Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that adversarial perturbations can push an autonomous driving perception model's close-range distance estimates tens of meters off, and that each defense tested only works under specific conditions.

desk verdict Useful empirical sweep of attacks and defenses on OpenPilot and YOLOv8, but the regression results are measured against the clean model's own predictions, so the headline distance numbers aren't grounded in physical truth. read the letter →

arxiv 2505.11532 v2 pith:RKACRBSR submitted 2025-05-14 cs.RO cs.CR

Cheng Chen , Yuhong Wang , Nafis S Munir , Xiangwei Zhou , Xugui Zhou This is my paper · ORCID
classification cs.ROcs.CR
keywords adversarialattacksautonomousdrivingOpenPilotSupercomboYOLOv8relativedistancepredictionstopsigndetectiondefensesdiffusion-baseddefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that adversarial perturbations are a practical threat to both major perception outputs of a driving stack—road sign detection and lead-vehicle distance regression—and that currently available defenses are only partially effective. Working with OpenPilot's Supercombo model and a YOLOv8 detector, it reports that optimization-based attacks such as Auto-PGD and CAP-attack can push average relative-distance errors above 29 meters when the lead vehicle is within 20 meters, while simpler noise and black-box attacks matter less. It then evaluates four families of defenses and finds that each works in some settings and fails in others, so no single defense is sufficient. The contribution is a head-to-head comparison, on a production-style platform, of how attack strength, distance range, and defense interact.

What carries the argument

The central device is a paired attack-defender evaluation on two production-style perception models. For regression, adversarial perturbations are injected into the bounding-box region of the lead vehicle in each frame of the driving videos fed to OpenPilot's Supercombo end-to-end model, and errors are measured against the model's own clean-frame distance predictions in four ranges. For classification, a single-class YOLOv8 stop sign detector is attacked and scored with mAP@50, precision, and recall. The attacks are the comparison instruments: FGSM and Auto-PGD as white-box gradient attacks, SimBA as a query-based black-box attack, RP2 as a physical-world patch attack, and CAP-attack as a runtime patch attack aimed at adaptive cruise control distance prediction, with Gaussian noise as a non-optimized baseline. The defenses are adversarial training with single-attack and mixed adversarial datasets, input preprocessing such as median blurring and bit-depth reduction, contrastive learning on the YOLO backbone, and DiffPIR, a plug-and-play diffusion-based restoration method.

What would settle it

Recompute the same attacks with physical ground-truth distances for the lead vehicle—for example, from logged radar or LiDAR or hand-labeled depth in the same video frames—and compare range-binned errors. If the large close-range errors such as 34.45 meters under Auto-PGD shrink or disappear against physical truth, the safety conclusion is an artifact of using the clean model as the reference; if they persist, the finding is confirmed.

Watch

Extended reading notes

Core claim

The paper claims that adversarial attacks significantly degrade both classification and regression in ADS perception models, with the largest regression errors occurring at close range, and that the evaluated defenses—adversarial training, image processing, contrastive learning, and diffusion-based restoration—are effective only under specific conditions. Concretely, Auto-PGD yields average relative-distance errors of 34.45 meters within 0–20 meters for OpenPilot's Supercombo model, and CAP-attack yields 29.62 meters in the same range, while errors at 60–80 meters drop to roughly 8 meters. Diffusion repair reduces the close-range Auto-PGD error to 4.98 meters and mixed adversarial training reduces it to 5.84 meters, but mixed adversarial training also produces a −43.04 meter average error at 60–80 meters, and diffusion reconstruction introduces negative biases at long range. On YOLOv8 stop sign detection, FGSM and Gaussian noise cause the largest drops in mAP@50 and recall, while Auto-PGD is less effective in the single-class setting. The paper concludes that defenses must be adaptive because no single method is robust across attacks and distance ranges.

Load-bearing premise

The evaluation measures attack-induced error as the difference between the model's distance prediction on attacked frames and its own prediction on clean frames, so if the clean model is already biased about physical distance, all reported meter errors are deviations from that possibly flawed baseline rather than verified physical error.

