bin, the close-range vulnerability claim and the defense rankings must be re-evaluated against physical distance.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section V-B-1 states that the model's predicted relative distances under attack are 'compared to the predictions on clean images in each frame.' This makes the clean model's output the baseline for every regression attack and defense claim in Tables I, II, III, and V. The central claim that attacks 'significantly affect the model's classification and regression tasks, particularly at close range' depends on interpreting these shifts as prediction errors relevant to driving safety. However, no ground-truth lead-vehicle distance is ever used to validate Supercombo's clean estimates. If the clean model is biased by range, or if its output noise is not uniform across distance bins, then the apparent close-range vulnerability in Table I (34.45 m versus 8.49 m at longer ranges) could reflect the structure of the baseline's errors rather than the effect of the attack. Likewise, negative long-range values such as -43.04 m under mixed adversarial training with Gaussian attack become impossible to interpret: they measure deviation from an unvalidated clean output, not an actual underestimation of a physical distance. The 'no single defense is sufficient' conclusion inherits this problem because defense effectiveness is quantified as reduction in deviation-from-clean rather than improvement in physical distance accuracy. This is the most load-bearing weakness because it affects all regression conclusions, not just one table row or one attack.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper revisits adversarial attacks and defenses for ADS perception, with experiments on two tasks: stop-sign detection using YOLOv8 and lead-vehicle relative-distance regression using OpenPilot's Supercombo model. The attacks considered are Gaussian noise, FGSM, Auto-PGD, SimBA, RP2, and CAP-Attack; the defenses are median blurring, bit-depth reduction, randomization, adversarial training, contrastive learning, and diffusion-based restoration with DiffPIR. The central claim, stated in the conclusion, is that adversarial attacks significantly affect both classification and regression tasks, particularly at close range, and that no single defense is sufficient because different defenses are effective only under specific conditions. The paper also releases code for the experiments.","tokens_in":13134,"tokens_out":4894,"duration_ms":51425,"significance":"If the evaluation were fully supported, the paper would be a useful contribution: it studies a production ADS model rather than only research classifiers, it covers both detection and regression tasks, and it compares several defense families under a common framework. The release of code is a concrete strength. However, the current experimental evidence has gaps that are load-bearing for the central claims, especially the unvalidated regression baseline and the lack of repeated-run statistics, so the significance of the results depends on whether these gaps can be closed.","major_comments":[{"comment":"The regression evaluation measures deviation from the model's own clean-image predictions rather than from physical ground-truth distance. Section V-B-1 states that 'the model's predicted relative distances under attack are then compared to the predictions on clean images in each frame.' If Supercombo's clean distance estimates are biased by range or noisy in a distance-dependent way, the close-range vulnerability reported in Table I (e.g., 34.45 m under Auto-PGD) and the long-range negative values in Table III (e.g., -43.04 m under mixed adversarial training) reflect changes relative to an unvalidated baseline, not necessarily safety-relevant prediction error. This is the central quantity behind the paper's main regression conclusions, so the authors should validate clean Supercombo outputs against any available ground-truth (e.g., radar or lead-vehicle annotations), or at minimum report the clean model's calibration across distance bins and discuss how the reported deviations translate into physical distance error.","section":"V-B-1, Tables I, II, III, V"},{"comment":"Adversarially trained models are never evaluated on clean inputs, so the claim of 'over-defense' or reduced long-distance accuracy is not substantiated. The mixed-training model's -43.04 m long-range error is computed against the clean predictions of the same retrained model, but no clean-input accuracy of that model is reported. The negative value could reflect a global shift in the retrained model's distance estimates rather than an attack-induced effect. The authors should report clean performance for every adversarially trained model, including the mixed model, and compare pre- and post-training calibration.","section":"V-C-2, Table III"},{"comment":"The experimental results are point estimates with no error bars, confidence intervals, or repeated runs. This matters because the mixed adversarial training split is random (Section V-C-2), the Randomization defense is stochastic, and contrastive learning involves stochastic training. Without repeated trials or seeds, the quantitative rankings of defenses, such as the reduction from 34.45 m to 5.04 m under Randomization in Table II, cannot be distinguished from sampling variability. The