Pith. sign in

REVIEW 4 major objections 5 minor 49 references

Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Simulated signal-injection images fool traffic AI just like real ones.

desk verdict A useful simulation framework for ESIA color strips, with a new BDD100k scenario evaluation, but the 'statistically indistinguishable' claim overreaches; the trend results hold up. read the letter →

arxiv 2501.05239 v1 pith:TSW7TT7G submitted 2025-01-09 cs.CR cs.CVeess.SP

Wenhao Liao , Sineng Yan , Youqian Zhang , Xinwei Zhai , Yuanyuan Wang , Eugene Yujun Fu This is my paper · ORCID
classification cs.CRcs.CVeess.SP
keywords electromagneticsignalinjectionattackautonomousvehicleperceptionadversarialsimulationobjectdetectiondrivableareasegmentationcamerasensorsecuritycolorstripartifactsBDD100k
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Electromagnetic Signal Injection Attacks (ESIA) let an attacker inject radio signals into a car camera's circuitry, turning captured frames into corrupted images with colored horizontal strips. This paper tries to show that such attacks pose a serious, under-measured threat to autonomous driving perception, and that the threat can be studied at scale with a simple simulation. It proposes a simulation rule that swaps the red/blue and green channel values on alternating image rows to create strip artifacts, then shows that object-detection models react to those simulated images statistically the same as they do to images from real electromagnetic attacks. Applying the simulator to thousands of traffic scenes from the BDD100k dataset, it finds that traffic object detection and drivable-area segmentation degrade consistently as attack intensity increases, with severe attacks cutting detection performance by large margins in nearly every condition. The paper presents this as a foundation for building more ESIA-resistant perception models and for testing other safety-critical camera systems.

What carries the argument

The load-bearing object is the ESIA simulation rule: an RGB image is corrupted by selecting impacted rows; on even rows the red value is replaced by the next row's green and the green by the next row's blue, and on odd rows green is replaced by next row's red and blue by next row's green, after which the image is reassembled as if undergoing demosaicing. A single row index controls the strip's position, and the number of impacted rows controls severity. The rule is what lets the paper generate thousands of under-attack traffic images without a physical radio setup, and it is justified by comparing the resulting mAP degradation to the degradation caused by real ESIA images, an equivalence the paper supports with t-tests.

What would settle it

Collect a fresh set of real ESIA images on traffic scenes not used in calibration, apply the simulator to the same clean frames with matched strip counts and positions, and compare detector and segmentation degradation with a t-test; a p-value below 0.05 for any severity level would show the simulation is not statistically equivalent to the real attack.

Watch

Extended reading notes

Core claim

The central claim is that ESIA distortion is, for practical purposes, a row-wise color-channel corruption: on even-indexed impacted rows red is replaced by green from the next row and green by blue from the next row, while odd rows perform the complementary swap, and the number and position of the resulting color strips encode the attack severity. Using 100 COCO images retaken under real electromagnetic attacks as reference, the paper generates simulated versions with the same strip counts and positions (1-6 for mild, 7-12 for moderate, 13-20 for severe) and compares how much twelve object detectors' mAP drops. A t-test at the 5% level yields p-values above 0.05 for all three severity levels and all three mAP criteria, so the paper concludes that simulated and real attacks are statistically indistinguishable in their effect on detectors. It then applies the simulator to 10,000 BDD100k validation images grouped by weather, scene, and time of day, and reports that mAP50 and mIoU decrease from unattacked to severe conditions for HybridNets, A-YOLOM, and YOLOP, with attention-map visualizations showing the models shifting attention to misleading regions and, in some cases, marking oncoming-traffic lanes as drivable or sharply shrinking the drivable area.

Load-bearing premise

Everything rests on the claim that a real ESIA's effect on AI perception is fully captured by swapping red/blue and green channels on alternating rows, with only the number and location of the resulting strips varying.

