An automatic driving continuous test method based on adversarial attack

Abstract

The application discloses an automatic driving continuous testing method based on an adversarial attack, takes end-to-end automatic driving software as a testing object, takes a picture as an input, outputs a deflection angle for controlling a virtual car, sets a billboard area in the input picture as a testing area, sets an expected driving track as a testing target, positions a current position of the testing object, calculates an expected deflection angle of the testing object based on the testing target, positions the testing area in the input, adds Gaussian disturbance noise to simulate the influence of environmental factors, calculates a gradient about the input picture, updates the input of the testing object based on a sub-gradient iteration, extracts and uses affine transformation and interpolation transformation to convert the testing area image into a billboard size, inputs the testing area image into a virtual camera, and finally outputs the testing area image to the billboard in a testing scene, and completes the continuous testing based on feedback information and control information. The application improves the robustness and safety of automatic driving software based on machine learning and deep learning.

Description

Technical Field

[0001] This invention relates to a continuous testing method for autonomous driving based on adversarial attacks, belonging to the field of testing technology in software engineering. Background Technology

[0002] Machine learning and deep learning models are widely used in various real-world applications, such as image processing, object recognition, and autonomous driving. However, their vulnerability to adversarial examples poses security risks to software based on these components. Given their outstanding performance in image processing, machine learning and deep learning models often serve as core decision-making modules in autonomous driving software, making them highly susceptible to adversarial examples that significantly threaten their security. Therefore, identifying these vulnerabilities early in the testing phase is crucial for enhancing the robustness of autonomous driving models through adversarial training before deployment.

[0003] Current research focuses on the output changes of end-to-end autonomous driving software in response to static scene transformations. However, static scenes have limitations. First, existing methods do not consider feedback information from the test scene and do not actually apply the control information of the autonomous driving software to the vehicle under test; they merely print out the control information as the test result, making the entire testing process simplistic and limited. Second, because it is a static testing method, the testing process cannot achieve the goal of continuous testing over long sequences. Autonomous driving software has the ability to self-adjust, and incorrect decisions at a certain moment can be corrected later, a point that current work does not take into account. Finally, current methods lack a closed loop of control feedback, making it impossible to achieve dynamic attacks and truly expose security vulnerabilities in autonomous driving software, a security-related software. Summary of the Invention

[0004] Purpose of the Invention: Addressing the problems and shortcomings of existing technologies, this invention provides a continuous testing method for autonomous driving based on adversarial attacks. This method features adaptability, effectiveness, and efficiency. Adaptability means that the method can adaptively change the test scenario according to changes in the behavior of the test object, deeply revealing security issues. Effectiveness means that the method can successfully and continuously hijack the end-to-end autonomous driving software under test, exposing serious security problems that existing methods cannot reveal. Furthermore, this method considers the weakening effect of physical scene changes on the test environment, making the testing method realistic and robust, representing a physical-level test. Efficiency means that the method is based on gradient completion, allowing for online real-time adaptive testing or offline testing by storing pre-calculated test scenario change schemes on disk, greatly reducing computational time and achieving the goal of real-time testing.

[0005] Technical solution: A method for continuous testing of autonomous driving based on adversarial attacks, comprising the following steps:

[0006] Step 1: Based on the Carla simulator, bind the virtual camera to the texture pattern of the billboard object inside the simulator to build a virtual test scene, and set the billboard as the only dynamically changeable object in the test scene.

[0007] Step 2: Given the end-to-end autonomous driving software as the test object, the test object takes the image as input and outputs the deflection angle to control the virtual car. Set the billboard area in the input image as the test area and set the expected driving trajectory as the test target.

[0008] Step 3: Locate the current position of the test object, and calculate the expected deflection angle of the test object using a pure tracking control algorithm based on the test target;

[0009] Step 4: Locate the test region in the input, add Gaussian perturbation noise to the test region to simulate the influence of environmental factors, and calculate the gradient with respect to the input image (after perturbation) based on the difference between the expected deflection angle and the current deflection angle;

[0010] Step 5: Extract the sub-gradients of the test region from the gradient, and use optimization techniques to iteratively update the input of the test object based on the sub-gradients;

[0011] Step 6: Extract and use affine transformation and interpolation transformation to convert the test area image into billboard size, input it into the virtual camera, and finally output it onto the billboard in the test scene;

[0012] Step 7: Changes in the billboard image in the test scenario lead to changes in the test object's behavior (feedback information). Changes in the test object's behavior lead to changes in its input image (control information). Based on the feedback information and control information, further continuous testing is completed.

