Detecting adversarial examples via vision-based perception systems

Abstract

In one embodiment, the system receives a first image captured by a capture device of an ADV. The system applies an image transformation to the first image to generate a second image. The system applies an object detection model to the first and second images to generate first and second outputs, respectively. The system calculates a similarity measure between the first and second outputs. If a temporal change in the similarity measure between the first image and a previous image is above a threshold, the system detects the first image as an adversarial example.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to operating an autonomous vehicle. More specifically, embodiments of the present disclosure relate to detecting adversarial examples (e.g., input images) by a vision-based perception system for a robotic system or an autonomous driving vehicle (ADV). Background Art

[0002] A vehicle operating in an autonomous mode (e.g., without human control) can relieve occupants, particularly the driver, of some driving-related responsibilities. When operating in an autonomous mode, the vehicle can navigate to various locations using onboard sensors, allowing the vehicle to travel with minimal human interaction or in some cases without any passengers.

[0003] Motion planning and control are key operations in autonomous driving. However, traditional motion planning operations mainly estimate the difficulty of completing a given path from the curvature and speed of the given path, without considering the differences in characteristics used for different types of vehicles. The same motion planning and control are applied to all types of vehicles, which may not be precise and smooth in some cases.

[0004] Vision-based perception is one of the main tasks of autonomous vehicles and robotic systems, and deep learning-based computer vision models have achieved modern state-of-the-art performance in this task and have been widely deployed. However, these deep neural networks (DNNs) have been shown to be vulnerable to attacks by carefully crafted adversarial inputs (e.g., "adversarial examples"). For example, it has been demonstrated that by placing a carefully crafted small sticker on a stop sign, an adversary can trick an autonomous vehicle's vision-based perception system into recognizing it as a speed limit sign. Summary of the invention

[0005] A first aspect embodiment of the present disclosure provides a computer-implemented method, comprising: receiving a first image captured by a capture device of an autonomous driving vehicle ADV; performing image transformation to transform the first image into a second image; applying an object detection model to the first image and the second image to generate a first output and a second output, respectively; calculating a similarity measure between the first output and the second output; and detecting that the first image is an adversarial sample if a temporal variation in the similarity measure between the first image and a previous image is above a predetermined threshold.

[0006] A second aspect embodiment of the present disclosure provides a non-temporary machine-readable medium having instructions stored therein. When executed by a processor, the instructions cause the processor to perform operations, the operations comprising: receiving a first image captured by a capture device of an autonomous driving vehicle ADV; performing an image transformation to transform the first image into a second image; applying an object detection model to the first image and the second image to generate a first output and a second output, respectively; calculating a similarity measure between the first output and the second output; and detecting that the first image is an adversarial sample if a temporal variation in the similarity measure between the first image and a previous image is above a predetermined threshold.

[0007] In a third aspect, an embodiment of the present disclosure provides a data processing system, comprising: a processor; and a memory connected to the processor to store instructions, wherein the instructions, when executed by the processor, cause the processor to perform operations, the operations comprising: receiving a first image captured by a capture device of an autonomous driving vehicle ADV; performing an image transformation to transform the first image into a second image; applying an object detection model to the first image and the second image to generate a first output and a second output, respectively; calculating a similarity measure between the first output and the second output; and detecting that the first image is an adversarial sample if a temporal variation in the similarity measure between the first image and a previous image is above a predetermined threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Embodiments of the present disclosure are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.

[0009] Figure 1 is a block diagram illustrating a networking system according to one embodiment.

[0010] Figure 2 is a block diagram illustrating an example of an autonomous vehicle according to one embodiment.

[0011] Figure 3A-3B is a block diagram illustrating an example of a perception and planning system for use with an autonomous vehicle, according to one embodiment.

[0012] Figure 4 is a block diagram illustrating an example of an adversarial example module according to one embodiment.

[0013] Figure 5 is a block diagram illustrating a workflow for detecting adversarial examples according to one embodiment.

[0014] Figure 6 is a block diagram illustrating the output of an object detection system for a vehicle according to one embodiment.

[0015] Figure 7 is a block diagram illustrating the output of an object detection system for a vehicle with perturbations according to one embodiment.

[0016] Figure 8 is a flow chart illustrating a method according to one embodiment.

[0017] Fig. 9 is a block diagram illustrating a data processing system according to one embodiment. DETAILED DESCRIPTION

[0018] Various embodiments and aspects of the present disclosure will be described with reference to the details discussed below, and the accompanying drawings will illustrate various embodiments. The following description and the accompanying drawings are illustrative of the present disclosure and should not be construed as limiting the present disclosure. Many specific details are described to provide a comprehensive understanding of various embodiments of the present disclosure. However, in some cases, in order to provide a brief discussion of embodiments of the present disclosure, known or conventional details are not described.

[0019] References in the specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present disclosure. The phrase "in one embodiment" appearing in various places in the specification does not necessarily refer to the same embodiment.

[0020] According to some embodiments, a system receives a first image captured by a capture device of an ADV. The system applies an image transformation to the first image to generate a second image. The system applies an object detection model to the first and second images to generate first and second outputs, respectively. The system calculates a similarity measure between the first and second outputs. If a temporal change in the similarity measure between the first image and a previous image is above a threshold, the system detects the first image as an adversarial example.

