Pith. sign in

REVIEW 4 major objections 5 minor 111 references

A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper presents the first taxonomy of system-level attacks against autonomous vehicles, classifying 21 studies into 12 categories that trace how a model-level misprediction escalates into a vehicle-level failure.

desk verdict A carefully built taxonomy of system-level AV attacks, but the 'first taxonomy' claim is load-bearing and needs to be checked against Shen et al.'s SoK before publication. read the letter →

arxiv 2412.04510 v2 pith:4WHSCLFD submitted 2024-12-04 cs.CR cs.SE

Masoud Jamshidiyan Tehrani , Jinhan Kim , Rosmael Zidane Lekeufack Foulefack , Alessandro Marchetto , Paolo Tonella This is my paper · ORCID
classification cs.CRcs.SE
keywords taxonomyautonomousvehiclesdeeplearningsecurityadversarialattackssystem-levelfailurestestingthreatmodelspropagationchains
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to organize the growing literature on attacks that do not stop at fooling a deep learning model but manipulate the environment so that the resulting misprediction propagates into a system-level failure such as a collision, an off-road departure, or emergency braking. It proposes a taxonomy of such system-level attacks on autonomous vehicles, built bottom-up from 21 selected papers and organized into 12 top-level categories with subcategories. Tagging each paper against the taxonomy yields a map of attack features, attacked components, threat models, and the chains from input perturbation to system failure, and it exposes gaps in current research. A careful reader would care because the taxonomy turns scattered attack studies into a structured picture of where autonomous vehicles are most exposed and which defenses and testing efforts are missing.

What carries the argument

The central instrument is the 12-category taxonomy itself, rendered as a tree that links each category and subcategory to the 21 analyzed papers. Two load-bearing definitions carry the argument: a model-level attack exploits vulnerabilities of a deep learning model in isolation, while a system-level attack manipulates the environment where the autonomous vehicle operates in order to cause a system-level failure, defined as a deviation of the vehicle's behavior from its functional or safety requirements. The system-level categories (System Under Attack, Attack Scenario, Attacked Target, Attacker's Capability, System's Failure Specificity, System-level Results) are what distinguish this taxonomy from earlier model-level surveys, because they capture the propagation from input perturbation to model misprediction to observable vehicle misbehavior. The mapping table, produced by at least two assessors per paper with weekly consensus meetings to resolve disagreements, is the evidence base for the paper's distributional claims.

What would settle it

A replication that broadens the selection—dropping the venue whitelist, extending the date range, using additional synonyms, or including studies that report only model-level mispredictions—could reveal new attack categories or substantially shift the paper distribution, showing that the 12-category structure was an artifact of the search. Concretely, locating even a few system-level attacks on localization or control modules, or on maritime or space vehicles, would contradict the paper's statement that those areas are uncovered.

Watch

Extended reading notes

Core claim

The paper claims that existing attacks on the deep learning components of autonomous vehicles that produce system-level failures can be classified by a taxonomy with 12 top-level categories, mixing conventional model-level dimensions (application domain, DL model under attack, attack type, attacker knowledge, attack/error specificity, model-level result) with system-level dimensions (system under attack, attack scenario, attacked target, attacker capability, failure specificity, system-level result). The defining move is to treat the attack as an environmental manipulation that must propagate through the vehicle: one or more model-level mispredictions are triggered, and the attack succeeds only when the vehicle's behavior deviates from its functional or safety requirements. Applied to 21 papers, the taxonomy yields findings such as the dominance of attacks on perception modules and image-processing models, the prevalence of simulation-based studies, the common assumption of white-box model knowledge paired with black-box system knowledge, and a split between targeted attack chains aimed at a specific failure and untargeted chains where the failure is observed rather than controlled. The paper also identifies gaps in the literature, most notably the absence of system-level attacks on localization and control modules and on vehicles in maritime, underwater, and space domains.

Load-bearing premise

The taxonomy's categories and reported gaps stand or fall on whether the 21 papers obtained through the specific query, venue filter, and manual screening are representative of all research on system-level attacks on autonomous-vehicle deep learning models.

Editorial extensions

If this is right

  • Defenders should concentrate on the perception module, especially object detection and tracking, because most surveyed attacks target it and a compromise there can propagate into downstream decisions.
  • Multi-sensor fusion is not a sufficient shield: the taxonomy shows that fusion-based systems are attacked nearly as often as single-sensor systems, though usually under white-box model knowledge.
  • Since most surveyed attacks require only black-box knowledge of the vehicle system, keeping system internals secret is unlikely to be an adequate defense by itself.
  • Security testing should cover both targeted attacks (a specific failure such as a wrong steering decision) and untargeted attacks (any misprediction that happens to produce harm), because the two chains call for different defenses.
  • The taxonomy's uncovered regions identify concrete research opportunities: attacks on planning, localization, and control modules, attacks on non-car and non-drone vehicles, and studies of whether simulator-based attacks transfer to real vehicles.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: if the taxonomy is representative, the field's concentration on camera-based perception suggests that defense research could profitably shift toward sensor-fusion and LiDAR/camera cross-checks, since attackers may be pushed toward more complex targets once camera defenses improve.
  • Extension: the exclusion of papers that report model-level mispredictions without system-level outcomes implies that the rate at which model-level attacks fail to propagate is currently unknown; measuring this filter rate would directly test the propagation assumption that motivates system-level taxonomies.
  • Extension: the paper's use of a large language model to enumerate the broader vehicle domain could be turned into a prioritization tool, comparing newly published attacks against the taxonomy to see which uncovered domains, such as maritime or space vehicles with slow control loops, deserve security testing first.
  • Extension: applying the same 12 categories to attacks published after 2024 would provide a direct test of whether the observed imbalances (perception-heavy, simulation-heavy, evasion-heavy) are stable features of the field or artifacts of the early literature.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents a taxonomy of system-level attacks on deep learning models in autonomous vehicles. The authors define system-level attacks as attacks that manipulate the environment of an autonomous vehicle (or otherwise cause model mispredictions) and lead to a system-level failure. They select 21 relevant papers through a systematic process involving a query, venue filtering, snowballing, and multi-assessor coding, and they organize the resulting literature into 12 top-level taxonomy categories. They then analyze the distribution of papers across these categories, answer four research questions about attack features, attacked components, threat models, and consequences, and discuss implications and research gaps.