[0013] Furthermore, in step 1, binding the third-party virtual camera to the texture pattern of the billboard object inside the simulator means using UE4 Editor to replace the data source path of the surface texture pattern of the billboard object in the virtual test scene with the path of the output file of the virtual camera.

[0014] Furthermore, in step 1, constructing a virtual test scene and setting the billboard as the only dynamically changeable object in the test scene means using UE4 Editor to edit and construct the virtual test scene. Inside the virtual scene, all objects except the billboard and the vehicle are static objects, and the position and texture of static objects are static and unchanging.

[0015] Furthermore, in step 2, end-to-end autonomous driving software refers to a type of autonomous driving software that uses a deep learning model as its backbone from input to output. It autonomously learns the module divisions in the autonomous driving decision-making process through machine learning and deep learning models. Machine learning models include logistic regression, SVM, etc., while the deep learning model backbone network includes various commonly used DNN, CNN, RNN models, etc. The input is the input to the deep model, primarily images, with a matrix data structure; it can be one image or a batch of inputs. The test target is the desired decision value output by the autonomous driving model. For example, for end-to-end autonomous driving software with a CNN backbone network, the output is the car's deflection angle, and the test target might be a 30-degree right deflection.

[0016] Furthermore, in step 2, the desired driving trajectory refers to the trajectory of the vehicle under test after being subjected to an adversarial attack. It consists of a series of coordinate points, and the trajectory shape can be a curve, an S-curve, etc.

[0017] Furthermore, in step 3, locating the current position of the test object and calculating the desired deflection angle of the test object using a pure tracking control algorithm based on the test target means that, in order for the test object to travel according to the test target, the pure tracking control algorithm finds the nearest coordinate point to the test target based on the current position of the test object, models the test object using a two-wheeled bicycle model, and calculates the angle that the test object needs to deflect. The test target refers to the desired trajectory.

[0018] Furthermore, in step 4, locating the test area in the input and adding Gaussian noise to the test area to simulate the influence of environmental factors refers to mapping the billboard's range from three-dimensional space to two-dimensional image plane coordinates using three-dimensional positioning. This involves locating the billboard area in the input image and adding Gaussian noise and physical transformations to that area to simulate data loss and unknown noise disturbances during sensor data acquisition. Moreover, the Gaussian noise process is differentiable, facilitating subsequent gradient calculation.

[0019] Furthermore, in step 4, the gradient with respect to the input image (i.e., the image after adding Gaussian perturbation) is calculated based on the difference between the expected deflection angle and the current deflection angle. Therefore, the end-to-end network model of the autonomous driving software is required to be continuously differentiable, that is, the gradient between the input and output of the end-to-end network model of the autonomous driving software can be calculated. At the same time, the model parameter information of the end-to-end network model (such as weight, bias, etc. in the CNN model) is required to be obtainable. That is, the entire test environment is based on a white-box model, and the testers can obtain all the information of the test object (such as network architecture, model parameters, etc.).

[0020] Furthermore, in step 5, extracting the sub-gradient of the test region in the gradient means that after calculating the full gradient of the input image, all gradients outside the test region are set to 0, and only the gradient of the test region in the image is retained, because only the display content of the test region (billboard) in the entire test scene can be dynamically changed.

[0021] Furthermore, in step 6, extracting and using affine transformation and interpolation to convert the test area image into the billboard size means displaying the test area content in the input image after the iteration update in step 5 onto the billboard in the virtual scene. However, the shape of the test area in the image is an irregular quadrilateral, and the size of the test area is relatively small compared to the original size of the billboard. Therefore, projection transformation and interpolation are used to convert the content of the test area in the input to be consistent with the shape and size of the billboard in the virtual scene.