[0021] Figure 1 is a block diagram showing an autonomous vehicle network configuration according to one embodiment of the present disclosure. Figure 1 , network configuration 100 includes an autonomous vehicle 101, which can be communicatively connected to one or more servers 103-104 via a network 102. Although one autonomous vehicle is shown, multiple autonomous vehicles can be connected to each other and / or to servers 103-104 via network 102. Network 102 can be any type of network, such as a local area network (LAN), a wide area network (WAN) such as the Internet, a cellular network, a satellite network, or a combination thereof, wired or wireless. Servers 103-104 can be any type of server or server cluster, such as a web or cloud server, an application server, a back-end server, or a combination thereof. Servers 103-104 can be data analysis servers, content servers, traffic information servers, maps and points of interest (MPOI) servers, or location servers, etc.

[0022] An autonomous vehicle refers to a vehicle that can be configured to be in an autonomous mode, in which the vehicle navigates through an environment with little or no input from a driver. Such an autonomous vehicle may include a sensor system having one or more sensors configured to detect information about the environment in which the vehicle operates. The vehicle and its associated controller use the detected information to navigate through the environment. Autonomous vehicle 101 may operate in a manual mode, a fully autonomous mode, or a partially autonomous mode.

[0023] In one embodiment, autonomous vehicle 101 includes, but is not limited to, perception and planning system 110, vehicle control system 111, wireless communication system 112, user interface system 113, infotainment system 114, and sensor system 115. Autonomous vehicle 101 may also include certain common components included in ordinary vehicles, such as an engine, wheels, a steering wheel, a transmission, etc., which can be controlled by vehicle control system 111 and / or perception and planning system 110 using various communication signals and / or commands (e.g., acceleration signals or commands, deceleration signals or commands, steering signals or commands, braking signals or commands, etc.).

[0024] The components 110-115 may be communicatively connected to each other via an interconnect, a bus, a network, or a combination thereof. For example, the components 110-115 may be communicatively connected to each other via a controller area network (CAN) bus. The CAN bus is a vehicle bus standard designed to allow microcontrollers and devices to communicate with each other in applications without a host. It is a message-based protocol that was originally designed for multi-way electrical wiring in automobiles, but is also used in many other environments.

[0025] Reference now Figure 2In one embodiment, the sensor system 115 includes, but is not limited to, one or more cameras 211, a global positioning system (GPS) unit 212, an inertial measurement unit (IMU) 213, a radar unit 214, and a light detection and range (LIDAR) unit 215. The GPS system 212 may include a transceiver operable to provide information about the location of the autonomous vehicle. The IMU unit 213 may sense the position and orientation changes of the autonomous vehicle based on inertial acceleration. The radar unit 214 may represent a system that uses radio signals to sense objects within the local environment of the autonomous vehicle. In some embodiments, in addition to sensing objects, the radar unit 214 may additionally sense the speed and / or heading of the object. The LIDAR unit 215 may use lasers to sense objects in the environment in which the autonomous vehicle is located. The LIDAR unit 215 may include one or more laser sources, a laser scanner, and one or more detectors, among other system components. The camera 211 may include one or more devices to capture images of the environment surrounding the autonomous vehicle. The camera 211 may be a static camera and / or a video camera. The camera may be mechanically movable, for example by mounting the camera on a rotating and / or tilting platform.

[0026] The sensor system 115 may also include other sensors, such as sonar sensors, infrared sensors, steering sensors, throttle sensors, brake sensors, and audio sensors (e.g., microphones). The audio sensor may be configured to capture sounds from the environment surrounding the autonomous vehicle. The steering sensor may be configured to sense the steering angle of the steering wheel, the wheels of the vehicle, or a combination thereof. The throttle sensor and the brake sensor sense the throttle position and the brake position of the vehicle, respectively. In some cases, the throttle sensor and the brake sensor may be integrated into an integrated throttle / brake sensor.

[0027] In one embodiment, the vehicle control system 111 includes, but is not limited to, a steering unit 201, a throttle unit 202 (also referred to as an acceleration unit), and a brake unit 203. The steering unit 201 is used to adjust the direction or heading of the vehicle. The throttle unit 202 is used to control the speed of the motor or engine, which in turn controls the speed and acceleration of the vehicle. The brake unit 203 decelerates the vehicle by providing friction to slow down the wheels or tires of the vehicle. Note that Figure 2 The components shown may be implemented in hardware, software or a combination thereof.

[0028] Return to reference Figure 1, the wireless communication system 112 allows communication between the autonomous vehicle 101 and external systems, such as devices, sensors, other vehicles, etc. For example, the wireless communication system 112 can wirelessly communicate with one or more devices (such as servers 103-104 on the network 102) directly or via a communication network. The wireless communication system 112 can use any cellular communication network or wireless local area network (WLAN), such as using WiFi to communicate with another component or system. The wireless communication system 112 can communicate directly with devices (e.g., a passenger's mobile device, a display device, a speaker within the vehicle 101) using, for example, an infrared link, Bluetooth, etc. The user interface system 113 can be part of a peripheral device implemented within the vehicle 101, including, for example, a keyboard, a touch screen display device, a microphone, and a speaker, etc.

[0029] Some or all functions of autonomous vehicle 101 may be controlled or managed by perception and planning system 110, particularly when operating in an autonomous driving mode. Perception and planning system 110 includes necessary hardware (e.g., processor, memory, storage device) and software (e.g., operating system, planning and routing programs) to receive information from sensor system 115, control system 111, wireless communication system 112, and / or user interface system 113, process the received information, plan a route or path from a starting point to a destination point, and then drive vehicle 101 based on the planning and control information. Alternatively, perception and planning system 110 may be integrated with vehicle control system 111.

