To operate safely, autonomous vehicles (AVs) rely on external sensors such as cameras, light detection and ranging (LiDAR) technology, and radar. These sensors pair with machine learning-based perception modules that interpret the surrounding environment and enable the AV to act accordingly. Perception modules are the “eyes and ears” of the vehicle and are vulnerable to cybersecurity attacks. The most critical and practical threats, however, arise from physical attacks that do not require access to the AV’s internal systems. The risks of these types of attacks are still unknown. To advance the field in this area, we conducted the first ever quantitative risk assessment for physical adversarial attacks on AVs. First, we identified relevant attack vectors, or types of cyber security attacks, targeting AV perception modules. Next, we conducted an in-depth analysis of the stages of an attack. Finally, we used these exercises to identify risk metrics and perform a subsequent computation of risk scores for different attack vectors. Through this process, we were able to quantitatively rank the real-life risks posed by different attack vectors identified in existing research. This analysis provides a framework for comprehensive risk analysis to ensure the safety of AVs on our roadways.

Autonomous vehicles (AVs) heavily rely on machine learning-based perception models to accurately interpret their surroundings. However, these crucial perception components are vulnerable to a range of malicious attacks. Even though individual attacks can be highly successful, the actual security risks such attacks can pose to our daily life are unclear. Various factors, such as lack of stealthiness, cost-effectiveness, and ease of deployment, can deter potential attackers from employing certain attacks, thereby reducing the actual risk. This research report presents the first quantitative risk assessment for physical adversarial attacks on AVs. The specific focus is on attacks on AV’s perception components due to their highly critical function and representation in existing research. The report defines the daily-life risk as the likelihood that a given type of attack will be employed in real life and the authors develop a problem-specific risk scoring system and accompanying metrics. They perform an initial evaluation of the proposed risk assessment method for all the reported attacks on AVs from 2017 to 2023. They quantitatively rank the daily-life risks posed by each of eight different categories of attacks s and find three attacks with the highest risks: 2D printed images, 2D patches, and coated camouflage stickers, which deserve more focused attention for potential future mitigation strategy development and policy making.