authors should report means and standard deviations over multiple seeds or at least a table of results from several runs.","section":"V-C-2, Table III and Table II"},{"comment":"The 'CAP/RP2' row conflates two attacks that target different tasks: CAP-Attack is a runtime regression attack on ACC distance prediction, while RP2 is a physical-world classification/patch attack for stop signs. Combining them in one row means that the regression error (e.g., 29.62 m in Table II) and the detection metrics (e.g., 88.97% mAP50 in the same row) come from different attacks without any indication of which number belongs to which attack. The authors should separate CAP and RP2 into distinct rows or clearly report the per-task attack conditions in separate columns.","section":"Tables I, II, III, V, and Section V-C-1"}],"minor_comments":[{"comment":"The text refers to the 'Traffic Signs Detection dataset' but the cited reference [29] is titled 'Car detection dataset'; the reference identifier appears to be mismatched with the dataset actually used for stop-sign detection.","section":"V-A and References"},{"comment":"The phrase 'bounded region defined by ϵ)' contains a stray parenthesis; also, the paper does not state the ϵ budget used for the attacks, which is needed to interpret the comparison across attack methods.","section":"IV-B, Eq. (8)"},{"comment":"The y-axis of Fig. 2 starts at 0.6, which visually exaggerates the differences between detection metrics; starting the axis at 0 would give a more accurate visual impression of the attack effects.","section":"Fig. 2"},{"comment":"The statement that Median Blurring mitigates FGSM and Auto-PGD errors 'by more than 10 meters' is not supported by Table II: the largest reduction in the [0,20] range is 8.88 m for Auto-PGD (34.45 m to 25.57 m), and FGSM reductions are much smaller. The claim should be revised or the relevant numbers cited.","section":"VI, Discussion"}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea is reasonable and the experimental scope is useful, but the unvalidated regression baseline and the lack of repeated runs are substantial enough that the current version should not be accepted as-is. The self-citation of CAP-Attack is appropriate because it is the attack under evaluation, not supporting evidence. If the authors can validate the clean Supercombo distance outputs and provide statistical evidence for the reported rankings, this paper could become a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know up front. First, this is a useful practical sweep: it runs six attack and four defense families against YOLOv8 stop-sign detection and OpenPilot's Supercombo distance regression, on real-ish data. Second, every regression number in Tables I-III and V is the deviation from the model's own clean-image predictions, not from any physical ground-truth distance. That means the headline '34.45 m error at 0-20 m' is a shift in model output, not a measured misestimation of the true gap to the lead car. The stress-test about this is on target.\n\nWhat's actually new: the specific measurements on Supercombo, e.g., DiffPIR bringing the Auto-PGD induced shift down from 34.45 m to 4.98 m in the near range, and median blurring recovering YOLOv8 stop-sign mAP from 70.49% to 94.64% under Gaussian noise. These are concrete data points that aren't in the cited literature. The paper also reports time overhead for defenses, which is often skipped. The classification results are more solid because they're standard detection metrics.\n\nSoft spots, in order of severity. The regression baseline issue is load-bearing. Without validation that clean Supercombo outputs are close to physical distances, the 'close-range vulnerability' and the negative -43.04 m under mixed adversarial training cannot be interpreted as safety degradation. The authors should either evaluate against ground truth (e.g., radar or dataset metadata) or at minimum report clean-model accuracy on known distances and discuss bias by range. Second, no error bars or repeated runs, so all differences could be within run-to-run noise; given the large effects claimed, probably not, but it's unprofessional. Third, CAP and RP2 are combined into a single 'CAP/RP2' row even though CAP is a regression attack and RP2 targets classification; that conflates two different threat models and makes the tables hard to trust. Fourth, adversarial training, contrastive learning, and diffusion details (hyperparameters, training set construction, clean performance of retrained models) are missing or partial. Reproducibility: code link exists but no commit hash.\n\nNone of this destroys the paper's qualitative message: attacks do shift predictions, and no single defense is universally effective. But the quantitative strength of that message is nowhere near what the tables suggest. This is a conference-level empirical study that needs solid revision, not a definitive benchmark.