[0030] For example, a user as a passenger may specify a starting location and a destination of a trip, for example, via a user interface. The perception and planning system 110 obtains trip-related data. For example, the perception and planning system 110 may obtain location and route information from an MPOI server, which may be part of the servers 103-104. The location server provides location services, and the MPOI server provides map services and POIs of certain locations. Alternatively, such location and MPOI information may be cached locally in a permanent storage device of the perception and planning system 110.

[0031] As the autonomous vehicle 101 moves along the route, the perception and planning system 110 may also obtain real-time traffic information from a traffic information system or server (TIS). Note that the servers 103-104 may be operated by a third-party entity. Alternatively, the functionality of the servers 103-104 may be integrated with the perception and planning system 110. Based on the real-time traffic information, MPOI information, and location information, as well as real-time local environment data (e.g., obstacles, objects, nearby vehicles) detected or sensed by the sensor system 115, the perception and planning system 110 may plan an optimal route and, for example, drive the vehicle 101 according to the planned route via the control system 111 to reach a designated destination safely and efficiently.

[0032] The server 103 may be a data analysis system for performing data analysis services for various clients. In one embodiment, the data analysis system 103 includes a data collector 121 and a machine learning engine 122. The data collector 121 collects driving statistics 123 from various vehicles (autonomous vehicles or conventional vehicles driven by human drivers). The driving statistics 123 include information indicating driving commands issued (e.g., throttle, brake, steering commands) and responses of the vehicle captured by the vehicle's sensors at different points in time (e.g., speed, acceleration, deceleration, direction). The driving statistics 123 may also include information describing the driving environment at different points in time, such as routes (including starting and destination locations), MPOI, road conditions, weather conditions, etc.

[0033] Based on the driving statistics 123, the machine learning engine 122 generates or trains a set of rules, algorithms, and / or prediction models 124 for various purposes. In one embodiment, the algorithms / models 124 may include models for detecting obstacles, algorithms for various image transformations, including but not limited to blurring, JPEG compression, bit compression, color depth reduction, etc. The obstacle detection model may be a deep learning neural network model, such as a deep convolutional neural network model. The algorithms / models 124 may then be uploaded to the ADV to be used in real time during autonomous driving.

[0034] Figure 3A and 3B is a block diagram illustrating an example of a perception and planning system for use with an autonomous vehicle according to one embodiment. System 300 may be implemented as Figure 1 Portions of autonomous vehicle 101 include, but are not limited to, perception and planning system 110, control system 111, and sensor system 115. Figure 3A-3B The perception and planning system 110 includes but is not limited to a positioning module 301 , a perception module 302 , a prediction module 303 , a decision module 304 , a planning module 305 , a control module 306 , a routing module 307 and an adversarial sample module 308 .

[0035] Some or all of the modules 301-308 may be implemented in software, hardware, or a combination thereof. For example, these modules may be installed in permanent storage device 352, loaded into memory 351, and executed by one or more processors (not shown). Note that some or all of these modules may be communicatively connected to Figure 2 Some or all modules of the vehicle control system 111 may be integrated with or integrated with the vehicle control system 111. Some of the modules 301-308 may be integrated together as an integrated module. For example, the adversarial sample module 308 may be integrated with the perception module 302 as an integrated module.

[0036] The positioning module 301 determines the current location of the autonomous vehicle 300 (e.g., using the GPS unit 212) and manages any data related to the user's trip or route. The positioning module 301 (also known as the map and route module) manages any data related to the user's trip or route. The user can log in and specify the starting location and destination of the trip, for example, via a user interface. The positioning module 301 communicates with other components of the autonomous vehicle 300, such as map and route information 311, to obtain data related to the trip. For example, the positioning module 301 can obtain location and route information from a location server and a map and POI (MPOI) server. The location server provides location services, and the MPOI server provides map services and POIs of certain locations, which can be cached as part of the map and route information 311. When the autonomous vehicle 300 moves along the route, the positioning module 301 can also obtain real-time traffic information from a traffic information system or server.

[0037] Based on the sensor data provided by the sensor system 115 and the positioning information obtained by the positioning module 301, the perception of the surrounding environment is determined by the perception module 302. The perception information can represent the situation around the vehicle that the driver is driving as perceived by an ordinary driver. The perception can include lane configuration, traffic light signals, relative positions of another vehicle, pedestrians, buildings, crosswalks or other traffic-related signs (e.g., stop signs, yield signs), etc., such as in the form of objects. The lane configuration includes information describing one or more lanes, such as, for example, the shape of the lane (e.g., straight or curved), the width of the lane, the number of lanes in the road, one-way or two-way lanes, merging or splitting lanes, exit lanes, etc.

[0038] The perception module 302 may include a computer vision system or functionality of a computer vision system to process and analyze images captured by one or more cameras in order to identify objects and / or features in the environment of the autonomous vehicle. Objects may include traffic signals, roadway boundaries, other vehicles, pedestrians, and / or obstacles, etc. The computer vision system may use object recognition algorithms, video tracking, and other computer vision techniques. In some embodiments, the computer vision system may map the environment, track objects, and estimate the speed of objects, etc. The perception module 302 may also detect objects based on other sensor data provided by other sensors such as radar and / or LIDAR.