[0022] Furthermore, in step 7, the continuous testing based on feedback and control information refers to the alteration of the test scenario, combined with the change in vehicle position due to its configuration. These two factors together constitute environmental feedback information, influencing the next decision made by the autonomous driving system. The decision information output by the autonomous driving software, which is the control information, acts on the vehicle under test, achieving a closed loop of control-feedback-control, and continuing to execute the next test step to achieve the test objective.

[0023] Beneficial effects: Compared with existing technologies, the autonomous driving continuous testing technology method based on adversarial attacks provided by this invention can make up for the shortcomings of existing end-to-end autonomous driving model testing methods, which cannot change the continuous behavior of the test object in static test scenarios, thus failing to deeply reveal the security vulnerabilities of the test object. By using a closed-loop approach, the feedback information of the test object is taken into account, thereby continuing iterative testing. Based on the real-time feedback information of the autonomous driving model, the behavior of the test object is analyzed, the effect of the current test is evaluated, and the subsequent test objectives are guided to change, so as to reveal the security problems of the test object and improve its robustness and safety in real-world deployment scenarios. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the execution of the closed-loop testing method according to an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram illustrating the binding process between the virtual camera and the texture pattern of the billboard in the virtual scene according to an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of the adversarial sample generation process that is robust to physical factors according to an embodiment of the present invention. Implementation

[0027] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading the present invention, any modifications of the present invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0028] Figure 1 The overall execution flowchart of the closed-loop testing method of this invention is described, with the entire process being closed-loop. The vehicle's sensor data is transmitted to the end-to-end autonomous driving software and the adversarial example generation module. The former calculates new decisions to control the vehicle, causing a change in the vehicle's position. The latter calculates new adversarial examples based on the vehicle's current state and displays them on a billboard object in the virtual scene. Together, these two alter the vehicle's environment, thereby changing the sensor data acquisition at the next moment. In the above description, the autonomous driving software's decisions constitute the control information, and the dynamic changes in the scene constitute the feedback information. The entire process is closed-loop, realizing a control-feedback-control testing process.

[0029] The following is a detailed implementation description. First, let's describe the method's initialization and construction part:

[0030] Step 1: Figure 2This describes the process of binding a virtual camera to the texture pattern of a billboard. Based on the Carla simulator, the virtual camera is bound to the texture pattern of the billboard object within the simulator to construct a virtual test scene, setting the billboard as the only dynamically changeable object in the test scene. Binding a third-party virtual camera to the texture pattern of the billboard object within the simulator means replacing the data source path of the surface texture pattern of the billboard object in the virtual test scene with the path of the virtual camera's output file using the UE4 Editor. Constructing the virtual test scene and setting the billboard as the only dynamically changeable object in the test scene means editing and building the virtual test scene using the UE4 Editor. Within the virtual scene, all objects except the billboard and the vehicle are static objects, and the position and texture of static objects remain unchanged.

[0031] Step Two: Given an end-to-end autonomous driving software as the test object, the test object takes an image as input and outputs a deflection angle to control the virtual car. The billboard area in the input image is set as the test area, and the desired driving trajectory is set as the test target. The desired driving trajectory refers to the trajectory of the test car after being subjected to an adversarial attack, and it consists of a series of coordinate points.

[0032] The following is the specific implementation process of the test:

[0033] Figure 3 This paper describes the process of generating adversarial examples that are robust to physical factors. Because autonomous driving software operates in environments characterized by mobility, speed, and numerous environmental factors, it is necessary to ensure that the generated adversarial examples can withstand the weakening effects of these physical factors and still maintain their adversarial nature. Therefore, the generation process includes the following steps.

[0034] Step 3: Locate the current position of the test object and, based on the test target, calculate the desired deflection angle of the test object using a pure tracking control algorithm. Locating the current position of the test object and calculating the desired deflection angle based on the test target means that, in order for the test object to travel according to the test target, the pure tracking control algorithm finds the nearest coordinate point on the test target based on the current position of the test object, models the test object using a two-wheeled bicycle model, and calculates the required deflection angle. The test target refers to the desired trajectory.

