Adaptive Adversarial Videos on Roadside Billboards: Dynamically Modifying Trajectories of Autonomous Vehicles Deep neural networks (DNNs) are being incorporated into various autonomous systems like selfdriving cars and robots. However, there is a rising concern about the robustness of these systems because of their susceptibility to adversarial attacks on DNNs. Past research has established that DNNs used for classification and object detection are prone to attacks causing targeted misclassification. In this paper, we show the effectiveness of an adversarial dynamic attack on an endtoend trained DNN controlling an autonomous vehicle. We launch the attack by installing a billboard on the roadside and displaying videos to approaching vehicles to cause the DNN controller in the vehicle to generate steering commands that cause, for example, unintended lane changes or motion off the road causing accidents. The billboard has an integrated camera estimating the pose of the oncoming vehicle. The approach enables dynamic adversarial perturbation that adapts to the relative pose of the vehicle and uses the dynamics of the vehicle to steer it along adversarychosen trajectories while being robust to variations in view, lighting, and weather. We demonstrate the effectiveness of the attack on a recently published offtheshelf endtoend learningbased autonomous navigation system in a highfidelity simulator, CARLA (CAR Learning to Act). The proposed approach may also be applied to other systems driven by an endtoend trained network.

Legislating Autonomous Vehicles against the Backdrop of Adversarial Machine Learning Findings Recent studies on adversarial machine learning1 made Michael Grossman, a Texasbased injury lawyer, skeptical of the viability of autonomous vehicles.2 These studies had pointed out that adversarial attacks or perturbations on pictures makes it difficult for the algorithm to correctly classify the content of that picture. If this is applied to traffic sign recognition, simple graffiti on the sign could mislead the algorithm that is analyzing the picture of the traffic sign captured by the camera. 3 Rather than recognizing the traffic sign for what it is, the algorithm could attribute a different meaning to the traffic sign. The consequences could be disastrous, especially if, for example, a stop sign would be read as a speeding sign.4 When rational car manufacturers know this defect, they will not proceed with the marketing of autonomous vehicles.