NutVLM: A Self-Adaptive Defense Framework against Full-Dimension Attacks for Vision Language Models in Autonomous Driving
Department of Control Science and Engineering, Harbin Institute of Technology（控制科学与工程系，哈尔滨工业大学）；College of Computing and Data Science, Nanyang Technological University（计算与数据科学学院，南洋理工大学）
Xiaoxu Peng, Dong Zhou, Jianwen Zhang, Guanghui Sun, Anh Tu Ngo, Anupam Chattopadhyay
Vision Language Models (VLMs) have advanced perception in autonomous driving (AD), but they remain vulnerable to adversarial threats. These risks range from localized physical patches to imperceptible global perturbations. Existing defense methods for VLMs remain limited and often fail to reconcile robustness with clean-sample performance. To bridge these gaps, we propose NutVLM, a comprehensive self-adaptive defense framework designed to secure the entire perception-decision lifecycle. Specifically, we first employ NutNet++ as a sentinel, which is a unified detection-purification mechanism. It identifies benign samples, local patches, and global perturbations through three-way classification. Subsequently, localized threats are purified via efficient grayscale masking, while global perturbations trigger Expert-guided Adversarial Prompt Tuning (EAPT). Instead of the costly parameter updates of full-model fine-tuning, EAPT generates "corrective driving prompts" via gradient-based latent optimization and discrete projection. These prompts refocus the VLM's attention without requiring exhaustive full-model retraining. Evaluated on the Dolphins benchmark, our NutVLM yields a 4.89% improvement in overall metrics (e.g., Accuracy, Language Score, and GPT Score). These results validate NutVLM as a scalable security solution for intelligent transportation. Our code is available at https://github.com/PXX/NutVLM.
Visual detection is a key task in autonomous driving, and it serves as a crucial foundation for self-driving planning and control. Deep neural networks have achieved promising results in various visual tasks, but they are known to be vulnerable to adversarial attacks. A comprehensive understanding of deep visual detectors' vulnerability is required before people can improve their robustness. However, only a few adversarial attack/defense works have focused on object detection, and most of them employed only classification and/or localization losses, ignoring the objectness aspect. In this pape…
Macquarie University（麦考瑞大学）；Swinburne University of Technology（斯威本科技大学）
The rapid development of artificial intelligence, especially deep learning technology, has advanced autonomous driving systems (ADSs) by providing precise control decisions to counterpart almost any driving event, spanning from anti-fatigue safe driving to intelligent route planning. However, ADSs are still plagued by increasing threats from different attacks, which could be categorized into physical attacks, cyberattacks and learning-based adversarial attacks. Inevitably, the safety and security of deep learning-based autonomous driving are severely challenged by these attacks, from which the…
Recent success of semantic segmentation approaches on demanding road driving datasets has spurred interest in many related application fields. Many of these applications involve real-time prediction on mobile platforms such as cars, drones and various kinds of robots. Real-time setup is challenging due to extraordinary computational complexity involved. Many previous works address the challenge with custom lightweight architectures which decrease computational complexity by reducing depth, width and layer capacity with respect to general purpose architectures. We propose an alternative approac…
A Hybrid Defense Strategy for Boosting Adversarial Robustness in Vision-Language Models
Harbin Institute of Technology（哈尔滨工业大学）；University of Bristol（布里斯托大学）；Beijing University of Civil Engineering and Architecture（北京建筑大学）；University of Toronto Mississauga（多伦多大学密西沙加分校）；Xi’an Tieyi ICC（西安铁一中国际合作课程中心）
Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspective
SKLCCSE, the School of Computer Science and Engineering, Beihang University（北京航空航天大学计算机科学与工程学院软件安全技术与工程北京市重点实验室）；the School of Cyber Science and Technology, Sun Yat-sen University（中山大学网络空间科学与技术学院）；Henan University of Science and Technology（河南科技大学）；the School of Computing, National University of Singapore（新加坡国立大学计算学院）；College of Computing & Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）
