# Bait and Switch: Online Training Data Poisoning of Autonomous Driving Systems

arXiv: https://arxiv.org/abs/2011.04065 · HTML: https://mlsanity.com/paper/2011.04065/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Nov 2020.

## Built on by (most cited first, 5 of 5)

- [Visual Adversarial Attacks and Defenses in the Physical World: A Survey](https://mlsanity.com/paper/2211.01671/) (2022)
- [Universal Backdoor Attacks](https://mlsanity.com/paper/2312.00157/) (2023)
- [Defending against Data Poisoning Attacks in Federated Learning via User Elimination](https://mlsanity.com/paper/2404.12778/) (2024)
- [Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense](https://mlsanity.com/paper/2409.08509/) (2024)
- [Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection](https://mlsanity.com/paper/2606.20752/) (2026)

## Abstract (arXiv)

We show that by controlling parts of a physical environment in which a pre-trained deep neural network (DNN) is being fine-tuned online, an adversary can launch subtle data poisoning attacks that degrade the performance of the system. While the attack can be applied in general to any perception task, we consider a DNN based traffic light classifier for an autonomous car that has been trained in one city and is being fine-tuned online in another city. We show that by injecting environmental perturbations that do not modify the traffic lights themselves or ground-truth labels, the adversary can cause the deep network to learn spurious concepts during the online learning phase. The attacker can leverage the introduced spurious concepts in the environment to cause the model's accuracy to degrade during operation; therefore, causing the system to malfunction.