[论文解读] Adversarial Attack on Radar-based Environment Perception Systems

Amira Guesmi, Ihsen Alouani|arXiv (Cornell University)|Nov 2, 2022

Geophysical Methods and Applications被引用 4

一句话总结

本文提出 a-RNA，一种针对超宽带（UWB）雷达环境感知系统的新型对抗性无线电噪声攻击。该方法生成输入无关、抗时移、抗频谱域防御的对抗性噪声，可规避滤波和频谱感知防御机制，在视距条件下以高成功率实现对基于深度神经网络（DNN）障碍物识别系统的实际攻击。

ABSTRACT

Due to their robustness to degraded capturing conditions, radars are widely used for environment perception, which is a critical task in applications like autonomous vehicles. More specifically, Ultra-Wide Band (UWB) radars are particularly efficient for short range settings as they carry rich information on the environment. Recent UWB-based systems rely on Machine Learning (ML) to exploit the rich signature of these sensors. However, ML classifiers are susceptible to adversarial examples, which are created from raw data to fool the classifier such that it assigns the input to the wrong class. These attacks represent a serious threat to systems integrity, especially for safety-critical applications. In this work, we present a new adversarial attack on UWB radars in which an adversary injects adversarial radio noise in the wireless channel to cause an obstacle recognition failure. First, based on signals collected in real-life environment, we show that conventional attacks fail to generate robust noise under realistic conditions. We propose a-RNA, i.e., Adversarial Radio Noise Attack to overcome these issues. Specifically, a-RNA generates an adversarial noise that is efficient without synchronization between the input signal and the noise. Moreover, a-RNA generated noise is, by-design, robust against pre-processing countermeasures such as filtering-based defenses. Moreover, in addition to the undetectability objective by limiting the noise magnitude budget, a-RNA is also efficient in the presence of sophisticated defenses in the spectral domain by introducing a frequency budget. We believe this work should alert about potentially critical implementations of adversarial attacks on radar systems that should be taken seriously.

研究动机与目标

• 为解决当前在自动驾驶等安全关键应用中日益广泛使用的UWB雷达环境感知系统缺乏实用对抗性攻击的问题。
• 克服传统对抗性攻击在实际场景中因信号不同步和预处理防御机制而失效的局限性。
• 设计一种无需同步即可抵御时间延迟、滤波和频谱域防御的输入无关对抗性噪声生成方法。
• 通过限制噪声幅度和频谱预算，确保对抗性噪声不可检测，同时保持高攻击成功率。
• 在视距传播条件下，验证真实世界物理对抗攻击在UWB雷达系统上的可行性。

提出的方法

• 提出 a-RNA（对抗性无线电噪声攻击），一种新型框架，用于生成输入无关且对时间延迟具有鲁棒性的对抗性无线电噪声。
• 引入一种噪声生成策略，在训练过程中聚合随机噪声位置，以确保对信号不同步的鲁棒性。
• 采用频谱预算约束，增强对滤波和频谱感知等频谱域防御机制的鲁棒性。
• 设计对抗性噪声时，通过限制其幅度和功率谱密度，避免触发检测机制，使其不可察觉。
• 采用通用补丁化方法生成对抗性噪声，可无需微调直接应用于多种输入信号。
• 利用在受控环境中采集的真实UWB信号数据，在真实无线传播条件下验证攻击效果。

实验结果

研究问题

• RQ1 能否为UWB雷达系统生成在信号不同步和时间延迟下仍有效的对抗性噪声？
• RQ2 能否使对抗性噪声对滤波和频谱感知等常见防御机制具有鲁棒性？
• RQ3 是否可能生成在真实无线环境中不可检测且保持高攻击成功率的对抗性噪声？
• RQ4 在视距传播和路径损耗等实际约束条件下，该攻击的有效性如何？
• RQ5 该攻击是否可普遍应用于不同输入信号，而无需针对特定输入生成扰动？

主要发现

• 所提出的 a-RNA 攻击在存在实际信号延迟的情况下，仍能以高成功率欺骗基于深度神经网络（DNN）的障碍物识别系统。
• 传统对抗性攻击因信号不同步而失效，凸显了对时移鲁棒性噪声生成的迫切需求。
• 由于采用了频谱预算设计，a-RNA 生成的噪声对基于滤波的防御和频谱感知机制仍具有效性。
• 在幅度和频谱约束下，该攻击不可检测，适合真实世界部署。
• 当噪声功率根据路径损耗进行调整时，该攻击在不同距离的视距条件下仍保持有效性。
• 据我们所知，这是首个在真实世界中实现、输入无关且具有鲁棒性的UWB雷达系统对抗性攻击。