Pith. sign in

REVIEW 3 major objections 6 minor 72 references

PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lighting

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read When emergency vehicle lights flash at night, object detectors' confidence scores for a nearby car swing wildly, sometimes below detection thresholds, and a software pipeline can largely stabilize them.

desk verdict A genuinely new empirical finding about flashing emergency lights causing confidence fluctuations in object detectors, but the mitigation's headline numbers rest on a possible train/test overlap that needs fixing. read the letter →

arxiv 2505.05183 v1 pith:D3AW76QX submitted 2025-05-08 cs.CV cs.LG

Elad Feldman , Jacob Shams , Dudi Biton , Alfred Chen , Shaoyuan Xie , Satoru Koda , Yisroel Mirsky , Asaf Shabtai
show 2 more authors
Yuval Elovici Ben Nassi
This is my paper · ORCID
classification cs.CVcs.LG
keywords PaniCarobjectdetectionconfidenceemergencyvehiclelightinglensflareADASperceptionautonomousdrivingsafetyCaracetamolthreshold
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the flashing lights of parked emergency vehicles at night cause a previously unidentified failure in the vision systems that power advanced driving assistance systems (ADASs). The effect, which the authors call PaniCar, is a wide fluctuation in an object detector's confidence that a car is present, with the score periodically falling below a reasonable detection threshold. The paper documents the effect across seven commercial ADAS cameras, four common object detectors, and fourteen light patterns, and shows that the fluctuation tracks the frequency of the light pattern. It then proposes Caracetamol, a software framework that pairs a flare-removing denoiser with a fine-tuned copy of the detector, and reports that it raises average car-detection confidence by about 0.20, lifts the lower confidence bound by about 0.33, and shrinks the fluctuation range by about 0.33 on YOLOv3 and Faster R-CNN at 30–50 FPS. If correct, the finding gives a technical explanation for why autopilot-equipped cars repeatedly crashed into emergency vehicles, and offers a path to fix it.

What carries the argument

The central object is PaniCar itself: a time-varying confidence signal produced by an object detector when flare from flashing emergency lights changes the tonal distribution of the car in successive frames, with the fluctuation's dominant frequency matching the light pattern's frequency (a 1.3 Hz peak in the paper's recordings, confirmed by photodiode measurements). The central mechanism carrying the mitigation is the Caracetamol framework, a four-part perception pipeline: a CycleGAN-based denoiser, i.e., a generative network trained to translate flashed frames back to unflashed frames, a fine-tuned replica of the ADAS's object detector running on the denoised frame, the original detector running on the original frame to preserve its detections, and a combiner that aggregates the two. The replication-plus-denoiser path supplies the confidences that the original detector loses, while the original path guarantees no regression on normal scenes.

What would settle it

Record the same nighttime scene with a production Level 2 ADAS's own vision stack and measure its reported confidence for a stationary vehicle in the path while emergency lights flash; if the confidence never dips below the deployment threshold, or the dips do not track the light pattern's frequency, then PaniCar as described does not transfer to the deployed system.

Watch

Extended reading notes

Core claim

The paper's central claim is that activating emergency vehicle lighting creates a phenomenon, PaniCar, in which an object detector's confidence score for a detected object fluctuates within a wide range, dipping below a reasonable detection threshold in some frames. The underlying mechanism is the flare from the lights: the added light changes the tonal distribution of the car in the captured frame over time, and the pattern and frequency of the flashing lights dictate when confidence rises and falls. The paper shows that the fluctuation appears consistently across four object detectors (YOLO, SSD, RetinaNet, Faster R-CNN) and footage from seven ADAS cameras plus a smartphone, that object trackers layered on top do not compensate for the detection loss, and that the effect is strongest in darkness. It further finds that existing flare-removal methods either do not restore detector confidence or run too slowly for real-time driving, and proposes Caracetamol, a pipeline that combines a CycleGAN-based denoiser, a fine-tuned replica of the original detector, the original detector on the unprocessed frame, and a combiner layer. On YOLOv3 and Faster R-CNN, Caracetamol raises average car-detection confidence by 0.20, raises the lower confidence bound by 0.33, and reduces the fluctuation range by 0.33, at 30–50 FPS.

Load-bearing premise

The claim rests on assuming that the open-source, publicly trained object detectors used in the lab behave like the proprietary detectors inside the commercial ADASs — especially Tesla's — whose crash footage motivated the study, so the confidence dips observed here would actually occur in the deployed vehicles.