Editorial extensions

If this is right

  • Simulated ESIA can serve as a low-cost substitute for physical attack data when evaluating perception robustness, because detector-level degradation matches real attacks.
  • Traffic object detection is highly vulnerable: across the tested multi-task models, severe simulated attacks reduce mAP50 by roughly 60 to 70 percent in most subcategories.
  • Drivable-area segmentation degrades less but still meaningfully, with severe attacks lowering mIoU by about 10 to 14 percent depending on model and condition.
  • Environment structure modulates ESIA impact: models show the smallest relative drop in cluttered city-street scenes and the largest relative drop in simpler highway scenes.
  • ESIA can create concrete safety hazards, not just metric drops: attention-map examples show reverse lanes being reclassified as drivable and drivable area shrinking after attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If strip count and position truly exhaust the model-relevant geometry of ESIA, the same simulator could be inverted to generate training data for adversarial robustness, since augmenting traffic images with such artifacts requires only code, not a radio bench.
  • A natural next test is to capture real ESIA images on BDD100k-style traffic scenes and run the same t-test on mAP and mIoU; this would show whether the equivalence holds beyond the 100 COCO images used for calibration.
  • The channel-swap rule also suggests a cheap defense probe: practitioners could audit any camera-based perception stack by varying the number and location of strips before committing to physical hardware tests.
  • Because the paper's severity labels are tied to strip counts from one physical attack setup, transfer to other camera circuits, raw-format pipelines, or signal frequencies remains an open question.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper addresses electromagnetic signal injection attacks (ESIA) on camera-based perception in autonomous driving. It proposes a simulation method that reproduces ESIA-induced color strips by swapping red/blue and green channel values on selected even/odd image rows, and it generates a simulated attack dataset. The method is validated against a real ESIA dataset by comparing mAP degradation across 13 object detection models using t-tests, and it is then applied to BDD100k images. Using three multi-task models (HybridNets, A-YOLOM, YOLOP), the paper reports that simulated attacks degrade traffic object detection and drivable-area segmentation across weather, scene, and time-of-day conditions, with monotonically increasing degradation from mild to severe attack intensity. It also identifies concrete driving-risk cases, such as contraflow lane detection and drivable-area reduction, and visualizes attention shifts with Grad-CAM.

Significance. If the simulation were validated as representative of real ESIA, the contribution would be valuable: it would provide a low-cost, scalable way to study ESIA robustness across diverse traffic scenarios, and the systematic results on weather, scene, and time-of-day would be useful for safety analysis of camera-based perception. The paper also has concrete strengths: the channel-swap rule is a mechanism-inspired, non-black-box simulation hypothesis; the evaluation spans a broad set of detection architectures; and the attention analysis and risk-case discussion connect metric degradation to plausible driving consequences. However, the central claim that simulated and real attacks are statistically indistinguishable is not currently supported by the evidence, and the validation has an in-sample component. These issues are load-bearing because the safety conclusions depend on simulated attacks faithfully representing real ESIA.

