mlsanityData to 7 Oct 2026

SoK: On the Semantic AI Security in Autonomous Driving

arXiv 2203.05314 ↗First posted 10 Mar 2022cs.CR cs.AI cs.ROcited by 22

Not on the map. Why?

Abstract (arXiv)

Autonomous Driving (AD) systems rely on AI components to make safety and correct driving decisions. Unfortunately, today's AI algorithms are known to be generally vulnerable to adversarial attacks. However, for such AI component-level vulnerabilities to be semantically impactful at the system level, it needs to address non-trivial semantic gaps both (1) from the system-level attack input spaces to those at AI component level, and (2) from AI component-level attack impacts to those at the system level. In this paper, we define such research space as semantic AI security as opposed to generic AI security. Over the past 5 years, increasingly more research works are performed to tackle such semantic AI security challenges in AD context, which has started to show an exponential growth trend. In this paper, we perform the first systematization of knowledge of such growing semantic AD AI security research space. In total, we collect and analyze 53 such papers, and systematically taxonomize them based on research aspects critical for the security field. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels. To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS, for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Builds on 70 of its 156 references that are in the map. First posted on arXiv 10 Mar 2022.

Builds on

70 of 156 references.

References · 70

  1. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  6. 2016Adversarial Machine Learning at Scalecited by 934
  7. 2016ORB-SLAM2: an Open-Source SLAM System for Monocular, Stereo and RGB-D Camerascited by 801
  8. 2016Multi-View 3D Object Detection Network for Autonomous Drivingcited by 721
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  11. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  12. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
38 more
  1. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  2. 2019A Survey of Autonomous Driving: Common Practices and Emerging Technologiescited by 373
  3. 2017DeepXplore: Automated Whitebox Testing of Deep Learning Systemscited by 307
  4. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  5. 2020Deep Continuous Fusion for Multi-Sensor 3D Object Detectioncited by 263
  6. 2018Adversarial Attacks and Defences: A Surveycited by 259
  7. 2016A Survey of Motion Planning and Control Techniques for Self-driving Urban Vehiclescited by 251
  8. 2017DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Carscited by 249
  9. 2014Multiple Object Tracking: A Literature Reviewcited by 165
  10. 2018Physical Adversarial Examples for Object Detectorscited by 163
  11. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  12. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  13. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  14. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  15. 2020LiDARsim: Realistic LiDAR Simulation by Leveraging the Real Worldcited by 137
  16. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  17. 2020A Survey of End-to-End Driving: Architectures and Training Methodscited by 123
  18. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  19. 2020Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasurescited by 95
  20. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  21. 2019Online Multi-Object Tracking with Dual Matching Attention Networkscited by 77
  22. 2021GeoSim: Realistic Video Simulation via Geometry-Aware Composition for Self-Drivingcited by 75
  23. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  24. 2018DLFuzz: Differential Fuzzing Testing of Deep Learning Systemscited by 64
  25. 2020Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attackcited by 64
  26. 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
  27. 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
  28. 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
  29. 2020SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbationscited by 50
  30. 2017NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehiclescited by 48
  31. 2020SoK: The Faults in our ASRs: An Overview of Attacks against Automatic Speech Recognition and Speaker Identification Systemscited by 46
  32. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  33. 2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 39
  34. 2019Hear "No Evil", See "Kenansville": Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systemscited by 37
  35. 2019Securing Connected & Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and The Way Forwardcited by 33
  36. 2017Compositional Falsification of Cyber-Physical Systems with Machine Learning Componentscited by 31
  37. 2019Attacking Vision-based Perception in End-to-End Autonomous Driving Modelscited by 31
  38. 2021Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defensescited by 29

50 most cited of 70 All 70 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 7; 2024: 6; 2025: 6; 2026: 1.

22 papers.

Sort:

By area:

  1. 2023Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attackcited by 37
  2. 2023TPatch: A Triggered Physical Adversarial Patchcited by 22
  3. 2023SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examplescited by 15
  4. 2023LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategiescited by 9
  5. 2024Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspectivecited by 6
  6. 2024ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Drivingcited by 5
  7. 2023Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Modelscited by 4
  8. 2024SlowPerception: Physical-World Latency Attack against Visual Perception in Autonomous Drivingcited by 3
  9. 2024COMMIT: Certifying Robustness of Multi-Sensor Fusion Systems against Semantic Attackscited by 2
  10. 2025Safety2Drive: Safety-Critical Scenario Benchmark for the Evaluation of Autonomous Drivingcited by 2
  11. 2022A Certifiable Security Patch for Object Tracking in Self-Driving Systems via Historical Deviation Modelingcited by 1
  12. 2022Security of Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 1
10 more
  1. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  2. 2023Differentiable Radio Frequency Ray Tracing for Millimeter-Wave Sensingcited by 1
  3. 2024MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agentscited by 1
  4. 2025Towards Benchmarking and Assessing the Safety and Robustness of Autonomous Driving on Safety-critical Scenarioscited by 1
  5. 2025Toward Inherently Robust VLMs Against Visual Perception Attackscited by 1
  6. 2024Optical Lens Attack on Monocular Depth Estimation for Autonomous Drivingcited by 0
  7. 2025PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lightingcited by 0
  8. 2025AI Security Map: Holistic Organization of AI Security Technologies and Impacts on Stakeholderscited by 0
  9. 2025T2I-Based Physical-World Appearance Attack against Traffic Sign Recognition Systems in Autonomous Drivingcited by 0
  10. 2026Detecting Trojaned DNNs via Spectral Regression Analysiscited by 0