[0039] For each object, the prediction module 303 predicts how the object will behave in the environment. Predictions are performed based on sensory data that senses the driving environment at a point in time, given a set of map / route information 311 and traffic rules 312. For example, if the object is a vehicle in the opposite direction and the current driving environment includes an intersection, the prediction module 303 will predict whether the vehicle will likely move straight ahead or turn. If the sensory data indicates that there is no traffic light at the intersection, the prediction module 303 may predict that the vehicle may have to come to a complete stop before entering the intersection. If the sensory data indicates that the vehicle is currently in a left-turn-only lane or a right-turn-only lane, the prediction module 303 may predict that the vehicle will be more likely to make a left turn or a right turn, respectively.

[0040] For each object, decision module 304 makes a decision about how to handle the object. For example, for a particular object (e.g., another vehicle in a crossing path) and metadata describing the object (e.g., speed, direction, steering angle), decision module 304 determines how to encounter the object (e.g., overtake, yield, stop, pass). Decision module 304 may make these decisions based on a set of rules, such as traffic rules or driving rules 312, which may be stored in persistent storage device 352.

[0041] The routing module 307 is configured to provide one or more routes or paths from the starting point to the destination point. For a given trip from the starting position to the destination position, for example, received from a user, the routing module 307 obtains the route and map information 311 and determines all possible routes or paths from the starting position to the destination position. The routing module 307 can generate a reference line in the form of a topographic map for each route determined by it from the starting position to the destination position. The reference line refers to an ideal route or path without any interference from others such as other vehicles, obstacles or traffic conditions. In other words, if there are no other vehicles, pedestrians or obstacles on the road, the ADV should follow the reference line accurately or closely. Then, the topographic map is provided to the decision module 304 and / or the planning module 305. The decision module 304 and / or the planning module 305 check all possible routes to select and modify one of the best routes in view of other data provided by other modules (such as traffic conditions from the positioning module 301, the driving environment perceived by the perception module 302, and the traffic conditions predicted by the prediction module 303). Depending on the particular driving circumstances at a point in time, the actual path or route used to control the ADV may be close to or different from the reference line provided by the routing module 307 .

[0042] Based on the decision for each perceived object, the planning module 305 uses the reference line provided by the routing module 307 as a basis to plan a path or route for the autonomous vehicle and driving parameters (e.g., distance, speed, and / or steering angle). That is, for a given object, the decision module 304 decides what to do with the object, and the planning module 305 determines how to do it. For example, for a given object, the decision module 304 may decide to pass through the object, and the planning module 305 may determine whether to pass on the left or right side of the object. Planning and control data are generated by the planning module 305 and include information describing how the vehicle 300 will move in the next movement cycle (e.g., the next route / path segment). For example, the planning and control data may indicate that the vehicle 300 moves at a speed of 30 miles per hour (mph) for 10 meters and then changes to the right lane at a speed of 25mph.

[0043] Based on the planning and control data, the control module 306 controls and drives the autonomous vehicle by sending appropriate commands or signals to the vehicle control system 111 according to the route or path defined by the planning and control data. The planning and control data includes sufficient information to drive the vehicle from a first point on the route or path to a second point using appropriate vehicle settings or driving parameters (e.g., throttle, brake, steering commands) at different points in time along the route or path.

[0044] In one embodiment, the planning phase is performed over multiple planning cycles (also referred to as driving cycles, such as within each time interval of 100 milliseconds (ms)). For each planning cycle or driving cycle, one or more control commands will be issued based on the planning and control data. That is, for every 100ms, the planning module 305 plans the next route segment or path segment, for example, including the target position and the time required for the ADV to reach the target position. Alternatively, the planning module 305 can also specify a specific speed, direction and / or steering angle, etc. In one embodiment, the planning module 305 plans the route segment or path segment for the next predetermined time period, such as 5 seconds. For each planning cycle, the planning module 305 plans the target position for the current cycle (e.g., the next 5 seconds) based on the target position planned in the previous cycle. The control module 306 then generates one or more control commands (e.g., throttle, brake, steering control commands) based on the planning and control data of the current cycle.

[0045] Note that decision module 304 and planning module 305 can be integrated into an integrated module. Decision module 304 / planning module 305 may include a navigation system or the functionality of a navigation system to determine a driving path for an autonomous vehicle. For example, the navigation system may determine a series of speeds and direction headings to affect the movement of the autonomous vehicle along a path that substantially avoids perceived obstacles while generally advancing the autonomous vehicle along a roadway-based path to a final destination. The destination may be set based on user input via user interface system 113. The navigation system may dynamically update the driving path while the autonomous vehicle is operating. The navigation system may incorporate data from a GPS system and one or more maps to determine a driving path for the autonomous vehicle.

[0046] Figure 4 is a block diagram illustrating an example of an adversarial sample module according to one embodiment. The adversarial sample module 308 can identify adversarial samples in several image samples or image streams (e.g., video feeds). Figure 4 In one embodiment, the adversarial sample module 308 includes modules such as an image receiver module 401, an image transformation module 403, an object detection module 405, a similarity metric calculator 407, and an adversarial sample detection module 409. The image receiver module 401 can receive one or more images from a sensor system (e.g., a camera, LIDAR, RADAR, or a combination thereof) of the ADV 101. The image transformation module 403 can apply image transformations to the received images to generate a set of transformed images. Examples of image transformations include, but are not limited to, blurring, bit reduction, color reduction, JPEG compression, various spatial filtering, etc. The object detection module 405 can detect and classify objects in images (for both the original image and the transformed image). The object detection module 405 can generate an output image with objects marked with bounding boxes, with the bounding boxes having associated confidence scores for object classification. In one embodiment, the object detection module 405 is implemented by machine learning or an artificial intelligence model such as a deep neural network model. These models may not detect objects in adversarial samples caused by overfitting or underfitting of data during model training. The similarity metric calculator 407 can calculate a similarity metric for any two output images or object detection outputs. The similarity metric can generate a similarity score based on the distance between the two images. For example, for any two images, the distance can be calculated based on weighting factors such as the number of bounding box detections, the overlapping area of ​​the bounding boxes, and the difference in whether the object classification matches the overlapping bounding boxes. If the similarity metric between the original image and each of the transformations of the image is above a predetermined threshold, the adversarial sample detection module 409 can determine that the image is an adversarial sample. The adversarial sample detection module 409 can also confirm that the sample is indeed adversarial based on the time changes in the detection.

