Vision-Based Perception Failsafe for Adversarial Image Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional motion planning and control systems for autonomous vehicles do not accurately account for differences in vehicle types, leading to potential inaccuracies and inefficiencies, and deep learning-based vision systems are vulnerable to adversarial samples that can misinterpret road signs, posing safety risks.
Innovation Solution
Implementing a failsafe mechanism that applies image transformations such as color depth reduction, image compression, or blurring to detect adversarial samples and triggers user intervention or ignores them if the vehicle is in self-driving mode, using a processor-based system to calculate similarity metrics between original and transformed images to identify potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep learning-based vision systems are used for object detection, then detection accuracy is improved, but vulnerability to adversarial samples increases
Solution Approach 1:
The system performs preliminary actions by generating multiple transformed versions of the input image (e.g., blurred, compressed, color-adjusted) before the main detection process. These transformed images are then processed through the detection model to generate multiple outputs, which are aggregated to produce a final detection result. This preliminary transformation step prepares the data in multiple forms that can help counteract adversarial perturbations before the main detection occurs.
Solution Approach 2:
The system creates multiple copies of the input image through different transformation operations (blurring, compression, color space conversions). Each transformed copy is then processed independently through the detection model. The final detection result is obtained by aggregating the outputs from all these copies, which helps mitigate the impact of adversarial samples that may have been designed to exploit specific characteristics of a single image version.
2Reliability
If image transformations are applied to detect adversarial samples, then safety is improved, but processing time increases
Solution Approach 1:
The system applies a limited set of common image transformations (blurring, compression, color adjustments) rather than exhaustively trying all possible transformations. This partial action approach generates enough varied copies to detect adversarial samples while keeping the computational overhead manageable. The transformations selected are those most likely to reveal adversarial manipulations without requiring excessive processing time.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In one embodiment, a system receives a first image captured by a capturing device of an ADV. The system applies an image transformation to the first image to generate a second image. The system applies an object detection model to the first and the second images to generate a first and a second output, respectively. The system calculates a similarity metric between the first and the second output. The system detects the first image as an adversarial sample if a temporal variation of the similarity metric between the first image and a prior image is above a threshold.