Editorial extensions

If this is right

  • Vision-only ADAS and autopilot systems may intermittently fail to detect vehicles sitting near active emergency lights at night, even when the same vehicle is detected with high confidence a few frames earlier or later.
  • Object trackers do not repair the failure, so countermeasures must act at the detector level, not the tracking layer.
  • Existing flare-removal networks, which the paper evaluates, are too slow and too weak at restoring detector confidence to be used as-is in a real-time driving loop.
  • A detector-plus-denoiser pipeline such as Caracetamol can run within real-time budgets (31–50 FPS on the tested GPUs) while raising average confidence and shrinking the confidence range.
  • The same phenomenon can be weaponized: a person who places or triggers emergency-style flashing lights can cause an ADAS to miss a vehicle or obstacle, turning a safety issue into a deliberate attack surface.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the confidence dips are periodic and phase-locked to the light pattern, a temporal filter that integrates confidence over one or two flash cycles could recover detection without a learned denoiser; the paper does not test this.
  • The spectral signature (around 1.3 Hz in the reported recordings) implies that the failure depends on the light pattern's frequency content, so patterns with faster or irregular flashing may produce different dip durations and severities than the ones measured here.
  • The transferability question cuts the other way too: production detectors with temporal smoothing or radar/camera fusion might already be partially robust, which would mean PaniCar is mostly a hazard for vision-only, per-frame systems rather than all ADASs.
  • If Caracetamol's gains hold on production hardware, the same denoise-then-finetune structure could generalize to other glare sources (oncoming headlights, sun glare) since the mechanism is a tonal shift that degrades confidence, not emergency lights specifically.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper identifies and characterizes PaniCar, a phenomenon in which activated emergency vehicle lighting causes the confidence scores of common object detectors to fluctuate widely over time, sometimes dropping below typical detection thresholds. The authors demonstrate this across four open-source COCO-pretrained detectors (YOLOv9/YOLOv3, SSD, RetinaNet, Faster R-CNN) applied to footage from seven commercial ADAS cameras and a smartphone, across 14 emergency-vehicle light patterns, and show via FFT analysis that the confidence fluctuation frequency matches the photodiode-measured modulation frequency of the lights. They further show that object trackers do not compensate for the detection loss, and that the effect is stronger in darkness. To mitigate PaniCar, the paper proposes Caracetamol, a pipeline consisting of a CycleGAN-based denoiser, a fine-tuned copy of the original detector, and a combiner, reporting large confidence improvements at 30-50 FPS, while also evaluating four state-of-the-art flare removal methods and finding them inadequate for real-time use. The authors explicitly disclaim access to Tesla's proprietary detectors and frame their analysis as based on commonly used detectors.

Significance. If it holds, the PaniCar phenomenon is an important empirical result for vision-based ADAS safety: it connects a known optical artifact (lens flare from dynamic emergency lighting) to a measurable, patterned degradation of object detector confidence, with plausible safety implications. The evidence for the phenomenon itself is strong and multi-faceted: it is reproduced across multiple detectors, multiple ADAS cameras, real recordings, and an external photodiode measurement, and the pattern-dependent detection-loss analysis shows a concrete mechanism. The dataset release and the negative evaluation of SOTA flare removal methods are also useful contributions. The Caracetamol mitigation, while promising, is undermined by a likely data-leakage problem in its evaluation and by inconsistencies between the paper's headline quantitative claims and the reported table; these issues must be resolved before the mitigation results can be accepted.

major comments (3)
  1. [4.2.2, 4.5.1, Table 4] The Caracetamol evaluation appears to suffer from data leakage between CycleGAN training and evaluation. Section 4.2.2 states that the YouTube dataset 'was used to both evaluate Caracetamol and facilitate the training of a CycleGAN model,' and Section 4.5.1 reports 'We fed the YouTube data test to each model.' No train/test split is described between the approximately 1,000 YouTube images used as CycleGAN Group B and the YouTube 'test' set. This is load-bearing because the denoiser is the main driver of the reported improvement: in Table 4, fine-tuning alone moves YOLOv3 from 0.50 to 0.54, while adding the denoiser raises it to 0.71. If the denoiser was trained on the same videos on which it is evaluated, the reported gains (+0.20 average confidence, +0.33 lower bound, 0.33 range reduction) may reflect memorization rather than generalization. Please provide an explicit split (e.g., disjoint sets of YouTube videos for CycleGAN training and evaluation), re-run the Table 4 evaluation on the held-out set, and update all affected abstract and Section 7 numbers.
  2. [Abstract, Section 7, Table 4] The paper's headline quantitative claims do not match the numbers in Table 4. For YOLOv3, the average confidence improves from 0.50 (YOLOCOCO) to 0.71 (Denoiser+YOLOMFA), which is +0.21, not +0.20; the absolute range reduces from 0.69 to 0.23, a reduction of 0.46, not 0.33. For Faster R-CNN, the average confidence improves from 0.63 to 0.81 (+0.18) and the minimum confidence from 0.21 to 0.45 (+0.24), not +0.33. The claim of 'reduces the fluctuation range by 0.33' is also not supported by the SSD row, where the range increases from 0.65 to 0.70. Please specify exactly which model/detector combinations support each claimed improvement, or revise the abstract and Section 7 to match the reported data.
  3. [Section 1, Section 2, Section 5] The paper motivates the work with the 16 documented Tesla crashes and states that PaniCar 'can cause autonomous vehicles to fail to detect objects near emergency vehicles.' However, all experiments use open-source COCO-pretrained detectors applied to footage from ADAS cameras, not the proprietary detectors actually deployed in Tesla or the other seven ADASs. The authors' own disclaimer in Sections 1 and 5 acknowledges that there may be a discrepancy, but the abstract and discussion do not carry that caveat. This is a load-bearing scope issue: the paper's safety-critical conclusion is about real ADAS perception, while the evidence is about a set of generic detectors on recorded footage. Please either (a) provide evidence that the tested detectors behave like production ADAS detectors (e.g., test on a production-like detection stack or on the ADAS's own detection outputs), or (b) explicitly reframe the conclusions as applying to common open-source detectors on ADAS camera footage and temper the language connecting the results to the documented Tesla crashes.
minor comments (6)
  1. [4.2.2] The dataset availability link is left as '??' and should be filled in.
  2. [Abstract, throughout] There are typos, including 'lightning' for 'lighting' and 'Telsa' for 'Tesla' in the abstract; please proofread the final version.
  3. [Table 5] Table 5 uses green/red color coding to indicate whether 30-60 FPS is met; this may not be legible in black-and-white printing. Add explicit textual markers (e.g., 'yes'/'no') to each row.
  4. [4.5.3] The 'Robustness against Adversaries' section is a brief argument rather than an experiment; consider renaming it to 'Discussion' or adding an actual adversarial evaluation if this claim is to be retained.
  5. [Section 4.2.1, Table 4] The metric 'Absolute Range' is used in Table 4 but not precisely defined in Section 4.2.1; please state that it is the maximum minus minimum confidence over the evaluated frames.
  6. [Figure 22 caption] The caption repeats 'Tesla 2023 Tesla model 3'; please correct the wording.