Editorial extensions

If this is right

  • Close-range distance prediction is the highest-risk perception output: a 34.45-meter error within 20 meters is larger than any degradation observed in stop sign detection.
  • Adversarial training with mixed attack samples gives the most balanced defense but trades away long-range accuracy, so highway-speed deployment would need distance-aware training or loss weighting.
  • Diffusion-based repair restores stop sign detection precision above 99 percent but takes 1–2 seconds per image, making it unusable for real-time driving without major optimization.
  • Attack-specific training transfers poorly: a model trained only on RP2 examples drops to 40.78 percent mAP@50 under FGSM, so defense evaluations must always test across attack types.
  • Because no single defense holds across attacks and distances, practical robustness requires combining input preprocessing, robust training, and runtime detection rather than relying on one method.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is distance-weighted adversarial training that penalizes long-range errors as heavily as close-range ones; the paper's −43.04-meter mixed-training result predicts this would remove the long-range failure while preserving close-range gains.
  • Because the attacks are applied as patches inside the lead vehicle bounding box, the close-range vulnerability is plausibly driven by apparent object size; if so, defenses that normalize or randomize bounding-box content could be cheaper than full adversarial training.
  • The paper's errors are measured against the model's own clean-frame predictions, so rerunning the same evaluation with physical ground-truth distances from radar or LiDAR would show whether the reported meter errors translate directly into physical safety margins.
  • CAP-attack is designed to be temporally coherent across frames, but the paper reports per-frame errors; real-world impact could be larger or smaller once tracking and control smoothing are included, which is a testable extension.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper revisits adversarial attacks and defenses for ADS perception, with experiments on two tasks: stop-sign detection using YOLOv8 and lead-vehicle relative-distance regression using OpenPilot's Supercombo model. The attacks considered are Gaussian noise, FGSM, Auto-PGD, SimBA, RP2, and CAP-Attack; the defenses are median blurring, bit-depth reduction, randomization, adversarial training, contrastive learning, and diffusion-based restoration with DiffPIR. The central claim, stated in the conclusion, is that adversarial attacks significantly affect both classification and regression tasks, particularly at close range, and that no single defense is sufficient because different defenses are effective only under specific conditions. The paper also releases code for the experiments.

Significance. If the evaluation were fully supported, the paper would be a useful contribution: it studies a production ADS model rather than only research classifiers, it covers both detection and regression tasks, and it compares several defense families under a common framework. The release of code is a concrete strength. However, the current experimental evidence has gaps that are load-bearing for the central claims, especially the unvalidated regression baseline and the lack of repeated-run statistics, so the significance of the results depends on whether these gaps can be closed.

major comments (4)
  1. [V-B-1, Tables I, II, III, V] The regression evaluation measures deviation from the model's own clean-image predictions rather than from physical ground-truth distance. Section V-B-1 states that 'the model's predicted relative distances under attack are then compared to the predictions on clean images in each frame.' If Supercombo's clean distance estimates are biased by range or noisy in a distance-dependent way, the close-range vulnerability reported in Table I (e.g., 34.45 m under Auto-PGD) and the long-range negative values in Table III (e.g., -43.04 m under mixed adversarial training) reflect changes relative to an unvalidated baseline, not necessarily safety-relevant prediction error. This is the central quantity behind the paper's main regression conclusions, so the authors should validate clean Supercombo outputs against any available ground-truth (e.g., radar or lead-vehicle annotations), or at minimum report the clean model's calibration across distance bins and discuss how the reported deviations translate into physical distance error.
  2. [V-C-2, Table III] Adversarially trained models are never evaluated on clean inputs, so the claim of 'over-defense' or reduced long-distance accuracy is not substantiated. The mixed-training model's -43.04 m long-range error is computed against the clean predictions of the same retrained model, but no clean-input accuracy of that model is reported. The negative value could reflect a global shift in the retrained model's distance estimates rather than an attack-induced effect. The authors should report clean performance for every adversarially trained model, including the mixed model, and compare pre- and post-training calibration.
  3. [V-C-2, Table III and Table II] The experimental results are point estimates with no error bars, confidence intervals, or repeated runs. This matters because the mixed adversarial training split is random (Section V-C-2), the Randomization defense is stochastic, and contrastive learning involves stochastic training. Without repeated trials or seeds, the quantitative rankings of defenses, such as the reduction from 34.45 m to 5.04 m under Randomization in Table II, cannot be distinguished from sampling variability. The authors should report means and standard deviations over multiple seeds or at least a table of results from several runs.
  4. [Tables I, II, III, V, and Section V-C-1] The 'CAP/RP2' row conflates two attacks that target different tasks: CAP-Attack is a runtime regression attack on ACC distance prediction, while RP2 is a physical-world classification/patch attack for stop signs. Combining them in one row means that the regression error (e.g., 29.62 m in Table II) and the detection metrics (e.g., 88.97% mAP50 in the same row) come from different attacks without any indication of which number belongs to which attack. The authors should separate CAP and RP2 into distinct rows or clearly report the per-task attack conditions in separate columns.
minor comments (4)
  1. [V-A and References] The text refers to the 'Traffic Signs Detection dataset' but the cited reference [29] is titled 'Car detection dataset'; the reference identifier appears to be mismatched with the dataset actually used for stop-sign detection.
  2. [IV-B, Eq. (8)] The phrase 'bounded region defined by ϵ)' contains a stray parenthesis; also, the paper does not state the ϵ budget used for the attacks, which is needed to interpret the comparison across attack methods.
  3. [Fig. 2] The y-axis of Fig. 2 starts at 0.6, which visually exaggerates the differences between detection metrics; starting the axis at 0 would give a more accurate visual impression of the attack effects.
  4. [VI, Discussion] The statement that Median Blurring mitigates FGSM and Auto-PGD errors 'by more than 10 meters' is not supported by Table II: the largest reduction in the [0,20] range is 8.88 m for Auto-PGD (34.45 m to 25.57 m), and FGSM reductions are much smaller. The claim should be revised or the relevant numbers cited.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the paper is an empirical evaluation of attack and defense methods, and its regression-error metric is a direct measured deviation from clean-model outputs, not a fitted quantity renamed as a prediction.

