DARTS: Deceiving Autonomous Cars with Toxic Signs

Sign recognition is an integral part of autonomous cars. Any misclassi€cation of trac signs can potentially lead to a multitude of disastrous consequences, ranging from a life-threatening accident to even a large-scale interruption of transportation services relying on autonomous cars. In this paper, we propose and examine realistic security aˆacks against sign recognition systems for Deceiving Autonomous caRs with Toxic Signs (we call the proposed aŠacks DARTS). Leveraging the concept of adversarial examples, we strategically modify innocuous signs/advertisements in the environment in such a way that they seem normal to human observers but are interpreted as the adversary’s desired trac sign by autonomous cars. Further, we pursue a fundamentally di‚erent perspective to aŠacking autonomous cars, motivated by the observation that the driver and vehicle-mounted camera see the environment from di‚erent angles (the camera commonly sees the road with a higher angle, e.g., from top of the car). Bridging concepts from optics (in particular, lenticular printing), security, and computer vision, we propose a novel aŠack against vehicular sign recognition systems: we create signs that change as they are viewed from di‚erent angles, and thus, can be interpreted di‚erently by the driver and sign recognition. We extensively evaluate the proposed aŠacks under various conditions: di‚erent distances, lighting conditions, and camera angles. We €rst examine our aŠacks virtually, i.e., we check if the digital images of toxic signs can deceive the sign recognition system. Further, we investigate the e‚ectiveness of aŠacks in real-world seŠings: we print toxic signs, install them in the environment, capture videos using a vehicle-mounted camera, and process them using our sign recognition pipeline. We €nd our aŠacks to achieve aŠack success rates of over 90% in both the digital and real-world seŠings. We further suggest a countermeasure based on adversarial training to protect against adversarial example-based aŠacks. Our proof-of-concept aŠacks shed light on a fundamental security challenge associated with the use of sign recognition techniques in autonomous cars, paving the way for further investigation of overlooked security challenges of autonomous cars.