BSides Dubai 2018: Adversarial Attacks on Autonomous Cars - The Missed Gap

Rudolph Azeemi, Director of the Center for Cybersecurity at NYU Abu Dhabi, presents research on adversarial attacks targeting autonomous vehicle object detection systems. He contextualizes autonomous vehicle development from DARPA challenges in the 1970s–1980s to contemporary prototypes by Tesla and Uber, noting that by 2025, over $3.7 billion in semiconductor industry investment is expected. However, a critical security awareness gap exists: at the Dubai Autonomous World Challenge (350–400 submissions), fewer than 10% of entries addressed cybersecurity issues. Real-world failures underscore the risk—an Uber autonomous vehicle fatality in September 2018 when a pedestrian was struck, and Tesla incidents where object detection failed to identify obstacles.

The research team developed an object detector using YOLO (You Only Look Once), selected for efficiency and speed, paired with a generator to attack detection via adversarial examples—minimally modified images that fool deep learning models. The team experimented with one-pixel, three-pixel, and four-pixel attacks using differential evolution, testing on Udacity and CARLA simulators. The methodology mirrors physical attacks (such as UC Berkeley's work manipulating traffic signs) but uses algorithmic perturbations. By iteratively modifying pixels, the team generated adversarial samples barely perceptible to human eyes yet causing misclassification of road signs and objects.

The adversarial examples successfully altered the steering angle and trajectory of the simulated autonomous vehicle. Tiny pixel modifications created significant changes in classifier output, with the team demonstrating modified steering commands that shifted vehicle routes. They successfully fooled the Udacity classifier through one-pixel attacks, changing central and right-side camera images. Throttle control remained unmodified.

Azeemi emphasizes that autonomous vehicle security requires a holistic, multi-stakeholder approach involving academia, industry, and government. Testing must extend beyond lab environments to real-world scenarios. Current security algorithms lag behind autonomous vehicle deployment pace. The speaker advocates for bridging research-industry gaps, establishing measurable security models, and raising cybersecurity awareness among manufacturers. The presentation concludes with demonstrations at a car hacking village and announcements of an autonomous vehicle racing challenge for audience participation.