[0047] Figure 5 500 is a block diagram showing a workflow for detecting adversarial examples according to one embodiment. Figure 1 Specifically, the workflow 500 may be performed by Figure 3B Module 308 is executed. Figure 4-5 In one embodiment, workflow 500 receives a temporal sequence of input images (time=t0, t1, ... tN) 501, one or more images at a time. In another embodiment, workflow 500 receives a video feed. For each image received, workflow 500 may apply one or more image transformations (T1, T2, ... TM) 503 to the image (using image transformation module 403). Image transformations include blurring, filtering, color reduction, bit reduction, JPEG compression, etc., or a combination thereof. For example, let image 0 be an image at time=0 (reference time). Image 0 may be applied with JPEG compression, such as T1 (image 0). The original image and its transformations, such as image 0 and T1 (image 0), may be passed through object detection module 405. Object detection module 405 generates outputs for original image 513 and transformed image 515 using an object detection ML / AI model or an image recognition model. Workflow 500 then applies a similarity metric calculation 507 (using similarity metric calculator module 407) to calculate a distance measure for the image 0 / T1 (image 0) pair. Although only one transformation is shown, multiple transformations may be applied to generate one or more pairs for similarity determination, such as Image0 / T1(Image0), Image0 / T2(Image0), Image0 / T3(Image0) ... Image0 / TM(Image0).

[0048] The distance measure may be calculated based on an equation using weighting factors. For example, for an original image (e.g., image 0) and a transformed image (e.g., T1 (image 0)), the equation for the distance (similarity measure) may be: distance = w_1*(f_1)+w_2*(f_2)+…, where w_x is a weight and f_x is a factor representing the difference in characteristics between the output of the original image and the transformed image. The difference factors may include, but are not limited to, the ratio of the number of bounding boxes inferred by the object detection algorithm between the original image and the transformed image, the ratio of the number of overlapping bounding boxes, the percentage of matching object classifications for each of the bounding boxes, the difference in confidence scores for the bounding boxes, and the percentage of overlapping areas of overlapping bounding boxes.

[0049] Based on the distance measurement calculations for each of image 0 and one or more corresponding transformed images, the workflow 500 determines whether image 0 is an adversarial example 509. In one embodiment, image 0 is adversarial if the difference measurement result is above a first predetermined threshold. Here, an adversarial example refers to a sample with a perturbation that causes an object from the image to not be detected by the object detection module. The motivation is that the transformed image will allow the object to be detected again because the detection of the adversarial example is inconsistent across transformations, and these inconsistencies are captured by the transformed image.

[0050] In another embodiment, when the difference measurement is inconsistent for two or more time samples, the adversarial image is confirmed by time change 511. For example, an object captured by a capture device between consecutive time frames (e.g., T=0 and T=1) should exist in both time frames. Therefore, if the object is removed from the frame and one or more previous frames capture the object, the frame can be confirmed as an adversarial sample. The determination can be calculated by analyzing the distance measurement of consecutive image frames for temporal changes in the distance measurement. For example, if the difference in the distance measurement between the current time frame and the previous time frame is higher than a second predetermined threshold, the image for the current time frame is confirmed as an adversarial sample. In another embodiment, the temporal change analysis can be performed by an ML / AI model or any statistical model.

[0051] In one embodiment, if an image frame is detected as an adversarial sample, the ADV may activate a fail-safe mechanism for the ADV. For example, the sensor system of the ADV may abandon (one or more) adversarial frames, for example, one or more frames are temporarily ignored until the adversarial sample fails. In another embodiment, the adversarial image is enhanced or replaced by another image from another camera, infrared, LIDAR, RADAR, or other imaging sensor of the ADV. In one embodiment, if the vehicle is in autonomous driving mode and an adversarial sample is detected and / or confirmed, the ADV enters a fail-safe mode and warns (via display, sound or tactile feedback vibration, etc.) the user to temporarily take over the steering of the ADV. Although only some fail-safe mechanisms are described, other conventional fail-safe mechanisms may be employed.

[0052] Figure 6-7 It is shown that ML / AI models for obstacle detection have blind spots. Figure 6 is a block diagram illustrating the output of an object detection system for a vehicle according to one embodiment. Figure 7 is a block diagram illustrating the output of an object detection system for a vehicle with perturbations according to one embodiment. Figure 6 , the white truck is detected (with a bounding box) as a “car” with a confidence score of 0.99. Although Figure 7The same truck is shown with disturbances, but the truck is not detected as an obstacle. Here, both scenarios use the same object detection algorithm (e.g., the same ML / AI model) for object detection.

