Autonomous driving (AD) systems are often built and tested in a modular
fashion, where the performance of different modules is measured using
task-specific metrics. These metrics should be chosen so as to capture the
downstream impact of each module and the performance of the system as a whole.
For example, high perception quality should enable prediction and planning to
be performed safely. Even though this is true in general, we show here that it
is possible to construct planner inputs that score very highly on various
perception quality metrics but still lead to planning failures. In an analogy
to adversarial attacks on image classifiers, we call such inputs
\textbf{adversarial perception errors} and show they can be systematically
constructed using a simple boundary-attack algorithm. We demonstrate the
effectiveness of this algorithm by finding attacks for two different black-box
planners in several urban and highway driving scenarios using the CARLA
simulator. Finally, we analyse the properties of these attacks and show that
they are isolated in the input space of the planner, and discuss their
implications for AD system deployment and testing.

自动驾驶（AD）系统通常以模块化方式构建和测试，其中使用特定任务的度量标准来衡量不同模块的性能。我们展示了可以构建得分在各种感知质量度量方面非常高，但仍导致规划失败的规划输入，称之为对抗感知错误，并通过使用简单的边界攻击算法在 CARLA 模拟器中找到了针对两个不同黑盒规划器的攻击，适用于几种城市和高速公路驾驶场景。最后，我们分析了这些攻击的特性，表明它们在规划器的输入空间中是孤立的，并讨论了它们对自动驾驶系统部署和测试的影响。