Technical Report on the CVPR 2026@AdvML Workshop Challenge
Beihang University（北京航空航天大学）；University of Chinese Academy of Sciences（中国科学院大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；Tongji University（同济大学）；iFLYTEK Co., Ltd.（科大讯飞股份有限公司）；Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta（长三角安全人工智能安徽实验室）；Wenzhou Business College（温州商学院）；Jiangnan University（江南大学）；Guangzhou City University of Technology（广州理工学院）；Inceptio Technology（智元机器）；Institute of Dataspace（数据空间研究所）；Zhongguancun Laboratory（中关村实验室）；Tsinghua University（清华大学）；ETH Zürich（苏黎世联邦理工学院）；University of Oxford（牛津大学）；Shanghai AI Laboratory（上海人工智能实验室）；BAAI（北京智源人工智能研究院）；Meta；Johns Hopkins University（约翰·霍普金斯大学）；University of California, Berkeley（加州大学伯克利分校）；Nanyang Technological University（南洋理工大学）
Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
Dept. of Comp. Sci. & Tech.（计算机科学与技术系）；Institute for AI（人工智能研究院）；BNRist Center（BNRist中心）；THBI Lab（THBI实验室）；Tsinghua-Bosch Joint Center for ML（清华大学-博世联合机器学习中心）；Tsinghua University（清华大学）
Boston University（波士顿大学）；Northeastern University（东北大学）；IBM Research（IBM研究院）
Designing effective defense against adversarial attacks is a crucial topic as deep neural networks have been proliferated rapidly in many security-critical domains such as malware detection and self-driving cars. Conventional defense methods, although shown to be promising, are largely limited by their single-source single-cost nature: The robustness promotion tends to plateau when the defenses are made increasingly stronger while the cost tends to amplify. In this paper, we study principles of designing multi-source and multi-cost schemes where defense performance is boosted from multiple def…
K. J. Somaiya College Of Engineering（K. J. 索马亚工程学院）；Startup School India（印度创业学校）
Self Driving Car technology is a vehicle that guides itself without human conduction. The first truly autonomous cars appeared in the 1980s with projects funded by DARPA( Defense Advance Research Project Agency ). Since then a lot has changed with the improvements in the fields of Computer Vision and Machine Learning. We have used the concept of behavioral cloning to convert a normal RC model car into an autonomous car using Deep Learning technology
Bosch Center for Artificial Intelligence, Robert Bosch GmbH（罗伯特·博世有限公司博世人工智能中心）
Adversarial patches pose a realistic threat model for physical world attacks on autonomous systems via their perception component. Autonomous systems in safety-critical domains such as automated driving should thus contain a fail-safe fallback component that combines certifiable robustness against patches with efficient inference while maintaining high performance on clean inputs. We propose BagCert, a novel combination of model architecture and certification procedure that allows efficient certification. We derive a loss that enables end-to-end optimization of certified robustness against pat…
Poisoning Attacks on Federated Learning for Autonomous Driving
Umeå University（于默奥大学）；AI Sweden（瑞典人工智能研究院）；Royal Institute of Technology（皇家理工学院）；Chalmers University of Technology（查尔姆斯理工大学）；Dakota State University（达科他州立大学）；Scaleout Systems（Scaleout系统公司）
According to recent studies, the vulnerability of state-of-the-art Neural Networks to adversarial input samples has increased drastically. A neural network is an intermediate path or technique by which a computer learns to perform tasks using Machine learning algorithms. Machine Learning and Artificial Intelligence model has become a fundamental aspect of life, such as self-driving cars [1], smart home devices, so any vulnerability is a significant concern. The smallest input deviations can fool these extremely literal systems and deceive their users as well as administrator into precarious si…
Architecture-agnostic Iterative Black-box Certified Defense against Adversarial Patches
East China Normal University（华东师范大学）；Nanyang Technological University（南洋理工大学）；Centre for Frontier AI Research (CFAR), A*STAR（新加坡科技研究局前沿人工智能研究中心（CFAR））；New York University（纽约大学）
Susceptibility of neural networks to adversarial attack prompts serious safety concerns for lane detection efforts, a domain where such models have been widely applied. Recent work on adversarial road patches have successfully induced perception of lane lines with arbitrary form, presenting an avenue for rogue control of vehicle behavior. In this paper, we propose a modular lane verification system that can catch such threats before the autonomous driving system is misled while remaining agnostic to the particular lane detection model. Our experiments show that implementing the system with a s…
Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety
Fudan University（复旦大学）；The University of Melbourne（墨尔本大学）；Singapore Management University（新加坡国立大学）；Deakin University（德肯大学）；Hong Kong University of Science and Technology（香港科学与技术大学）；City University of Hong Kong（香港城市大学）；University of Oxford（牛津大学）；Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Shanghai Jiao Tong University（上海交通大学）；Nanyang Technological University（南洋理工大学）；The University of Sydney（悉尼大学）；Griffith University（格里菲斯大学）；University of California, Santa Cruz（加州大学圣克鲁兹分校）；Sea AI Lab（Sea AI实验室）；Tsinghua University（清华大学）；Virginia Tech（弗吉尼亚理工大学）；CISPA Helmholtz Center for Information Security（CISPA海德堡信息安全部）；University of Massachusetts Amherst（马萨诸塞大学阿姆赫斯特分校）；Purdue University（普渡大学）；Duke University（杜克大学）；University of Wisconsin - Madison（威斯康星大学麦迪逊分校）；RIKEN（理化学研究所）；The University of Tokyo（东京大学）
Pennsylvania State University（宾夕法尼亚州立大学）；Shanghai Jiao Tong University（上海交通大学）
Backdoor attacks (BA) are an emerging threat to deep neural network classifiers. A classifier being attacked will predict to the attacker's target class when a test sample from a source class is embedded with the backdoor pattern (BP). Recently, the first BA against point cloud (PC) classifiers was proposed, creating new threats to many important applications including autonomous driving. Such PC BAs are not detectable by existing BA defenses due to their special BP embedding mechanism. In this paper, we propose a reverse-engineering defense that infers whether a PC classifier is backdoor atta…
Valeo R&D Egypt（法雷奥研发埃及）；Valeo DAR Germany（法雷奥DAR德国）；Technische Universität Ilmenau（伊尔梅瑙工业大学）；Valeo Ireland（法雷奥爱尔兰）
Deep neural networks (DNNs) have accomplished impressive success in various applications, including autonomous driving perception tasks, in recent years. On the other hand, current deep neural networks are easily fooled by adversarial attacks. This vulnerability raises significant concerns, particularly in safety-critical applications. As a result, research into attacking and defending DNNs has gained much coverage. In this work, detailed adversarial attacks are applied on a diverse multi-task visual perception deep network across distance estimation, semantic segmentation, motion detection, a…
Nanjing University（南京大学）；Purdue University（普渡大学）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Pennsylvania State University（宾夕法尼亚州立大学）
Backdoor attacks have been shown to be a serious threat against deep learning systems such as biometric authentication and autonomous driving. An effective backdoor attack could enforce the model misbehave under certain predefined conditions, i.e., triggers, but behave normally otherwise. However, the triggers of existing attacks are directly injected in the pixel space, which tend to be detectable by existing defenses and visually identifiable at both training and inference stages. In this paper, we propose a new backdoor attack FTROJAN through trojaning the frequency domain. The key intuitio…
Deep learning systems are known to be vulnerable to adversarial examples. In particular, query-based black-box attacks do not require knowledge of the deep learning model, but can compute adversarial examples over the network by submitting queries and inspecting returns. Recent work largely improves the efficiency of those attacks, demonstrating their practicality on today's ML-as-a-service platforms. We propose Blacklight, a new defense against query-based black-box adversarial attacks. The fundamental insight driving our design is that, to compute adversarial examples, these attacks perform …
Deep learning models are being integrated into a wide range of high-impact, security-critical systems, from self-driving cars to medical diagnosis. However, recent research has demonstrated that many of these deep learning architectures are vulnerable to adversarial attacks--highlighting the vital need for defensive techniques to detect and mitigate these attacks before they occur. To combat these adversarial attacks, we developed UnMask, an adversarial detection and defense framework based on robust feature alignment. The core idea behind UnMask is to protect these models by verifying that an…
Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；The University of Sydney（悉尼大学）；JD Explore Academy（京东探索研究院）
Deep neural networks have achieved impressive performance in a variety of tasks over the last decade, such as autonomous driving, face recognition, and medical diagnosis. However, prior works show that deep neural networks are easily manipulated into specific, attacker-decided behaviors in the inference stage by backdoor attacks which inject malicious small hidden triggers into model training, raising serious security threats. To determine the triggered neurons and protect against backdoor attacks, we exploit Shapley value and develop a new approach called Shapley Pruning (ShapPruning) that su…
Module-wise Adaptive Adversarial Training for End-to-end Autonomous Driving
School of Computer Science and Engineering, Beihang University（北京航空航天大学计算机科学与工程学院）；School of Software, Beihang University（北京航空航天大学软件学院）；School of Computing, National University of Singapore（新加坡国立大学计算学院）；Aviation Industry Development Research Center of China（中国航空工业发展研究中心）
Technische Universität Braunschweig（布伦瑞克工业大学）；Volkswagen Group Automation（大众汽车集团自动驾驶部门）
Enabling autonomous driving (AD) can be considered one of the biggest challenges in today's technology. AD is a complex task accomplished by several functionalities, with environment perception being one of its core functions. Environment perception is usually performed by combining the semantic information captured by several sensors, i.e., lidar or camera. The semantic information from the respective sensor can be extracted by using convolutional neural networks (CNNs) for dense prediction. In the past, CNNs constantly showed state-of-the-art performance on several vision-related tasks, such…
Modern autonomous vehicles adopt state-of-the-art DNN models to interpret the sensor data and perceive the environment. However, DNN models are vulnerable to different types of adversarial attacks, which pose significant risks to the security and safety of the vehicles and passengers. One prominent threat is the backdoor attack, where the adversary can compromise the DNN model by poisoning the training samples. Although lots of effort has been devoted to the investigation of the backdoor attack to conventional computer vision tasks, its practicality and applicability to the autonomous driving …
Perception plays a pivotal role in autonomous driving systems, which utilizes onboard sensors like cameras and LiDARs (Light Detection and Ranging) to assess surroundings. Recent studies have demonstrated that LiDAR-based perception is vulnerable to spoofing attacks, in which adversaries spoof a fake vehicle in front of a victim self-driving car by strategically transmitting laser signals to the victim's LiDAR sensor. However, existing attacks suffer from effectiveness and generality limitations. In this work, we perform the first study to explore the general vulnerability of current LiDAR-bas…
Efficient Model-Based Purification Against Adversarial Attacks for LiDAR Segmentation
Industrial Systems Institute, Athena Research Center, Patras Science Park, Greece（工业系统研究所，雅典研究中心，帕特拉斯科学公园，希腊）；AviSense.AI, Patras Science Park, Greece（AviSense.AI，帕特拉斯科学公园，希腊）
Waabi；University of Toronto（多伦多大学）；UIUC（伊利诺伊大学厄巴纳-香槟分校）；Cornell University（康奈尔大学）
Modern self-driving perception systems have been shown to improve upon processing complementary inputs such as LiDAR with images. In isolation, 2D images have been found to be extremely vulnerable to adversarial attacks. Yet, there have been limited studies on the adversarial robustness of multi-modal models that fuse LiDAR features with image features. Furthermore, existing works do not consider physically realizable perturbations that are consistent across the input modalities. In this paper, we showcase practical susceptibilities of multi-sensor detection by placing an adversarial object on…
University of Michigan（密歇根大学）；NVIDIA（英伟达）；ASU（亚利桑那州立大学）
3D Point cloud is becoming a critical data representation in many real-world applications like autonomous driving, robotics, and medical imaging. Although the success of deep learning further accelerates the adoption of 3D point clouds in the physical world, deep learning is notorious for its vulnerability to adversarial attacks. In this work, we first identify that the state-of-the-art empirical defense, adversarial training, has a major limitation in applying to 3D point cloud models due to gradient obfuscation. We further propose PointDP, a purification strategy that leverages diffusion mod…
