Towards Robust Physical-world Backdoor Attacks on Lane Detection

TL;DR

BadLANE addresses the vulnerability of lane-detection models to backdoor attacks in dynamic real-world driving by combining amorphous, mud-inspired triggers with a meta-learning framework that generates environment-aware meta-triggers. The approach formalizes four attack strategies, designs an irregular trigger pattern, and trains meta-generators to seed triggers under varied weather and lighting conditions, achieving high attack success while maintaining clean accuracy. Extensive digital and physical experiments across multiple LD models demonstrate substantial performance gains over baselines and robust real-world transfer, with practical implications for LD security and the need for defenses. The work also discusses defenses, ethical considerations, and avenues for improving stealthiness and robustness against mitigation efforts.

Abstract

Deep learning-based lane detection (LD) plays a critical role in autonomous driving systems, such as adaptive cruise control. However, it is vulnerable to backdoor attacks. Existing backdoor attack methods on LD exhibit limited effectiveness in dynamic real-world scenarios, primarily because they fail to consider dynamic scene factors, including changes in driving perspectives (e.g., viewpoint transformations) and environmental conditions (e.g., weather or lighting changes). To tackle this issue, this paper introduces BadLANE, a dynamic scene adaptation backdoor attack for LD designed to withstand changes in real-world dynamic scene factors. To address the challenges posed by changing driving perspectives, we propose an amorphous trigger pattern composed of shapeless pixels. This trigger design allows the backdoor to be activated by various forms or shapes of mud spots or pollution on the road or lens, enabling adaptation to changes in vehicle observation viewpoints during driving. To mitigate the effects of environmental changes, we design a meta-learning framework to train meta-generators tailored to different environmental conditions. These generators produce meta-triggers that incorporate diverse environmental information, such as weather or lighting conditions, as the initialization of the trigger patterns for backdoor implantation, thus enabling adaptation to dynamic environments. Extensive experiments on various commonly used LD models in both digital and physical domains validate the effectiveness of our attacks, outperforming other baselines significantly (+25.15% on average in Attack Success Rate). Our codes will be available upon paper publication.

Figures (7)

• Figure 1: Illustration of our attack on LD scenarios (ground truth in blue, model prediction in red, and triggers in green). Our attacks can be activated by diverse forms of triggers (e.g., mud spots, lens pollution) in various driving perspectives and environmental changes (e.g., highlight, rain).
• Figure 2: Overall Framework. BadLANE employs an amorphous pattern for trigger design, which is extracted from various mud patterns and shaped with a mask generator. By utilizing them to construct meta-tasks, we introduce a meta-learning framework to generate meta-triggers that integrate diverse environmental information through sampling benign images.
• Figure 3: Visualization of different attack strategies. Our BadLANE can be activated by various forms/shapes of mud spots and is robust to dynamic scene factors.
• Figure 4: Illustration of various forms/shapes of mud triggers.
• Figure 5: Average ASR (%) of diverse forms/shapes mud trigger patterns under driving perspective changes (DPC) and various environmental conditions (EC).