SoK: On the Semantic AI Security in Autonomous Driving

In this paper, we perform the first systematization of knowledge (SoK) of the semantic AD AI security research space. In total, we collect and analyze 53 such papers in the past 5 years, and systematically taxonomize them based on research aspects critical for the security field such as the attack/defense targeted AI component, attack/defense goal, attack vector, attack knowledge, defense deployability, defense robustness, and evaluation methodologies. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels.

To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS (Platform for Autonomous driving Security and Safety), for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

Available AD Vehicles for PASS

Simulation Fidelity Evaluation Results

Attack effectiveness at specific distances/angles between physical world and simulation

Experimental setup:

• Apply the ShapeShifter (SS) attack [1]

• Physical world:

  • Results are from the paper (i.e., untargeted attack in Table 1 in the SS paper [1])

• Simulation:

  • The adversarial STOP sign is generated using the same code and configuration as released by SS authors [GitHub]

  • Test at the same distance/angle combinations

Results:

Attack trace similarity between physical world and simulation

Experimental setup:

• Apply the ShapeShifter (SS) attack [1]

  • Use the same adversarial STOP sign in both simulation and the physical world

  • Drive vehicle from 300 ft until passes the STOP sign

• Physical world:

  • Collected 20 physical world driving traces

  • Two STOP sign locations: at the middle or end of the road

• Simulation:

  • Use road with similar geometry as the one in the physical world

  • Collected 1 simulation trace

• Calculate Pearson's correlation of the STOP sign detection confidences in each physical world trace and the simulation trace

Results:

Research Paper

@article{arxiv:2022:shen:sok,

title={{SoK: On the Semantic AI Security in Autonomous Driving}},

author={Junjie Shen and Ningfei Wang and Ziwen Wan and Yunpeng Luo and Takami Sato and Zhisheng Hu and Xinyang Zhang and Shengjian Guo and Zhenyu Zhong and Kang Li and Ziming Zhao and Chunming Qiao and Qi Alfred Chen},

journal={arXiv preprint arXiv:2203.05314},

year={2022}

}

[PDF] [Code Release (Now in selected-group collaboration stage. Email Alfred <alfchen@uci.edu> for questions & access requests.)]

Team

• Junjie Shen, Ph.D. student, CS, UC Irvine

• Ningfei Wang, Ph.D. student, CS, UC Irvine

• Ziwen Wan, Ph.D. student, CS, UC Irvine

• Yunpeng Luo, Ph.D. student, CS, UC Irvine

• Takami Sato, Ph.D. student, CS, UC Irvine

• Zhisheng Hu, Baidu Security

• Xinyang Zhang, Baidu Security

• Shengjian Guo, Baidu Security

• Zhenyu Zhong, Baidu Security

• Kang Li, Baidu Security

• Ziming Zhao, Assistant Professor, CSE, University at Buffalo

• Chunming Qiao, SUNY Distinguished Professor and Chair, CSE, University at Buffalo

• Qi Alfred Chen, Assistant Professor, CS, UC Irvine

Acknowledgments