Circularity Check

1 steps flagged · score 6.0 of 10

Caracetamol's headline gains may be inflated because the CycleGAN denoiser was trained on the same YouTube dataset used for evaluation, with no reported train/test split.

  1. fitted input called prediction [Sections 4.2.2 and 4.5.1; Table 4]
    "This dataset was used to both evaluate Caracetamol and facilitate the training of a CycleGAN model that was used to generate synthetic emergency vehicle lighting imagery (described below). ... Group B (with emergency vehicle lighting), which consisted of approximately 1,000 images from the YouTube dataset. ... We fed the YouTube data test to each model and analyzed the model performance according to the metrics described in Section 4.2."

    The denoiser is a learned CycleGAN generator fit on roughly 1,000 YouTube images (Group B). The same YouTube dataset is described as being 'used to both evaluate Caracetamol and facilitate the training of a CycleGAN model,' and the evaluation is then run on 'the YouTube data test' with no reported train/test split separating it from those training images. As written, the reported improvements in Table 4 (e.g., YOLOv3 average confidence 0.50 to 0.71 and minimum confidence 0.18 to 0.59 with the denoiser) can reflect the denoiser having memorized the very frames on which it is evaluated. The denoiser is the main driver of the mitigation gain, so the headline 'prediction' of Caracetamol's performance is not demonstrably out-of-sample.

full rationale

The PaniCar phenomenon analysis is self-contained: it uses real ADAS footage, public COCO-pretrained detectors, and photodiode measurements, so the confidence-fluctuation finding is not fitted, definitionally forced, or supported by self-citation. The circularity is confined to the mitigation evaluation. Section 4.2.2 states that the YouTube dataset was used both to evaluate Caracetamol and to train the CycleGAN model, with Group B for the CycleGAN consisting of roughly 1,000 YouTube images. Section 4.5.1 then evaluates on 'the YouTube data test' without describing any split from those training images. Because the denoiser is the main contributor to the reported gains in Table 4, the evaluation cannot be distinguished from in-sample memorization under the paper's own description. The PaniCar phenomenon remains externally supported; the Caracetamol generalization claim, as written, reduces partially to its training input.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The paper is empirical and does not introduce mathematical postulates. Its load-bearing assumptions concern the representativeness of detectors, dataset splits, causal inference from frequency matching, and the meaning of confidence thresholds. The only hand-set numeric constant in the pipeline is the day/night brightness threshold.

free parameters (1)
  • nighttime classification brightness threshold = 60
    Hand-picked threshold from prior work [36] used to label BDD100K images as day or night before augmenting about 27,500 nighttime images. It shapes Caracetamol's training data but is not fitted to the target result.
assumptions (4)
  • domain assumption COCO-pretrained object detectors are representative of the proprietary detectors in the commercial ADASs under study
    Section 3.1 uses four COCO-pretrained detectors, and Section 1 disclaims lacking access to Tesla's detectors. The claim that PaniCar can cause real ADAS failures depends on this transfer.
  • domain assumption The YouTube test videos are representative of real-world emergency vehicle encounters and are disjoint from the CycleGAN training subset
    Section 4.2.2 uses the YouTube dataset both to train the CycleGAN generator (Group B, about 1,000 images) and to evaluate Caracetamol; no disjoint split is stated, so evaluation validity depends on this unstated assumption.
  • domain assumption Matching 1.3 Hz FFT peaks in the detector confidence signal and photodiode voltage establish a causal link between the light pattern and confidence fluctuation
    Section 3.1.4 shows both signals peak near 1.3 Hz, but the paper does not vary the pattern frequency in a controlled way or account for other periodic factors such as frame aliasing.
  • domain assumption Confidence scores from the selected detectors map to detection success at thresholds 0.5 to 0.8 as used in ADAS decision-making
    The paper equates confidence below these thresholds with detection loss (Section 3.1.5), but production ADAS may use additional temporal, radar, or ultrasonic fusion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lighting." pith.science (2026). https://pith.science/paper/D3AW76QX

