{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T15:57:21Z","timestamp":1783526241079,"version":"3.55.0"},"reference-count":128,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2021,12,1]],"date-time":"2021-12-01T00:00:00Z","timestamp":1638316800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,12,1]],"date-time":"2021-12-01T00:00:00Z","timestamp":1638316800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,12,1]],"date-time":"2021-12-01T00:00:00Z","timestamp":1638316800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Australian Research Council Linkage Project","award":["LP190100676"],"award-info":[{"award-number":["LP190100676"]}]},{"name":"Discovery Project","award":["DP210102447"],"award-info":[{"award-number":["DP210102447"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Ind. Inf."],"published-print":{"date-parts":[[2021,12]]},"DOI":"10.1109\/tii.2021.3071405","type":"journal-article","created":{"date-parts":[[2021,4,6]],"date-time":"2021-04-06T20:01:32Z","timestamp":1617739292000},"page":"7897-7912","source":"Crossref","is-referenced-by-count":171,"title":["Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses"],"prefix":"10.1109","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9762-7058","authenticated-orcid":false,"given":"Yao","family":"Deng","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7195-4472","authenticated-orcid":false,"given":"Tiehua","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guannan","family":"Lou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2572-2355","authenticated-orcid":false,"given":"Xi","family":"Zheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0306-2691","authenticated-orcid":false,"given":"Jiong","family":"Jin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7207-0716","authenticated-orcid":false,"given":"Qing-Long","family":"Han","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00376"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00240"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00472"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.169"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC.2018.8569951"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2016.7535466"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.660"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00086"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00271"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2017.7989236"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.autcon.2006.11.001"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2019.2948775"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref23","first-page":"1","article-title":"A survey on security attacks and defense techniques for connected and autonomous vehicles","volume":"abs 2007 8041","author":"pham","year":"2020","journal-title":"CoRR"},{"key":"ref101","first-page":"1","article-title":"Towards deep neural network architectures robust to adversarial examples","author":"gu","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/IC3I.2016.7917999"},{"key":"ref100","first-page":"417","article-title":"Deep defense: Training DNNs with improved adversarial robustness","author":"yan","year":"2018","journal-title":"Proc NeurIPS"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref50","first-page":"445","article-title":"Illusion and dazzle: Adversarial optical channel exploits against lidars for automotive applications","author":"shin","year":"2017","journal-title":"Proc Graphics Hardware Conf"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/WF-IoT.2018.8355132"},{"key":"ref59","first-page":"1","article-title":"MobilBye: Attacking ADAS with camera spoofing","volume":"arxiv 1906 9765","author":"nassi","year":"2019","journal-title":"CoRR"},{"key":"ref58","first-page":"1","article-title":"Controlling UAVs with sensor input spoofing attacks","author":"davidson","year":"2016","journal-title":"Proc UNISEX Workshop"},{"key":"ref57","first-page":"1527","article-title":"All your GPS are belong to us: Towards stealthy manipulation of road navigation systems","author":"zeng","year":"2018","journal-title":"Proc Usenix Secur Symp"},{"key":"ref56","first-page":"19","article-title":"A simple demonstration that the global positioning system (GPS) is vulnerable to spoofing","volume":"25","author":"warner","year":"2002","journal-title":"J Security Admin"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.3390\/s19183993"},{"key":"ref54","article-title":"Protecting GPS from spoofers is critical to the future of navigation","author":"psiaki","year":"0","journal-title":"IEEE Spectr"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660336"},{"key":"ref52","first-page":"881","article-title":"Rocking drones with intentional sound noise on gyroscopic sensors","author":"son","year":"2015","journal-title":"Proc Usenix Secur Symp"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/IROS.2016.7759328"},{"key":"ref4","author":"waymo","year":"2019"},{"key":"ref3","author":"tesla","year":"2019"},{"key":"ref6","author":"baidu","year":"0"},{"key":"ref5","author":"berboucha","year":"2019","journal-title":"Uber Self-Driving Car Crash What Really Happened"},{"key":"ref8","author":"tesla","year":"2021"},{"key":"ref49","first-page":"109","article-title":"Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle","volume":"24","author":"yan","year":"2016","journal-title":"DEF CON"},{"key":"ref7","article-title":"Baidu fully opens apollo go robotaxi services in Beijing","year":"2021","journal-title":"Global Times"},{"key":"ref9","first-page":"1","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref46","first-page":"194","article-title":"LSTM neural networks for language modeling","author":"sundermeyer","year":"2012","journal-title":"Proc Annu Conf Int Speech Commun Assoc"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.376"},{"key":"ref48","first-page":"1","article-title":"This ain’t your dose: Sensor spoofing attack on medical infusion pump","author":"park","year":"2016","journal-title":"Proc Workshop Offensive Technol"},{"key":"ref47","first-page":"995","article-title":"Remote attacks on automated vehicles sensors: experiments on camera and lidar","volume":"11","author":"petit","year":"2015","journal-title":"Black Hat Eur"},{"key":"ref42","first-page":"1","article-title":"End to end learning for self-driving cars","volume":"abs 1604 7316","author":"bojarski","year":"2016","journal-title":"CoRR"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995727"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2018.8460487"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3054912"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01272"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00655"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2016.2614599"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2951766"},{"key":"ref73","first-page":"877","article-title":"Towards robust