SlowPerception: Physical-World Latency Attack against Visual Perception in Autonomous Driving

自动驾驶系统（AD）在实时物体检测和多目标跟踪（MOT）方面严重依赖视觉感知以确保安全驾驶。然而，这些视觉感知组件的高延迟可能导致重大安全风险，如车辆碰撞。虽然以前的研究已经广泛探讨了数字领域内的延迟攻击，但将这些方法有效地转化到物理世界中仍然存在挑战。例如，现有的攻击依赖于不现实或不切实际的扰动，如影响天空等区域的对抗性扰动，或需要遮挡大部分摄像头视野的大型补丁，因此在现实世界中难以有效地进行。本文介绍了SlowPerception，这是针对AD感知的第一个物理世界延迟攻击，通过生成基于投影仪的通用扰动。SlowPerception在环境中的各种表面上策略性地创建了许多幻象对象，显著增加了非极大值抑制（NMS）和MOT的计算负载，从而引起了重大的延迟。我们的SlowPerception在物理世界设置中实现了第二级延迟，不同的AD感知系统、场景和硬件配置平均延迟为2.5秒，这一性能显著优于现有的最先进的延迟攻击。此外，我们使用产业级AD系统和生产级AD模拟器进行了AD系统级影响评估，例如车辆碰撞，平均达到了97%。我们希望我们的分析能够激发在这个关键领域的进一步研究，增强AD系统对新兴漏洞的鲁棒性。

SlowPerception: A Physical-World Latency Attack Against Autonomous Driving Perception

The paper proposes SlowPerception, a physical-world latency attack against autonomous driving perception, achieved through generating projector-based universal perturbations to create phantom objects and significantly increase the computational load of Non-Maximum Suppression (NMS) and MOT, inducing substantial latency.

SlowPerception achieves second-level latency in physical-world settings, with an average latency of 2.5 seconds across different AD perception systems, scenarios, and hardware configurations, outperforming existing state-of-the-art latency attacks. The paper conducts AD system-level impact assessments, such as vehicle collisions, using industry-grade AD systems with production-grade AD simulators with a 97% average rate.

Related work includes research on latency attacks within the digital realm, but this paper is the first to propose a physical-world latency attack against AD perception.