AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Abstract
Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
This work proposes an efficient and effective adversarial attack detection scheme leveraging the multi-task perception within a complex vision system, and develops a consistency score metric to measure the inconsistency between vision tasks.
Cong Chen, J. Monteuuis, Jonathan Petit· 0 citations
Deep Neural Networks (DNNs) remain vulnerable to adversarial perturbations, raising significant concerns in image processing applications, particularly in high-stakes domains such as medical imaging and security-critical systems. Most existing defense strategies are limited by domain specificity, architectural dependence, or the need for extensive retraining, making them impractical for real-world deployment. In this work, we propose ADEx, the first framework to integrate low-rank image approximation with explainability-driven analysis for the detection of adversarial samples. ADEx works by extracting a low-rank representation of the input image using Singular Value Thresholding (SVT), and identifying important image regions by computing class-specific gradient maps from the final layers of the classifier. These maps are then compared using Rank-Biased Overlap (RBO) to quantify the degree of attention drift induced by adversarial perturbations. ADEx is designed for adversarial detection in image classification systems, where class-specific gradient-based explanations are well defined. The framework operates without retraining or architectural modification and can be applied to a wide range of differentiable classifiers, provided gradient access is available for explanation generation. Extensive experiments across multiple datasets, architectures, and attack types demonstrate consistent performance, robustness to hyperparameter choices, and low sensitivity to calibration size. The method provides an interpretable and lightweight solution suitable for practical deployment.
Syamantak Sarkar, Nirmal Joseph, Sudhish N. George et al.· IEEE Transactions on Image P...· 0 citations
InsCAT is proposed, an instance-level contrastive adversarial training framework that prevents detectors from using adversarial texture as an independent decision cue, and consistent gains across separately trained detectors demonstrate applicability across architectures with direct inference.
Yuanhao Huang, Yi-Long Ren, Jinlei Wang et al.· arXiv.org· 0 citations
This survey examines a recent class of adversarial efficiency degradation attacks that target these mechanisms to increase computation without necessarily degrading accuracy, and unify and compare two representative attacks across three popular token-pruning frameworks.
Anadi Goyal, Nandish Chattopadhyay, Anupam Chattopadhyay et al.· 0 citations
AdvSerial is proposed, a dynamic 2D--3D joint optimization framework for generating continuous high-angle physical adversarial patches against pedestrian detectors in infrastructure-based scenarios and the results reveal persistent, temporally consistent failure modes under high-angle surveillance, and motivate the design of motion-aware and 3D-aware defenses for security-critical infrastructure deployments.
Yuanhao Huang, Yi-Long Ren, Jinlei Wang et al.· Computer-Aided Civil and Inf...· 1 citation
This research investigates the adversarial robustness of lane detection for Autonomous Vehicles (AVs) under challenging driving conditions using Generative Adversarial Networks (GANs). In this work, the term adversarial refers to the adversarial training mechanism of GANs and to robustness under naturally adverse driving conditions, particularly illumination variation, rather than to defence against deliberate pixel-level perturbation attacks such as FGSM or PGD. Lane detection is a crucial component for safe navigation, but it often fails under poor lighting or adverse weather. To solve this, a U-Net model is trained on the Berkeley DeepDrive (BDD100K) dataset as a baseline. Then, Conditional GAN (CGAN) is used with the Cityscapes dataset to learn the mapping between RGB images and lane masks, which improves structural consistency. To handle illumination changes, CycleGAN is used to simulate Day-to-Night and Night-to-Day translations using BDD100K datasets, creating a more diverse training set. Preprocessing involves resizing images to 512×512 to ensure training efficiency on limited GPU hardware. The experiments are conducted using TensorFlow in a GPU-accelerated environment. Results show that the U-Net + CycleGAN model achieves a Precision of 65.41% and an F1-Score of 63.79%, which outperforms previous studies. The CGAN model also shows high performance with 92.55% F1-Score. This research proves that using GANs for data augmentation and domain translation can enhance the adversarial robustness and reliability of lane detection systems in real-world scenarios.
Brian Lee Chong Ming, Thinesh Ganesan· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
