Autonomous Driving Systems (ADSs) are complex Cyber-Physical Systems (CPSs) that must ensure safety even in uncertain conditions. Modern ADSs often employ Deep Neural Networks (DNNs), which may not produce correct results in every possible driving scenario. Thus, an approach to estimate the confidence of an ADS at runtime is necessary to prevent potentially dangerous situations. In this paper we propose MarMot, an online monitoring approach for ADSs based on Metamorphic Relations (MRs), which are properties of a system that hold among multiple inputs and the corresponding outputs. Using domain-specific MRs, MarMot estimates the uncertainty of the ADS at runtime, allowing the identification of anomalous situations that are likely to cause a faulty behavior of the ADS, such as driving off the road. We perform an empirical assessment of MarMot with five different MRs, using a small-scale ADS, two different circuits for training, and two additional circuits for evaluation. Our evaluation encompasses the identification of both external anomalies, e.g., fog, as well as internal anomalies, e.g., faulty DNNs due to mislabeled training data. Our results show that MarMot can identify 35\% to 65\% of the external anomalies and 77\% to 100\% of the internal anomalies, outperforming both SelfOracle and Ensemble-based ADS monitoring approaches.

翻译：自主驾驶系统（ADS）是复杂的网络-物理系统（CPS），必须确保在不确定条件下的安全性。现代ADS常采用深度神经网络（DNN），但在所有可能的驾驶场景中可能无法产生正确结果。因此，为在运行时评估ADS的置信度，以防止潜在危险情况，需要一种方法。本文提出MarMot，一种基于变形关系（MR）的ADS在线监测方法。变形关系是系统在多个输入及对应输出之间保持的特性。通过使用领域特定的MR，MarMot在运行时估计ADS的不确定性，从而识别可能导致ADS故障行为（如驶离道路）的异常情况。我们使用一个小型ADS、两个不同的训练电路和两个额外的评估电路，对五种不同的MR进行了MarMot的实证评估。评估涵盖外部异常（如雾）和内部异常（如因错误标注训练数据导致的DNN故障）的识别。结果显示，MarMot能识别35%至65%的外部异常和77%至100%的内部异常，优于SelfOracle和基于集成的ADS监测方法。