[0035] Step 4: Locate the test region in the input and add Gaussian noise perturbation to the test region to simulate the influence of environmental factors. Calculate the gradient with respect to the input image (after perturbation) based on the difference between the desired deflection angle and the current deflection angle. Locating the test region in the input and adding Gaussian noise perturbation to simulate the influence of environmental factors involves mapping the billboard's range from 3D space to 2D image plane coordinates using 3D localization. The area of ​​the billboard in the input image is located, and Gaussian noise and physical transformations are added to this area to simulate data loss and unknown noise perturbations during sensor data acquisition. Furthermore, the Gaussian noise process is differentiable, facilitating subsequent gradient calculation. The gradient with respect to the input image (i.e., the image after adding Gaussian perturbation) is calculated based on the difference between the expected deflection angle and the current deflection angle. Therefore, the end-to-end network model of the autonomous driving software is required to be continuously differentiable, that is, the gradient between the input and output of the end-to-end network model of the autonomous driving software can be calculated. At the same time, the model parameter information of the end-to-end network model (such as weights, biases, etc. in CNN models) must be available. That is, the entire test environment is based on a white-box model, and testers can obtain all information about the test object (such as network architecture, model parameters, etc.).

[0036] Step 5: Extract the sub-gradients of the test region from the gradient, and iteratively update the input of the test object based on the sub-gradients using optimization techniques. Extracting the sub-gradients of the test region from the gradient means that after calculating the full gradient of the input image, all gradients outside the test region are set to 0, and only the gradient of the test region in the image is retained, because only the display content of the test region (billboard) in the entire test scene can be dynamically changed.

[0037] Step Six: Extract and use affine transformation and interpolation to convert the test area image to billboard size, input it into the virtual camera, and finally output it onto the billboard in the test scene. Extracting and using affine transformation and interpolation to convert the test area image to billboard size means displaying the test area content from the input image (updated in Step 5) onto the billboard in the virtual scene. However, the test area in the image is an irregular quadrilateral, and its size is relatively small compared to the original billboard size. Therefore, projection transformation and interpolation are used to convert the content of the input test area to match the shape and size of the billboard in the virtual scene.

[0038] Finally, we will proceed with the next stage of testing to achieve the testing objectives:

[0039] Step 7: Changes in the billboard image in the test scenario lead to changes in the behavior of the test subject (feedback information). Changes in the behavior of the test subject lead to changes in its input image (control information). Based on the feedback information and control information, further continuous testing is completed.

[0040] Continuous testing based on feedback and control information refers to the process of changing the test scenario and altering the vehicle's position. These changes, combined with the environmental feedback, influence the next decision made by the autonomous driving system. The decision information output by the autonomous driving software, known as control information, acts on the vehicle under test, creating a closed loop of control-feedback-control, and allowing the system to continue with the next test step to achieve the test objective.

[0041] This invention offers a novel approach to end-to-end autonomous driving software. Based on adversarial attack techniques and utilizing Billboard as a platform, it achieves physical-level closed-loop testing, revealing security issues in end-to-end autonomous driving models at a deeper level and aiding in the analysis and localization of vulnerabilities in the test objects. Continuous testing technology corresponds to continuous driving scenarios, avoiding the randomness and unsustainability of single tests, further exposing security risks in end-to-end autonomous driving software, thereby improving the robustness and security of autonomous driving software based on machine learning and deep learning.