[0053] Figure 8 800 is a flow chart illustrating a method according to one embodiment. Process 800 may be performed by processing logic that may include software, hardware, or a combination thereof. For example, process 800 may be performed by Figure 1 Perception and planning systems 110 or Figure 3B The adversarial sample module 308 is executed. Figure 8 , at box 801, processing logic receives a first image captured by a capture device of an ADV. At box 802, processing logic applies an image transformation to the first image to generate a second image. At box 803, processing logic applies an object detection model to the first and second images to generate first and second outputs, respectively. At box 804, processing logic calculates a similarity measure between the first and second outputs. At box 805, if a temporal change in the similarity measure between the first image and a previous image is above a threshold, processing logic detects the first image as an adversarial example.

[0054] In one embodiment, the first and second outputs include a list of bounding boxes, the locations of the bounding boxes, and annotations for each class of objects of the bounding boxes for the input images. In one embodiment, the image transformation includes color depth reduction, image compression, or blur transformation. In one embodiment, a similarity measure is calculated based on a distance between the two inputs.

[0055] In another embodiment, the distance includes the class prediction, the number of bounding boxes, and the difference in the overlapping area of ​​the bounding boxes. In one embodiment, if the adversarial example is identified, the processing logic also activates a fail-safe mechanism for the ADV. In another embodiment, the fail-safe mechanism includes ignoring the adversarial example or transferring control to the user of the ADV if the ADV is in autonomous driving mode.

[0056] Note that some or all of the components shown and described above may be implemented in software, hardware, or a combination thereof. For example, these components may be implemented as software installed and stored in a permanent storage device, which may be loaded and executed in a memory by a processor (not shown) to perform the processes or operations described throughout the present application. Alternatively, these components may be implemented as executable code programmed or embedded into dedicated hardware, such as an integrated circuit (e.g., a dedicated IC or ASIC), a digital signal processor (DSP), or a field programmable gate array (FPGA), which may be accessed via a corresponding driver and / or operating system from an application. In addition, these components may be implemented as specific hardware logic in a processor or processor core as part of an instruction set accessible via one or more specific instruction software components.

[0057] Fig. 9 1500 is a block diagram illustrating an example of a data processing system that can be used with one embodiment of the present invention. For example, system 1500 can represent any of the above-mentioned data processing systems, such as, for example, ADV 101 or the above-mentioned servers, such as, for example, server 103, that perform any of the above-mentioned processes or methods.

[0058] System 1500 may include many different components. These components may be implemented as integrated circuits (ICs), portions thereof, discrete electronic devices, or other modules suitable for use on a circuit board such as a motherboard or add-in card of a computer system, or as components otherwise incorporated into a chassis of a computer system.

[0059] It should also be noted that system 1500 is intended to illustrate the high-level view of many components of a computer system. However, it should be understood that in some embodiments, there may be additional components, and in addition, in other embodiments, the different arrangements of the components shown may occur. System 1500 may represent a desktop, notebook computer, tablet computer, server, mobile phone, media player, personal digital assistant (PDA), smart watch, personal communicator, gaming device, network router or hub, wireless access point (AP) or repeater, set-top box or its combination. In addition, although only a single machine or system is shown, the term "machine" or "system" should also be considered to include executing a set of (or multiple sets of) instructions individually or jointly to perform any one or more of the machines or systems in the method discussed herein.

[0060] In one embodiment, system 1500 includes a processor 1501, a memory 1503, and devices 1505-1508 connected via a bus or interconnect 1510. Processor 1501 may represent a single processor or multiple processors including a single processor core or multiple processor cores. Processor 1501 may represent one or more general-purpose processors, such as a microprocessor, a central processing unit (CPU), etc. More particularly, processor 1501 may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets, or a processor implementing a combination of instruction sets. Processor 1501 may also be one or more special-purpose processors, such as an application-specific integrated circuit (ASIC), a cellular or baseband processor, a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, a graphics processor, a network processor, a communication processor, a cryptographic processor, a coprocessor, an embedded processor, or any other type of logic capable of processing instructions.

[0061] Processor 1501 may be a low power multi-core processor socket, such as an ultra low voltage processor, and processor 1501 may act as a main processing unit and a central hub for communicating with various components of the system. Such a processor may be implemented as a system on a chip (SoC). Processor 1501 is configured to execute instructions for performing the operations and steps discussed herein. System 1500 may further include a graphics interface for communicating with an optional graphics subsystem 1504, which may include a display controller, a graphics processor, and / or a display device.

[0062] Processor 1501 may communicate with memory 1503, which, in one embodiment, may be implemented via multiple memory devices to provide a fixed amount of system memory. Memory 1503 may include one or more volatile storage (or memory) devices, such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. Memory 1503 may store information including sequences of instructions to be executed by processor 1501 or any other device. For example, executable code and / or data of various operating systems, device drivers, firmware (e.g., input-output basic system or BIOS), and / or applications may be loaded into memory 1503 and executed by processor 1501. The operating system may be any type of operating system such as, for example, from of Operating system, Mac from Apple From of Or other real-time or embedded operating systems, such as VxWorks.

[0063] System 1500 may also include IO devices, such as devices 1505-1508, including (one or more) network interface devices 1505, (one or more) optional input devices 1506, and (one or more) other optional IO devices 1507. Network interface device 1505 may include a wireless transceiver and / or a network interface card (NIC). The wireless transceiver may be a WiFi transceiver, an infrared transceiver, a Bluetooth transceiver, a WiMax transceiver, a wireless cellular telephone transceiver, a satellite transceiver (e.g., a global positioning system (GPS) transceiver) or other radio frequency (RF) transceiver, or a combination thereof. The NIC may be an Ethernet card.