@misc{pith2026250505183,
  author       = {Pith},
  title        = {Pith review of: PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lighting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D3AW76QX}},
  note         = {Machine review of arXiv:2505.05183}
}
read the original abstract

The safety of autonomous cars has come under scrutiny in recent years, especially after 16 documented incidents involving Teslas (with autopilot engaged) crashing into parked emergency vehicles (police cars, ambulances, and firetrucks). While previous studies have revealed that strong light sources often introduce flare artifacts in the captured image, which degrade the image quality, the impact of flare on object detection performance remains unclear. In this research, we unveil PaniCar, a digital phenomenon that causes an object detector's confidence score to fluctuate below detection thresholds when exposed to activated emergency vehicle lighting. This vulnerability poses a significant safety risk, and can cause autonomous vehicles to fail to detect objects near emergency vehicles. In addition, this vulnerability could be exploited by adversaries to compromise the security of advanced driving assistance systems (ADASs). We assess seven commercial ADASs (Tesla Model 3, "manufacturer C", HP, Pelsee, AZDOME, Imagebon, Rexing), four object detectors (YOLO, SSD, RetinaNet, Faster R-CNN), and 14 patterns of emergency vehicle lighting to understand the influence of various technical and environmental factors. We also evaluate four SOTA flare removal methods and show that their performance and latency are insufficient for real-time driving constraints. To mitigate this risk, we propose Caracetamol, a robust framework designed to enhance the resilience of object detectors against the effects of activated emergency vehicle lighting. Our evaluation shows that on YOLOv3 and Faster RCNN, Caracetamol improves the models' average confidence of car detection by 0.20, the lower confidence bound by 0.33, and reduces the fluctuation range by 0.33. In addition, Caracetamol is capable of processing frames at a rate of between 30-50 FPS, enabling real-time ADAS car detection.

Figures

Figures reproduced from arXiv: 2505.05183 by the authors.

Figure 1
Figure 1. Top: A vehicle detected by SSD with a confidence of 0.98 with [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The emergency vehicle lightning and ADASs we used: Rexing [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of the confidence score signal for Faster R-CNN, YOLOv9, and SSD using video obtained by the frontal camera of a 2023 Tesla [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: Comparison of the confidence score of SSD per frame for videos recorded by different ADASs and a smartphone. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Left: Extracted FFT graph from the confidence signal of Faster R-CNN recorded by AZDOME when the emergency vehicle lighting is on. A [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: The percentage of frames in which a car was detected by Faster R-CNN with confi￾dence higher than the threshold (in the presence of emergency vehicle lighting) [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 9
Figure 9. Figure 9: Samples taken from two authentic collected datasets; a sample [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 11
Figure 11. Figure 11: Faster R-CNN confidence score signal range for each examined shutter speed (SS). The results obtained when the emergency vehicle light￾ing was on are presented in blue, while the results obtained when the emergency vehicle lighting was off are in red; the points in ea…
Figure 15
Figure 15. Figure 15: Faster R-CNN confidence score signal range for each examined emergency vehicle light￾ing color, as well as when the emergency vehicle lighting was off. The points in each range indicate the average value for each signal [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]
Figure 17
Figure 17. Figure 17: Left: Faster R-CNN confidence score signal range for each examined distance between an autonomous vehicle’s camera and an observed vehicle. [PITH_FULL_IMAGE:figures/full_fig_p018_17.png]
Figure 18
Figure 18. Figure 18: Comparison of percentage of frames with confidence higher than threshold for 14 emergency vehicle lighting patterns observed by RetinaNet, [PITH_FULL_IMAGE:figures/full_fig_p019_18.png]
Figure 19
Figure 19. Figure 19: Extracted FFT graphs from the confidence signals of three object detectors when the emergency vehicle lighting is on. A peak around 1.3 Hz [PITH_FULL_IMAGE:figures/full_fig_p019_19.png]
Figure 20
Figure 20. Figure 20: Confidence score signal ranges of various object detectors (YOLO, SSD, and RetinaNet) for each examined lux value. The results obtained [PITH_FULL_IMAGE:figures/full_fig_p019_20.png]
Figure 21
Figure 21. Figure 21: Confidence score signal ranges of various object detectors (YOLO, SSD, and RetinaNet) for each examined distance between an ADAS’ camera [PITH_FULL_IMAGE:figures/full_fig_p020_21.png]
Figure 22
Figure 22. Figure 22: confidence score per frame with Tesla 2023 Tesla model 3 frontal camera obtained with RetinaNet [PITH_FULL_IMAGE:figures/full_fig_p020_22.png]
Figure 23
Figure 23. Figure 23: The confidence score signals of bytetrack object tracker model applied on the Faster R-CNN object detector and Faster R-CNN object detector [PITH_FULL_IMAGE:figures/full_fig_p020_23.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

72 extracted references · 58 canonical work pages

  1. [1]

    Odi resume,

    NHTSA, “Odi resume,” https://static.nhtsa.gov/odi/inv/2022/INOA- EA22002-3184.PDF

    work page 2022

  2. [2]