major comments (4)
  1. [Evaluation of Similarity between Simulated Attack and Real Attack, Table 1] The statement that 'images generated by simulated attacks do not differ significantly from those generated by real attacks' is not supported by the reported analysis. The t-test used has the null hypothesis of equal mean degradation; a p-value above 0.05 can only indicate that no difference was detected, not that the two conditions are equivalent. With 13 paired model measurements and no pre-specified equivalence margin, power analysis, or confidence intervals, the high p-values in Table 1 (e.g., 0.876, 0.803, 0.950 for mild attacks) are also compatible with a true difference too small for this sample to resolve. The paper should either perform an equivalence test (e.g., TOST with a prespecified margin based on a meaningful mAP difference), report confidence intervals for the mean differences, and provide an effect-size analysis, or it should soften the claim to 'no statistically significant difference was detected' and avoid drawing safety conclusions from that absence of evidence.
  2. [Simulation Method and Evaluation of Similarity between Simulated Attack and Real Attack] The validation is in-sample: the strip-count ranges [1,6], [7,12], and [13,20] and the strip locations used in the simulation are derived from the same real-attack dataset (Zhang et al. 2024a) that is then used as the comparison benchmark. Consequently, the t-tests only check whether these two geometric parameters suffice to reproduce model-level degradation on those 100 images; they do not validate that the simulation captures the full pixel-level ESIA distortion, nor that the rule transfers to BDD100k images with different content and multi-task models. The paper should validate on held-out real attack images whose strip counts and placements were not used in calibration, and should compare image-level fidelity (e.g., SSIM, per-pixel color error, or artifact location accuracy) in addition to downstream model metrics.
  3. [Simulation Method] The load-bearing approximation that 'neighboring pixel values are similar' and that the effect on AI models depends mainly on strip count and location rather than finer pixel-level artifact details is stated but not independently tested. No ablation is provided that varies strip placement, strip width, channel-swap details, or pixel-level artifact realism while holding other factors fixed. Without such an ablation, the claim that the simulation captures the mechanism relevant to model behavior remains an assumption, not an established premise. Adding an ablation study or a per-image similarity analysis would materially strengthen the validity of the transfer to BDD100k.
  4. [Evaluation of Similarity between Simulated Attack and Real Attack; Impacts of ESIA in Different Driving Scenarios] The similarity validation is performed only for object detection (mAP), but the BDD100k study also draws conclusions about drivable-area segmentation. Since segmentation models may respond to different artifacts than detection models, the claim that simulated attacks are representative of real ESIA is not automatically transferable to the segmentation task. The paper should either validate the simulation against real ESIA for segmentation or explicitly present the segmentation results as simulation-only predictions that have not been verified against real attacks.
minor comments (5)
  1. [General] There are several typographical and terminological inconsistencies, including 'EISA' for ESIA in the Conclusion and 'for to simulate' in the same section; these should be corrected.
  2. [Evaluation of Similarity between Simulated Attack and Real Attack] The claim about 'consistent trends' in Figure 4 is based on visual inspection; reporting a correlation coefficient (e.g., Pearson or Spearman) or the mean absolute difference between real and simulated degradation would make the comparison quantitative.
  3. [Experimental Results and Analysis] The notation D Smild, D Smoderate, and D Ssevere in Tables 4 and 5 is not fully defined before its first use; the text should define D S_i and D M_i with explicit formulas.
  4. [Experimental Results and Analysis] The paper states that 'all p-values from the t-tests for ΔmAP exceed the 5% threshold'; it would be more precise to say 'exceed 0.05' and to specify whether the t-test was two-tailed or one-tailed, as this affects interpretation.
  5. [Simulation of ESIA] No code, dataset, or reproducibility statement is provided; releasing the simulation code and the generated dataset would substantially increase the impact and allow independent verification.

Circularity Check

1 steps flagged · score 5.0 of 10

Simulation is validated on the same real-attack images from which its strip counts and locations are taken, making the 'indistinguishable' claim partially by construction.

  1. fitted input called prediction [Section 'Simulation of ESIA', subsection 'Evaluation of Similarity between Simulated Attack and Real Attack'; Table 1]
    "According to this real attack image set, the counts of color strips induced by mild, moderate, and severe attacks, fall in the ranges of[1, 6], [7, 12], and [13, 20], respectively. ... Specifically, we use the simulated attack method to produce the same number and location of color strips as the real ones (for each image at each severity level). ... These tests and analyses demonstrate that images generated by simulated attacks do not differ significantly from those generated by real attacks."

    The simulation's key scene-specific parameters—strip counts and strip locations—are taken directly from the same real-attack images that are later used as the benchmark for validation. The t-test in Table 1 therefore does not test whether the simulation predicts real attacks out-of-sample; it tests only whether, after forcing identical strip geometry, the channel-swap rendering leaves model mAP degradation statistically indistinguishable. The conclusion 'do not differ significantly' is thus partly guaranteed by construction, because the geometric perturbation has been matched before the comparison. Additionally, the severity bins [1,6], [7,12], [13,20] were estimated from Zhang et al. (2024a)'s dataset and then evaluated on that same dataset, making the validation in-sample.