\n\nWho is it for? Practitioners evaluating defenses for production-like perception stacks, and researchers wanting a compact map of what has been tested where. I'd bring it to a reading group as a cautionary example of how to (and how not to) measure attack impact on regression. It deserves peer review, but only with major changes: ground-truth regression evaluation, per-run variance, separated CAP/RP2, and full hyperparameter disclosure.","headline":"Useful empirical sweep of attacks and defenses on OpenPilot and YOLOv8, but the regression results are measured against the clean model's own predictions, so the headline distance numbers aren't grounded in physical truth.","tokens_in":13718,"tokens_out":4569,"would_cite":false,"duration_ms":41850,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that adversarial perturbations can push an autonomous driving perception model's close-range distance estimates tens of meters off, and that each defense tested only works under specific conditions.","keywords":["adversarial attacks","autonomous driving","OpenPilot Supercombo","YOLOv8","relative distance prediction","stop sign detection","adversarial defenses","diffusion-based defense"],"falsifier":"Recompute the same attacks with physical ground-truth distances for the lead vehicle—for example, from logged radar or LiDAR or hand-labeled depth in the same video frames—and compare range-binned errors. If the large close-range errors such as 34.45 meters under Auto-PGD shrink or disappear against physical truth, the safety conclusion is an artifact of using the clean model as the reference; if they persist, the finding is confirmed.","tokens_in":12704,"feed_emoji":"🚗","tokens_out":6808,"duration_ms":64121,"temperature":0.7,"pith_summary":"The paper tries to establish that adversarial perturbations are a practical threat to both major perception outputs of a driving stack—road sign detection and lead-vehicle distance regression—and that currently available defenses are only partially effective. Working with OpenPilot's Supercombo model and a YOLOv8 detector, it reports that optimization-based attacks such as Auto-PGD and CAP-attack can push average relative-distance errors above 29 meters when the lead vehicle is within 20 meters, while simpler noise and black-box attacks matter less. It then evaluates four families of defenses and finds that each works in some settings and fails in others, so no single defense is sufficient. The contribution is a head-to-head comparison, on a production-style platform, of how attack strength, distance range, and defense interact.","feed_headline":"Adversarial patches skew close-range driving distance by 34 m","feed_subtitle":"On OpenPilot's Supercombo, no single defense reliably restores lead-vehicle distance estimates under attack.","key_machinery":"The central device is a paired attack-defender evaluation on two production-style perception models. For regression, adversarial perturbations are injected into the bounding-box region of the lead vehicle in each frame of the driving videos fed to OpenPilot's Supercombo end-to-end model, and errors are measured against the model's own clean-frame distance predictions in four ranges. For classification, a single-class YOLOv8 stop sign detector is attacked and scored with mAP@50, precision, and recall. The attacks are the comparison instruments: FGSM and Auto-PGD as white-box gradient attacks, SimBA as a query-based black-box attack, RP2 as a physical-world patch attack, and CAP-attack as a runtime patch attack aimed at adaptive cruise control distance prediction, with Gaussian noise as a non-optimized baseline. The defenses are adversarial training with single-attack and mixed adversarial datasets, input preprocessing such as median blurring and bit-depth reduction, contrastive learning on the YOLO backbone, and DiffPIR, a plug-and-play diffusion-based restoration method.","core_discovery":"The paper claims that adversarial attacks significantly degrade both classification and regression in ADS perception models, with the largest regression errors occurring at close range, and that the evaluated defenses—adversarial training, image processing, contrastive learning, and diffusion-based restoration—are effective only under specific conditions. Concretely, Auto-PGD yields average relative-distance errors of 34.45 meters within 0–20 meters for OpenPilot's Supercombo model, and CAP-attack yields 29.62 meters in the same range, while errors at 60–80 meters drop to roughly 8 meters. Diffusion repair reduces the close-range Auto-PGD error to 4.98 meters and mixed adversarial training reduces it to 5.84 meters, but mixed adversarial training also produces a −43.04 meter average error at 60–80 meters, and diffusion reconstruction introduces negative biases at long range. On YOLOv8 stop sign detection, FGSM and Gaussian noise cause the largest drops in mAP@50 and recall, while Auto-PGD is less effective in the single-class setting. The paper concludes that defenses must be adaptive because no single method is robust across attacks and distance ranges.","pith_inferences":["A natural extension is distance-weighted adversarial training that penalizes long-range errors as heavily as close-range ones; the paper's −43.04-meter mixed-training result predicts this would remove the long-range failure while preserving close-range gains.","Because the attacks are applied as patches inside the lead vehicle bounding box, the close-range vulnerability is plausibly driven by apparent object size; if so, defenses that normalize or randomize bounding-box content could be cheaper than full adversarial training.","The paper's errors are measured against the model's own clean-frame predictions, so rerunning the same evaluation with physical ground-truth distances from radar or