Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94\% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.

翻译：基于摄像头的计算机视觉是自动驾驶车辆感知系统的核心。本文提出一种攻击方法，利用发光二极管并借助摄像头的卷帘快门效应，在捕获图像中生成对抗性条纹以误导交通标志识别。该攻击具有隐蔽性，因为条纹在交通标志上对人眼不可见。为使攻击具备威胁性，识别结果需在连续图像帧中保持稳定。为此，我们设计并实现了GhostStripe攻击系统，通过控制调制光发射的时序以适应摄像头工作模式与受害车辆运动状态。在真实测试平台上的评估表明，当受害车辆通过路段时，GhostStripe可稳定地将高达94%帧数的交通标志识别结果欺骗至错误类别。现实中，此类攻击效果可能导致受害车辆陷入危及生命的事故。我们从摄像头传感器、感知模型及自动驾驶系统三个层面探讨了相应的防御对策。