Fooling the Camera: Adversarial Attacks on Self-Driving Vision

In 2018, a team led by researcher Kevin Eykholt printed a handful of black-and-white stickers, about the size of sticky notes, and pressed them onto an ordinary stop sign. To every human driver who walked past, it was still obviously a stop sign. But when a self-driving car's camera-based classifier looked at it, the stickers pushed its prediction into a completely different category: a 45 mph speed limit sign, with high confidence, in the vast majority of test trials. That single experiment launched a whole field of automotive security research called adversarial machine learning.

How convolutional neural networks classify road signs and objects from camera pixels. Why tiny, carefully calculated changes to an image can cause massive misclassifications. The difference between digital perturbation attacks and physical adversarial patches. How engineers defend real vehicles using sensor fusion and adversarial training.

A convolutional neural network (CNN) doesn't see a stop sign the way you do. It breaks the image into a grid of pixel values, then runs those values through layers of filters that detect edges, then shapes, then whole objects. By the final layer, the network outputs a confidence score for each possible label -- 'stop sign: 98%, yield sign: 1%, speed limit sign: 1%' -- and picks the highest score. That scoring process is precise but rigid, and rigidity is exactly what an attacker can exploit.

Eykholt's team, working across the University of Michigan and University of Washington, called their method RP2 (Robust Physical Perturbations). They used an algorithm to calculate the exact pixel changes that would shift a classifier's confidence the most, then translated those changes into printable stickers shaped like graffiti or camouflage patterns. In controlled lab conditions the stop sign was misread as a speed limit sign 100% of the time. In real outdoor field tests, with changing light, angles, and distances, the attack still succeeded 84.8% of the time. The stickers cost only a few dollars to print.

Digital perturbation attacks, like the Fast Gradient Sign Method (FGSM), tweak an image file's pixel values directly -- useful for testing a model in software, but useless against a real camera pointed at the real world. Physical patch attacks, like the stop-sign stickers, have to survive sunlight, rain, motion blur, and different viewing angles, which makes them far harder to design but far more dangerous, since they can be deployed on an actual road sign that any passing vehicle will photograph.

Automakers use several layered defenses. Adversarial training deliberately feeds a model thousands of attacked images during training so it learns to resist similar patterns. Sensor fusion combines the camera with LiDAR (which measures distance using laser pulses) and radar (which detects motion and speed), so a sticker that fools the camera alone won't fool the LiDAR's 3D shape reading of the same sign. Input preprocessing, like randomly cropping or slightly blurring the image before classification, can also disrupt the precise pixel patterns an attack depends on.