超越事故：为娱乐和利润劫持你的自动驾驶汽车
Beyond Crash: Hijacking Your Autonomous Vehicle for Fun and Profit
AI总结：
本文提出JackZebra框架，通过物理可行的攻击车辆实现对自动驾驶车辆的路线劫持，以实现长期路线完整性妥协。
摘要：
自动驾驶汽车（AVs），尤其是基于视觉的AVs，正迅速被部署，而无需人类操作员。由于AVs在安全关键环境中运行，理解其在对抗性环境中的鲁棒性是一个重要的研究问题。先前针对基于视觉的自动驾驶汽车的物理对抗攻击主要针对即时安全故障（例如，碰撞、交通规则违规或短暂车道偏离），通过引发短暂的感知或控制错误。本文展示了一种不同的风险：长期路线完整性妥协，攻击者会逐步将受害者AV偏离其预期路线，并驶向攻击者选择的目的地，而受害者继续以正常方式驾驶。这不会对受害者车辆本身构成危险，但也会对车内潜在乘客造成威胁。本文设计并实现了第一个对抗框架，称为JackZebra，该框架使用一个配备可重新配置显示装置的物理可行攻击车辆，对基于视觉的端到端驾驶堆栈进行路线级劫持。核心挑战是时间持久性：对抗性影响必须在改变视角、光照、天气、交通和受害者持续重新规划的过程中保持有效，而不会触发明显的故障。我们的关键见解是将路线劫持视为闭环控制问题，并将对抗性补丁转换为可在线选择的转向基本单元。我们的对抗性补丁还经过精心设计，以对抗最坏的背景和传感器变化，从而影响受害者。我们的评估显示，JackZebra能够成功劫持受害者车辆，使其偏离原始路线并停在对抗性目的地，成功率较高。
英文摘要：
Autonomous Vehicles (AVs), especially vision-based AVs, are rapidly being deployed without human operators. As AVs operate in safety-critical environments, understanding their robustness in an adversarial environment is an important research problem. Prior physical adversarial attacks on vision-based autonomous vehicles predominantly target immediate safety failures (e.g., a crash, a traffic-rule violation, or a transient lane departure) by inducing a short-lived perception or control error. This paper shows a qualitatively different risk: a long-horizon route integrity compromise, where an attacker gradually steers a victim AV away from its intended route and into an attacker-chosen destination while the victim continues to drive "normally." This will not pose a danger to the victim vehicle itself, but also to potential passengers sitting inside the vehicle. In this paper, we design and implement the first adversarial framework, called JackZebra, that performs route-level hijacking of a vision-based end-to-end driving stack using a physically plausible attacker vehicle with a reconfigurable display mounted on the rear. The central challenge is temporal persistence: adversarial influence must remain effective in changing viewpoints, lighting, weather, traffic, and the victim's continual replanning -- without triggering conspicuous failures. Our key insight is to treat route hijacking as a closed-loop control problem and to convert adversarial patches into steering primitives that can be selected online via an interactive adjustment loop. Our adversarial patches are also carefully designed against worst-case background and sensor variations so that the adversarial impacts on the victim. Our evaluation shows that JackZebra can successfully hijack victim vehicles to deviate from original routes and stop at adversarial destinations with a high success rate.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