full rationale

The paper contains no derivation chain that reduces to its own inputs. Attack methods, including CAP-Attack [14], are imported from prior work and are the objects under evaluation rather than evidence for the paper's conclusions, so the self-citation is not load-bearing. Defense results are obtained by retraining or preprocessing standard models and measuring attack-induced changes on public datasets (Comma2k19, Traffic Signs Detection), making the study a self-contained empirical comparison. The closest candidate for circularity is the regression baseline in Sec. V-B-1, where 'the model's predicted relative distances under attack are then compared to the predictions on clean images in each frame'; this is an external-validity limitation because clean-model predictions are not validated against physical ground truth, but it is not circularity, because the reported errors are exactly the measured differences by definition and no parameter is fitted so that a later output equals it by construction. No uniqueness theorem, ansatz smuggled via citation, or renamed empirical pattern is used as support. The paper's conclusions are empirical observations about measured attack and defense behavior, not derivations that presuppose those conclusions.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new entities. The load-bearing assumptions are about the evaluation methodology: using clean-model outputs as ground truth, simplifying to single-class detection, and treating digital perturbations as physical threats. The two free parameters are the mixed training split and adversarial training set size, both chosen by hand and central to the adversarial training conclusions.

free parameters (2)
  • mixed adversarial training split = 25% per attack
    The mixed training set is built by randomly selecting 25% of attacked examples from each attack. The claim that mixed training balances robustness depends on this split, and no sweep over split ratios is reported.
  • adversarial training dataset size = 416 stop sign images / 9600 video frames
    The dataset sizes are chosen by availability, and no analysis shows how performance scales with training set size, yet the adversarial training defense conclusions rest on these small sets.
assumptions (3)
  • domain assumption Deviation from the model's clean prediction is a valid proxy for safety-relevant distance error.
    Section V-B-1 compares attacked predictions to clean predictions rather than to measured ground-truth distances, so inferred safety impact rests on the accuracy of the clean model.
  • domain assumption Single-class stop sign detection with YOLOv8 adequately represents traffic sign perception in a production ADS.
    Section V-B-2 explicitly simplifies to single-class detection, while real OpenPilot perception is multi-class and joint with other tasks, so attack and defense numbers may not transfer to production settings.
  • domain assumption Digital perturbations applied to image regions represent physically realizable adversarial threats.
    Attacks are applied directly to camera frames as patches or noise rather than printed or projected, and physical-world transfer is not demonstrated in this evaluation, so the real-world risk is inferred rather than measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems." pith.science (2026). https://pith.science/paper/RKACRBSR

@misc{pith2026250511532,
  author       = {Pith},
  title        = {Pith review of: Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RKACRBSR}},
  note         = {Machine review of arXiv:2505.11532}
}
abstract

Autonomous driving systems (ADS) increasingly rely on deep learning-based perception models, which remain vulnerable to adversarial attacks. In this paper, we revisit adversarial attacks and defense methods, focusing on road sign recognition and lead object detection and prediction (e.g., relative distance). Using a Level-2 production ADS, OpenPilot by Comma$.$ai, and the widely adopted YOLO model, we systematically examine the impact of adversarial perturbations and assess defense techniques, including adversarial training, image processing, contrastive learning, and diffusion models. Our experiments highlight both the strengths and limitations of these methods in mitigating complex attacks. Through targeted evaluations of model robustness, we aim to provide deeper insights into the vulnerabilities of ADS perception systems and contribute guidance for developing more resilient defense strategies.