LiDAR would show whether the reported meter errors translate directly into physical safety margins.","CAP-attack is designed to be temporally coherent across frames, but the paper reports per-frame errors; real-world impact could be larger or smaller once tracking and control smoothing are included, which is a testable extension."],"forward_implications":["Close-range distance prediction is the highest-risk perception output: a 34.45-meter error within 20 meters is larger than any degradation observed in stop sign detection.","Adversarial training with mixed attack samples gives the most balanced defense but trades away long-range accuracy, so highway-speed deployment would need distance-aware training or loss weighting.","Diffusion-based repair restores stop sign detection precision above 99 percent but takes 1–2 seconds per image, making it unusable for real-time driving without major optimization.","Attack-specific training transfers poorly: a model trained only on RP2 examples drops to 40.78 percent mAP@50 under FGSM, so defense evaluations must always test across attack types.","Because no single defense holds across attacks and distances, practical robustness requires combining input preprocessing, robust training, and runtime detection rather than relying on one method."],"supporting_citations":[{"why":"Supplies the YOLOv8 model used as the stop sign detection classifier under attack and defense.","marker":"[7]"},{"why":"Supplies the production open-source ADS and its Supercombo end-to-end model used for relative distance regression.","marker":"[8]"},{"why":"Supplies FGSM, the white-box gradient attack used as a baseline in both perception tasks.","marker":"[10]"},{"why":"Supplies Auto-PGD, the iterative attack that produces the largest close-range distance regression errors.","marker":"[11]"},{"why":"Supplies SimBA, the query-efficient black-box attack used in stop sign detection and contrastive learning evaluations.","marker":"[12]"},{"why":"Supplies RP2, the robust physical perturbation attack used in detection and adversarial training transfer tests.","marker":"[13]"},{"why":"Supplies CAP-attack, the runtime patch attack targeting adaptive cruise control distance prediction.","marker":"[14]"},{"why":"Supplies the adversarial training formulation and motivation for the min-max retraining experiments.","marker":"[26]"},{"why":"Supplies DiffPIR, the diffusion-based restoration method evaluated as a defense.","marker":"[27]"},{"why":"Supplies the driving video dataset used for Supercombo relative distance regression experiments.","marker":"[32]"}],"fun_headline_variants":["Adversarial attacks skew close-range driving distance by 34m","No single defense fixes 34m close-range ADS distance errors","Auto-PGD attack causes 34m error in OpenPilot's close-range distance","Close-range distance errors hit 34m under adversarial perturbations"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation measures attack-induced error as the difference between the model's distance prediction on attacked frames and its own prediction on clean frames, so if the clean model is already biased about physical distance, all reported meter errors are deviations from that possibly flawed baseline rather than verified physical error.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial attacks skew close-range driving distance by 34m","No single defense fixes 34m close-range ADS distance errors","Auto-PGD attack causes 34m error in OpenPilot's close-range distance","Close-range distance errors hit 34m under adversarial perturbations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00064,"raw_usage":{"total_tokens":2929,"prompt_tokens":910,"completion_tokens":2019,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":526,"completion_tokens_details":{"reasoning_tokens":1943}},"tokens_in":526,"tokens_out":2019,"duration_ms":15695,"temperature":1.0,"reasoning_tokens":1943,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:40:18.494023+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the same attacks with physical ground-truth distances for the lead vehicle—for example, from logged radar or LiDAR or hand-labeled depth in the same video frames—and compare range-binned errors. If the large close-range errors such as 34.45 meters under Auto-PGD shrink or disappear against physical truth, the safety conclusion is an artifact of using the clean model as the reference; if they persist, the finding is confirmed.","supporting_citations":[{"cited_title":"Available: https://www .tesla.com/ownersmanual/modely/ en_us/GUID-2CB60804-9CEA-4F4B-8B04-09B991368DC5 .html","cited_arxiv_id":null,"evidence_quote":"Supplies the YOLOv8 model used as the stop sign detection classifier under attack and defense."},{"cited_title":"[Online]","cited_arxiv_id":null,"evidence_quote":"Supplies the production open-source ADS and its Supercombo end-to-end model used for relative distance regression."},{"cited_title":"(2024) Gaussian noise - wikipedia","cited_arxiv_id":null,"evidence_quote":"Supplies FGSM, the white-box gradient attack used as a baseline in both perception tasks."},{"cited_title":"Strategic Safety-Critical Attacks against an Advanced Driver Assistance System,","cited_arxiv_id":null,"evidence_quote":"Supplies the driving video dataset used for Supercombo relative distance regression experiments."}],"review_version":1}