[Paper Review] On Robustness of Lane Detection Models to Physical-World Adversarial Attacks in Autonomous Driving

Takami Sato, Qi Alfred Chen|arXiv (Cornell University)|Jul 6, 2021

Adversarial Robustness in Machine Learning46 references4 citations

TL;DR

This paper conducts the first large-scale empirical study on the robustness of state-of-the-art lane detection models to physical-world adversarial attacks in autonomous driving. It reveals a critical disconnect: models performing best under conventional accuracy and F1-score metrics are often the least robust in end-to-end driving scenarios, highlighting the inadequacy of current evaluation standards for real-world safety and security.

ABSTRACT

After the 2017 TuSimple Lane Detection Challenge, its evaluation based on accuracy and F1 score has become the de facto standard to measure the performance of lane detection methods. In this work, we conduct the first large-scale empirical study to evaluate the robustness of state-of-the-art lane detection methods under physical-world adversarial attacks in autonomous driving. We evaluate 4 major types of lane detection approaches with the conventional evaluation and end-to-end evaluation in autonomous driving scenarios and then discuss the security proprieties of each lane detection model. We demonstrate that the conventional evaluation fails to reflect the robustness in end-to-end autonomous driving scenarios. Our results show that the most robust model on the conventional metrics is the least robust in the end-to-end evaluation. Although the competition dataset and its metrics have played a substantial role in developing performant lane detection methods along with the rapid development of deep neural networks, the conventional evaluation is becoming obsolete and the gap between the metrics and practicality is critical. We hope that our study will help the community make further progress in building a more comprehensive framework to evaluate lane detection models.

Motivation & Objective

• To evaluate the robustness of lane detection models under real-world physical adversarial attacks in autonomous driving.
• To identify the limitations of conventional evaluation metrics (accuracy, F1-score) in reflecting practical robustness for end-to-end autonomous driving systems.
• To develop a fair evaluation methodology bridging lane detection models with vehicle lateral control using OpenPilot.
• To assess the vulnerability of four major lane detection approaches to three types of physical-world adversarial attacks.
• To advocate for a more comprehensive evaluation framework that better reflects real-world safety and security requirements.

Proposed method

• Taxonomized state-of-the-art DNN-based lane detection models into four categories: segmentation, row-wise classification, anchor-based, and keypoint-based.
• Constructed an end-to-end evaluation pipeline by integrating lane detection outputs with OpenPilot’s lateral control system to simulate real autonomous driving behavior.
• Applied three physical-world adversarial attack types: white-box differentiable patch (DRP), black-box DRP, and drawing-lane-line attacks.
• Used a gradient-free optimization (NES-based) approach to generate black-box physical adversarial patches under stealthiness constraints.
• Evaluated model performance under both conventional metrics (accuracy, F1) and end-to-end driving performance (lateral deviation).
• Designed a controlled experimental setup to fairly compare robustness across models under identical attack conditions.

Experimental results

Research questions

• RQ1 How do conventional evaluation metrics (accuracy, F1-score) correlate with robustness in end-to-end autonomous driving scenarios?
• RQ2 Which lane detection model architectures are most vulnerable to physical-world adversarial attacks in real driving conditions?
• RQ3 To what extent do stealthiness constraints in physical adversarial attacks reduce the effectiveness of query-based (black-box) attacks?
• RQ4 How does the integration of lane detection outputs with a real vehicle control system (OpenPilot) reveal hidden vulnerabilities not visible in standard benchmarks?
• RQ5 Can model-level or sensor-fusion defenses mitigate the risks posed by simple, deployable attacks like drawing lane lines?

Key findings

• The most robust model under conventional accuracy and F1-score metrics was the least robust in end-to-end evaluation, demonstrating a critical disconnect between standard benchmarks and real-world performance.
• The white-box DRP attack achieved high success rates across all models, indicating high vulnerability when attackers have full model access.
• The black-box DRP attack was less effective than expected, likely due to the complexity of stealthiness constraints (e.g., grayscale, limited perturbation area) in gradient estimation.
• The drawing-lane-line attack was particularly effective and easily deployable, with LaneATT showing high vulnerability, possibly due to its anchor-based structure.
• The vulnerability to simple, low-cost physical attacks like drawing lane lines poses a severe real-world security risk due to ease of deployment.
• Current conventional evaluation methods are becoming obsolete, as they fail to capture critical robustness issues that directly impact autonomous driving safety.