PG-Attack: A Precision-Guided Adversarial Attack Framework Against Vision Foundation Models for Autonomous Driving

TL;DR

Vision foundation models enable real-time perception for autonomous driving but remain vulnerable to adversarial inputs. The paper introduces PG-Attack, a precision-guided adversarial framework that fuses Precision Mask Perturbation Attack (PMP-Attack) and Deceptive Text Patch Attack (DTP-Attack) to maximize cross-modal disruption while preserving perceptual similarity, formalized by maximizing $ \mathcal{D}(E_I(Img_{Adv}), E_T(Caption)) $ under SSIM constraints. It employs a three-phase workflow with modality expansion, masked patch perturbations, and deceptive text patches, validated on cross-model VQA tasks including GPT-4V, Qwen-VL, and imp-V1, achieving high transferability. The approach secured First-Place at the CVPR 2024 Workshop Challenge and highlights the urgent need for defenses to safeguard autonomous driving perception against multimodal adversarial threats.

Abstract

Vision foundation models are increasingly employed in autonomous driving systems due to their advanced capabilities. However, these models are susceptible to adversarial attacks, posing significant risks to the reliability and safety of autonomous vehicles. Adversaries can exploit these vulnerabilities to manipulate the vehicle's perception of its surroundings, leading to erroneous decisions and potentially catastrophic consequences. To address this challenge, we propose a novel Precision-Guided Adversarial Attack (PG-Attack) framework that combines two techniques: Precision Mask Perturbation Attack (PMP-Attack) and Deceptive Text Patch Attack (DTP-Attack). PMP-Attack precisely targets the attack region to minimize the overall perturbation while maximizing its impact on the target object's representation in the model's feature space. DTP-Attack introduces deceptive text patches that disrupt the model's understanding of the scene, further enhancing the attack's effectiveness. Our experiments demonstrate that PG-Attack successfully deceives a variety of advanced multi-modal large models, including GPT-4V, Qwen-VL, and imp-V1. Additionally, we won First-Place in the CVPR 2024 Workshop Challenge: Black-box Adversarial Attacks on Vision Foundation Models and codes are available at https://github.com/fuhaha824/PG-Attack.

Figures (6)

• Figure 1: Visualization of the impact of PG-Attack on the VQA performance of GPT-4V, imp-V1, and Qwen-VL.
• Figure 2: PG-Attack Framework. Phase I: Modality Expansion generates mask images and captions. Phase II: Precision Mask Patch Attack maximizes target region discrepancy. Phase III: Deceptive Text Patch Attack enhances overall attack effectiveness.
• Figure 3: The Impact of Mask Partial Perturbation Range.
• Figure 4: The Impact of Disruptive Text Color.
• Figure 5: The Impact of Disruptive Text Quantity.