[Paper Review] DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems

Husheng Zhou, Wei Li+5 more|arXiv (Cornell University)|Dec 27, 2018

Adversarial Robustness in Machine Learning23 references41 citations

TL;DR

DeepBillboard develops a systematic physical-world adversarial testing approach by painting printable perturbations on roadside billboards to mislead steering decisions of autonomous driving systems, evaluated both digitally and with physical-world case studies.

ABSTRACT

Deep Neural Networks (DNNs) have been widely applied in many autonomous systems such as autonomous driving. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, they mostly focus on generating digital adversarial perturbations (particularly for autonomous driving), e.g., changing image pixels, which may never happen in physical world. There is a critical missing piece in the literature on autonomous driving testing: understanding and exploiting both digital and physical adversarial perturbation generation for impacting steering decisions. In this paper, we present DeepBillboard, a systematic physical-world testing approach targeting at a common and practical driving scenario: drive-by billboards. DeepBillboard is capable of generating a robust and resilient printable adversarial billboard, which works under dynamic changing driving conditions including viewing angle, distance, and lighting. The objective is to maximize the possibility, degree, and duration of the steering-angle errors of an autonomous vehicle driving by the generated adversarial billboard. We have extensively evaluated the efficacy and robustness of DeepBillboard through conducting both digital and physical-world experiments. Results show that DeepBillboard is effective for various steering models and scenes. Furthermore, DeepBillboard is sufficiently robust and resilient for generating physical-world adversarial billboard tests for real-world driving under various weather conditions. To the best of our knowledge, this is the first study demonstrating the possibility of generating realistic and continuous physical-world tests for practical autonomous driving systems.

Motivation & Objective

• Motivate robust testing of autonomous driving DNNs in the physical world beyond digital perturbations.
• Develop a joint-optimization method to generate printable adversarial billboard perturbations effective across multiple driving frames.
• Model and evaluate the impact of perturbations on steering angle decisions under varying viewing conditions.
• Propose evaluation metrics to quantify the effectiveness and robustness of physical-world adversarial tests.

Proposed method

• Formulate a joint optimization problem to generate a single printable perturbation that misleads the steering model across a sequence of frames.
• Limit frame perturbations to a small set of impactful pixels to reduce overlap and interference across frames.
• Minimize non-printability scores to ensure perturbations are printable by real printers.
• Incorporate color adjustment to account for environmental lighting variations in different frames.
• Use a projection function to map printable perturbations to each frame and optimize using a gradient-based approach.
• Provide an algorithm (Algorithm 1) that iterates perturbation proposals, applies color/digital constraints, handles pixel overlap, and selects perturbations that maximize steering-angle divergence.

Experimental results

Research questions

• RQ1 Can printable perturbations on roadside billboards cause consistent misalignment in steering angles for drive-by autonomous vehicles across changing distances and viewing angles?
• RQ2 How robust are such physical perturbations under varying lighting conditions, weather, and printer limitations?
• RQ3 What metrics effectively capture the strength and likelihood of physical-world adversarial effects on steering models?
• RQ4 Can a single billboard perturbation be optimized to affect a sequence of frames rather than a single snapshot?
• RQ5 How well do digital evaluations translate to physical-world experiments for steering models such as Dave and Epoch?

Key findings

• Digital tests show DeepBillboard can mislead steering across multiple steering models and scenes, with average steering-angle error up to 41.93 degrees in digital experiments.
• Physical case studies demonstrate robustness under varied weather conditions, yielding average steering-angle errors from 4.86 to 26.44 degrees.
• The approach enables realistic and continuous physical-world tests for practical autonomous driving systems.
• The method generalizes to other physical surfaces beyond billboards, such as graffiti on walls.
• The study provides a framework for testing and stress-testing steering models with printable adversarial artefacts.