# Physical Backdoor Attacks to Lane Detection Systems in Autonomous Driving

arXiv: https://arxiv.org/abs/2203.00858 · HTML: https://mlsanity.com/paper/2203.00858/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 66 references that are in the map.
- First posted on arXiv 2 Mar 2022.

## Builds on (most cited first, 30 of 32)

- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning](https://mlsanity.com/paper/1712.05526/) (2017)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [STRIP: A Defence Against Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/1902.06531/) (2019)
- [Backdoor Learning: A Survey](https://mlsanity.com/paper/2007.08745/) (2020)
- [Invisible Backdoor Attack with Sample-Specific Triggers](https://mlsanity.com/paper/2012.03816/) (2020)
- [Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks](https://mlsanity.com/paper/2007.02343/) (2020)
- [Spatial As Deep: Spatial CNN for Traffic Scene Understanding](https://mlsanity.com/paper/1712.06080/) (2017)
- [Blind Backdoors in Deep Learning Models](https://mlsanity.com/paper/2005.03823/) (2020)
- [Clean-Label Backdoor Attacks on Video Recognition Models](https://mlsanity.com/paper/2003.03030/) (2020)
- [Learning Lightweight Lane Detection CNNs by Self Attention Distillation](https://mlsanity.com/paper/1908.00821/) (2019)
- [Keep your Eyes on the Lane: Real-time Attention-guided Lane Detection](https://mlsanity.com/paper/2010.12035/) (2020)
- [Backdoor Attacks Against Deep Learning Systems in the Physical World](https://mlsanity.com/paper/2006.14580/) (2020)
- [Ultra Fast Structure-aware Deep Lane Detection](https://mlsanity.com/paper/2004.11757/) (2020)
- [PolyLaneNet: Lane Estimation via Deep Polynomial Regression](https://mlsanity.com/paper/2004.10924/) (2020)
- [CondLaneNet: a Top-to-down Lane Detection Framework Based on Conditional Convolution](https://mlsanity.com/paper/2105.05003/) (2021)
- [Backdoor Pre-trained Models Can Transfer to All](https://mlsanity.com/paper/2111.00197/) (2021)
- [BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models](https://mlsanity.com/paper/2110.02467/) (2021)
- [RESA: Recurrent Feature-Shift Aggregator for Lane Detection](https://mlsanity.com/paper/2008.13719/) (2020)
- [DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation](https://mlsanity.com/paper/2012.07006/) (2020)
- [BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning](https://mlsanity.com/paper/2105.00579/) (2021)
- [Triggerless Backdoor Attack for NLP Tasks with Clean Labels](https://mlsanity.com/paper/2111.07970/) (2021)
- [Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack](https://mlsanity.com/paper/2009.06701/) (2020)
- [Black-box Adversarial Attacks on Video Recognition Models](https://mlsanity.com/paper/1904.05181/) (2019)
- [Backdooring and Poisoning Neural Networks with Image-Scaling Attacks](https://mlsanity.com/paper/2003.08633/) (2020)
- [Robust Backdoor Attacks against Deep Neural Networks in Real Physical World](https://mlsanity.com/paper/2104.07395/) (2021)
- [Amora: Black-box Adversarial Morphing Attack](https://mlsanity.com/paper/1912.03829/) (2019)
- [Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems](https://mlsanity.com/paper/2009.06996/) (2020)
- [Discriminator-Free Generative Adversarial Attack](https://mlsanity.com/paper/2107.09225/) (2021)