Significance. If the taxonomy's claims are substantiated, this would be a useful organizing framework for an emerging and safety-critical research area. The paper's strengths include a transparent and detailed methodology: the query is reported, the filtering and snowballing steps are described, each paper is coded by at least two assessors with consensus meetings, and threats to validity are explicitly acknowledged. The paper also makes its replication package available, which is a positive feature. However, the central claim of being the 'first taxonomy' is not adequately supported given the existence of Shen et al.'s SoK, and the taxonomy itself contains an internal inconsistency in its category structure. These issues need to be resolved before the paper's contribution can be fully assessed.

major comments (4)
  1. [Section 1, Section 8] The claim that 'no research has comprehensively taxonomized the attacks on AVs' DL models that cause system-level failures' (Section 1) and the corresponding 'first taxonomy' claim are not supported with evidence. Section 8 dismisses Shen et al. [30] by asserting that their SoK focuses only on semantic AI security and 'quite limited extent' covers system-level attacks, but no quantitative comparison is provided. The paper should report the overlap between the 21 analyzed papers and Shen et al.'s 53-paper corpus, map the taxonomy dimensions between the two works, and explicitly state which dimensions in the proposed taxonomy are missing from Shen et al. Without this, the novelty claim remains unverified.
  2. [Section 6.3, Figure 2] The text states that the taxonomy has 12 top-level categories, but the taxonomy tree in Figure 2 includes a 'Module Under Attack' branch with subcategories (Perception, Planning, End-to-end) that is not listed among the 12 categories described in Section 6.3. This is an inconsistency in the central artifact of the paper. Either the category list should include this category, or the tree should be revised to place 'Module Under Attack' within an existing category, and the count of top-level categories must be reconciled.
  3. [Section 2.2, Section 5.3] The definition of a system-level attack as 'an attack that manipulates the environment where the AV operates' (Section 2.2) is inconsistent with the inclusion of several papers that operate through software interference or malware to directly modify the input image or sensor data (e.g., [1], [4], [16]). These attacks do not manipulate the physical environment. The paper should either broaden the definition to encompass any attack that causes model-level mispredictions propagating to system-level failures, or explain how these papers satisfy the stated definition.
  4. [Section 5.1, Section 9.1] The venue filtering step (Section 5.1) selects the top 50 most frequent venues and then removes venues without security-related keywords, with a whitelist of additional venues. The paper acknowledges this as a threat to validity (Section 9.1) but does not assess how many relevant papers may have been missed by this selection. Since the taxonomy's completeness is a core part of the claimed contribution, the paper should provide a sensitivity analysis or at least a clearer justification for the whitelist composition and the security-keyword criterion.
minor comments (5)
  1. [Table 4] There is a typo in the 'Attacked Target' column for paper [1]: 'Purturbing' should be 'Perturbing'.
  2. [Table 2, Table 4, Figure 2] The naming of category (7) is inconsistent: Table 2 and Section 6.3 call it 'Attack Type', while Table 4 uses the header 'Attack Strategy'. Please use a single consistent term throughout.
  3. [Figure 2] The taxonomy tree is dense and the labels for some branches, such as 'System-level Results' and 'System's Failure Specificity', are visually similar and easy to confuse. Consider a cleaner layout or separating the tree into two figures for readability.
  4. [Section 4] The use of GPT-4-turbo to produce the domain overview is acceptable, but the claim that manual verification 'revealed no instances of hallucinations, misleading, or incomplete information' is a strong statement that deserves a brief description of how the verification was performed.
  5. [Section 6.1] The paper summaries are useful, but the bookkeeping of which physical objects are attacked (e.g., billboards, road patches, traffic cones) is repeated with much overlap. A short tabular comparison could reduce redundancy.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the taxonomy is a transparent, descriptive annotation of a defined corpus, with no fitted parameter or self-citation chain forcing its conclusions.