Figures

Figures reproduced from arXiv: 2505.11532 by the authors.

Figure 1
Figure 1. Example of datasets. Given a batch B = {xi} N i=1, we generate two augmented views per sample (˜xi , x˜ ′ i ) and optimize the InfoNCE loss: Lcontrast = − 1 N XN i=1 log exp (sim(zi, z ′ i)/τ ) PK k=1 ⊮[k̸=i] exp (sim(zi, zk)/τ ) (10) where, zi = gϕ(fθ(˜xi)) is the projected embedding, with fθ as the encoder (e.g., YOLOv8 backbone) and gϕ as the projec￾tion head (MLP); sim(u, v) = u ⊤v/(∥u∥∥v∥) denotes cosine simila… view at source ↗
Figure 2
Figure 2. Performance of stop sign detection with or w/o attacks. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

    cs.CR 2026-03 unverdicted novelty 6.0 of 10

    The survey organizes over 400 papers on embodied AI safety into a multi-level taxonomy and flags overlooked issues such as fragile multimodal fusion and unstable planning under jailbreaks.

Reference graph

Works this paper leans on

57 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    Autonomous driving system: A comprehensive survey,

    J. Zhao, W. Zhao, B. Deng, Z. Wang, F. Zhang, W. Zheng, W. Cao, J. Nan, Y . Lian, and A. F. Burke, “Autonomous driving system: A comprehensive survey,” Expert Systems with Applications , vol. 242, p. 122836, 2024

    2024

  2. [2]

    (2024) Model y owner’s manual

    Tesla, Inc. (2024) Model y owner’s manual. Accessed: 2025-04-

    work page 2024

  3. [3]

    Deep learning-based perception systems for autonomous driving: A comprehensive survey,

    L.-H. Wen and K.-H. Jo, “Deep learning-based perception systems for autonomous driving: A comprehensive survey,” Neurocomputing, vol. 489, pp. 255–270, 2022

    work page 2022

  4. [4]

    Adversarial sensor attack on lidar-based perception in autonomous driving,

    Y . Cao, C. Xiao, B. Cyr, Y . Zhou, W. Park, S. Rampazzi, Q. A. Chen, K. Fu, and Z. M. Mao, “Adversarial sensor attack on lidar-based perception in autonomous driving,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 2267–2281

    work page 2019

  5. [5]

    Adversarial attacks on autonomous driving systems in the physical world: a survey,

    L. Chi, M. Msahli, Q. Zhang, H. Qiu, T. Zhang, G. Memmi, and M. Qiu, “Adversarial attacks on autonomous driving systems in the physical world: a survey,” IEEE Transactions on Intelligent Vehicles , 2024

    work page 2024

  6. [6]

    Adversarial driving: Attacking end-to-end autonomous driving,

    H. Wu, S. Yunas, S. Rowlands, W. Ruan, and J. Wahlström, “Adversarial driving: Attacking end-to-end autonomous driving,” in 2023 IEEE Intelligent Vehicles Symposium (IV) . IEEE, 2023, pp. 1–7

    work page 2023

  7. [7]

    Available: https://www .tesla.com/ownersmanual/modely/ en_us/GUID-2CB60804-9CEA-4F4B-8B04-09B991368DC5 .html

    [Online]. Available: https://www .tesla.com/ownersmanual/modely/ en_us/GUID-2CB60804-9CEA-4F4B-8B04-09B991368DC5 .html

    work page

  8. [8]

    [Online]

    Ultralytics, “Yolov8,” 2025, accessed: 2025-05-06. [Online]. Available: https://docs.ultralytics.com/models/yolov8/

    work page 2025

Show all 57 references
  1. [9]

    OpenPilot

    Comma.ai, “OpenPilot.” [Online]. Available: https://github .com/ commaai/openpilot

