## 5 Autonomous Vehicle Vulnerabilities
### Countermeasures for Autonomous Vehicles
This technique now commonly referred to as the fast gradient sign method (FGSM) was an effective tool for generating adversarial instances. The researchers also introduced adversarial training, a technique used to fortify DNNs against such adversarial instances, advancing our knowledge of both the vulnerabilities and potential defenses in this field. The vulnerabilities of DNNs were further highlighted by [PERSON] and [PERSON] [97]. Utilizing adversarial examples derived from images taken by a mobile phone camera, they revealed the susceptibility of machine learning (ML) and deep learning (DL) techniques to attacks in real-world scenarios. Using the basic iterative method (BIM), a more sophisticated version of FGSM, they produced adversarial examples that successfully deceived advanced image classifiers. Further research [98] highlighted the susceptibility of convolutional neural networks (CNNs), the most sophisticated deep-learning-based image categorization algorithms, to simple manipulations such as rotations and translations. Another study [99] emphasized this vulnerability, demonstrating that even basic geometric transformations like translation, rotation, and blurring could confound ten state-of-the-art CNNs. Meanwhile, [PERSON] et al. [100] offered a different approach by modifying the neurons of an already trained model, demonstrating a stealthy back-door attack on the model. The researchers maliciously injected the ML model and applied it to an autonomous vehicle, where a specific trigger, a particular billboard in this case, caused the vehicle to behave unpredictably. With a different strategy, [PERSON] et al. [101] constructed a white-box Jacobian saliency-based adversarial attack (JSMA), which manipulated the mapping between the input and output of DNNs to deceive the classifiers. They also proposed a defensive technique, namely defensive distillation, where a model is trained to predict the probabilities of another model trained on the baseline standard. This aimed to foster a higher emphasis on accuracy, serving as protection against adversarial perturbations. [PERSON] et al. [102] extended their work to present a black-box adversarial ML attack that exploited the transferability property of adversarial examples. This method not only deceived ML/DL classifiers but also bypassed the defensive distillation mechanism, highlighting the sophistication of adversarial attacks. [PERSON] and [PERSON] [103] introduced a synergy of adversarial techniques known as C&W attacks, utilizing three distinct distance metrics: L1, L2, and L\({}_{\infty}\). These attacks were successful in evading both defensive distillation and DNN classifiers, exposing the inadequacy of existing defensive strategies. In another study [PERSON] and [PERSON] [104] demonstrated that their adversarial attacks could bypass ten commonly used defensive techniques against adversarial instances, further emphasizing the complexity of the problem. Another alarming vulnerability was demonstrated by [PERSON] et al. [105], who reported that a malicious patch, when applied to an original image, led the deep model to misclassify that image. These universal adversarial patches could deceive classifiers without the need to know about other objects present in the image, allowing for the offline creation and dissemination of such patches. [PERSON] et al. [106] adopted an alternative approach by employing differential evolution to generate one-pixel adversarial perturbations. This novel attack demonstrated the capability of minimal yet calculated manipulations to compromise a variety of neural networks. Despite substantial progress in identifying and comprehending these weaknesses, effective defense mechanisms against adversarial attacks remain elusive, while some countermeasures have proven to be somewhat effective against low-level attacks, they are ineffective against a broader range of sophisticated attacks.