full rationale

The paper's core novelty is the ESIA simulation rule (even/odd row red-blue/green channel swap), which is a reasonable mechanistic hypothesis and is not itself fitted to model outputs. The degradation experiments on BDD100k (Tables 3-5) are also independent measurements: the models' mAP/mIoU drops are not constructed by the simulation definition. However, the central validation claim—that simulated attack images are statistically indistinguishable from real attack images—is partially circular. The simulation is calibrated to Zhang et al. (2024a)'s real-attack dataset: strip-count severity bins ([1,6], [7,12], [13,20]) are read off that dataset, and for each validation image the simulation is explicitly given the same number and location of color strips as the real attack image. The subsequent t-test then compares model degradation only after this geometric matching. A non-significant p-value is therefore not evidence of general equivalence; it is largely a check on the residual channel-swap rendering. Because the same dataset supplies both the fitted parameters and the benchmark, the 'do not differ significantly' conclusion is in-sample and partly by construction. The self-citation to Zhang et al. (2024a) (shared authors: Zhang, Zhai, Fu) is load-bearing in this calibration loop, but the underlying measurements are empirical, so the self-citation alone would not be circular. The t-test's use as equivalence evidence is statistically fragile (no margin or power analysis), but that is an inference problem, not a circularity. Overall: partial circularity in the validation protocol, with independent content in the rendering rule and the scenario study.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical entities are introduced. The framework relies on a channel-swap model imported from prior work, severity bins fitted to the authors' own real-attack dataset, and an assumed transfer from COCO detectors to BDD100k multi-task models.

free parameters (2)
  • strip count ranges per severity level = Mild [1,6], Moderate [7,12], Severe [13,20]
    Taken from the real attack dataset of Zhang et al. 2024a and used both to generate simulated attacks and to define severity in the BDD100k experiments. The ranges come from observation of 100 real attack images.
  • strip row placement = Not specified; matched to real images in validation, random or unspecified in BDD100k
    The placement of color strips determines which image content is corrupted; in the COCO validation it is matched to the real attack images, and in the BDD100k experiments the placement rule is not fully specified.
assumptions (5)
  • domain assumption ESIA induces packet loss and channel misreading that produce color strips
    Adopted from prior work (Jiang et al. 2023; Zhang et al. 2024a) and not independently re-established here.
  • ad hoc to paper Neighboring pixel values are similar enough for the four-corner approximation
    Stated in the Simulation Method paragraph: 'Assuming neighboring pixel values are similar'.
  • ad hoc to paper The effect on AI models depends mainly on strip count and location, not finer pixel-level artifact details
    The validation only matches strip count and location between real and simulated images, then compares mAP drops; no pixel-level fidelity is checked.
  • domain assumption Validation results on COCO object detectors transfer to BDD100k multi-task traffic models
    The 13 detectors used for validation and the 3 multi-task models used in the main experiments are different, as are the datasets; transfer is assumed rather than tested against real attacks on traffic scenes.
  • domain assumption A t-test with p > 0.05 indicates no practically meaningful difference
    Used in the similarity evaluation; with 13 paired observations the test has low power, and no equivalence margin is defined.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception." pith.science (2026). https://pith.science/paper/TSW7TT7G

@misc{pith2026250105239,
  author       = {Pith},
  title        = {Pith review of: Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TSW7TT7G}},
  note         = {Machine review of arXiv:2501.05239}
}
read the original abstract

Autonomous vehicles rely on camera-based perception systems to comprehend their driving environment and make crucial decisions, thereby ensuring vehicles to steer safely. However, a significant threat known as Electromagnetic Signal Injection Attacks (ESIA) can distort the images captured by these cameras, leading to incorrect AI decisions and potentially compromising the safety of autonomous vehicles. Despite the serious implications of ESIA, there is limited understanding of its impacts on the robustness of AI models across various and complex driving scenarios. To address this gap, our research analyzes the performance of different models under ESIA, revealing their vulnerabilities to the attacks. Moreover, due to the challenges in obtaining real-world attack data, we develop a novel ESIA simulation method and generate a simulated attack dataset for different driving scenarios. Our research provides a comprehensive simulation and evaluation framework, aiming to enhance the development of more robust AI models and secure intelligent systems, ultimately contributing to the advancement of safer and more reliable technology across various fields.