full rationale

The paper's central product is a taxonomy, i.e., a descriptive organization of 21 selected papers into 12 categories. The construction is explicitly bottom-up (Section 5.3 says category creation was 'bootstrapped with the categories already available from the literature' and then widened during analysis), and the paper-level mapping in Appendix A is an annotation of the corpus rather than a quantitative prediction. No parameter is fitted to a subset of data and later renamed as a prediction; the descriptive statistics in Section 7 are counts over the annotated corpus. The inclusion criteria are transparent: papers not reporting system-level failures are discarded (Section 5.3), so the observation that the corpus contains system-level failures is a stated scope condition rather than a hidden circular inference. The only self-citation by an author (Tonella et al., [22]) appears in the reference list without a load-bearing role in the taxonomy's derivation. The claim to be the 'first' taxonomy is a priority comparison with Shen et al. [30]; the paper's dismissal of Shen et al. in Section 8 is unquantified and may be a validity or priority risk, but that is not circularity because the claim does not reduce to this paper's own definitions, fitted values, or self-citations. The threats-to-validity discussion in Section 9 acknowledges selection subjectivity, further supporting that the taxonomy is an openly constructed artifact rather than a derivation that assumes its conclusion.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no free parameters or invented physical entities. Its load-bearing assumptions are methodological scoping decisions about what counts as a system-level attack, which papers to include, and whether the resulting categories are stable. These assumptions are disclosed and partially mitigated through consensus coding and a replication package.

assumptions (4)
  • domain assumption The definition of a system-level attack as an attack that manipulates the environment to cause a system-level failure, potentially via one or more model-level attacks, is the correct scoping for the taxonomy.
    Section 2.2 defines system-level attacks and failures; this definition excludes sensor-only attacks and model-level-only studies, shaping the entire taxonomy.
  • domain assumption The initial query and venue frequency filtering identify a representative sample of the literature on system-level DL attacks on AVs.
    Section 5.1 describes the query and venue filter; if the sample is biased, the resulting taxonomy categories and gap analysis are incomplete.
  • domain assumption Papers that do not report system-level failures, or that attack sensors without involving a DL component, are out of scope for this taxonomy.
    Section 5.3 describes the exclusion criteria; these exclusions are value judgments that determine which papers appear in the taxonomy.
  • domain assumption The 12 top-level taxonomy categories and their subcategories, refined through consensus meetings, form a stable and reproducible classification scheme.
    Section 5.3 and Section 6.3 describe the bottom-up category creation and consensus process; the taxonomy's validity depends on the stability of the manual coding.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles." pith.science (2026). https://pith.science/paper/4WHSCLFD

@misc{pith2026241204510,
  author       = {Pith},
  title        = {Pith review of: A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4WHSCLFD}},
  note         = {Machine review of arXiv:2412.04510}
}
read the original abstract

The advent of deep learning and its astonishing performance has enabled its usage in complex systems, including autonomous vehicles. On the other hand, deep learning models are susceptible to mispredictions when small, adversarial changes are introduced into their input. Such mis-predictions can be triggered in the real world and can result in a failure of the entire system. In recent years, a growing number of research works have investigated ways to mount attacks against autonomous vehicles that exploit deep learning components. Such attacks are directed toward elements of the environment where these systems operate and their effectiveness is assessed in terms of system-level failures triggered by them. There has been however no systematic attempt to analyze and categorize such attacks. In this paper, we present the first taxonomy of system-level attacks against autonomous vehicles. We constructed our taxonomy by selecting 21 highly relevant papers, then we tagged them with 12 top-level taxonomy categories and several sub-categories. The taxonomy allowed us to investigate the attack features, the most attacked components and systems, the underlying threat models, and the failure chains from input perturbation to system-level failure. We distilled several lessons for practitioners and identified possible directions for future work for researchers.

Figures

Figures reproduced from arXiv: 2412.04510 by the authors.

Figure 1
Figure 1. Overview of the paper collection process [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Taxonomy Tree , Vol. 1, No. 1, Article . Publication date: September 2025 [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Paper distribution in the taxonomy tree , Vol. 1, No. 1, Article . Publication date: September 2025 [PITH_FULL_IMAGE:figures/full_fig_p018_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

111 extracted references · 64 canonical work pages

  1. [30]

    Sok: On the semantic ai security in autonomous driving,

    J. Shen, N. Wang, Z. Wan, Y. Luo, T. Sato, Z. Hu, X. Zhang, S. Guo, Z. Zhong, K. Li, Z. Zhao, C. Qiao, and Q. A. Chen, “Sok: On the semantic ai security in autonomous driving, ” 2024. [Online]. Available: https://arxiv.org/abs/2203.05314

    arXiv 2024

  2. [1]

    Slowtrack: Increasing the latency of camera-based perception in autonomous driving using adversarial examples,

    C. Ma, N. Wang, Q. A. Chen, and C. Shen, “Slowtrack: Increasing the latency of camera-based perception in autonomous driving using adversarial examples, ” inProceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 5, 2024, pp. 4062–4070

    2024

  3. [4]

    Learning when to use adaptive adversarial image perturbations against autonomous vehicles,

    H.-J. Yoon, H. Jafarnejadsani, and P. Voulgaris, “Learning when to use adaptive adversarial image perturbations against autonomous vehicles, ”IEEE Robotics and Automation Letters , vol. 8, no. 7, pp. 4179–4186, 2023

    2023

  4. [16]

    Ml-driven malware that targets av safety,

    S. Jha, S. Cui, S. Banerjee, J. Cyriac, T. Tsai, Z. Kalbarczyk, and R. K. Iyer, “Ml-driven malware that targets av safety, ” in 2020 50th annual IEEE/IFIP international conference on dependable systems and networks (DSN) . IEEE, 2020, pp. 113–124

