论文标题
诱饵和开关：自主驾驶系统的在线培训数据中毒
Bait and Switch: Online Training Data Poisoning of Autonomous Driving Systems
论文作者
论文摘要
我们表明，通过控制预训练的深度神经网络（DNN）的物理环境的一部分，在线进行了微调，对手可以发射微妙的数据中毒攻击，从而降低系统的性能。虽然这次攻击一般可以应用于任何感知任务，但我们考虑了一个基于DNN的交通灯分类器，用于在一个城市接受过培训的自动驾驶汽车，并在另一个城市进行了微调。我们表明，通过注入不会改变交通信号灯本身或地面真相标签的环境扰动，对手可以使深网络在在线学习阶段学习虚假概念。攻击者可以利用环境中引入的虚假概念来导致模型在操作过程中降解的准确性；因此，导致系统故障。
We show that by controlling parts of a physical environment in which a pre-trained deep neural network (DNN) is being fine-tuned online, an adversary can launch subtle data poisoning attacks that degrade the performance of the system. While the attack can be applied in general to any perception task, we consider a DNN based traffic light classifier for an autonomous car that has been trained in one city and is being fine-tuned online in another city. We show that by injecting environmental perturbations that do not modify the traffic lights themselves or ground-truth labels, the adversary can cause the deep network to learn spurious concepts during the online learning phase. The attacker can leverage the introduced spurious concepts in the environment to cause the model's accuracy to degrade during operation; therefore, causing the system to malfunction.
