Research map / Adversarial robustness and security / Attacks on text and graphs
Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Simulates electromagnetic signal injection attacks (color strips) on camera images, validates the simulation against real attacks via object detection, builds a simulated ESIA dataset on BDD100k, and evaluates three multi-task driving models under attack across weather, scene, and time-of-day conditions.
Problem
Autonomous vehicle camera perception is vulnerable to electromagnetic signal injection attacks (ESIA), but their impact on AI perception models across diverse driving scenarios is poorly understood, and real attack data is costly to collect.
Approach
A simulation method that mimics ESIA's packet-loss-induced red/blue and green channel swaps in image rows to generate color strips with controllable severity, validated statistically against real attack images from prior work.
Key results
- HybridNets under clear weather: mAP50 drops 10.80%, 31.60%, and 50.50% under mild, moderate, and severe simulated attacks.
- t-tests comparing real vs simulated attack degradation (dmAP50, dmAP75, dmAP50:95) gave all p-values above 0.05 (e.g., 0.876 for mild dmAP50), indicating no significant difference.
- Highway scenes were most affected (e.g., -70.89% mAP50 degradation under severe attack for YOLOP-averaged results), while city street was least affected.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply mild, moderate, or severe simulated ESIA | HybridNets · BDD100k, Clear | mAP50: 0.755 -> 0.647 -> 0.439 -> 0.250 | Hurt |
| Apply severe simulated ESIA | A-YOLOM · BDD100k, Highway | mAP50: 0.782 -> 0.240 | Hurt |
| Apply severe simulated ESIA | A-YOLOM · BDD100k, Highway | mIoU: 0.928 -> 0.791 | Hurt |
| Apply simulated ESIA at increasing severity | HybridNets, A-YOLOM, and YOLOP · BDD100k traffic scenarios | traffic object detection degradation (D_M_severe): -64.45%, -60.95%, -63.37% | Hurt |
| Apply simulated ESIA at increasing severity | HybridNets, A-YOLOM, and YOLOP · BDD100k driving scenarios | drivable area segmentation degradation (D_M_severe): -12.08%, -13.61%, -11.54% | Hurt |
| Use simulated instead of real ESIA images | Object detection models · COCO2017 test images, mild ESIA | ΔmAP50: 0.876 | No clear effect |
| Use simulated instead of real ESIA images | Object detection models · COCO2017 test images, moderate ESIA | ΔmAP50: 0.493 | No clear effect |
| Use simulated instead of real ESIA images | Object detection models · COCO2017 test images, severe ESIA | ΔmAP50: 0.491 | No clear effect |
| Apply simulated ESIA | Traffic object detection and drivable area segmentation models · BDD100k, Highway versus City Street | performance degradation: Highway detection D_S_severe -70.89%; City Street detection D_S_severe -59.29% | Mixed |
| Apply simulated ESIA | A-YOLOM and YOLOP · BDD100k, across environmental scenarios | robustness: -60.95%; -11.54% | Mixed |
Surprising findings
- Higher attack severity partly reverted model attention toward pre-attack states, which the authors speculate is a counteracting effect across modules.
- A-YOLOM was least affected in detection and YOLOP in segmentation, despite SPP-based robustness expectations not being clearly confirmed.
Limitations
- Simulation assumes neighboring pixel values are similar, approximating color information with four values.
- Validation of realism relies on a small real attack set of 100 COCO images and only object detection tasks.
- Only three multi-task driving models evaluated for perception; attacks limited to color strips and no end-to-end driving evaluation.
Experimental setup
Datasets: BDD100k validation set (10,000 images sampled) COCO2017 test images (100 images, real attack set from prior work)
Benchmarks: BDD100k
Metrics: mAP50 mAP75 mAP50:95 mIoU degradation (%) t-test p-value
Baselines: HybridNets A-YOLOM YOLOP
Builds on: BDD100k COCO Grad-CAM
Closest papers by meaning
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.80)
- Dual-View Interaction-Aware Lane Change Prediction for Autonomous Driving (AAAI 2025 · similarity 0.79)
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.78)
- DiffScene: Diffusion-Based Safety-Critical Scenario Generation for Autonomous Vehicles (AAAI 2025 · similarity 0.78)
- Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving (NeurIPS 2025 · similarity 0.78)
- SafeAuto: Knowledge-Enhanced Safe Autonomous Driving with Multimodal Foundation Models (ICML 2025 · similarity 0.77)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.