    2020

  5. [2]

    Rpau: Fooling the eyes of uavs via physical adversarial patches,

    T. Liu, C. Yang, X. Liu, R. Han, and J. Ma, “Rpau: Fooling the eyes of uavs via physical adversarial patches, ” IEEE Transactions on Intelligent Transportation Systems , vol. 25, no. 3, pp. 2586–2598, 2024

    2024

  6. [3]

    Adversarial attacks on adaptive cruise control systems,

    Y. Guo, T. Sato, Y. Cao, Q. A. Chen, and Y. Cheng, “Adversarial attacks on adaptive cruise control systems, ” in Proceedings of Cyber-Physical Systems and Internet of Things Week 2023 . New York, NY, USA: Association for Computing Machinery, 2023, p. 49–54. [Online]. Available: https://doi.org/10.1145/3576914.3587493

    arXiv 2023

  7. [5]

    Deepmaneuver: Adversarial test generation for trajectory manipulation of autonomous vehicles,

    M. von Stein, D. Shriver, and S. Elbaum, “Deepmaneuver: Adversarial test generation for trajectory manipulation of autonomous vehicles, ”IEEE Transactions on Software Engineering , 2023

    2023

  8. [6]

    Kidnapping deep learning-based multirotors using optimized flying adversarial patches,

    P. Hanfeld, K. Wahba, M. M.-C. Höhne, M. Bussmann, and W. Hönig, “Kidnapping deep learning-based multirotors using optimized flying adversarial patches, ” in2023 International Symposium on Multi-Robot and Multi-Agent Systems (MRS). IEEE, 2023, pp. 78–84

    2023

Show all 111 references
  1. [7]

    Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack,

    N. Wang, Y. Luo, T. Sato, K. Xu, and Q. A. Chen, “Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack, ” inProceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 4412–4423

    2023

  2. [8]

    On data fabrication in collaborative vehicular perception: Attacks and countermeasures,

    Q. Zhang, S. Jin, J. Sun, X. Zhang, R. Zhu, Q. A. Chen, and Z. M. Mao, “On data fabrication in collaborative vehicular perception: Attacks and countermeasures, ”arXiv preprint arXiv:2309.12955, 2023

    2023 arXiv

  3. [9]

    Rolling colors: Adversarial laser exploits against traffic light recognition,

    C. Yan, Z. Xu, Z. Yin, S. Mangard, X. Ji, W. Xu, K. Zhao, Y. Zhou, T. Wang, G. Guet al., “Rolling colors: Adversarial laser exploits against traffic light recognition, ” in31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 1957–1974

    2022

  4. [10]

    Stop-and-go: Exploring backdoor attacks on deep rein- forcement learning-based traffic congestion control systems,

    Y. Wang, E. Sarkar, W. Li, M. Maniatakos, and S. E. Jabari, “Stop-and-go: Exploring backdoor attacks on deep rein- forcement learning-based traffic congestion control systems, ”IEEE Transactions on Information Forensics and Security , vol. 16, pp. 4772–4787, 2021

    2021

  5. [11]

    Attack and fault injection in self-driving agents on the carla simulator– experience report,

    N. Piazzesi, M. Hong, and A. Ceccarelli, “Attack and fault injection in self-driving agents on the carla simulator– experience report, ” inComputer Safety, Reliability, and Security: 40th International Conference, SAFECOMP 2021, York, UK, September 8–10, 2021, Proceedings 40 ....

    2021

  6. [12]

    Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World} attack,

    T. Sato, J. Shen, N. Wang, Y. Jia, X. Lin, and Q. A. Chen, “Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World} attack, ” in30th USENIX security symposium (USENIX Security 21) , 2021, pp. 3309–3326

    2021

  7. [13]

    Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks,

    Y. Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li, “Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks, ” in2021 IEEE symposium on security and privacy (SP) ....

    2021

  8. [14]

    Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,

    P. Jing, Q. Tang, Y. Du, L. Xue, X. Luo, T. Wang, S. Nie, and S. Wu, “Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations, ” in30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 3237–3254

    2021

  9. [15]

    Robust roadside physical adversarial attack against deep learning in lidar perception modules,

    K. Yang, T. Tsai, H. Yu, M. Panoff, T.-Y. Ho, and Y. Jin, “Robust roadside physical adversarial attack against deep learning in lidar perception modules, ” inProceedings of the 2021 ACM Asia Conference on Computer and Communications Security , 2021, pp. 349–362

    2021

  10. [17]

    Attacking vision-based perception in end-to-end autonomous driving models,

    A. Boloor, K. Garimella, X. He, C. Gill, Y. Vorobeychik, and X. Zhang, “Attacking vision-based perception in end-to-end autonomous driving models, ”Journal of Systems Architecture, vol. 110, p. 101766, 2020

    2020

  11. [18]

    Feasibility and suppression of adversarial patch attacks on end-to-end vehicle control,

    S. Pavlitskaya, S. Ünver, and J. M. Zöllner, “Feasibility and suppression of adversarial patch attacks on end-to-end vehicle control, ” in2020 IEEE 23rd International Conference on Intelligent Transportation Systems (ITSC) . IEEE, 2020, pp. 1–8

    2020

  12. [19]

    Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks,

    B. Nassi, Y. Mirsky, D. Nassi, R. Ben-Netanel, O. Drokin, and Y. Elovici, “Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks, ” inProceedings of the 2020 ACM SIGSAC conference on computer and communications security , 2020, pp. 293–308

    2020

  13. [20]

    Adversarial sensor attack on lidar-based perception in autonomous driving,

    Y. Cao, C. Xiao, B. Cyr, Y. Zhou, W. Park, S. Rampazzi, Q. A. Chen, K. Fu, and Z. M. Mao, “Adversarial sensor attack on lidar-based perception in autonomous driving, ” inProceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 2267–2281

    2019

  14. [21]

    Trojaning attack on neural networks,

    Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks, ” 2017. , Vol. 1, No. 1, Article . Publication date: September 2025. 26 Tehrani et al

    2017

  15. [22]

    Mind the gap! a study on the transferability of virtual versus physical-world testing of autonomous driving systems,

    A. Stocco, B. Pulfer, and P. Tonella, “Mind the gap! a study on the transferability of virtual versus physical-world testing of autonomous driving systems, ”IEEE Transactions on Software Engineering , vol. 49, no. 4, pp. 1928–1940, 2022

    1928

  16. [23]

    Guidelines for performing systematic literature reviews in software engineering,

    B. Kitchenham and S. Charters, “Guidelines for performing systematic literature reviews in software engineering, ” 2007

    2007

  17. [24]

    Taxonomy and definitions for terms related to driving automation systems for on-road motor vehicles,

    “Taxonomy and definitions for terms related to driving automation systems for on-road motor vehicles, ” SAE Interna- tional, Tech. Rep. J3016_202104, April 2021

    2021

  18. [25]

    Findpapers: A tool for helping researchers who are looking for related works,

    J. Grosman, “Findpapers: A tool for helping researchers who are looking for related works, ” https://github.com/ jonatasgrosman/findpapers, 2020

    2020

  19. [26]

    Wild patterns: Ten years after the rise of adversarial machine learning,

    B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning, ” inProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , 2018, pp. 2154–2156

    2018

  20. [27]

    Wild patterns reloaded: A survey of machine learning security against training data poisoning,

    A. E. Cinà, K. Grosse, A. Demontis, S. Vascon, W. Zellinger, B. A. Moser, A. Oprea, B. Biggio, M. Pelillo, and F. Roli, “Wild patterns reloaded: A survey of machine learning security against training data poisoning, ”ACM Computing Surveys, vol. 55, no. 13s, pp. 1–39, 2023

    2023

  21. [28]

    Guidelines for snowballing in systematic literature studies and a replication in software engineering,

    C. Wohlin, “Guidelines for snowballing in systematic literature studies and a replication in software engineering, ” in Proceedings of the 18th international conference on evaluation and assessment in software engineering , 2014, pp. 1–10

    2014

  22. [29]

    Deepbillboard: Systematic physical-world testing of autonomous driving systems,

    H. Zhou, W. Li, Z. Kong, J. Guo, Y. Zhang, B. Yu, L. Zhang, and C. Liu, “Deepbillboard: Systematic physical-world testing of autonomous driving systems, ” inProceedings of the ACM/IEEE 42nd International Conference on Software Engineering, 2020, pp. 347–358

    2020

  23. [31]

    A survey of deep learning applications to autonomous vehicle control,

    S. Kuutti, R. Bowden, Y. Jin, P. Barber, and S. Fallah, “A survey of deep learning applications to autonomous vehicle control, ”IEEE Transactions on Intelligent Transportation Systems , vol. 22, no. 2, pp. 712–733, 2020

    2020

  24. [32]

    Understanding autonomous vehicles,

    A. Faisal, M. Kamruzzaman, T. Yigitcanlar, and G. Currie, “Understanding autonomous vehicles, ”Journal of transport and land use, vol. 12, no. 1, pp. 45–72, 2019

    2019

  25. [33]

    CARLA: An open urban driving simulator,

    A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V. Koltun, “CARLA: An open urban driving simulator, ” inProceedings of the 1st Annual Conference on Robot Learning , 2017, pp. 1–16

    2017

  26. [34]

    Apollo: Open source autonomous driving

    B. A. team, “Apollo: Open source autonomous driving. ” [Online]. Available: https://github.com/ApolloAuto/apollo

  27. [35]

    Lgsvl simulator: A high fidelity simulator for autonomous driving,

    G. Rong, B. H. Shin, H. Tabatabaee, Q. Lu, S. Lemke, M. Možeiko, E. Boise, G. Uhm, M. Gerow, S. Mehtaet al., “Lgsvl simulator: A high fidelity simulator for autonomous driving, ”arXiv preprint arXiv:2005.03778, 2020

    2005 arXiv

  28. [36]

    BeamNG.tech

    BeamNG GmbH, “BeamNG.tech. ” [Online]. Available: https://www.beamng.tech/

  29. [37]

    A self-driving car simulator built with unity

    Udacity, “A self-driving car simulator built with unity. ” [Online]. Available: https://github.com/udacity/self-driving- car-sim

  30. [38]

    Physical hijacking attacks against object trackers,

    R. Muller, Y. Man, Z. B. Celik, M. Li, and R. Gerdes, “Physical hijacking attacks against object trackers, ” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2309–2322

    2022

  31. [39]

