Autonomous Driving (AD) systems critically depend on visual perception for
real-time object detection and multiple object tracking (MOT) to ensure safe
driving. However, high latency in these visual perception components can lead
to significant safety risks, such as vehicle collisions. While previous
research has extensively explored latency attacks within the digital realm,
translating these methods effectively to the physical world presents
challenges. For instance, existing attacks rely on perturbations that are
unrealistic or impractical for AD, such as adversarial perturbations affecting
areas like the sky, or requiring large patches that obscure most of a camera's
view, thus making them impossible to be conducted effectively in the real
world.
In this paper, we introduce SlowPerception, the first physical-world latency
attack against AD perception, via generating projector-based universal
perturbations. SlowPerception strategically creates numerous phantom objects on
various surfaces in the environment, significantly increasing the computational
load of Non-Maximum Suppression (NMS) and MOT, thereby inducing substantial
latency. Our SlowPerception achieves second-level latency in physical-world
settings, with an average latency of 2.5 seconds across different AD perception
systems, scenarios, and hardware configurations. This performance significantly
outperforms existing state-of-the-art latency attacks. Additionally, we conduct
AD system-level impact assessments, such as vehicle collisions, using
industry-grade AD systems with production-grade AD simulators with a 97%
average rate. We hope that our analyses can inspire further research in this
critical domain, enhancing the robustness of AD systems against emerging
vulnerabilities.

该论文介绍 SlowPerception，这是针对自主驾驶感知的第一个物理世界延迟攻击，通过生成基于投影仪的通用扰动。SlowPerception 通过在环境中各种表面上战略性地创建众多幽灵物体，显著增加了非极大抑制和多目标跟踪的计算负载，从而引发了重大的延迟。我们的 SlowPerception 在物理世界环境中实现了二级延迟，不同自主驾驶感知系统、情景和硬件配置下的平均延迟为 2.5 秒。此性能远远超过现有最先进的延迟攻击。另外，我们使用工业级自主驾驶系统和生产级自主驾驶模拟器进行了车辆碰撞等自主驾驶系统水平影响评估，平均成功率为 97%。我们希望我们的分析能够激发进一步研究，增强自主驾驶系统对新兴漏洞的鲁棒性。

SlowPerception: 自主驾驶中针对视觉感知的物理世界延迟攻击

SlowPerception: Physical-World Latency Attack against Visual Perception  in Autonomous Driving

Latency attacks against object detection represent a variant of adversarial
attacks that aim to inflate the inference time by generating additional ghost
objects in a target image. However, generating ghost objects in the black-box
scenario remains a challenge since information about these unqualified objects
remains opaque. In this study, we demonstrate the feasibility of generating
ghost objects in adversarial examples by extending the concept of "steal now,
decrypt later" attacks. These adversarial examples, once produced, can be
employed to exploit potential vulnerabilities in the AI service, giving rise to
significant security concerns. The experimental results demonstrate that the
proposed attack achieves successful attacks across various commonly used models
and Google Vision API without any prior knowledge about the target model.
Additionally, the average cost of each attack is less than \$ 1 dollars, posing
a significant threat to AI security.

利用‘偷现，解密后’的攻击方式，在黑盒情况下生成幽灵对象的可行性研究，证明了该攻击可以成功地利用 AI 服务的潜在漏洞，给 AI 安全带来了重大威胁。

抢先行动，后继攻击：评估目标检测系统对黑盒对抗攻击的鲁棒性

Steal Now and Attack Later: Evaluating Robustness of Object Detection  against Black-box Adversarial Attacks

Nowadays, the deployment of deep learning based applications on edge devices
is an essential task owing to the increasing demands on intelligent services.
However, the limited computing resources on edge nodes make the models
vulnerable to attacks, such that the predictions made by models are unreliable.
In this paper, we investigate latency attacks on deep learning applications.
Unlike common adversarial attacks for misclassification, the goal of latency
attacks is to increase the inference time, which may stop applications from
responding to the requests within a reasonable time. This kind of attack is
ubiquitous for various applications, and we use object detection to demonstrate
how such kind of attacks work. We also design a framework named Overload to
generate latency attacks at scale. Our method is based on a newly formulated
optimization problem and a novel technique, called spatial attention, to
increase the inference time of object detection. We have conducted experiments
using YOLOv5 models on Nvidia NX. The experimental results show that with
latency attacks, the inference time of a single image can be increased ten
times longer in reference to the normal setting. Moreover, comparing to
existing methods, our attacking method is simpler and more effective.

本文探讨了深度学习应用程序遭受的延迟攻击，并提出了一种新的框架名称为 Overload，用于在物体检测中生成这种攻击。实验结果表明，相比现有方法，我们的攻击方法更简单更有效。