Figures

Figures reproduced from arXiv: 2501.05239 by the authors.

Figure 1
Figure 1. A general process of autonomous driving systems [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The simulation process generates arbitrary adver [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Similar performance (∆mAP50) between (a) real attack images and (b) simulated attack images across differ￾ent object detection models. Weather Time of Day Scene Overcast (1239) Clear (5346) Rainy (738) Snowy (769) Partly Cloudy (738) Daytime (5258) Night (3929) Dawn (778) City Street (6112) Highway (2499) Residential (1253) Total (8830) Total (9965) Total (9864) [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: Example real (left) and simulated (right) attack im [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 5
Figure 5. Figure 5: Model attention variations across attack intensities [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Model attention variations across attack intensities [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 34 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    V.; Azevedo, P.; Cardoso, V

    Badue, C.; Guidolini, R.; Carneiro, R. V.; Azevedo, P.; Cardoso, V. B.; Forechi, A.; Jesus, L.; Berriel, R.; Paixao, T. M.; Mutz, F.; et al. 2021. Self-driving cars: A survey. Expert systems with applications, 165: 113816

    work page 2021

  4. [4]

    Cai, Z.; and Vasconcelos, N. 2019. Cascade R-CNN: High quality object detection and instance segmentation. IEEE transactions on pattern analysis and machine intelligence, 43(5): 1483--1498

    2019

  5. [5]

    Carion, N.; Massa, F.; Synnaeve, G.; Usunier, N.; Kirillov, A.; and Zagoruyko, S. 2020. End-to-end object detection with transformers. In European conference on computer vision, 213--229. Springer

    2020

  6. [6]

    Carlini, N.; and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), 39--57. IEEE

    work page 2017

  7. [7]

    I.; and Wainwright, M

    Chen, J.; Jordan, M. I.; and Wainwright, M. J. 2020. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 IEEE Symposium on Security and Privacy (SP), 1277--1294. IEEE

    work page 2020

  8. [8]

    K.; and Yang, Y

    Duan, R.; Ma, X.; Wang, Y.; Bailey, J.; Qin, A. K.; and Yang, Y. 2020. Adversarial camouflage: Hiding physical-world attacks with natural styles. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 1000--1008

    work page 2020

Show all 49 references
  1. [9]

    Eykholt, K.; Evtimov, I.; Fernandes, E.; Li, B.; Rahmati, A.; Xiao, C.; Prakash, A.; Kohno, T.; and Song, D. 2018. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, 1625--1634

    2018

  2. [10]

    Feng, D.; Haase-Sch \"u tz, C.; Rosenbaum, L.; Hertlein, H.; Glaeser, C.; Timm, F.; Wiesbeck, W.; and Dietmayer, K. 2020. Deep multi-modal object detection and semantic segmentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions on Intelligent Tra...

    2020

  3. [11]

    Fu, Z.; Zhi, Y.; Ji, S.; and Sun, X. 2021. Remote Attacks on Drones Vision Sensors: An Empirical Study . IEEE Transactions on Dependable and Secure Computing, 19(5): 3125--3135

    2021

  4. [12]

    Ge, Z.; Liu, S.; Wang, F.; Li, Z.; and Sun, J. 2021. Yolox: Exceeding yolo series in 2021. arXiv preprint arXiv:2107.08430

    2021 arXiv

  5. [13]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples. In Bengio, Y.; and LeCun, Y., eds., 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings

    2015

  6. [14]

    A.; Ouni, B.; and Shafique, M

    Guesmi, A.; Hanif, M. A.; Ouni, B.; and Shafique, M. 2023. Physical adversarial attacks for camera-based smart systems: Current trends, categorization, applications, research challenges, and future outlook. IEEE Access

    2023

  7. [15]

    He, K.; Gkioxari, G.; Doll \'a r, P.; and Girshick, R. 2017. Mask r-cnn. In Proceedings of the IEEE international conference on computer vision, 2961--2969