    Ad 2 attack: Adaptive adversarial attack on real-time uav tracking,

    C. Fu, S. Li, X. Yuan, J. Ye, Z. Cao, and F. Ding, “Ad 2 attack: Adaptive adversarial attack on real-time uav tracking, ” in 2022 International Conference on Robotics and Automation (ICRA) . IEEE, 2022, pp. 5893–5899

    2022

  32. [40]

    You can’t see me: Physical removal attacks on{lidar-based} autonomous vehicles driving frameworks,

    Y. Cao, S. H. Bhupathiraju, P. Naghavi, T. Sugawara, Z. M. Mao, and S. Rampazzi, “You can’t see me: Physical removal attacks on{lidar-based} autonomous vehicles driving frameworks, ” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 2993–3010

    2023

  33. [41]

    Unmanned ground vehicle,

    Wikipedia contributors, “Unmanned ground vehicle, ” https://en.wikipedia.org/wiki/Unmanned_ground_vehicle, 2025, accessed: 2025-07-11

    2025

  34. [42]

    Self-driving car,

    ——, “Self-driving car, ” https://en.wikipedia.org/wiki/Self-driving_car, 2025, accessed: 2025-07-11

    2025

  35. [43]

    Unmanned aerial vehicle,

    ——, “Unmanned aerial vehicle, ” https://en.wikipedia.org/wiki/Unmanned_aerial_vehicle, 2025, accessed: 2025-07-11

    2025

  36. [44]

    Unmanned surface vehicle,

    ——, “Unmanned surface vehicle, ” https://en.wikipedia.org/wiki/Unmanned_surface_vehicle, 2025, accessed: 2025-07-11

    2025

  37. [45]

    Autonomous underwater vehicle,

    ——, “Autonomous underwater vehicle, ” https://en.wikipedia.org/wiki/Autonomous_underwater_vehicle, 2025, ac- cessed: 2025-07-11

    2025

  38. [46]

    Vehicular automation,

    ——, “Vehicular automation, ” https://en.wikipedia.org/wiki/Vehicular_automation, 2025, accessed: 2025-07-11

    2025

  39. [47]

    Voxelnet: End-to-end learning for point cloud based 3d object detection,

    Y. Zhou and O. Tuzel, “Voxelnet: End-to-end learning for point cloud based 3d object detection, ” inProceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 4490–4499

    2018

  40. [48]

    Pointrcnn: 3d object proposal generation and detection from point cloud,

    S. Shi, X. Wang, and H. Li, “Pointrcnn: 3d object proposal generation and detection from point cloud, ” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 770–779

    2019

  41. [49]

    Mask r-cnn,

    K. He, G. Gkioxari, P. Dollár, and R. Girshick, “Mask r-cnn, ” in Proceedings of the IEEE international conference on computer vision, 2017, pp. 2961–2969

    2017

  42. [50]

    You only look once: Unified, real-time object detection,

    J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, “You only look once: Unified, real-time object detection, ” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 779–788

    2016

  43. [51]

    Simultaneous localization, mapping and moving object tracking,

    C.-C. Wang, C. Thorpe, S. Thrun, M. Hebert, and H. Durrant-Whyte, “Simultaneous localization, mapping and moving object tracking, ”The International Journal of Robotics Research , vol. 26, no. 9, pp. 889–916, 2007. , Vol. 1, No. 1, Article . Publication date: September 2025. A...

    2007

  44. [52]

    Airsim: High-fidelity visual and physical simulation for autonomous vehicles,

    S. Shah, D. Dey, C. Lovett, and A. Kapoor, “Airsim: High-fidelity visual and physical simulation for autonomous vehicles, ” inField and service robotics: Results of the 11th international conference . Springer, 2017, pp. 621–635

    2017

  45. [53]

    http://www.cyberbotics.com,

    Webots, “http://www.cyberbotics.com, ” open-source Mobile Robot Simulation Software. [Online]. Available: http://www.cyberbotics.com

  46. [54]

    Coppeliasim (formerly v-rep): a versatile and scalable robot simulation framework,

    E. Rohmer, S. P. N. Singh, and M. Freese, “Coppeliasim (formerly v-rep): a versatile and scalable robot simulation framework, ” inProc. of The International Conference on Intelligent Robots and Systems (IROS) , 2013

    2013

  47. [55]

    Design and use paradigms for gazebo, an open-source multi-robot simulator,

    N. Koenig and A. Howard, “Design and use paradigms for gazebo, an open-source multi-robot simulator, ” in 2004 IEEE/RSJ international conference on intelligent robots and systems (IROS)(IEEE Cat. No. 04CH37566) , vol. 3. Ieee, 2004, pp. 2149–2154

    2004

  48. [56]

    The flightgear flight simulator,

    A. R. Perry, “The flightgear flight simulator, ” inProceedings of the USENIX annual technical conference , vol. 686, 2004, pp. 1–12

    2004

  49. [57]

    The trick simulation toolkit: a nasa/opensource framework for running time based physics models,

    J. Penn and A. Lin, “The trick simulation toolkit: a nasa/opensource framework for running time based physics models, ” in AIAA modeling and simulation technologies conference , 2016, p. 1187

    2016

  50. [58]

    Vulnerability of clean-label poisoning attack for object detection in maritime autonomous surface ships,