    Tesla Driver Was on Autopilot Eating a Bagel When He Smashed into a Fire Truck,

    C. ATIYEH, “Tesla Driver Was on Autopilot Eating a Bagel When He Smashed into a Fire Truck,” https://www.caranddriver.com/news/ a28911259/tesla-crash-california-autopilot-driver-ntsb/, 2019

    work page 2019

  3. [3]

    Tesla Autopilot Crashes Into Police Car, Hits Cop as Driver ’Watches Movie’,

    J. Klawans, “Tesla Autopilot Crashes Into Police Car, Hits Cop as Driver ’Watches Movie’,” https://www.newsweek.com/ tesla-autopilot-crashes-police-car-hits-cop-driver-watches-movie- 1677814, 2022

    work page 2022

  4. [4]

    Investigation launched after Tesla cars crash into ambulances while on Autopilot,

    J. Titcomb, “Investigation launched after Tesla cars crash into ambulances while on Autopilot,” https://www.telegraph.co.uk/ technology/2021/08/16/investigation-launched-tesla-cars-crash- ambulances-autopilot/, 2021

    work page 2021

  5. [5]

    Mystery Accidents: Teslas in ’Autopilot’ crashing into emergency vehicles,

    A. N. Angie Moreschi and L. Deal, “Mystery Accidents: Teslas in ’Autopilot’ crashing into emergency vehicles,” https://cbsaustin.com/news/spotlight-on-america/responders-at-risk- nhtsa-probes-driver-assistance-systems-after-a-series-of-crashes- involving-teslas-and-emergency-vehicles, 2023

    work page 2023

  6. [6]

    Teslas Are Crashing Into Emergency Vehicles Too Much, So NHTSA Asks Other Car Companies About It,

    B. Templeton, “Teslas Are Crashing Into Emergency Vehicles Too Much, So NHTSA Asks Other Car Companies About It,” https://www.forbes.com/sites/bradtempleton/2021/09/20/teslas-are- crashing-into-emergency-vehicles-too-much-so-nhtsa-asks-other- car-companies-about-it/, 2021

    work page 2021

  7. [7]

    Flare7k: A phe- nomenological nighttime flare removal dataset,

    Y . Dai, C. Li, S. Zhou, R. Feng, and C. C. Loy, “Flare7k: A phe- nomenological nighttime flare removal dataset,”Advances in Neural Information Processing Systems, vol. 35, pp. 3926–3937, 2022

    work page 2022

  8. [8]

    Im- proving lens flare removal with general-purpose pipeline and multiple light sources recovery,

    Y . Zhou, D. Liang, S. Chen, S.-J. Huang, S. Yang, and C. Li, “Im- proving lens flare removal with general-purpose pipeline and multiple light sources recovery,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 12 969–12 979

    work page 2023

Show all 72 references
  1. [9]

    How to train neural networks for flare removal,

    Y . Wu, Q. He, T. Xue, R. Garg, J. Chen, A. Veeraraghavan, and J. T. Barron, “How to train neural networks for flare removal,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 2239–2247

    2021

  2. [10]

    Tesla vision update: Replacing ultrasonic sensors with tesla vision,

    “Tesla vision update: Replacing ultrasonic sensors with tesla vision,” https://www.tesla.com/support/transitioning-tesla-vision

  3. [11]

    Available: https://www.amazon.com/dp/ B081YDHHBR/

    “Hp.” [Online]. Available: https://www.amazon.com/dp/ B081YDHHBR/

  4. [12]

    Available: https://www.amazon.com/dp/ B0BF4XB3VP/

    “Pelsee.” [Online]. Available: https://www.amazon.com/dp/ B0BF4XB3VP/

  5. [13]

    Available: https://www.amazon.com/dp/ B094YDVV7L/

    “Azdome.” [Online]. Available: https://www.amazon.com/dp/ B094YDVV7L/

  6. [14]

    Imagebon

    “Imagebon.” [Online]. Available: https://www.amazon.com/dp/ B0C86CV679/

  7. [15]

    Available: https://www.amazon.com/dp/ B08N1KMSZ7/

    “Rexing.” [Online]. Available: https://www.amazon.com/dp/ B08N1KMSZ7/

  8. [16]

    Tesla dashcam footage suggests reasons for autopilot crashes

    “Tesla dashcam footage suggests reasons for autopilot crashes.” [Online]. Available: https://youtu.be/V2u3dcH2VGM

  9. [17]

    Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,

    Y . Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,” in2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA), 2014, p...

    2014

  10. [18]

    Flip feng shui: Hammering a needle in the software stack,

    K. Razavi, B. Gras, E. Bosman, B. Preneel, C. Giuffrida, and H. Bos, “Flip feng shui: Hammering a needle in the software stack,” in25th USENIX Security Symposium (USENIX Security 16). Austin, TX: USENIX Association, Aug. 2016, pp. 1–18. [Online]. Available: https://www.usenix....

    2016

  11. [19]

    Drammer: Deterministic rowhammer attacks on mobile platforms,

    V . van der Veen, Y . Fratantonio, M. Lindorfer, D. Gruss, C. Maurice, G. Vigna, H. Bos, K. Razavi, and C. Giuffrida, “Drammer: Deterministic rowhammer attacks on mobile platforms,” inProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. C...

