# Spatiotemporal-Aware Bit-Flip Injection on DNN-based Advanced Driver Assistance Systems (extended version)

arXiv: https://arxiv.org/abs/2604.03753 · HTML: https://mlsanity.com/paper/2604.03753/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 19 of its 35 references that are in the map.
- First posted on arXiv 4 Apr 2026.

## Builds on (most cited first, 19 of 19)

- [CARLA: An Open Urban Driving Simulator](https://mlsanity.com/paper/1711.03938/) (2017)
- [Importance Estimation for Neural Network Pruning](https://mlsanity.com/paper/1906.10771/) (2019)
- [DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Cars](https://mlsanity.com/paper/1708.08559/) (2017)
- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [Baidu Apollo EM Motion Planner](https://mlsanity.com/paper/1807.08048/) (2018)
- [Robust Physical-World Attacks on Deep Learning Models](https://mlsanity.com/paper/1707.08945/) (2017)
- [Adversarial camera stickers: A physical camera-based attack on deep learning systems](https://mlsanity.com/paper/1904.00759/) (2019)
- [A Commute in Data: The comma2k19 Dataset](https://mlsanity.com/paper/1812.05752/) (2018)
- [ML-based Fault Injection for Autonomous Vehicles: A Case for Bayesian Fault Injection](https://mlsanity.com/paper/1907.01051/) (2019)
- [SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples](https://mlsanity.com/paper/2312.09520/) (2023)
- [One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training](https://mlsanity.com/paper/2308.07934/) (2023)
- [GPUHammer: Rowhammer Attacks on GPU Memories are Practical](https://mlsanity.com/paper/2507.08166/) (2025)
- [ML-driven Malware that Targets AV Safety](https://mlsanity.com/paper/2004.13004/) (2020)
- [Experimental Resilience Assessment of An Open-Source Driving Agent](https://mlsanity.com/paper/1807.06172/) (2018)
- [Data-driven Design of Context-aware Monitors for Hazard Prediction in Artificial Pancreas Systems](https://mlsanity.com/paper/2104.02545/) (2021)
- [Strategic Safety-Critical Attacks Against an Advanced Driver Assistance System](https://mlsanity.com/paper/2204.06768/) (2022)
- [Kayotee: A Fault Injection-based System to Assess the Safety and Reliability of Autonomous Vehicles to Faults and Errors](https://mlsanity.com/paper/1907.01024/) (2019)
- [Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors](https://mlsanity.com/paper/1812.10217/) (2018)
- [Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systems](https://mlsanity.com/paper/2307.08939/) (2023)

## Abstract (arXiv)

Modern advanced driver assistance systems (ADAS) rely on deep neural networks (DNNs) for perception and planning. Since DNNs' parameters reside in DRAM during inference, bit flips caused by cosmic radiation or low-voltage operation may corrupt DNN computations, distort driving decisions, and lead to real-world incidents. This paper presents a SpatioTemporal-Aware Fault Injection (STAFI) framework to locate critical fault sites in DNNs for ADAS efficiently. Spatially, we propose a Progressive Metric-guided Bit Search (PMBS) that efficiently identifies critical network weight bits whose corruption causes the largest deviations in driving behavior (e.g., unintended acceleration or steering). Furthermore, we develop a Critical Fault Time Identification (CFTI) mechanism that determines when to trigger these faults, taking into account the context of real-time systems and environmental states, to maximize the safety impact. Experiments on DNNs for a production ADAS demonstrate that STAFI uncovers 29.56x more hazard-inducing critical faults than the strongest baseline.