Claims

1. A method for continuous testing of autonomous driving based on adversarial attacks, characterized in that, Includes the following steps: Step 1: Based on the Carla simulator, bind the virtual camera to the texture pattern of the billboard object inside the simulator to build a virtual test scene, and set the billboard as the only dynamically changeable object in the test scene. Step 2: Given the end-to-end autonomous driving software as the test object, the test object takes the image as input and outputs the deflection angle to control the virtual car. Set the billboard area in the input image as the test area and set the expected driving trajectory as the test target. Step 3: Locate the current position of the test object, and calculate the expected deflection angle of the test object using a pure tracking control algorithm based on the test target; Step 4: Locate the test region in the input, add Gaussian perturbation noise to the test region to simulate the influence of environmental factors, and calculate the gradient of the perturbated image based on the difference between the expected deflection angle and the current deflection angle. Step 5: Extract the sub-gradients of the test region from the gradient, and use optimization techniques to iteratively update the input of the test object based on the sub-gradients; Step 6: Extract and use affine transformation and interpolation transformation to convert the test area image into billboard size, input it into the virtual camera, and finally output it onto the billboard in the test scene; Step 7: Changes in the billboard image in the test scenario lead to changes in the test subject's behavior, which in turn leads to changes in its input image. Based on the feedback and control information, continuous testing is further completed. Changes in the billboard image in the test scenario leading to changes in the test subject's behavior constitute feedback information; changes in the test subject's behavior leading to changes in its input image constitute control information. In step 3, locating the current position of the test object and calculating the expected deflection angle of the test object using a pure tracking control algorithm based on the test target means that in order for the test object to travel according to the test target, the pure tracking control algorithm finds the nearest coordinate point in the test target based on the current position of the test object, models the test object using a two-wheeled bicycle model, and calculates the angle that the test object needs to deflect; the test target refers to the expected trajectory. In step 4, locating the test area in the input and adding Gaussian noise to the test area to simulate the influence of environmental factors means mapping the range of the billboard from three-dimensional space to two-dimensional image plane coordinates through three-dimensional positioning, locating the area of ​​the billboard in the input image, and adding Gaussian noise and physical transformation to this area to simulate data loss and unknown noise disturbances during the sensor data acquisition process; furthermore, the Gaussian noise process is differentiable, which facilitates subsequent gradient calculation. In step 6, extracting and using affine transformation and interpolation to convert the test area image into the billboard size means displaying the test area content in the input image after the iteration update in step 5 onto the billboard in the virtual scene. However, the shape of the test area in the image is an irregular quadrilateral, and the size of the test area is relatively small compared to the original size of the billboard. Therefore, projection transformation and interpolation are used to convert the content of the test area in the input to be consistent with the shape and size of the billboard in the virtual scene.

2. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 1, binding the virtual camera to the texture pattern of the billboard object inside the simulator means using UE4Editor to replace the data source path of the surface texture pattern of the billboard object in the virtual test scene with the path of the output file of the virtual camera. Building a virtual test scene and setting the billboard as the only dynamically changeable object in the test scene means using UE4 Editor to edit and build the virtual test scene. Inside the virtual scene, all objects except the billboard and the vehicle are static objects, and the position and texture of static objects are static and unchanging.

3. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 2, end-to-end autonomous driving software refers to a type of autonomous driving software that uses a deep learning model as its backbone from input to output. It learns the module division in the autonomous driving decision-making process through machine learning models and deep learning models. The input is the input of the deep model, and the data structure is a matrix structure. The test target is the decision value expected to be output by the autonomous driving model.

4. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 2, the desired driving trajectory refers to the trajectory of the vehicle under test after being subjected to an adversarial attack. It consists of a series of coordinate points, and the trajectory shape includes curves and S-curves.

5. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 4, the gradient with respect to the input image is calculated based on the difference between the expected deflection angle and the current deflection angle. The input image is the image after adding Gaussian perturbation. Therefore, the end-to-end network model of the autonomous driving software is required to be continuously differentiable. At the same time, the model parameter information of the end-to-end network model must be obtainable.

6. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 5, extracting the sub-gradient of the test region in the gradient means that after calculating the full gradient of the input image, all gradients outside the test region are set to 0, and only the gradient of the test region in the image is retained.

7. The method for continuous testing of autonomous driving based on adversarial attacks according to claim 1, characterized in that, In step 7, further continuous testing based on feedback information and control information means that after changing the test scenario, the change in position caused by the vehicle's form, together with the change in the test scenario, constitutes environmental feedback information, which affects the decision made by the autonomous driving system in the next test. The decision information output by the autonomous driving software is the control information, which acts on the vehicle under test to realize the control-feedback-control closed loop, and continues to execute the next test to achieve the test objective.

Images