  2. [10]

    (2024) Gaussian noise - wikipedia

    Wikipedia contributors. (2024) Gaussian noise - wikipedia. [Online]. Available: https://en.wikipedia.org/wiki/Gaussian_noise

    2024

  3. [11]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2015. [Online]. Available: https: //arxiv.org/abs/1412.6572

    2015 arXiv

  4. [12]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” 2020. [Online]. Available: https://arxiv.org/abs/2003.01690

    2020 arXiv

  5. [13]

    Simple black-box adversarial attacks,

    C. Guo, J. R. Gardner, Y . You, A. G. Wilson, and K. Q. Weinberger, “Simple black-box adversarial attacks,” 2019. [Online]. Available: https://arxiv.org/abs/1905.07121

    2019 arXiv

  6. [14]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625– 1634

    2018

  7. [15]

    Runtime Stealthy Perception Attacks against DNN- Based Adaptive Cruise Control Systems,

    X. Zhou, A. Chen, M. Kouzel, H. Ren, M. McCarty, C. Nita-Rotaru, and H. Alemzadeh, “Runtime Stealthy Perception Attacks against DNN- Based Adaptive Cruise Control Systems,” in ACM Asia Conference on Computer and Communications Security (ASIA CCS) , 2025

    2025

  8. [16]

    Sensor and sensor fusion technology in autonomous vehicles: A review,

    D. J. Yeong, G. Velasco-Hernandez, J. Barry, and J. Walsh, “Sensor and sensor fusion technology in autonomous vehicles: A review,” Sensors, vol. 21, no. 6, p. 2140, 2021

    2021

  9. [17]

    Vehicle localization with low cost radar sensors,

    E. Ward and J. Folkesson, “Vehicle localization with low cost radar sensors,” in 2016 IEEE Intelligent Vehicles Symposium (IV) . IEEE, 2016, pp. 864–870

    2016

  10. [18]

    In-vehicle camera traffic sign detection and recognition,

    A. Ruta, F. Porikli, S. Watanabe, and Y . Li, “In-vehicle camera traffic sign detection and recognition,” Machine Vision and Applications , vol. 22, pp. 359–375, 2011

    2011

  11. [19]

    A deep learning approach to traffic lights: Detection, tracking, and classification,

    K. Behrendt, L. Novak, and R. Botros, “A deep learning approach to traffic lights: Detection, tracking, and classification,” in 2017 IEEE International Conference on Robotics and Automation (ICRA) . IEEE, 2017, pp. 1370–1377

    2017

  12. [20]

    A real-time computer vision system for vehicle tracking and traffic surveillance,

    B. Coifman, D. Beymer, P. McLauchlan, and J. Malik, “A real-time computer vision system for vehicle tracking and traffic surveillance,” Transportation Research Part C: Emerging Technologies , vol. 6, no. 4, pp. 271–288, 1998

    1998

  13. [21]

    A review of lidar sensor technologies for perception in automated driving,

    J. Zhou, “A review of lidar sensor technologies for perception in automated driving,” Academic Journal of Science and Technology, vol. 3, no. 3, pp. 255–261, 2022

    2022

  14. [22]

    Adversarial examples in modern machine learning: A review,

    R. R. Wiyatno, A. Xu, O. Dia, and A. De Berker, “Adversarial examples in modern machine learning: A review,” arXiv preprint arXiv:1911.05268, 2019

    1911 arXiv

  15. [23]

    Adversarial attacks and coun- termeasures on image classification-based deep learning models in autonomous driving systems: A systematic review,

    B. Badjie, J. Cecílio, and A. Casimiro, “Adversarial attacks and coun- termeasures on image classification-based deep learning models in autonomous driving systems: A systematic review,” ACM Computing Surveys, vol. 57, no. 1, pp. 1–52, 2024

    2024

  16. [24]

    Efficient defenses against adversarial attacks,

    V . Zantedeschi, M.-I. Nicolae, and A. Rawat, “Efficient defenses against adversarial attacks,” in Proceedings of the 10th ACM workshop on artificial intelligence and security , 2017, pp. 39–49

    2017

  17. [25]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” in Proceedings 2018 Network and Distributed System Security Symposium , ser. NDSS 2018. Internet Society, 2018. [Online]. Available: http: //dx.doi.org/10.14722/ndss.2018.23198

