Physical Backdoor Attacks to Lane Detection Systems in Autonomous Driving

Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, Tiawei Zhang

Physical-World Setup

  • In the physical setup, we use 2 real traffic cones as a physical trigger, and evaluated two attacks on a Baidu Apollo vehicle and a Weston UGV in campus scenarios.

  • Lane detection models:

    1. Segmentation-based: SCNN,

    2. Anchor-based: LaneATT,

    3. Classification-based: UltraFast,

    4. Polynomial-based: PolyLaneNet

  • UGV with Intel RealSense D435i camera (left).

  • Apollo with Leopard camera (right).

Clean-annotation attack

1, Physical testing

SCNN-gt-7 meters

SCNN-gt-6 meters

SCNN-gt-5 meters

SCNN-7 meters

SCNN-6 meters

SCNN-5 meters


2, Physical testing at different sites

Site 1 ---- tested with benign model

Site 1 ---- clean-annotation attack

Site 2 ---- tested with benign model

Site 2 ---- clean-annotation attack

3, Physical testing with different testbeds, Apollo and UGV

Apollo

UGV

4, More results on Tusimple

Poisoning-annotation attack

1, Physical testing

Benign SCNN

Backdoored SCNN

2, Physical testing with different poisoned backdoored SCNN

SCNN-gt

SCNN-20

SCNN-40

SCNN-60

SCNN-80

SCNN-100

3, TuSimple (dataset simulation), with different number of poisoned images

SCNN-0

LaneATT-0

UltraFast-0

PolyLaneNet-0

SCNN-20

LaneATT-20

UltraFast-20

PolyLaneNet-20

SCNN-40

LaneATT-40

UltraFast-40

PolyLaneNet-40

SCNN-60

LaneATT-60

UltraFast-60

PolyLaneNet-60

SCNN-80

LaneATT-80

UltraFast-80

PolyLaneNet-80

SCNN-100

LaneATT-100

UltraFast-100

PolyLaneNet-100

4, More results on Tusimple