[论文解读] DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems

Husheng Zhou, Wei Li+5 more|arXiv (Cornell University)|Dec 27, 2018

Adversarial Robustness in Machine Learning参考文献 23被引用 41

一句话总结

DeepBillboard 通过在路边广告牌上绘制可打印的扰动，系统性地对现实世界进行对抗性测试，以误导自动驾驶系统的转向决策；在数字环境和现实世界案例研究中进行评估。

ABSTRACT

Deep Neural Networks (DNNs) have been widely applied in many autonomous systems such as autonomous driving. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, they mostly focus on generating digital adversarial perturbations (particularly for autonomous driving), e.g., changing image pixels, which may never happen in physical world. There is a critical missing piece in the literature on autonomous driving testing: understanding and exploiting both digital and physical adversarial perturbation generation for impacting steering decisions. In this paper, we present DeepBillboard, a systematic physical-world testing approach targeting at a common and practical driving scenario: drive-by billboards. DeepBillboard is capable of generating a robust and resilient printable adversarial billboard, which works under dynamic changing driving conditions including viewing angle, distance, and lighting. The objective is to maximize the possibility, degree, and duration of the steering-angle errors of an autonomous vehicle driving by the generated adversarial billboard. We have extensively evaluated the efficacy and robustness of DeepBillboard through conducting both digital and physical-world experiments. Results show that DeepBillboard is effective for various steering models and scenes. Furthermore, DeepBillboard is sufficiently robust and resilient for generating physical-world adversarial billboard tests for real-world driving under various weather conditions. To the best of our knowledge, this is the first study demonstrating the possibility of generating realistic and continuous physical-world tests for practical autonomous driving systems.

研究动机与目标

• 在物理世界中对自主驾驶深度神经网络进行鲁棒测试，超越数字扰动。
• 开发一种联合优化方法，生成在多个驾驶帧中都有效的可打印对抗性广告牌扰动。
• 建模并评估扰动在不同观看条件下对转向角决策的影响。
• 提出评估指标，以量化现实世界对抗性测试的有效性和鲁棒性。

提出的方法

• 提出一个联合优化问题，生成一个单个可打印扰动，在一系列帧中误导转向模型。
• 将帧扰动限制在少量有影响的像素集合内，以减少跨帧的重叠和干扰。
• 最小化不可打印性分数，确保扰动可被真正的打印机打印。
• 结合颜色调整，以应对不同帧中的环境光照变化。
• 使用投影函数将可打印扰动映射到每一帧，并使用基于梯度的方法进行优化。
• 给出一个算法（Algorithm 1），迭代扰动建议，应用颜色/数字约束，处理像素重叠，并选择使转向角发散最大化的扰动。

实验结果

研究问题

• RQ1 在不断变化的距离和视角下，路边广告牌上的可打印扰动是否会导致驱动经过的自主车辆的转向角出现稳定的错位？
• RQ2 在不同光照条件、天气和打印机限制下，这些物理扰动的鲁棒性如何？
• RQ3 哪些指标能够有效捕捉物理世界对转向模型对抗效应的强度与发生概率？
• RQ4 能否优化单一广告牌扰动以影响一系列帧，而不仅仅是单一快照？
• RQ5 数字评测在 Dave 与 Epoch 等转向模型的物理世界实验中的可迁移性如何？

主要发现

• 数字测试表明 DeepBillboard 能在多种转向模型与场景中误导转向，在数字实验中转向角误差的平均值高达 41.93 度。
• 现实案例研究显示在多种天气条件下具有鲁棒性，平均转向角误差从 4.86 到 26.44 度。
• 该方法使实际可用于实际自主驾驶系统的现实且连续的物理世界测试成为可能。
• 该方法可推广到广告牌之外的其他物理表面，如墙面的涂鸦。
• 该研究提供了一个使用可打印对抗性假象对转向模型进行测试与压力测试的框架。