Recent research in adversarial machine learning has focused on visual
perception in Autonomous Driving (AD) and has shown that printed adversarial
patches can attack object detectors. However, it is important to note that AD
visual perception encompasses more than just object detection; it also includes
Multiple Object Tracking (MOT). MOT enhances the robustness by compensating for
object detection errors and requiring consistent object detection results
across multiple frames before influencing tracking results and driving
decisions. Thus, MOT makes attacks on object detection alone less effective. To
attack such robust AD visual perception, a digital hijacking attack has been
proposed to cause dangerous driving scenarios. However, this attack has limited
effectiveness.
In this paper, we introduce a novel physical-world adversarial patch attack,
ControlLoc, designed to exploit hijacking vulnerabilities in entire AD visual
perception. ControlLoc utilizes a two-stage process: initially identifying the
optimal location for the adversarial patch, and subsequently generating the
patch that can modify the perceived location and shape of objects with the
optimal location. Extensive evaluations demonstrate the superior performance of
ControlLoc, achieving an impressive average attack success rate of around 98.1%
across various AD visual perceptions and datasets, which is four times greater
effectiveness than the existing hijacking attack. The effectiveness of
ControlLoc is further validated in physical-world conditions, including real
vehicle tests under different conditions such as outdoor light conditions with
an average attack success rate of 77.5%. AD system-level impact assessments are
also included, such as vehicle collision, using industry-grade AD systems and
production-grade AD simulators with an average vehicle collision rate and
unnecessary emergency stop rate of 81.3%.

介绍了一种新型的物理世界对抗贴片攻击 (ControlLoc)，利用两阶段过程，通过识别最佳位置生成贴片，修改感知到的物体位置和形状，在不同条件下以卓越的攻击成功率 (98.1%) 攻击自动驾驶视觉感知，比现有的劫持攻击有效性提高四倍，且在实际车辆测试中达到 77.5% 的攻击成功率，评估了 AD 系统的影响如车辆碰撞率和不必要的紧急停车率 (81.3%)。