    2017

  8. [16]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2015. Spatial pyramid pooling in deep convolutional networks for visual recognition. IEEE transactions on pattern analysis and machine intelligence, 37(9): 1904--1916

    2015

  9. [17]

    Ji, X.; Cheng, Y.; Zhang, Y.; Wang, K.; Yan, C.; Xu, W.; and Fu, K. 2021. Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision . In 2021 IEEE Symposium on Security and Privacy (SP), 160--175. IEEE

    2021

  10. [18]

    Jiang, Q.; Ji, X.; Yan, C.; Xie, Z.; Lou, H.; and Xu, W. 2023. GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI . In 32nd USENIX Security Symposium (USENIX Security 23), 7249--7266

    2023

  11. [19]

    Jing, P.; Tang, Q.; Du, Y.; Xue, L.; Luo, X.; Wang, T.; Nie, S.; and Wu, S. 2021. Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations. In 30th USENIX Security Symposium (USENIX Security 21), 3237--3254

    2021

  12. [20]

    C.; and Fu, E

    Kang, D.; Zhang, Y.; Tam, W. C.; and Fu, E. Y. 2024. Anti-ESIA: Analyzing and Mitigating Impacts of Electromagnetic Signal Injection Attacks. arXiv preprint arXiv:2409.10922

    2024 arXiv

  13. [21]

    K \"o hler, S.; Baker, R.; and Martinovic, I. 2022. Signal Injection Attacks against CCD Image Sensors . In Proc. 2022 ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022). ACM

    2022

  14. [22]

    Li, Y.; Mao, H.; Girshick, R.; and He, K. 2022. Exploring plain vision transformer backbones for object detection. In European conference on computer vision, 280--296. Springer

    2022

  15. [23]

    Lin, T.-Y.; Goyal, P.; Girshick, R.; He, K.; and Doll \'a r, P. 2017. Focal loss for dense object detection. In Proceedings of the IEEE international conference on computer vision, 2980--2988

    2017

  16. [24]

    Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft COCO: Common Objects in Context . In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V ...

    2014

  17. [25]

    Liu, N.; Nikitas, A.; and Parkinson, S. 2020. Exploring expert perceptions about the cyber security and privacy of Connected and Autonomous Vehicles: A thematic analysis approach. Transportation research part F: traffic psychology and behaviour, 75: 66--86

    2020

  18. [26]

    Liu, Z.; Lin, Y.; Cao, Y.; Hu, H.; Wei, Y.; Zhang, Z.; Lin, S.; and Guo, B. 2021. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, 10012--10022

    2021

  19. [27]

    Ljubi, K.; and Groznik, A. 2023. Role played by social factors and privacy concerns in autonomous vehicle adoption. Transport policy, 132: 1--15

    2023

  20. [28]

    B.; and Kolbe, L

    Nastjuk, I.; Herrenkind, B.; Marrone, M.; Brendel, A. B.; and Kolbe, L. M. 2020. What drives the acceptance of autonomous driving? An investigation of acceptance factors from an end-user's perspective. Technological Forecasting and Social Change, 161: 120319

    2020

  21. [29]

    Petit, J.; Stottelaar, B.; Feiri, M.; and Kargl, F. 2015. Remote attacks on automated vehicles sensors: Experiments on camera and lidar. Black Hat Europe, 11(2015): 995

    2015

  22. [30]

    Ranjan, A.; Janai, J.; Geiger, A.; and Black, M. J. 2019. Attacking optical flow. In Proceedings of the IEEE/CVF international conference on computer vision, 2404--2413

    2019

  23. [31]

    Redmon, J.; and Farhadi, A. 2018. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767

    2018 arXiv

  24. [32]

    R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D

    Selvaraju, R. R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, 618--626

    2017

  25. [33]

    Song, D.; Eykholt, K.; Evtimov, I.; Fernandes, E.; Li, B.; Rahmati, A.; Tramer, F.; Prakash, A.; and Kohno, T. 2018. Physical adversarial examples for object detectors. In 12th USENIX workshop on offensive technologies (WOOT 18)

    2018

  26. [34]

    Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2014. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014