    2018

  18. [26]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” 2018. [Online]. Available: https://arxiv.org/abs/1711.01991

    2018 arXiv

  19. [27]

    Adversarial training: A survey,

    M. Zhao, L. Zhang, J. Ye, H. Lu, B. Yin, and X. Wang, “Adversarial training: A survey,” 2024. [Online]. Available: https: //arxiv.org/abs/2410.15042

    2024 arXiv

  20. [28]

    Denoising diffusion models for plug-and-play image restoration,

    Y . Zhu, K. Zhang, J. Liang, J. Cao, B. Wen, R. Timofte, and L. V . Gool, “Denoising diffusion models for plug-and-play image restoration,” in IEEE Conference on Computer Vision and Pattern Recognition Workshops (NTIRE), 2023

    2023

  21. [29]

    A simple framework for contrastive learning of visual representations,

    T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” 2020. [Online]. Available: https://arxiv.org/abs/2002.05709

    2020 arXiv

  22. [30]

    Car detection dataset,

    P. K. Darabi, “Car detection dataset,” https://www .kaggle.com/datasets/ pkdarabi/cardetection, 2022, accessed: 2025-04-06

    2022

  23. [31]

    Strategic resilience evaluation of neural networks within autonomous vehicle software,

    A. Schmedding, P. Schowitz, X. Zhou, Y . Lu, L. Yang, H. Alemzadeh, and E. Smirni, “Strategic resilience evaluation of neural networks within autonomous vehicle software,” in International Conference on Computer Safety, Reliability, and Security . Springer, 2024, pp. 33–48

    2024

  24. [32]

    Strategic Safety-Critical Attacks against an Advanced Driver Assistance System,

    X. Zhou, A. Schmedding, H. Ren, L. Yang, P. Schowitz, E. Smirni, and H. Alemzadeh, “Strategic Safety-Critical Attacks against an Advanced Driver Assistance System,” in 2022 52nd Annual IEEE/IFIP Interna- tional Conference on Dependable Systems and Networks (DSN) . IEEE, 2022, ...

    2022

  25. [33]

    A commute in data: The comma2k19 dataset,

    H. Schafer, E. Santana, A. Haden, and R. Biasini, “A commute in data: The comma2k19 dataset,” 2018

    2018

  26. [34]

    Improving transformation invariance in contrastive representation learning,

    A. Foster, R. Pukdee, and T. Rainforth, “Improving transformation invariance in contrastive representation learning,” 2021. [Online]. Available: https://arxiv.org/abs/2010.09515

    2021 arXiv

  27. [35]

    Poba-ga: Pertur- bation optimized black-box adversarial attacks via genetic algorithm,

    J. Chen, M. Su, S. Shen, H. Xiong, and H. Zheng, “Poba-ga: Pertur- bation optimized black-box adversarial attacks via genetic algorithm,” Computers & Security , vol. 85, pp. 89–106, 2019

    2019

  28. [36]

    Robust roadside physical adversarial attack against deep learning in lidar perception modules,

    K. Yang, T. Tsai, H. Yu, M. Panoff, T.-Y . Ho, and Y . Jin, “Robust roadside physical adversarial attack against deep learning in lidar perception modules,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , 2021, pp. 349–362

    2021

  29. [37]

    Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,

    X. Wei, Y . Guo, J. Yu, and B. Zhang, “Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 7, pp. 9041–9054, 2022

    2022

  30. [38]

    Adversarial sticker: A stealthy attack method in the physical world,

    X. Wei, Y . Guo, and J. Yu, “Adversarial sticker: A stealthy attack method in the physical world,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 3, pp. 2711–2725, 2022

    2022

  31. [39]

    Adversarial color film: Effective physical-world attack to dnns,

    C. Hu and W. Shi, “Adversarial color film: Effective physical-world attack to dnns,” arXiv preprint arXiv:2209.02430 , 2022

    2022 arXiv

  32. [40]

    Targeted attention attack on deep learning models in road sign recognition,

    X. Yang, W. Liu, S. Zhang, W. Liu, and D. Tao, “Targeted attention attack on deep learning models in road sign recognition,” IEEE Internet of Things Journal , vol. 8, no. 6, pp. 4980–4990, 2020

    2020

  33. [41]

    Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,

    P. Jing, Q. Tang, Y . Du, L. Xue, X. Luo, T. Wang, S. Nie, and S. Wu, “Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3237–3254

