In Autonomous Driving (AD), real-time perception is a critical component responsible for detecting surrounding objects to ensure safe driving. While researchers have extensively explored the integrity of AD perception due to its safety and security implications, the aspect of availability (real-time performance) or latency has received limited attention. Existing works on latency-based attack have focused mainly on object detection, i.e., a component in camera-based AD perception, overlooking the entire camera-based AD perception, which hinders them to achieve effective system-level effects, such as vehicle crashes. In this paper, we propose SlowTrack, a novel framework for generating adversarial attacks to increase the execution time of camera-based AD perception. We propose a novel two-stage attack strategy along with the three new loss function designs. Our evaluation is conducted on four popular camera-based AD perception pipelines, and the results demonstrate that SlowTrack significantly outperforms existing latency-based attacks while maintaining comparable imperceptibility levels. Furthermore, we perform the evaluation on Baidu Apollo, an industry-grade full-stack AD system, and LGSVL, a production-grade AD simulator, with two scenarios to compare the system-level effects of SlowTrack and existing attacks. Our evaluation results show that the system-level effects can be significantly improved, i.e., the vehicle crash rate of SlowTrack is around 95% on average while existing works only have around 30%.

翻译：在自动驾驶中，实时感知是负责检测周围物体以确保安全驾驶的关键组件。尽管研究人员已广泛探索了自动驾驶感知的完整性（安全性）及其安全隐患，但可用性（实时性能）或延迟方面受到的关注有限。现有基于延迟的攻击工作主要聚焦于目标检测，即基于摄像头的自动驾驶感知中的一个组件，而忽视了整个基于摄像头的自动驾驶感知，从而无法实现有效的系统级效果（如车辆碰撞）。本文提出慢跟踪这一新颖框架，用于生成对抗攻击以增加基于摄像头的自动驾驶感知的执行时间。我们提出了一种新型两阶段攻击策略，并设计了三个新的损失函数。我们在四种主流基于摄像头的自动驾驶感知流水线上进行了评估，结果表明慢跟踪显著优于现有基于延迟的攻击，同时保持相当水平的不可感知性。此外，我们在工业级全栈自动驾驶系统百度Apollo和生产级自动驾驶模拟器LGSVL上，通过两种场景对比了慢跟踪与现有攻击的系统级效果。评估结果显示，系统级效果可得到显著提升：慢跟踪的平均车辆碰撞率约为95%，而现有工作仅为30%左右。