    2016

  12. [20]

    Grand pwning unit: Accelerating microarchitectural attacks with the gpu,

    P. Frigo, C. Giuffrida, H. Bos, and K. Razavi, “Grand pwning unit: Accelerating microarchitectural attacks with the gpu,” inProceedings - 2018 IEEE Symposium on Security and Privacy, SP 2018. United States: Institute of Electrical and Electronics Engineers Inc., 2018, pp. 195–...

    2018

  13. [21]

    Another flip in the wall of rowhammer defenses,

    D. Gruss, M. Lipp, M. Schwarz, D. Genkin, J. Juffinger, S. O’Connell, W. Schoechl, and Y . Yarom, “Another flip in the wall of rowhammer defenses,” in39th IEEE Symposium on Security and Privacy 2018, Jan. 2018

    2018

  14. [22]

    DRAMA: Exploiting DRAM addressing for Cross-CPU attacks,

    P. Pessl, D. Gruss, C. Maurice, M. Schwarz, and S. Mangard, “DRAMA: Exploiting DRAM addressing for Cross-CPU attacks,” in25th USENIX Security Symposium (USENIX Security 16). Austin, TX: USENIX Association, Aug. 2016, pp. 565–581. [Online]. Available: https://www.usenix.org/con...

    2016

  15. [23]

    Physically-based real-time lens flare rendering,

    M. Hullin, E. Eisemann, H.-P. Seidel, and S. Lee, “Physically-based real-time lens flare rendering,”ACM Trans. Graph., vol. 30, no. 4, Jul

  16. [24]

    YOLOv9: Learning what you want to learn using programmable gradient information,

    C.-Y . Wang and H.-Y . M. Liao, “YOLOv9: Learning what you want to learn using programmable gradient information,” 2024

    2024

  17. [25]

    Faster r-cnn: Towards real- time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real- time object detection with region proposal networks,”Advances in neural information processing systems, vol. 28, 2015

    2015

  18. [26]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” inComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14. Springer, 2016, pp. 21–37

    2016

  19. [27]

    Focal loss for dense object detection,

    T.-Y . Lin, P. Goyal, R. Girshick, K. He, and P. Dollár, “Focal loss for dense object detection,” inProceedings of the IEEE international conference on computer vision, 2017, pp. 2980–2988

    2017

  20. [28]

    Robust perception architecture design for automotive cyber-physical systems,

    J. Dey and S. Pasricha, “Robust perception architecture design for automotive cyber-physical systems,” in2022 IEEE Computer Society Annual Symposium on VLSI (ISVLSI). IEEE, 2022, pp. 241–246

    2022

  21. [29]

    Mmdetection: Open mmlab detection toolbox and benchmark,

    K. Chen, J. Wang, J. Pang, Y . Cao, Y . Xiong, X. Li, S. Sun, W. Feng, Z. Liu, J. Xuet al., “Mmdetection: Open mmlab detection toolbox and benchmark,”arXiv preprint arXiv:1906.07155, 2019

    1906 arXiv

  22. [30]

    Perception, information processing and modeling: Critical stages for autonomous driving applications,

    D. Gruyer, V . Magnier, K. Hamdi, L. Claussmann, O. Orfila, and A. Rakotonirainy, “Perception, information processing and modeling: Critical stages for autonomous driving applications,”Annual Reviews in Control, vol. 44, pp. 323–341, 2017

    2017

  23. [31]

    Observation- centric sort: Rethinking sort for robust multi-object tracking,

    J. Cao, X. Weng, R. Khirodkar, J. Pang, and K. Kitani, “Observation- centric sort: Rethinking sort for robust multi-object tracking,”arXiv preprint arXiv:2203.14360, 2022

    2022 arXiv

  24. [32]

    Simple online and realtime tracking,

    A. Bewley, Z. Ge, L. Ott, F. Ramos, and B. Upcroft, “Simple online and realtime tracking,” in2016 IEEE International Conference on Image Processing (ICIP). IEEE, 2016, pp. 3464–3468

    2016

  25. [33]

    Bytetrack: Multi-object tracking by associating every detection box,

    Y . Zhang, P. Sun, Y . Jiang, D. Yu, Z. Yuan, P. Luo, W. Liu, and X. Wang, “Bytetrack: Multi-object tracking by associating every detection box,” 2021

    2021

  26. [34]

    Available: https://www.amazon.com/Extech- HD450-Datalogging-Heavy-Light/dp/B003N3UOCK

    “Extech.” [Online]. Available: https://www.amazon.com/Extech- HD450-Datalogging-Heavy-Light/dp/B003N3UOCK

  27. [35]

    Bdd100k: A diverse driving dataset for heterogeneous multitask learning,

    F. Yu, H. Chen, X. Wang, W. Xian, Y . Chen, F. Liu, V . Madhavan, and T. Darrell, “Bdd100k: A diverse driving dataset for heterogeneous multitask learning,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 2636–2645

    2020

  28. [36]

    Towards calibration-free geo-localization of stationary outdoor webcams,

    F. E. Sandnes, “Towards calibration-free geo-localization of stationary outdoor webcams,” 2010

    2010

  29. [37]

    Unpaired image- to-image translation using cycle-consistent adversarial networks,

