mlsanityData to 7 Oct 2026

Adversarial Driving: Attacking End-to-End Autonomous Driving

arXiv 2103.09151 ↗First posted 16 Mar 2021cs.CVcited by 19

On the map: End-to-end autonomous driving → Adversarial scenarios and safety testing

Abstract (arXiv)

As research in deep neural networks advances, deep convolutional networks become promising for autonomous driving tasks. In particular, there is an emerging trend of employing end-to-end neural network models for autonomous driving. However, previous research has shown that deep neural network classifiers are vulnerable to adversarial attacks. While for regression tasks, the effect of adversarial attacks is not as well understood. In this research, we devise two white-box targeted attacks against end-to-end autonomous driving models. Our attacks manipulate the behavior of the autonomous driving system by perturbing the input image. In an average of 800 attacks with the same attack strength (epsilon=1), the image-specific and image-agnostic attack deviates the steering angle from the original output by 0.478 and 0.111, respectively, which is much stronger than random noises that only perturbs the steering angle by 0.002 (The steering angle ranges from [-1, 1]). Both attacks can be initiated in real-time on CPUs without employing GPUs. Demo video: https://youtu.be/I0i8uN2oOP0.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Adversarial scenarios and safety testing, one of 9 directions in End-to-end autonomous driving. Builds on 14 of its 34 references that are in the map. First posted on arXiv 16 Mar 2021.

Builds on

14 of 34 references.

References · 14

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2017CARLA: An Open Urban Driving Simulatorcited by 2,431
  4. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  5. 2016End to End Learning for Self-Driving Carscited by 1,000
  6. 2016Universal adversarial perturbationscited by 774
  7. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  8. 2017AirSim: High-Fidelity Visual and Physical Simulation for Autonomous Vehiclescited by 517
  9. 2019A Survey of Autonomous Driving: Common Practices and Emerging Technologiescited by 373
  10. 2020A Survey of End-to-End Driving: Architectures and Training Methodscited by 123
  11. 2020An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Modelscited by 67
  12. 2019Attacking Vision-based Perception in End-to-End Autonomous Driving Modelscited by 31
2 more
  1. 2019Simple Physical Adversarial Examples against End-to-End Autonomous Driving Modelscited by 17
  2. 2018Adversarial Attacks, Regression, and Numerical Stability Regularizationcited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 1; 2023: 3; 2024: 6; 2025: 2; 2026: 3.

19 papers.

Sort:

By area:

  1. 2023Vision Language Models in Autonomous Driving: A Survey and Outlookcited by 124
  2. 2023Recent Advancements in End-to-End Autonomous Driving using Deep Learning: A Surveycited by 101
  3. 2021Mind the Gap! A Study on the Transferability of Virtual vs Physical-world Testing of Autonomous Driving Systemscited by 36
  4. 2021Sparse Adversarial Video Attacks with Spatial Transformationscited by 11
  5. 2024Boosting Adversarial Training via Fisher-Rao Norm-based Regularizationcited by 7
  6. 2023Reward Certification for Policy Smoothed Reinforcement Learningcited by 6
  7. 2021Adversarial Robustness of Deep Learning: Theory, Algorithms, and Applicationscited by 5
  8. 2021Safe Imitation Learning on Real-Life Highway Data for Human-like Autonomous Drivingcited by 5
  9. 2024Responsible AI for Earth Observationcited by 4
  10. 2024Module-wise Adaptive Adversarial Training for End-to-end Autonomous Drivingcited by 4
  11. 2024High-Frequency Anti-DreamBooth: Robust Defense against Personalized Image Synthesiscited by 3
  12. 2025End-to-End Visual Autonomous Parking via Control-Aided Attentioncited by 2
7 more
  1. 2022A Human-in-the-Middle Attack against Object Detection Systemscited by 1
  2. 2024AI-Powered CPS-Enabled Vulnerable-User-Aware Urban Transportation Digital Twin: Methods and Applicationscited by 1
  3. 2025Advancing Autonomous Driving System Testing: Demands, Challenges, and Future Directionscited by 1
  4. 2024Adversarial Training in Low-Label Regimes with Margin-Based Interpolationcited by 0
  5. 2026AD2: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systemscited by 0
  6. 2026UniAda: Universal Adaptive Multi-objective Adversarial Attack for End-to-End Autonomous Driving Systemscited by 0
  7. 2026Off the Rails: Hijacking the Scoring Head in Generative End-to-End Driving Planners with Safety-Violating Adversarial Perturbationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Attack End-to-End Autonomous Driving through Module-Wise Noise
  2. 2026Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Driving
  3. 2021Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles
  4. 2025Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
  5. 2025Driving in Corner Case: A Real-World Adversarial Closed-Loop Evaluation Platform for End-to-End Autonomous Driving
  6. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Driving
  7. 2021Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns
  8. 2026Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis