# Too Afraid to Drive: Systematic Discovery of Semantic DoS Vulnerability in Autonomous Driving Planning under Physical-World Attacks

arXiv: https://arxiv.org/abs/2201.04610 · HTML: https://mlsanity.com/paper/2201.04610/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Jan 2022.

## Built on by (most cited first, 11 of 11)

- [Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack](https://mlsanity.com/paper/2308.11894/) (2023)
- [SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples](https://mlsanity.com/paper/2312.09520/) (2023)
- [ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving](https://mlsanity.com/paper/2406.05810/) (2024)
- [A First Physical-World Trajectory Prediction Attack via LiDAR-induced Deceptions in Autonomous Driving](https://mlsanity.com/paper/2406.11707/) (2024)
- [ROCAS: Root Cause Analysis of Autonomous Driving Accidents via Cyber-Physical Co-mutation](https://mlsanity.com/paper/2409.07774/) (2024)
- [AED: Automatic Discovery of Effective and Diverse Vulnerabilities for Autonomous Driving Policy with Large Language Models](https://mlsanity.com/paper/2503.20804/) (2025)
- [A Certifiable Security Patch for Object Tracking in Self-Driving Systems via Historical Deviation Modeling](https://mlsanity.com/paper/2207.08556/) (2022)
- [Adversarial Examples in Environment Perception for Automated Driving (Review)](https://mlsanity.com/paper/2504.08414/) (2025)
- [Beyond Crash: Hijacking Your Autonomous Vehicle for Fun and Profit](https://mlsanity.com/paper/2602.07249/) (2026)
- [Natural Adversaries: Fuzzing Autonomous Vehicles with Realistic Roadside Object Placements](https://mlsanity.com/paper/2409.10562/) (2024)
- [BEVLM: Distilling Semantic Knowledge from LLMs into Bird's-Eye View Representations](https://mlsanity.com/paper/2603.06576/) (2026)

## Abstract (arXiv)

In high-level Autonomous Driving (AD) systems, behavioral planning is in charge of making high-level driving decisions such as cruising and stopping, and thus highly securitycritical. In this work, we perform the first systematic study of semantic security vulnerabilities specific to overly-conservative AD behavioral planning behaviors, i.e., those that can cause failed or significantly-degraded mission performance, which can be critical for AD services such as robo-taxi/delivery. We call them semantic Denial-of-Service (DoS) vulnerabilities, which we envision to be most generally exposed in practical AD systems due to the tendency for conservativeness to avoid safety incidents. To achieve high practicality and realism, we assume that the attacker can only introduce seemingly-benign external physical objects to the driving environment, e.g., off-road dumped cardboard boxes. To systematically discover such vulnerabilities, we design PlanFuzz, a novel dynamic testing approach that addresses various problem-specific design challenges. Specifically, we propose and identify planning invariants as novel testing oracles, and design new input generation to systematically enforce problemspecific constraints for attacker-introduced physical objects. We also design a novel behavioral planning vulnerability distance metric to effectively guide the discovery. We evaluate PlanFuzz on 3 planning implementations from practical open-source AD systems, and find that it can effectively discover 9 previouslyunknown semantic DoS vulnerabilities without false positives. We find all our new designs necessary, as without each design, statistically significant performance drops are generally observed. We further perform exploitation case studies using simulation and real-vehicle traces. We discuss root causes and potential fixes.