Uber ATG（优步先进技术集团）；University of Toronto（多伦多大学）；Princeton University（普林斯顿大学）
Modern autonomous driving systems rely heavily on deep learning models to process point cloud sensory data; meanwhile, deep models have been shown to be susceptible to adversarial attacks with visually imperceptible perturbations. Despite the fact that this poses a security concern for the self-driving industry, there has been very little exploration in terms of 3D perception, as most adversarial attacks have only been applied to 2D flat images. In this paper, we address this issue and present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demo…
Safeguarding connected autonomous vehicle communication: Protocols, intra- and inter-vehicular attacks and defenses
University of North Texas（北得克萨斯大学）；Kennesaw State University（肯尼索州立大学）；Fordham University（福特汉姆大学）；University of Guelph（圭尔夫大学）；Howard University（霍华德大学）；Mohamed Bin Zayed University of Artificial Intelligence (MBZUAI)（穆罕默德·本·扎耶德人工智能大学）；Qatar University（卡塔尔大学）；Hamad Bin Khalifa University（哈马德·本·哈利法大学）
Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRF
Artificial Intelligence Thrust, The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）人工智能学科）；Department of Computer Science and Engineering, The Hong Kong University of Science and Technology（香港科技大学计算机科学与工程学系）
本文提出 Adv3D，首次将对抗样本建模为 NeRF，并通过基元感知采样与语义引导正则化生成可物理实现的 3D 伪装纹理补丁，攻击驾驶场景中的 3D 检测器。
University of Michigan（密歇根大学）；University of California, Irvine（加州大学欧文分校）
In Autonomous Vehicles (AVs), one fundamental pillar is perception, which leverages sensors like cameras and LiDARs (Light Detection and Ranging) to understand the driving environment. Due to its direct impact on road safety, multiple prior efforts have been made to study its the security of perception systems. In contrast to prior work that concentrates on camera-based perception, in this work we perform the first security study of LiDAR-based perception in AV settings, which is highly important but unexplored. We consider LiDAR spoofing attacks as the threat model and set the attack goal as …
CP-uniGuard: A Unified, Probability-Agnostic, and Adaptive Framework for Malicious Agent Detection and Defense in Multi-Agent Embodied Perception Systems
Hong Kong JC STEM Lab of Smart City and Department of Computer Science, City University of Hong Kong（香港JC STEM实验室及城市大学计算机科学系）；School of Computer Science and Engineering, University of Electronic Science and Technology of China（电子科技大学计算机科学与工程学院）；Department of Electrical and Electronic Engineering, The University of Hong Kong（香港大学电子与电气工程系）；School of Data Science, Lingnan University（岭南大学数据科学学院）
ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus
Changsha University of Science & Technology（长沙理工大学）；Xiangtan University（湘潭大学）；Yunnan University（云南大学）；Huazhong University of Science and Technology（华中科技大学）；City University of Hong Kong（香港城市大学）；Griffith University（格里菲斯大学）
Brain-SAD: A Brain-Inspired Safe Autonomous Driving Control Framework with Dynamic Fear-Oriented Constraint on Dual-Policy
Nanjing University of Information Science & Technology（南京信息工程大学）；University of Electronic Science and Technology of China（电子科技大学）；Jiangsu Ocean University（江苏海洋大学）
University of Michigan（密歇根大学）；NVIDIA Research（英伟达研究院）；Arizona State University（亚利桑那州立大学）；Inceptio（嬴彻科技）；Baidu Research（百度研究院）；National Engineering Laboratory of Deep Learning Technology and Application（深度学习技术及应用国家工程实验室）；University of California, Irvine（加州大学欧文分校）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
In Autonomous Driving (AD) systems, perception is both security and safety critical. Despite various prior studies on its security issues, all of them only consider attacks on camera- or LiDAR-based AD perception alone. However, production AD systems today predominantly adopt a Multi-Sensor Fusion (MSF) based design, which in principle can be more robust against these attacks under the assumption that not all fusion sources are (or can be) attacked at the same time. In this paper, we present the first study of security issues of MSF-based perception in AD systems. We directly challenge the bas…