    2021

  34. [42]

    Attacking vision-based perception in end-to-end autonomous driving models,

    A. Boloor, K. Garimella, X. He, C. Gill, Y . V orobeychik, and X. Zhang, “Attacking vision-based perception in end-to-end autonomous driving models,” Journal of Systems Architecture , vol. 110, p. 101766, 2020

    2020

  35. [43]

    Physical hijacking attacks against object trackers,

    R. Muller, Y . Man, Z. B. Celik, M. Li, and R. Gerdes, “Physical hijacking attacks against object trackers,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2309–2322

    2022

  36. [44]

    Advdo: Realistic adversarial attacks for trajectory prediction,

    Y . Cao, C. Xiao, A. Anandkumar, D. Xu, and M. Pavone, “Advdo: Realistic adversarial attacks for trajectory prediction,” in European Conference on Computer Vision . Springer, 2022, pp. 36–52

    2022

  37. [45]

    Physically realizable adversarial examples for lidar object detection,

    J. Tu, M. Ren, S. Manivasagam, M. Liang, B. Yang, R. Du, F. Cheng, and R. Urtasun, “Physically realizable adversarial examples for lidar object detection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 13 716–13 725

    2020

  38. [46]

    Beyond digital domain: Fooling deep learning based recognition system in physical world,

    K. Yang, T. Tsai, H. Yu, T.-Y . Ho, and Y . Jin, “Beyond digital domain: Fooling deep learning based recognition system in physical world,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 34, no. 01, 2020, pp. 1088–1095

    2020

  39. [47]

    Dual attention suppression attack: Generate adversarial camouflage in physical world,

    J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 8565–8574

    2021

  40. [48]

    Robustness testing of data and knowledge driven anomaly detection in cyber-physical systems,

    X. Zhou, M. Kouzel, and H. Alemzadeh, “Robustness testing of data and knowledge driven anomaly detection in cyber-physical systems,” in 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) . IEEE, 2022, pp. 44–51

    2022

  41. [49]

    Attackbench: Evaluating gradient- based attacks for adversarial examples,

    A. E. Cinà, J. Rony, M. Pintor, L. Demetrio, A. Demontis, B. Biggio, I. B. Ayed, and F. Roli, “Attackbench: Evaluating gradient- based attacks for adversarial examples,” 2024. [Online]. Available: https://arxiv.org/abs/2404.19460

    2024 arXiv

  42. [50]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in ICML, 2020

    2020

  43. [51]

    Defense against adversarial attacks using high-level representation guided denoiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2018

    2018

  44. [52]

    Adversarial defense by stratified convolutional sparse coding,

    B. Sun, N.-H. Tsai, F. Liu, R. Yu, and H. Su, “Adversarial defense by stratified convolutional sparse coding,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , June 2019

    2019

  45. [53]

    Defense against universal adversarial perturbations,

    N. Akhtar, J. Liu, and A. Mian, “Defense against universal adversarial perturbations,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , June 2018

    2018

  46. [54]

    Hybrid knowledge and data driven synthesis of runtime monitors for cyber- physical systems,

    X. Zhou, B. Ahmed, J. H. Aylor, P. Asare, and H. Alemzadeh, “Hybrid knowledge and data driven synthesis of runtime monitors for cyber- physical systems,” IEEE Transactions on Dependable and Secure Com- puting, vol. 21, no. 1, pp. 12–30, 2023

    2023

  47. [55]

    Data-driven design of context-aware monitors for hazard pre- diction in artificial pancreas systems,

    ——, “Data-driven design of context-aware monitors for hazard pre- diction in artificial pancreas systems,” in 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . IEEE, 2021, pp. 484–496

    2021

  48. [56]

    Safety interventions against adversarial patches in an open-source driver assistance system,

    C. Chen, G. Xiao, D. Lee, L. Yang, E. Smirni, H. Alemzadeh, and X. Zhou, “Safety interventions against adversarial patches in an open-source driver assistance system,” to appear in the 55th Annual IEEE/IFIP International Conference on Dependable Systems and Net- works (DSN), 2025

    2025

  49. [57]

    Adversarial attacks and defenses in deep learning for autonomous vehicles: A systematic review from a safety perspective,

    A. D. M. Ibrahum et al. , “Adversarial attacks and defenses in deep learning for autonomous vehicles: A systematic review from a safety perspective,” Artificial Intelligence Review , 2024

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.