Autonomous Driving (AD) systems critically depend on visual perception for real-time object detection and multiple object tracking (MOT) to ensure safe driving. However, high latency in these visual perception components can lead to significant safety risks, such as vehicle collisions. While previous research has extensively explored latency attacks within the digital realm, translating these methods effectively to the physical world presents challenges. For instance, existing attacks rely on perturbations that are unrealistic or impractical for AD, such as adversarial perturbations affecting areas like the sky, or requiring large patches that obscure most of a camera's view, thus making them impossible to be conducted effectively in the real world. In this paper, we introduce SlowPerception, the first physical-world latency attack against AD perception, via generating projector-based universal perturbations. SlowPerception strategically creates numerous phantom objects on various surfaces in the environment, significantly increasing the computational load of Non-Maximum Suppression (NMS) and MOT, thereby inducing substantial latency. Our SlowPerception achieves second-level latency in physical-world settings, with an average latency of 2.5 seconds across different AD perception systems, scenarios, and hardware configurations. This performance significantly outperforms existing state-of-the-art latency attacks. Additionally, we conduct AD system-level impact assessments, such as vehicle collisions, using industry-grade AD systems with production-grade AD simulators with a 97% average rate. We hope that our analyses can inspire further research in this critical domain, enhancing the robustness of AD systems against emerging vulnerabilities.

翻译：自动驾驶系统严重依赖视觉感知实现实时目标检测和多目标跟踪（MOT），以确保安全驾驶。然而，这些视觉感知组件的高延迟可能导致严重的安全风险，例如车辆碰撞。尽管先前研究已在数字领域广泛探索延迟攻击，但将这些方法有效迁移至物理世界仍面临挑战。例如，现有攻击依赖的扰动在自动驾驶场景中不切实际或难以实施，如影响天空区域的对抗扰动，或需覆盖摄像头大部分视野的大面积补丁，导致其无法在真实世界中有效执行。本文提出SlowPerception——首个针对自动驾驶感知的物理世界延迟攻击，通过生成基于投影仪的通用扰动实现攻击。SlowPerception策略性地在环境中多种表面制造大量幻影物体，显著增加非极大值抑制（NMS）与多目标跟踪（MOT）的计算负载，从而诱发显著延迟。在物理世界场景中，我们的SlowPerception实现了秒级延迟，在多种自动驾驶感知系统、场景及硬件配置下平均延迟达2.5秒，该性能显著优于现有最先进的延迟攻击。此外，我们利用工业级自动驾驶系统与生产级自动驾驶模拟器进行了系统级影响评估（如车辆碰撞），平均成功率达97%。我们期望此分析能推动该关键领域的进一步研究，增强自动驾驶系统对抗新型漏洞的鲁棒性。