# ML-driven Malware that Targets AV Safety

arXiv: https://arxiv.org/abs/2004.13004 · HTML: https://mlsanity.com/paper/2004.13004/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Apr 2020.

## Built on by (most cited first, 9 of 9)

- [SoK: On the Semantic AI Security in Autonomous Driving](https://mlsanity.com/paper/2203.05314/) (2022)
- [Learning When to Use Adaptive Adversarial Image Perturbations against Autonomous Vehicles](https://mlsanity.com/paper/2212.13667/) (2022)
- [A First Physical-World Trajectory Prediction Attack via LiDAR-induced Deceptions in Autonomous Driving](https://mlsanity.com/paper/2406.11707/) (2024)
- [Learning Image Attacks toward Vision Guided Autonomous Vehicles](https://mlsanity.com/paper/2105.03834/) (2021)
- [Watch Out for the Safety-Threatening Actors: Proactively Mitigating Safety Hazards](https://mlsanity.com/paper/2206.00886/) (2022)
- [Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systems](https://mlsanity.com/paper/2307.08939/) (2023)
- [High-Dimensional Fault Tolerance Testing of Highly Automated Vehicles Based on Low-Rank Models](https://mlsanity.com/paper/2407.21069/) (2024)
- [RansomAI: AI-powered Ransomware for Stealthy Encryption](https://mlsanity.com/paper/2306.15559/) (2023)
- [Spatiotemporal-Aware Bit-Flip Injection on DNN-based Advanced Driver Assistance Systems (extended version)](https://mlsanity.com/paper/2604.03753/) (2026)

## Abstract (arXiv)

Ensuring the safety of autonomous vehicles (AVs) is critical for their mass deployment and public adoption. However, security attacks that violate safety constraints and cause accidents are a significant deterrent to achieving public trust in AVs, and that hinders a vendor's ability to deploy AVs. Creating a security hazard that results in a severe safety compromise (for example, an accident) is compelling from an attacker's perspective. In this paper, we introduce an attack model, a method to deploy the attack in the form of smart malware, and an experimental evaluation of its impact on production-grade autonomous driving software. We find that determining the time interval during which to launch the attack is{ critically} important for causing safety hazards (such as collisions) with a high degree of success. For example, the smart malware caused 33X more forced emergency braking than random attacks did, and accidents in 52.6% of the driving simulations.