    2014

  27. [35]

    Tan, M.; and Le, Q. 2019. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, 6105--6114. PMLR

    2019

  28. [36]

    Tan, M.; Pang, R.; and Le, Q. V. 2020. Efficientdet: Scalable and efficient object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10781--10790

    2020

  29. [37]

    Vu, D.; Ngo, B.; and Phan, H. 2022. Hybridnets: End-to-end perception network. arXiv preprint arXiv:2203.09035

    2022 arXiv

  30. [38]

    J.; and Zhang, N

    Wang, J.; Wu, Q. J.; and Zhang, N. 2024. You only look at once for real-time and generic multi-task. IEEE Transactions on Vehicular Technology

    2024

  31. [39]

    Wu, D.; Liao, M.-W.; Zhang, W.-T.; Wang, X.-G.; Bai, X.; Cheng, W.-Q.; and Liu, W.-Y. 2022. Yolop: You only look once for panoptic driving perception. Machine Intelligence Research, 19(6): 550--562

    2022

  32. [40]

    Yan, C.; Xu, W.; and Liu, J. 2016. Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle. Def Con, 24(8): 109

    2016

  33. [41]

    Yan, C.; Xu, Z.; Yin, Z.; Mangard, S.; Ji, X.; Xu, W.; Zhao, K.; Zhou, Y.; Wang, T.; Gu, G.; et al. 2022. Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition . In 31st USENIX Security Symposium (USENIX Security 22), 1957--1974

    2022

  34. [42]

    Yu, F.; Chen, H.; Wang, X.; Xian, W.; Chen, Y.; Liu, F.; Madhavan, V.; and Darrell, T. 2020. BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    2020

  35. [43]

    M.; and Shum, H.-Y

    Zhang, H.; Li, F.; Liu, S.; Zhang, L.; Su, H.; Zhu, J.; Ni, L. M.; and Shum, H.-Y. 2022. Dino: Detr with improved denoising anchor boxes for end-to-end object detection. arXiv preprint arXiv:2203.03605

    2022 arXiv

  36. [44]

    Zhang, H.; Wang, Y.; Dayoub, F.; and Sunderhauf, N. 2021 a . Varifocalnet: An iou-aware dense object detector. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 8514--8523

    2021

  37. [45]

    Zhang, J.; Lou, Y.; Wang, J.; Wu, K.; Lu, K.; and Jia, X. 2021 b . Evaluating adversarial attacks on driving safety in vision-based autonomous vehicles. IEEE Internet of Things Journal, 9(5): 3443--3456

    2021

  38. [46]

    Y.; Chau, S.-Y.; and Luo, X

    Zhang, Y.; Cheung, M.; Yang, C.; Zhai, X.; Shen, Z.; Ji, X.; Fu, E. Y.; Chau, S.-Y.; and Luo, X. 2024 a . Modeling Electromagnetic Signal Injection Attacks on Camera-based Smart Systems: Applications and Mitigation. arXiv preprint arXiv:2408.05124

    2024 arXiv

  39. [47]

    Y.; Jiang, Q.; Yan, C.; Chau, S.-Y.; Ngai, G.; Leong, H.-V.; Luo, X.; and Xu, W

    Zhang, Y.; Yang, C.; Fu, E. Y.; Jiang, Q.; Yan, C.; Chau, S.-Y.; Ngai, G.; Leong, H.-V.; Luo, X.; and Xu, W. 2024 b . Understanding Impacts of Electromagnetic Signal Injection Attacks on Object Detection. 2024 IEEE International Conference on Multimedia and Expo (ICME)

    2024

  40. [48]

    Zhu, W.; Ji, X.; Cheng, Y.; Zhang, S.; and Xu, W. 2023. TPatch: A Triggered Physical Adversarial Patch . In 32nd USENIX Security Symposium (USENIX Security 23), 661--678

    2023

  41. [49]

    Zong, Z.; Song, G.; and Liu, Y. 2023. Detrs with collaborative hybrid assignments training. In Proceedings of the IEEE/CVF international conference on computer vision, 6748--6758

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.