lidar-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures","author":"sun","year":"2018","journal-title":"Proc USENIX Secur Symp Secur Symp"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339815"},{"key":"ref71","first-page":"1","article-title":"Physical adversarial attack on vehicle detector in the carla simulator","volume":"arxiv 2007 16118","author":"wu","year":"2020","journal-title":"CoRR"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2016.2614599"},{"key":"ref70","first-page":"1","article-title":"Finding physical adversarial examples for autonomous driving with fast and differentiable image compositing","volume":"arxiv 2010 8844","author":"yang","year":"2020","journal-title":"CoRR"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2012.2209421"},{"key":"ref77","first-page":"1989","article-title":"Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors","author":"zhao","year":"2019","journal-title":"Proc Conf Comput Commun Secur"},{"key":"ref74","first-page":"3354","article-title":"Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector","author":"chen","year":"2018","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"ref60","first-page":"1","article-title":"Exploiting social navigation","volume":"arxiv 1906 9765","author":"sinai","year":"2019","journal-title":"CoRR"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2917912"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2005.844422"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4939-2468-4_10"},{"key":"ref64","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"liu","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref66","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"brendel","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380422"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2020.101766"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73429-1"},{"key":"ref69","first-page":"1","article-title":"CARLA: An open urban driving simulator","author":"dosovitskiy","year":"0","journal-title":"Proc Conf Robot Learn"},{"key":"ref1","author":"eureka","year":"0","journal-title":"Programme for a European Traffic System with Highest Efficiency and Unprecedented Safety"},{"key":"ref109","first-page":"1","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/ICCW.2008.78"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2005.1505167"},{"key":"ref107","first-page":"7167","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","author":"lee","year":"2018","journal-title":"Proc NeurIPS"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813679"},{"key":"ref106","first-page":"7924","article-title":"Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks","author":"zheng","year":"2018","journal-title":"Proc NeurIPS"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2963294"},{"key":"ref105","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2891261"},{"key":"ref104","first-page":"1","article-title":"Certified defenses against adversarial examples","author":"raghunathan","year":"0","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref90","first-page":"299","article-title":"Poisoning attack on deep generative models in autonomous driving” in","author":"ding","year":"2019","journal-title":"Proc EAI Secur Commun"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref102","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","volume":"70","author":"ciss\u00e9","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683044"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref110","first-page":"1","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","author":"samangouei","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref99","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","author":"pang","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-94042-7_11"},{"key":"ref10","first-page":"1","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref11","first-page":"1","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref12","first-page":"1","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref13","first-page":"1","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref15","first-page":"10","article-title":"EAD: Elastic-net attacks to deep neural networks via adversarial examples","author":"chen","year":"2018","journal-title":"Proc AAAI Conf Artif Intell"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/IROS.2015.7353481"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref81","first-page":"77","article-title":"PointNet: Deep learning on point sets for 3D classification and segmentation","author":"qi","year":"2017","journal-title":"Proc Conf Comput Vis Pattern Recognit"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref84","first-page":"1","article-title":"Adversarial attacks on neural network policies","author":"huang","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref119","first-page":"515","article-title":"CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel","author":"batina","year":"2019","journal-title":"Proc UNISEX"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00465"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00935"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1996.tb02073.x"},{"key":"ref113","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref116","first-page":"1","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"chen","year":"2019","journal-title":"Proc AAAI Conf Artif Intell Workshop"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01204"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref120","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume":"97","author":"zhang","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29726-8_18"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref122","first-page":"167","article-title":"An approach to software testing of machine learning applications","author":"murphy","year":"2007","journal-title":"Proc SEKE"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_1"},{"key":"ref85","first-page":"1928","article-title":"Asynchronous methods for deep reinforcement learning","author":"mnih","year":"2016","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref86","first-page":"1","article-title":"Delving into adversarial attacks on deep policies","author":"kos","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/525"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"}],"container-title":["IEEE Transactions on Industrial Informatics"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9424\/9523447\/09397393.pdf?arnumber=9397393","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:52:39Z","timestamp":1652194359000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9397393\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12]]},"references-count":128,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tii.2021.3071405","relation":{},"ISSN":["1551-3203","1941-0050"],"issn-type":[{"value":"1551-3203","type":"print"},{"value":"1941-0050","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,12]]}}}