[0064] Input device(s) 1506 may include a mouse, a touchpad, a touch-sensitive screen (which may be integrated with display device 1504), a pointer device such as a stylus, and / or a keyboard (e.g., a physical keyboard or a virtual keyboard displayed as part of the touch-sensitive screen). For example, input device 1506 may include a touch screen controller connected to a touch screen. The touch screen and touch screen controller may detect contact and movement or interruption thereof, for example, using any of a variety of touch sensitivity technologies, including but not limited to capacitive, resistive, infrared, and surface acoustic wave technologies, as well as other proximity sensor arrays or other elements for determining one or more contact points with the touch screen.

[0065] IO devices 1507 may include audio devices. Audio devices may include speakers and / or microphones to facilitate voice-enabled functions, such as voice recognition, voice replication, digital recording, and / or telephone functions. Other IO devices 1507 may also include universal serial bus (USB) ports, parallel ports, serial ports, printers, network interfaces, bus bridges (e.g., PCI-PCI bridges), sensors (e.g., motion sensors such as accelerometers, gyroscopes, magnetometers, light sensors, compasses, proximity sensors, etc.) or combinations thereof. Device 1507 may further include an imaging processing subsystem (e.g., a camera), which may include an optical sensor, such as a charge coupled device (CCD) or a complementary metal oxide semiconductor (CMOS) optical sensor, for facilitating camera functions, such as recording photos and video clips. Certain sensors may be connected to interconnect 1510 via a sensor hub (not shown), while other devices such as keyboards or thermal sensors may be controlled by an embedded controller (not shown), depending on the specific configuration or design of system 1500.

[0066] In order to provide persistent storage of information such as data, applications, one or more operating systems, etc., a mass storage (not shown) may also be connected to the processor 1501. In various embodiments, in order to enable thinner and lighter system design and improve system responsiveness, the mass storage may be implemented via a solid-state device (SSD). However, in other embodiments, the mass storage may be implemented primarily using a hard disk drive (HDD) with a smaller amount of SSD storage to act as an SSD cache to enable non-volatile storage of context states and other such information during a power-off event, so that a fast power-up can occur when the system activity is restarted. In addition, a flash memory device may be connected to the processor 1501, for example, via a serial peripheral interface (SPI). The flash memory device may provide non-volatile storage of system software, including basic input / output software (BIOS) and other firmware of the system.

[0067] The storage device 1508 may include a computer-accessible storage medium 1509 (also referred to as a machine-readable storage medium or a computer-readable medium) on which is stored one or more sets of instructions or software (e.g., modules, units, and / or logic 1528) embodying any one or more of the methods or functions described herein. The processing module / unit / logic 1528 may represent any of the above-mentioned components, such as, for example Figure 1 Perception and planning systems 110 or Figure 3B The adversarial sample module 308. During the execution of the processing module / unit / logic 1528 by the data processing system 1500, the processing module / unit / logic 1528 may also reside completely or at least partially in the memory 1503 and / or in the processor 1501, and the memory 1503 and the processor 1501 also constitute a machine-accessible storage medium. The processing module / unit / logic 1528 may also be sent or received over a network via the network interface device 1505.

[0068] Computer-readable storage medium 1509 may also be used to persistently store some of the above-mentioned software functions. Although computer-readable storage medium 1509 is shown as a single medium in the exemplary embodiment, the term "computer-readable storage medium" should be considered to include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) storing one or more sets of instructions. The term "computer-readable storage medium" should also be considered to include any medium capable of storing or encoding an instruction set for execution by a machine and causing the machine to perform any one or more of the methods of the present invention. The term "computer-readable storage medium" should therefore be considered to include, but is not limited to, solid-state memory, optical and magnetic media, or any other non-temporary machine-readable medium.

[0069] The processing modules / units / logic 1528, components, and other features described herein may be implemented as discrete hardware components or integrated into the functionality of hardware components such as ASICs, FPGAs, DSPs, or similar devices. Additionally, the processing modules / units / logic 1528 may be implemented as firmware or functional circuits within a hardware device. Furthermore, the processing modules / units / logic 1528 may be implemented in any combination of hardware devices and software components.

[0070] Note that although system 1500 is shown using various components of a data processing system, it is not intended to represent any particular architecture or manner of interconnecting the components; as these details are not germane to embodiments of the present invention. It will also be understood that network computers, handheld computers, mobile phones, servers, and / or other data processing systems with fewer or perhaps more components may also be used with embodiments of the present invention.

[0071] Some portions of the foregoing detailed description have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. The operations are those requiring physical manipulations of physical quantities.

[0072] It should be remembered, however, that all of these and similar terms are associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless otherwise stated, as will be apparent from the above discussion, it should be understood that throughout the specification, discussions using terms such as those set forth in the appended claims refer to the actions and processes of a computer system or similar electronic computing device that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system's memories or registers or other such information storage, transmission or display devices.

[0073] The techniques shown in the figure can be implemented using code and data stored and executed on one or more electronic devices. Such electronic devices use computer-readable media to store and communicate (internally and / or with other electronic devices over a network) code and data, such as non-transitory computer-readable storage media (e.g., magnetic disks, optical disks, random access memory, read-only memory, flash memory devices, phase change memory) and temporary computer-readable transmission media (e.g., electrical, optical, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, digital signals).

