University of California Institute of Transportation Studies

Autonomous vehicles (AVs) heavily rely on machine learning-based perception models to accurately interpret their surroundings. However, these crucial perception components are vulnerable to a range of malicious attacks. Even though individual attacks can be highly successful, the actual security risks such attacks can pose to our daily life are unclear. Various factors, such as lack of stealthiness, cost-effectiveness, and ease of deployment, can deter potential attackers from employing certain attacks, thereby reducing the actual risk. This research report presents the first quantitative risk assessment for physical adversarial attacks on AVs. The specific focus is on attacks on AV’s perception components due to their highly critical function and representation in existing research. The report defines the daily-life risk as the likelihood that a given type of attack will be employed in real life and the authors develop a problem-specific risk scoring system and accompanying metrics. They perform an initial evaluation of the proposed risk assessment method for all the reported attacks on AVs from 2017 to 2023. They quantitatively rank the daily-life risks posed by each of eight different categories of attacks s and find three attacks with the highest risks: 2D printed images, 2D patches, and coated camouflage stickers, which deserve more focused attention for potential future mitigation strategy development and policy making.