动态欺骗：当行人联手欺骗自动驾驶汽车
Dynamic Deception: When Pedestrians Team Up to Fool Autonomous Cars
AI总结：
本文提出通过多个动态元素协作放大对抗信号，以引发自动驾驶车辆的系统级故障，展示动态协作在对抗攻击中的有效性。
摘要：
许多针对自动驾驶感知模型的对抗攻击在部署到完整的驾驶栈中时未能引起系统级故障。主要原因在于，一旦部署到系统中（例如在模拟器内），攻击往往在空间或时间上持续时间较短，由于车辆的动力学特性，因此很少影响车辆行为。在本文中，我们通过引入系统级攻击来解决这两个限制。多个动态元素（例如两个行人）携带对抗性补丁（例如在衣物上）并通过协调和运动共同放大其效果。我们使用最先进的自动驾驶代理在CARLA模拟器中评估了我们的攻击。在系统层面，单个行人攻击在所有运行中都失败（共10次），而两个行人动态协作导致在多达50%的运行中引发完整车辆停止，而静态协作则完全无法成功。这些结果表明，只有当对抗信号在时间上持续存在并通过协调的行动放大时，才会出现系统级故障，揭示了模型级鲁棒性和端到端安全性之间的差距。
英文摘要：
Many adversarial attacks on autonomous-driving perception models fail to cause system-level failures once deployed in a full driving stack. The main reason for such ineffectiveness is that once deployed in a system (e.g., within a simulator), attacks tend to be spatially or temporally short-lived, due to the vehicle's dynamics, hence rarely influencing the vehicle behaviour. In this paper, we address both limitations by introducing a system-level attack in which multiple dynamic elements (e.g., two pedestrians) carry adversarial patches (e.g., on cloths) and jointly amplify their effect through coordination and motion. We evaluate our attacks in the CARLA simulator using a state-of-the-art autonomous driving agent. At the system level, single-pedestrian attacks fail in all runs (out of 10), while dynamic collusion by two pedestrians induces full vehicle stops in up to 50\% of runs, with static collusion yielding no successful attack at all. These results show that system-level failures arise only when adversarial signals persist over time and are amplified through coordinated actors, exposing a gap between model-level robustness and end-to-end safety.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