    C. Lee and S. Lee, “Vulnerability of clean-label poisoning attack for object detection in maritime autonomous surface ships, ”Journal of Marine Science and Engineering , vol. 11, no. 6, p. 1179, 2023

    2023

  51. [59]

    Evaluating the Vulnerability of YOLOv5 to Adversarial Attacks for Enhanced Cybersecurity in MASS,

    C. Lee and S. Lee, “Evaluating the Vulnerability of YOLOv5 to Adversarial Attacks for Enhanced Cybersecurity in MASS, ”Journal of Marine Science and Engineering , vol. 11, 2023

    2023

  52. [60]

    Spotattack: Covering spots on surface to attack lidar-based autonomous driving systems,

    Q. Huang, C. Gu, Y. Wang, and D. Hu, “Spotattack: Covering spots on surface to attack lidar-based autonomous driving systems, ”IEEE Internet of Things Journal , vol. 11, no. 24, pp. 40 634–40 644, 2024

    2024

  53. [61]

    Chatgpt (gpt-4),

    OpenAI, “Chatgpt (gpt-4), ” https://chat.openai.com/, 2023, accessed: 2025-06-25

    2023

  54. [62]

    Testing of autonomous driving systems: where are we and where should we go?

    G. Lou, Y. Deng, X. Zheng, M. Zhang, and T. Zhang, “Testing of autonomous driving systems: where are we and where should we go?” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering , 2022, pp. 31–43

    2022

  55. [63]

    Testing vision-based control systems using learnable evolu- tionary algorithms,

    R. B. Abdessalem, S. Nejati, L. C. Briand, and T. Stifter, “Testing vision-based control systems using learnable evolu- tionary algorithms, ” inProceedings of the 40th International Conference on Software Engineering , 2018, pp. 1016–1026

    2018

  56. [64]

    Vectornet: Encoding hd maps and agent dynamics from vectorized representation,

    J. Gao, C. Sun, H. Zhao, Y. Shen, D. Anguelov, C. Li, and C. Schmid, “Vectornet: Encoding hd maps and agent dynamics from vectorized representation, ” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 11 525–11 533

    2020

  57. [65]

    The missing link: Developing a safety case for perception components in automated driving,

    R. Salay, K. Czarnecki, H. Kuwajima, H. Yasuoka, T. Nakae, V. Abdelzad, C. Huang, M. Kahn, and V. D. Nguyen, “The missing link: Developing a safety case for perception components in automated driving, ”arXiv preprint arXiv:2108.13294, 2021

    2021 arXiv

  58. [66]

    A causal model of safety assurance for machine learning,

    S. Burton, “A causal model of safety assurance for machine learning, ”arXiv preprint arXiv:2201.05451, 2022

    2022 arXiv

  59. [67]

    Towards fully autonomous driving: Systems and algorithms,

    J. Levinson, J. Askeland, J. Becker, J. Dolson, D. Held, S. Kammel, J. Z. Kolter, D. Langer, O. Pink, V. Prattet al., “Towards fully autonomous driving: Systems and algorithms, ” in2011 IEEE intelligent vehicles symposium (IV) . IEEE, 2011, pp. 163–168

    2011

  60. [68]

    A survey on multisensor fusion and consensus filtering for sensor networks,

    W. Li, Z. Wang, G. Wei, L. Ma, J. Hu, and D. Ding, “A survey on multisensor fusion and consensus filtering for sensor networks, ”Discrete Dynamics in Nature and Society , vol. 2015, no. 1, p. 683701, 2015

    2015

  61. [69]

    Project autovision: Localization and 3d scene perception for an autonomous vehicle with a multi-camera system,

    L. Heng, B. Choi, Z. Cui, M. Geppert, S. Hu, B. Kuan, P. Liu, R. Nguyen, Y. C. Yeo, A. Geiger et al., “Project autovision: Localization and 3d scene perception for an autonomous vehicle with a multi-camera system, ” in2019 International Conference on Robotics and Automation (I...

    2019

  62. [70]

    Cars SORT(Y5), FairMOT, ByteTrack, BoT-SORT (Perception) Baidu Apollo in LGSVL simulator (MSF) AVs changing lanes when another car is in the adjacent lane or approaching an intersection with a stop sign where another car is present

  63. [71]

    Drones A variation of DroNet (E2E) Parrot Bebop 2 Drone and Matlab simulation (SSF) Drones moving to its destination

  64. [72]

    Cars OpenPilot’s Adaptive Cruise Control ACC system (Perception) CARLA and Baidu Apollo (MSF) AV driving behind the attacker’s vehicle

  65. [73]

    Cars, Drones YOLO v5 (Perception) Vision-based guidance system in CARLA or AirSim (SSF) AVs following their target

  66. [74]

    Cars Dave2 (E2E) An AV vehicle (hopper vehicle) in BeamNG (SSF) AVs driving past a roadside billboard

  67. [75]

    (SSF) Autonomous drones following a human target

    Drones PULP Frontnet (Perception) A human-following drone control system known as the nano multirotor, the Crazyflie by Bitcraze. (SSF) Autonomous drones following a human target

  68. [76]

    Cars YOLO v2, v3, v5 (Perception) Baidu Apollo in LGSVL simulator (MSF)AVs approaching a critical physical road object on a sunny day, such as a stop sign or pedestrian

