Autonomous Driving (AD) systems critically depend on visual perception for real-time object detection and multiple object tracking (MOT) to ensure safe driving. However, high latency in these visual perception components can lead to significant safety risks, such as vehicle collisions. While previous research has extensively explored latency attacks within the digital realm, translating these methods effectively to the physical world presents challenges. For instance, existing attacks rely on perturbations that are unrealistic or impractical for AD, such as adversarial perturbations affecting areas like the sky, or requiring large patches that obscure most of a camera's view, thus making them impossible to be conducted effectively in the real world. In this paper, we introduce SlowPerception, the first physical-world latency attack against AD perception, via generating projector-based universal perturbations. SlowPerception strategically creates numerous phantom objects on various surfaces in the environment, significantly increasing the computational load of Non-Maximum Suppression (NMS) and MOT, thereby inducing substantial latency. Our SlowPerception achieves second-level latency in physical-world settings, with an average latency of 2.5 seconds across different AD perception systems, scenarios, and hardware configurations. This performance significantly outperforms existing state-of-the-art latency attacks. Additionally, we conduct AD system-level impact assessments, such as vehicle collisions, using industry-grade AD systems with production-grade AD simulators with a 97% average rate. We hope that our analyses can inspire further research in this critical domain, enhancing the robustness of AD systems against emerging vulnerabilities.

翻译：自动驾驶系统高度依赖视觉感知进行实时目标检测与多目标跟踪，以确保行车安全。然而，视觉感知组件的高延迟可能导致严重的安全风险，例如车辆碰撞。尽管先前研究已深入探索数字领域的延迟攻击，但将这些方法有效迁移至物理世界仍面临挑战。例如，现有攻击依赖于对自动驾驶不现实或不可行的扰动，例如影响天空区域的对抗性扰动，或需要遮挡摄像头大部分视野的大面积贴片，导致其无法在现实世界中有效实施。本文提出SlowPerception，首个针对自动驾驶感知的物理世界延迟攻击，通过生成基于投影仪的通用扰动实现。SlowPerception策略性地在环境中的不同表面创建大量幻影目标，显著增加非极大值抑制与多目标跟踪的计算负载，从而引发实质性延迟。我们的SlowPerception在物理世界环境中实现了秒级延迟，在不同自动驾驶感知系统、场景与硬件配置下平均延迟达2.5秒，其性能显著优于现有最先进的延迟攻击方法。此外，我们使用工业级自动驾驶系统与生产级模拟器进行系统级影响评估（如车辆碰撞），平均碰撞率达97%。我们希望本研究能够激发这一关键领域的进一步探索，以增强自动驾驶系统应对新兴漏洞的鲁棒性。