    J.-Y . Zhu, T. Park, P. Isola, and A. A. Efros, “Unpaired image- to-image translation using cycle-consistent adversarial networks,” in Computer Vision (ICCV), 2017 IEEE International Conference on, 2017

    2017

  30. [38]

    Why tesla’s autopilot can’t see a stopped firetruck

    “Why tesla’s autopilot can’t see a stopped firetruck.” [Online]. Avail- able: https://www.wired.com/story/tesla-autopilot-why-crash-radar/

  31. [39]

    Remote attacks on automated vehicles sensors: Experiments on camera and lidar,

    J. Petit, B. Stottelaar, M. Feiri, and F. Kargl, “Remote attacks on automated vehicles sensors: Experiments on camera and lidar,”Black Hat Europe, vol. 11, p. 2015, 2015

    2015

  32. [40]

    Adversarial sensor attack on lidar-based perception in autonomous driving,

    Y . Cao, C. Xiao, B. Cyr, Y . Zhou, W. Park, S. Rampazzi, Q. A. Chen, K. Fu, and Z. M. Mao, “Adversarial sensor attack on lidar-based perception in autonomous driving,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 2267–2281

    2019

  33. [41]

    Towards robust lidar- based perception in autonomous driving: General black-box adver- sarial sensor attack and countermeasures,

    J. Sun, Y . Cao, Q. A. Chen, and Z. M. Mao, “Towards robust lidar- based perception in autonomous driving: General black-box adver- sarial sensor attack and countermeasures,” in29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 877–894

    2020

  34. [42]

    Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks,

    Y . Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li, “Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks,” in2021 IEEE Symposium on Security and Privacy (SP). ...

    2021

  35. [43]

    You can’t see me: Physical removal attacks on {LiDAR-based}autonomous vehicles driving frameworks,

    Y . Cao, S. H. Bhupathiraju, P. Naghavi, T. Sugawara, Z. M. Mao, and S. Rampazzi, “You can’t see me: Physical removal attacks on {LiDAR-based}autonomous vehicles driving frameworks,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 2993– 3010

    2023

  36. [44]

    Lidar spoofing meets the new-gen: Capability improve- ments, broken assumptions, and new attack strategies,

    T. Sato, Y . Hayakawa, R. Suzuki, Y . Shiiki, K. Yoshioka, and Q. A. Chen, “Lidar spoofing meets the new-gen: Capability improve- ments, broken assumptions, and new attack strategies,”arXiv preprint arXiv:2303.10555, 2023

    2023 arXiv

  37. [45]

    Rolling colors: Adver- sarial laser exploits against traffic light recognition,

    C. Yan, Z. Xu, Z. Yin, X. Ji, and W. Xu, “Rolling colors: Adver- sarial laser exploits against traffic light recognition,”arXiv preprint arXiv:2204.02675, 2022

    2022 arXiv

  38. [46]

    {SLAP}: Improving physical adversarial examples with {Short-Lived}adversarial perturbations,

    G. Lovisotto, H. Turner, I. Sluganovic, M. Strohmeier, and I. Mar- tinovic, “{SLAP}: Improving physical adversarial examples with {Short-Lived}adversarial perturbations,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 1865–1882

    2021

  39. [47]

    Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,

    X. Ji, Y . Cheng, Y . Zhang, K. Wang, C. Yan, W. Xu, and K. Fu, “Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,” in2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 160–175

    2021

  40. [48]

    Physical adversarial exam- ples for object detectors,

    D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial exam- ples for object detectors,” in12th USENIX workshop on offensive technologies (WOOT 18), 2018

    2018

  41. [49]

    Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,

    S.-T. Chen, C. Cornelius, J. Martin, and D. H. P. Chau, “Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 2018, pp. 52–68

    2018

  42. [50]

    Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,

    Y . Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’19. New York, NY...

    2019

  43. [51]

    The translu- cent patch: A physical and universal attack on object detectors,

    A. Zolfi, M. Kravchik, Y . Elovici, and A. Shabtai, “The translu- cent patch: A physical and universal attack on object detectors,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 15 232–15 241

    2021

  44. [52]

    Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,

    T. Sato, S. H. V . Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi, “Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,”arXiv preprint arXiv:2401.03582, 2024

    2024 arXiv

  45. [53]

    Drift with devil: Security of{Multi-Sensor}fusion based localization in{High-Level} autonomous driving under{GPS}spoofing,

    J. Shen, J. Y . Won, Z. Chen, and Q. A. Chen, “Drift with devil: Security of{Multi-Sensor}fusion based localization in{High-Level} autonomous driving under{GPS}spoofing,” in29th USENIX security symposium (USENIX Security 20), 2020, pp. 931–948

    2020

  46. [54]

    Sok: On the semantic ai security in autonomous driving,

    J. Shen, N. Wang, Z. Wan, Y . Luo, T. Sato, Z. Hu, X. Zhang, S. Guo, Z. Zhong, K. Liet al., “Sok: On the semantic ai security in autonomous driving,”arXiv preprint arXiv:2203.05314, 2022

    2022 arXiv

  47. [55]

    Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks,

    B. Nassi, Y . Mirsky, D. Nassi, R. Ben-Netanel, O. Drokin, and Y . Elovici, “Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks,” inProceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, pp. 293–308