  69. [77]

    Cars PointPillars, VoxelNet, V2VNet, CoBEVT, FPV-RCNN (Perception) AVs utilizing LiDAR or GPS inform- ation from other cars in Baidu Apollo (MSF) Multiple AVs driving and jointly performing collaborative perception tasks

  70. [78]

    Cars Nexar & YOLO v4 (Perception)Baidu Apollo in LGSVL simulator (MSF)AVs approaching a traffic light

  71. [79]

    Cars DRL in decision-making module of SUMO (Planning) Microscopic traffic simulator SUMO And intelligent driver model (SSF) AVs driving in one or two lanes, following the malicious leading vehicle in traffic

  72. [80]

    Cars ResNet-34 (E2E) Learning by cheating agent in CARLA (SSF)AVs on a road with pedestrians and other vehicles

  73. [81]

    Cars OpenPilot’s Automated Lane Centering (ALC) (E2E) Automated Lane Centering (ALC) system in LGSVL (SSF) AVs driving

  74. [82]

    Cars (A5-L, A5-C) In-road obstacle detection (Perception) Baidu Apollo in LGSVL simulator v5 (MSF)Av on a single lane road

  75. [83]

    Cars Tesla’s APE lane recognition (AutoPilot ECU, Electronic Control Unit) (Perception)Tesla model S (SSF) AVs on roads driving into empty spaces in road line markings

  76. [84]

    Cars PointRCNN and PointPillar and PV-RCNN (Perception) Baidu Apollo in LGSVL simulator (Lincoln MKZ car) (MSF) AVs driving on a single lane road

  77. [85]

    Cars Kalman Filter in YOLO v3 (Perception)Baidu Apollo in LGSVL simulator (MSF)AVs on a road with pedestrians and vehicles in front of the car

  78. [86]

    Cars Conditional Imitation and Reinforcement learning (E2E) in CARLA End to end driving system in CARLA (SSF)AVs in turns and intersections

  79. [87]

    Cars DriveNet (an extension of Dave2) (E2E)Autonomous Driving agent in CARLA (SSF)AVs driving past a roadside billboard

  80. [88]

    Cars Faster_rcnn_inception_v2 and Tesla’s (Perception) model Tesla Model X HW 2.5/3 & Renault Captur (equipped with Mobileye 630) (MSF)AVs driving

  81. [89]

    Cars DNN of the Lidar-based (Perception) module in Baidu Apollo Driving agent in Baidu Apollo (MSF)AVs driving

  82. [90]

    Cars NN model of Udacity Simulator (E2E)Udacity Simulator (SSF) AVs driving *MSF stands for Multi-Sensor Fusion and SSF stands for Single-Sensor Fusion , Vol. 1, No. 1, Article . Publication date: September 2025. 30 Tehrani et al. Table 4. Paper Mapping (Part 2) RefAttacked Ta...

    2025

  83. [91]

    Losing detection due to increased latency and subsequently tracking of the target object Crashing into another car

  84. [92]

    Misdetection of objects and Misprediction of the steering wheel angle Crashing to objects, freezing or going off-route

  85. [93]

    Misdetection of the vehicle in front Acceleration and crash into the car in front

  86. [94]

    Misdetection of the correct coordinates of the target bounding box Losing path, stability and collision to surrounding obstacles

  87. [95]

    Misprediction of the steering wheel angle Going off-road

  88. [96]

    Misclassification of the adversarial patch as a real human Following the adversarially patched image and failing to detect the real human

  89. [97]

    Failure to detect stop signs and pedestrians Running a stop sign and colliding with pedestrians

  90. [98]

    Detecting fake objects as real while failing to detect a real object Stopping unexpectedly or causing collisions with objects

  91. [99]

    Misclassification of traffic light colors Running a red light, causing a car crash or emergency stop, which leads to the vehicle freezing

  92. [100]

    Causing a collision with the car in front

    Failing to predict the correct reaction to traffic. Causing a collision with the car in front

  93. [101]

    Misprediction of the steering wheel angle and failure to detect traffic lights Losing lane, going offroad, crashing into buildings, ignoring traffic lights, going to crossroads

  94. [102]

    Misprediction of the steering wheel angle Driving off-road, colliding with road curbs, crashing into obstacles, and having a car crash with oncoming traffic

  95. [103]

    Failing to detect an adversarial object Crashing into the adversarial object

  96. [104]

    Detecting the perturbation as a real line Following the fake line into oncoming traffic

  97. [105]

    Detecting adversarial objects as real cars Stopping completely or suddenly changing lane

  98. [106]

    Misdetection or failure to detect cars or pedestrians Emergency braking or unsafe acceleration leading to a car crash

  99. [107]

    Incorrectly detecting lines (wrong control decisions) Moving into another lane or veering out of bounds, resulting in collisions with road walls

  100. [108]

    Misprediction of the steering wheel angle Collision with the poster

  101. [109]

    Detecting phantoms as real road signs or real-world objects Acting according to the detected object (Brake or decelerate or follow a phantom lane into collision or into the upcoming lane and, etc...)

  102. [110]

    Detecting nonexistent obstacles Emergency braking or the vehicle freezing

  103. [111]

    Misprediction of the steering wheel angle Moving to the right and then going off the road , Vol. 1, No. 1, Article . Publication date: September 2025

    2025

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.