[0074] The processes or methods described in the foregoing figures may be performed by processing logic including hardware (e.g., circuits, dedicated logic, etc.), firmware, software (e.g., embodied on a non-transitory computer-readable medium), or a combination of both. Although the processes or methods are described above with respect to some sequential operations, it should be understood that some of the operations described may be performed in a different order. In addition, some operations may be performed in parallel rather than sequentially.

[0075] In the foregoing description, embodiments of the present invention have been described with reference to specific exemplary embodiments of the present invention. Obviously, various modifications may be made thereto without departing from the broader spirit and scope of the present invention as set forth in the appended claims. Therefore, the description and drawings should be considered illustrative rather than restrictive.

Claims

1. A computer-implemented method, include: receiving as input images a first image captured by a capture device of an autonomous driving vehicle ADV and a previous image captured before the first image; Calculating a distance measure between the first image and the previous image, comprising: applying an image transform to each image to generate a transformed image; applying an object detection model to each image and the corresponding transformed image to generate a first output and a second output, respectively; using a similarity measure between the first output and the second output as a distance measure for each of the images; If a distance measure between the first image and one of the previous images is above a first predetermined threshold, detecting that the one image is an adversarial example; If the distance measurements do not agree for the first image and the previous image, calculating a difference between the respective distance measurements for the first image and the previous image; and If the difference is higher than a second predetermined threshold, the first image is detected as an adversarial example.

2. The method of claim 1, wherein each of the first output and the second output comprises a list of bounding boxes, locations of the bounding boxes, and annotations for each class object of the bounding boxes for the input image.

3. The method of claim 1, wherein the image transformation comprises color depth reduction, image compression, or blur transformation. The method of claim 1 , wherein the similarity measure is calculated based on distances between a plurality of inputs.

5. The method of claim 4, wherein the distance comprises a difference in class prediction, a number of bounding boxes, and an overlapping area of ​​the bounding boxes.

6. The method according to claim 1, further comprising: include: If an adversarial example is detected, a fail-safe mechanism for the ADV is activated.

7. The method of claim 6, wherein the fail-safe mechanism comprises, if the ADV is in autonomous driving mode, ignoring the adversarial example or transferring control to a user of the ADV.

8. A non-transitory machine-readable medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations, the operations include: receiving as input images a first image captured by a capture device of an autonomous driving vehicle ADV and a previous image captured before the first image; Calculating a distance measure between the first image and the previous image, comprising: applying an image transform to each image to generate a transformed image; applying an object detection model to each image and the corresponding transformed image to generate a first output and a second output, respectively; using a similarity measure between the first output and the second output as a distance measure for each of the images; If a distance measure between the first image and one of the previous images is above a first predetermined threshold, detecting that the one image is an adversarial example; If the distance measurements do not agree for the first image and the previous image, calculating a difference between the respective distance measurements for the first image and the previous image; and If the difference is higher than a second predetermined threshold, the first image is detected as an adversarial example.

9. The non-transitory machine-readable medium of claim 8, wherein each of the first output and the second output comprises a list of bounding boxes, locations of the bounding boxes, and annotations for each class object of the bounding boxes for the input image.

10. The non-transitory machine-readable medium of claim 8, wherein the image transformation comprises color depth reduction, image compression, or a blur transformation.

11. The non-transitory machine-readable medium of claim 8, wherein the similarity metric is calculated based on distances between a plurality of inputs.

12. The non-transitory machine-readable medium of claim 11, wherein the distance comprises a class prediction, a number of bounding boxes, and a difference in an overlapping area of ​​the bounding boxes.

13. The non-transitory machine-readable medium of claim 8, wherein the operation further include: If an adversarial example is detected, a fail-safe mechanism for the ADV is activated.

14. The non-transitory machine-readable medium of claim 13, wherein the fail-safe mechanism comprises, if the ADV is in autonomous driving mode, ignoring the adversarial example or transferring control to a user of the ADV.

15. A data processing system, include: processor; as well as a memory coupled to the processor to store instructions that, when executed by the processor, cause the processor to perform operations comprising: receiving as input images a first image captured by a capture device of an autonomous driving vehicle ADV and a previous image captured before the first image; Calculating a distance measurement between the first image frame and the previous image, comprising: applying an image transform to each image to generate a transformed image; applying an object detection model to each image and the corresponding transformed image to generate a first output and a second output, respectively; using a similarity measure between the first output and the second output as a distance measure for each of the images; If a distance measure between the first image and one of the previous images is above a first predetermined threshold, detecting that the one image is an adversarial example; If the distance measurements do not agree for the first image and the previous image, calculating a difference between the respective distance measurements for the first image and the previous image; and If the difference is higher than a second predetermined threshold, the first image is detected as an adversarial example.

16. The system of claim 15, wherein each of the first output and the second output comprises a list of bounding boxes, locations of the bounding boxes, and annotations for each class object of the bounding boxes for the input image.

17. The system of claim 15, wherein the image transformation comprises color depth reduction, image compression, or a blur transformation.

18. The system of claim 15, wherein the similarity metric is calculated based on distances between a plurality of inputs.

19. The system of claim 18, wherein the distance comprises a class prediction, a number of bounding boxes, and a difference in an overlapping area of ​​the bounding boxes.

20. The system of claim 15, wherein the operation further include: If an adversarial example is detected, a fail-safe mechanism for the ADV is activated.

21. The system of claim 20, wherein the fail-safe mechanism comprises, if the ADV is in autonomous driving mode, ignoring the adversarial example or transferring control to a user of the ADV.

Images