Researchers crash Baidu robo-cars with tinfoil and paint daubed on cardboard
- Reference: 1717393698
- News link: https://www.theregister.co.uk/2024/06/03/baidu_robotaxi_attack/
- Source link:
"Extensive experiments based on a real-world AV testbed show that the proposed attack can continuously hide a target vehicle from the perception system of a victim AV using only two small adversarial objects," [1]explained the researchers, whose work was published last week in The 30th Annual International Conference on Mobile Computing and Networking.
While [2]others have proven vulnerabilities inherent in AV systems, this particular team expanded on single-sensing modality or camera-LiDAR manipulation, and tricked systems that employ Lidar, camera, and radar together.
[3]
The new attack leverages mmWave reflection – the signals that provide object detection in such systems – on a smooth metal surface. They do this in a way researchers refer to as "low cost" and "easily fabricated" as it involves strategically arranging metal foil and colored patches on cardboard.
[4]
[5]
"By placing a smooth metal surface between the radar and a target vehicle with a specific orientation, the transmitted mmWave signals can be deflected from the radar receiver, leading to a reduction in the energy of echo signals from the vehicle," wrote the study authors. "When the energy becomes lower than a threshold, the target vehicle will be hidden from radar perception."
Meanwhile, the color patch misrepresented input image pixel values and affected Apollo's camera perception. Reflections confused its read on Lidar lasers. Thus all three sensing modalities were compromised.
[6]Baidu's robotaxi division to wheel into profit next year
[7]GhostStripe attack haunts self-driving cars by making them ignore road signs
[8]Baidu's PR head has a PR problem after workaholic social media posts
[9]Waymo robotaxi drives down wrong side of street after being alarmed by unicyclists
The boffins suggest that the attack could be carried out with drones, which serve to "hide" a secondary vehicle from the victim AV by projecting or carrying the adversarial object. Absent a drone, the trickster collage could be mounted on the front vehicle and disguised as an advertisement.
[10]
Baidu robo-taxi hack by drone – Click to enlarge
[11]
Baidu robo taxi hack by advert – Click to enlarge
"Since the drones only hover for a few seconds during the attack and can fly away from the victim AV immediately after the attack, the attack can be performed with high stealthiness and flexibility," noted the researchers.
While Baidu Apollo platforms were used in the attack, the attack strategy could theoretically be applied to other multi-sensor fusion systems.
[12]
Baidu has [13]expanded its robo-taxi operations across China. The tech giant has charged for autonomous rides in its Apollo Go cabs since November 2021 and now operates robo-taxis in more than ten Chinese cities.
Its service in Wuhan alone covers 3,000 square kilometers and half the city's population.
The biz expects its robo-taxi wing to be profitable next year. ®
Get our [14]Tech Resources
[1] https://dl.acm.org/doi/abs/10.1145/3636534.3649372
[2] https://www.theregister.com/2024/05/10/baidu_apollo_hack/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zl2URcm1Pxh4-YSwxol0cAAAAEA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zl2URcm1Pxh4-YSwxol0cAAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zl2URcm1Pxh4-YSwxol0cAAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/05/17/apollo_go_profitable/
[7] https://www.theregister.com/2024/05/10/baidu_apollo_hack/
[8] https://www.theregister.com/2024/05/09/baidu_pr_chief/
[9] https://www.theregister.com/2024/04/23/waymo_selfdriving_car_unicycle/
[10] https://regmedia.co.uk/2024/06/03/baidu_robotaxi_hack_by_drone.jpg
[11] https://regmedia.co.uk/2024/06/03/baidu_robotaxi_hack_by_advert.jpg
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zl2URcm1Pxh4-YSwxol0cAAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2024/05/17/apollo_go_profitable/
[14] https://whitepapers.theregister.com/
Okay, but if you're willing to deploy a drone to drop something on a car, then there are several ways you could cause a human-piloted car to crash, too.
Cost and deniability.
A piece of cardboard and aluminium foil is very likely to be almost completely destroyed, and the wreckage overlooked in a subsequent collision investigation.
Even if identified as the cause, there won't be purchase records etc, unlike wreckage of a drone that may have traceable serial numbers.
Dropping something made with bits from the local supermarket from a drone is also very cheap, especially as you get to use the drone more than once.
A "kick me" sign is much cheaper than actually kicking someone.
..Alternatively, the drone can cover up the windshield of a fast driving car, blinding the driver and thus provoke a crash.
....Please fund my next paper...
I need money for 10 cars of various types, 10 drones, 10 cans of spray paint, some tarp and some flash-bang grenades. I also wish to rent a part of the M25.
You mean,... like Q made for 007? But now as a drone?
I mean like the Citroen 2CV.
If you ever see one with a dent perpendicular across the bonnet, then it will have had a very good driver.
A fault in the latching mechanism meant that the bonnect could come loose and open while the car was driving at speed (max. ca. 90 kph* for the "large" engine with 32 hp if I recall correctly).
This would leave the driver with no forward view (keep in mind that the side-windows could also not be fully lowered, just folded down halfways). A good driver would keep the steering centered and apply brakes without crashing.
*: At which point, the un-supported upper side-walls would vibrate at about 2 Hz with an amplitude of about 5 cm. ...Good times :)
"While Baidu Apollo platforms were used in the attack, the attack strategy could theoretically be applied to other multi-sensor fusion systems."
I'm curious was there a reason researchers in America chose to do their research on Baidu which is based in China? Was it fear of litigation in the US? Something like this could hit shareholder and investor confidence. As for mitigation I'm not too clued up on the technology but couldn't adjustments be made to the standard camera because it's not like it's invisible to one or is it?
The actual research was most likely by one of the US manufacturers on their own cars but rather than admit it, they’re throwing shade at the opposition to get into a lucrative market.
"I'm curious was there a reason researchers in America chose to do their research on Baidu which is based in China? "
If you're suggesting this is about economic nationalism, you might care to follow the link to the paper abstract and note the authors' names. That doesn't disprove any economic nationalism theory but it's interesting to observe they all appear to be of Chinese heritage.
I would guess it's more that the Baidu platform is open and available, and everyone else hides behind "Proprietary Company Data"...
You can only test, what's available...
Conspiracy
.... a reason researchers in America chose to do their research on Baidu which is based in China
American money funding potentially dangerous research in Wuhan? Sounds like conspiracy theory to me. Nothing to see here. Move along please.
Have they done the same experiment
on human drivers?
Re: Have they done the same experiment
"Have they done the same experiment on human drivers?"
They hardly need to. Observation suggests many human drivers' attention is easily snatched away by flashing lights, attractive members of their preferred gender, weird clothing or hair, etc etc. A few bits of tinfoil and colour, less so (perhaps unless displaying an inflammatory slogan).
Mind you, you'd have thought that the safety debate on autonomous taxis would be easily solved, by comparing the safety stats for Waymo and Baidu against the accident data for meatsack taxis in the same operating areas (subject to the usual caveats on data validity). The data exists for both, you have to wonder why regulators in both the US and China haven't done this work and published the results.
These damn drones
Always in my face when I'm driving, hundreds of the buggers, wondered what they were up to.
They are a menace and should be banned from flying in front of cars.
/s
Re: These damn drones
Perhaps the drones could carry red flags in front of self-driving cars.
Don't tell the kids...
Otherwise this'll be a mega meme on Tiktok.