Experimental Evaluation of Security Attacks on Self-Driving Car Platforms

1. Problem Statement

Autonomous vehicles (AVs) rely heavily on deep learning-based perception pipelines, which introduce new attack surfaces spanning input-space perturbations (adversarial examples), software pipeline manipulation, and network-layer disruptions. While existing research has extensively analyzed individual attack types in simulation or isolated components, there is a critical gap in understanding how different attack classes manifest in system behavior on real, physical autonomous vehicle hardware. Specifically, it is unclear whether distinct attacks produce unique, separable behavioral signatures ("fingerprints") across control, computational, and responsiveness dimensions that could enable practical detection and classification.

2. Methodology

The authors conducted a systematic, on-hardware experimental evaluation using a standardized protocol to characterize the impact of five distinct attack classes.

• Experimental Platforms: Two low-cost research platforms were used: the JetRacer (NVIDIA Jetson Nano) and the Yahboom ROSMaster X3 (NVIDIA Jetson Orin NX). Both utilize a ResNet-18 model for road-following tasks, processing 640×480 RGB frames to predict steering coordinates.
• Attack Classes Evaluated:
  1. FGSM (Fast Gradient Sign Method): Single-step adversarial perturbation injected before the CNN.
  2. PGD (Projected Gradient Descent): Iterative adversarial perturbation (resource-intensive).
  3. MitM (Man-in-the-Middle):
     • Input: Corrupting sensor streams (noise, blur, synthetic frames).
     • Output: Manipulating steering commands post-inference.
  4. DoS (Denial-of-Service): Introducing delays, dropping frames, or flooding I/O paths to degrade responsiveness.
  5. Phantom Attacks: Projecting false physical features (e.g., fake lane markings) onto the road to deceive the camera without digital manipulation.
• Experimental Protocol:
  • Duration: 13-second trials (5s clean baseline + 8s attack phase).
  • Trials: 10 independent trials per configuration.
  • Logging: Comprehensive automated logging of timestamps, model outputs, steering commands, CPU/memory usage, and FPS.
• Evaluation Dimensions (The "Fingerprint" Framework):
  1. Control Deviation: Steering angle deviation from the baseline.
  2. Computational Cost: Processing time increase and resource consumption.
  3. Runtime Responsiveness: Frame rate (FPS) degradation and latency.

3. Key Contributions

1. Attack Fingerprinting Framework: The paper introduces a three-dimensional characterization method that maps attack impacts across control, computation, and responsiveness. It demonstrates that different attack classes produce distinct, separable behavioral signatures.
2. Rigorous On-Hardware Evaluation: Unlike simulation-based studies, this work evaluates attacks on live hardware with embedded GPUs, capturing real-world constraints like thermal throttling and memory bandwidth limitations.
3. Defense-Relevant Insights: The study provides empirical evidence that attacks are not monolithic; they exhibit specific "fingerprints" that can inform the design of targeted, signature-based detection and response mechanisms rather than generic anomaly detection.

4. Key Results and Findings

The experiments revealed that each attack class produces a unique multi-dimensional profile:

• Control-Dominant Signatures (High Steering Deviation, Low Overhead):
  • MitM (Output) and Phantom Attacks caused significant steering deviations (0.72 and 0.27 respectively) but had negligible computational overhead and minimal impact on FPS.
  • Distinction: MitM output bypasses perception entirely, while Phantom attacks exploit the perception model's correct processing of physically false features.
• Multi-Dimensional Signatures (High Deviation + High Overhead + Low FPS):
  • PGD attacks generated a "distributed" profile: moderate steering deviation (0.42), massive processing time increases (3,360%), and severe FPS drops (68.5%). The iterative nature of PGD overwhelmed the onboard processor, acting as both an adversarial and a resource-exhaustion attack.
• Responsiveness-Dominant Signatures (Low Deviation, High Latency/FPS Drop):
  • DoS attacks (Delay/Drop) caused massive FPS drops (~75%) and latency spikes but resulted in minimal steering deviation (<0.1). The system struggled to process frames but did not necessarily steer incorrectly unless data staleness became critical.
• Moderate Signatures:
  • FGSM and MitM (Input) showed intermediate steering deviations with moderate computational costs and minimal FPS impact.

Table IV (Summary of Fingerprints):

5. Significance and Implications

• Shift from Binary to Classification: The findings suggest that security monitoring for AVs should move beyond simple "attack/no-attack" detection to attack classification. Knowing which attack is occurring (e.g., distinguishing a DoS lag from a Phantom projection) allows for more precise countermeasures.
• Targeted Defenses: The paper proposes a "fingerprint-aware" defense blueprint:
  • For Control-Dominant attacks: Implement command clamps, slew-rate limiting, and controller-side authentication.
  • For Multi-Dimensional attacks (PGD): Use compute-budget watchdogs, early-abort mechanisms, and dynamic downscaling.
  • For Responsiveness-Dominant attacks (DoS): Prioritize control threads, drop stale frames, and enforce freshness gating.
• Generalizability: The framework successfully generalized across digital attacks (software manipulation) and environmental attacks (physical projection), proving its utility for real-world AV security analysis.
• Limitations & Future Work: The study focused on road-following with a single camera and specific ResNet-18 models. Future work needs to address multi-sensor fusion, physical-world realizability of adversarial patches, and the evaluation of defense mechanisms under adaptive attackers.

In conclusion, this paper establishes that attacks on autonomous vehicles leave distinct, measurable "fingerprints" across control, computation, and timing dimensions. This insight is foundational for developing next-generation, adaptive security systems capable of detecting, classifying, and mitigating specific threats in real-time.