## Built on by (most cited first, 30 of 31)

- [Corrective Machine Unlearning](https://mlsanity.com/paper/2402.14015/) (2024)
- [Towards Robust Physical-world Backdoor Attacks on Lane Detection](https://mlsanity.com/paper/2405.05553/) (2024)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Certified Robustness to Data Poisoning in Gradient-Based Training](https://mlsanity.com/paper/2406.05670/) (2024)
- [Towards more Practical Threat Models in Artificial Intelligence Security](https://mlsanity.com/paper/2311.09994/) (2023)
- [One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIP](https://mlsanity.com/paper/2505.19840/) (2025)
- [CRASH: Crash Recognition and Anticipation System Harnessing with Context-Aware and Temporal Focus Attentions](https://mlsanity.com/paper/2407.17757/) (2024)
- [Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical World](https://mlsanity.com/paper/2304.10712/) (2023)
- [CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation](https://mlsanity.com/paper/2507.05113/) (2025)
- [Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggers](https://mlsanity.com/paper/2306.00816/) (2023)
- [CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World](https://mlsanity.com/paper/2302.13519/) (2023)
- [Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization](https://mlsanity.com/paper/2511.07210/) (2025)
- [Adversarial Neon Beam: A Light-based Physical Attack to DNNs](https://mlsanity.com/paper/2204.00853/) (2022)
- [A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarking](https://mlsanity.com/paper/2306.12111/) (2023)
- [When, Where, and What? A Novel Benchmark for Accident Anticipation and Localization with Large Language Models](https://mlsanity.com/paper/2407.16277/) (2024)
- [Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving](https://mlsanity.com/paper/2509.16950/) (2025)
- [Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming](https://mlsanity.com/paper/2602.16944/) (2026)
- [Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairness](https://mlsanity.com/paper/2403.14641/) (2024)
- [Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editing](https://mlsanity.com/paper/2410.18267/) (2024)
- [Keeping up with dynamic attackers: Certifying robustness to adaptive online data poisoning](https://mlsanity.com/paper/2502.16737/) (2025)
- [Provable Watermarking for Data Poisoning Attacks](https://mlsanity.com/paper/2510.09210/) (2025)
- [Adversarial Catoptric Light: An Effective, Stealthy and Robust Physical-World Attack to DNNs](https://mlsanity.com/paper/2209.11739/) (2022)
- [Synthesizing Physical Backdoor Datasets: An Automated Framework Leveraging Deep Generative Models](https://mlsanity.com/paper/2312.03419/) (2023)
- [FIGhost: Fluorescent Ink-based Stealthy and Flexible Backdoor Attacks on Physical Traffic Sign Recognition](https://mlsanity.com/paper/2505.12045/) (2025)
- [DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion](https://mlsanity.com/paper/2507.22813/) (2025)
- [6DAttack: Backdoor Attacks in the 6DoF Pose Estimation](https://mlsanity.com/paper/2512.19058/) (2025)
- [Twin Trigger Generative Networks for Backdoor Attacks against Object Detection](https://mlsanity.com/paper/2411.15439/) (2024)
- [ROAR: Robust Accident Recognition and Anticipation for Autonomous Driving](https://mlsanity.com/paper/2511.06226/) (2025)
- [Backdoor Attacks on Prompt-Driven Video Segmentation Foundation Models](https://mlsanity.com/paper/2512.22046/) (2025)
- [SECURE: Stable Early Collision Understanding via Robust Embeddings in Autonomous Driving](https://mlsanity.com/paper/2604.01337/) (2026)

## Abstract (arXiv)

Modern autonomous vehicles adopt state-of-the-art DNN models to interpret the sensor data and perceive the environment. However, DNN models are vulnerable to different types of adversarial attacks, which pose significant risks to the security and safety of the vehicles and passengers. One prominent threat is the backdoor attack, where the adversary can compromise the DNN model by poisoning the training samples. Although lots of effort has been devoted to the investigation of the backdoor attack to conventional computer vision tasks, its practicality and applicability to the autonomous driving scenario is rarely explored, especially in the physical world. In this paper, we target the lane detection system, which is an indispensable module for many autonomous driving tasks, e.g., navigation, lane switching. We design and realize the first physical backdoor attacks to such system. Our attacks are comprehensively effective against different types of lane detection algorithms. Specifically, we introduce two attack methodologies (poison-annotation and clean-annotation) to generate poisoned samples. With those samples, the trained lane detection model will be infected with the backdoor, and can be activated by common objects (e.g., traffic cones) to make wrong detections, leading the vehicle to drive off the road or onto the opposite lane. Extensive evaluations on public datasets and physical autonomous vehicles demonstrate that our backdoor attacks are effective, stealthy and robust against various defense solutions. Our codes and experimental videos can be found in https://sites.google.com/view/lane-detection-attack/lda.