    2020

  48. [56]

    Protecting autonomous cars from phantom attacks,

    B. Nassi, Y . Mirsky, J. Shams, R. Ben-Netanel, D. Nassi, and Y . Elovici, “Protecting autonomous cars from phantom attacks,” Communications of the ACM, vol. 66, no. 4, pp. 56–69, 2023

    2023

  49. [57]

    Mobilbye: at- tacking adas with camera spoofing,

    D. Nassi, R. Ben-Netanel, Y . Elovici, and B. Nassi, “Mobilbye: at- tacking adas with camera spoofing,”arXiv preprint arXiv:1906.09765, 2019

    1906 arXiv

  50. [58]

    I can see the light: Attacks on autonomous vehicles using invisible lights,

    W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I can see the light: Attacks on autonomous vehicles using invisible lights,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1930–1944

    2021

  51. [59]

    Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World}attack,

    T. Sato, J. Shen, N. Wang, Y . Jia, X. Lin, and Q. A. Chen, “Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World}attack,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3309–3326

    2021

  52. [60]

    Tencent keen security lab: Experimental security research of tesla autopilot,

    keen labs, “Tencent keen security lab: Experimental security research of tesla autopilot,” https://keenlab.tencent.com/en/2019/03/ 29/Tencent-Keen-Security-Lab-Experimental-Security-Research-of- Tesla-Autopilot/, 2019

    2019

  53. [61]

    Fooling a real car with adversarial traffic signs,

    N. Morgulis, A. Kreines, S. Mendelowitz, and Y . Weisglass, “Fooling a real car with adversarial traffic signs,”arXiv preprint arXiv:1907.00374, 2019

    1907 arXiv

  54. [62]

    Model Hacking ADAS to Pave Safer Roads for Autonomous Vehicles,

    B. by McAfee, “Model Hacking ADAS to Pave Safer Roads for Autonomous Vehicles,” https://www.mcafee.com/blogs/other- blogs/mcafee-labs/model-hacking-adas-to-pave-safer-roads-for- autonomous-vehicles/, 2020

    2020

  55. [63]

    Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,

    P. Jing, Q. Tang, Y . Du, L. Xue, X. Luo, T. Wang, S. Nie, and S. Wu, “Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3237–3254

    2021

  56. [64]

    badvertisement: Attacking advanced driver-assistance systems using print advertise- ments,

    B. Nassi, J. Shams, R. B. Netanel, and Y . Elovici, “badvertisement: Attacking advanced driver-assistance systems using print advertise- ments,” in2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2022, pp. 376–383

    2022

  57. [65]

    Madradar: A black-box physical layer attack framework on mmwave automotive fmcw radars,

    D. Hunt, K. Angell, Z. Qi, T. Chen, and M. Pajic, “Madradar: A black-box physical layer attack framework on mmwave automotive fmcw radars,”arXiv preprint arXiv:2311.16024, 2023

    2023 arXiv

  58. [66]

    Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle,

    C. Yan, W. Xu, and J. Liu, “Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle,”DEF CON, vol. 24, 2016

    2016

  59. [67]

    Tesla model 3 spoofed off the highway - regulus navigation system hack causes car to turn on its own,

    Regulus, “Tesla model 3 spoofed off the highway - regulus navigation system hack causes car to turn on its own,” https://www.regulus.com/ blog/tesla-model-3-spoofed-off-the-highway-regulus-researches- hack-navigation-system-causing-car-to-steer-off-road/

  60. [69]

    Due to space limitations, we only present the analysis per- formed using Faster R-CNN

    Appendix A: Effect of the Camera Settings Here we examine whether advanced driver-assistance system (ADAS) camera settings influence thePaniCarphe- nomenon, focusing on: (1) the shutter speed, (2) the ISO sensitivity, and (3) the frame rate of the vehicle’s camera. Due to spac...

  61. [70]

    Due to space limitations, we only present the analysis performed using Faster R-CNN

    Appendix B: Effect of Emergency Vehicle’s Characteristics In this section we examine the influence of an emer- gency vehicle’s characteristics on thePaniCarphenomenon, specifically investigating the effects of (1) the color of the emergency vehicle, (2) the color of the emerge...

  62. [71]

    Experimental Setup:A Samsung Galaxy S22 Ultra was positioned in front of a grey Ford Fiesta with emergency vehicle lighting mounted on its roof

    Appendix C: Effect of Camera Distance Here we analyze the effect of the distance between the semi-autonomous car’s camera and the emergency vehicle. Experimental Setup:A Samsung Galaxy S22 Ultra was positioned in front of a grey Ford Fiesta with emergency vehicle lighting moun...

  63. [72]

    Appendix D: Additional Material defm a k e _ l i g h t ( x , y , img_shape , o p t i o n ) : r_w , r_h = o p t i o n _ d i c t [ o p t i o n ] c h a n n e l = 0i fnp . random . r a n d ( ) > 0 . 5e l s e2 l a y e r _ c = np . z e r o s ( img_shape ) l a y e r _ c [ ( y − r_h )...

    2023

  64. [2011]

    Available: https://doi.org/10.1145/2010324.1965003

    [Online]. Available: https://doi.org/10.1145/2010324.1965003

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.