Research map / Adversarial robustness and security / Attacks on text and graphs
SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SlowTrack, an adversarial-perturbation attack that increases the latency of the whole camera-based AD perception pipeline (detection plus tracking-by-detection) by inflating tracker counts, evaluated on four trackers, Baidu Apollo, and LGSVL.
Problem
Latency (availability) attacks on camera-based autonomous driving perception have only targeted object detection, which fails to produce strong system-level effects such as vehicle crashes because the tracking stage is ignored.
Approach
A two-stage attack that exploits the tracker management module: first spawn many new trackers via region-based detection boxes not associated with existing trackers, then keep lost trackers alive by re-triggering matching boxes before the reserved age R expires, optimized with score, bounding-box area, and feature-match losses.
Key results
- On SORT (Y5) with 2080 Ti on MOT17, SlowTrack raises whole-pipeline latency by 50.9x (R-Lat) versus at most 19.3x for baselines; averaged across models, SlowTrack gives 2.9x more whole-perception latency than existing attacks.
- In Baidu Apollo + LGSVL simulation, SlowTrack achieves an average vehicle crash rate of about 95% versus around 30% for existing attacks.
- Latency on SORT (Y5) with 2080 Ti rises to 1,082 ms under SlowTrack compared with 411 ms under Overload, with average L2 norm around 0.021.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SlowTrack instead of PS | SORT (Y5) · MOT17, 2080 Ti | R-Lat: 8.6 -> 50.9 | Helped |
| Use SlowTrack instead of Overload | SORT (Y5) · MOT17, 2080 Ti | latency time (ms): 411 -> 1082 | Helped |
| Use SlowTrack instead of PS | SORT (Y5), Baidu Apollo/LGSVL · S1 vehicle scenario | vehicle crash rate: 10% -> 100% | Helped |
| Use SlowTrack instead of Overload | SORT (Y5), Baidu Apollo/LGSVL · S2 vehicle scenario | vehicle crash rate: 40% -> 90% | Helped |
| Add score loss (ablation) | SlowTrack · MOT17, 2080 Ti, SORT (Y5) | R-Lat: 0.0 -> 50.9 | Helped |
| Add bounding box area loss (ablation) | SlowTrack · MOT17, 2080 Ti, SORT (Y5) | R-Lat: 34.0 -> 50.9 | Helped |
| Add feature match loss (ablation) | SlowTrack · MOT17, 2080 Ti, SORT (Y5) | R-Lat: 38.3 -> 50.9 | Helped |
Surprising findings
- Object-detection-only latency attacks often fail to produce strong system-level effects because the tracker and post-processing filter out most injected boxes.
- Tuning confidence or NMS thresholds does not defeat the attack; SORT (Y5) tracker count stays high (about 92 vs 68) across thresholds.
Limitations
- Physical-world effectiveness is not demonstrated; only digital perturbations were evaluated.
- Threat model is white-box for the detector; black-box setting left to future work.
- Defenses are not explored.
Experimental setup
Datasets: MOT17 BDD100K
Benchmarks: MOT17 BDD100K
Metrics: R-Track R-Lat #Track increase rate average L2 norm latency (ms) vehicle crash rate
Baselines: PS Overload
Builds on: PS (preventing-sponge) latency attack Overload attack SORT YOLOv5 ByteTrack
Closest papers by meaning
- Can't Slow Me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices (CVPR 2025 · similarity 0.87)
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.85)
- Enduring, Efficient and Robust Trajectory Prediction Attack in Autonomous Driving via Optimization-Driven Multi-Frame Perturbation Framework (CVPR 2025 · similarity 0.84)
- SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · similarity 0.84)
- Overload: Latency Attacks on Object Detection for Edge Devices (CVPR 2024 · similarity 0.84)
- Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.