{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T05:49:36Z","timestamp":1776145776789,"version":"3.50.1"},"reference-count":157,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"University of Waterloo and Artificial Intelligence (AI) for Logistics program under National Research Council Canada"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Intell. Transport. Syst."],"published-print":{"date-parts":[[2026,4]]},"DOI":"10.1109\/tits.2026.3666151","type":"journal-article","created":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T20:50:59Z","timestamp":1772225459000},"page":"3819-3842","source":"Crossref","is-referenced-by-count":0,"title":["A Systematic Review of Adversarial Attacks and Defenses for Deep Reinforcement Learning in Autonomous Vehicle Applications"],"prefix":"10.1109","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-7580-5657","authenticated-orcid":false,"given":"Zahra","family":"Sarayloo","sequence":"first","affiliation":[{"name":"Department of Systems Design Engineering, University of Waterloo, Waterloo, ON, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8094-0363","authenticated-orcid":false,"given":"Saeedeh","family":"Lohrasbi","sequence":"additional","affiliation":[{"name":"Department of Systems Design Engineering, University of Waterloo, Waterloo, ON, Canada"}]},{"given":"Pulei","family":"Xiong","sequence":"additional","affiliation":[{"name":"Department of Systems Design Engineering, University of Waterloo, Waterloo, ON, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1412-7961","authenticated-orcid":false,"given":"Nasser","family":"Lashgarian Azad","sequence":"additional","affiliation":[{"name":"Department of Systems Design Engineering, University of Waterloo, Waterloo, ON, Canada"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2019.2949915"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2015.2498841"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2015.2503342"},{"key":"ref4","volume-title":"Deep Learning","author":"Goodfellow","year":"2016"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/tnn.1998.712192"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1038\/nature14236"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3012034"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3054625"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.2478\/acss-2021-0012"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102150"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3085297"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2021.3111139"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0027-x"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3037705"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM55135.2022.10017870"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/GCWkshps52748.2021.9681966"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.3390\/s22010360"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/8045874"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3359992.3366638"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3357845"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/mits.2019.2898964"},{"key":"ref23","article-title":"Sequential triggers for watermarking of deep reinforcement learning policies","author":"Behzadan","year":"2019","journal-title":"arXiv:1906.01126"},{"key":"ref24","article-title":"Adversarial exploitation of policy imitation","author":"Behzadan","year":"2019","journal-title":"arXiv:1906.01121"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-99229-7_34"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3264437.3264479"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3478684.3479254"},{"key":"ref28","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel","year":"2017","journal-title":"arXiv:1712.04248"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3099164"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/iv55152.2023.10186386"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415758"},{"key":"ref32","volume-title":"Stealthy and Efficient Adversarial Attacks Against Deep Reinforcement Learning","author":"Sun et al","year":"2020"},{"key":"ref33","article-title":"DARTS: Deceiving autonomous cars with toxic signs","author":"Sitawarin","year":"2018","journal-title":"arXiv:1802.06430"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3416013.3426461"},{"key":"ref35","article-title":"Adversarial deep reinforcement learning for improving the robustness of multi-agent autonomous driving policies","author":"Sharif","year":"2021","journal-title":"arXiv:2112.11937"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-27041-3_1"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3474376.3487287"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3143566"},{"key":"ref39","article-title":"Sequential attacks on agents for long-term adversarial goals","author":"Tretschk","year":"2018","journal-title":"arXiv:1805.12487"},{"key":"ref40","article-title":"Characterizing attacks on deep reinforcement learning","author":"Pan","year":"2019","journal-title":"arXiv:1907.09470"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339815"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3378936.3378938"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/IV51971.2022.9827222"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2016.2598873"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/PerCom45495.2020.9127389"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/OJITS.2022.3142612"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2023.3326736"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2024.3493938"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2024.3482723"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-024-11014-8"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2022.3186897"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3439363"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3020075"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3024655"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3115235"},{"key":"ref57","article-title":"End to end learning for self-driving cars","author":"Bojarski","year":"2016","journal-title":"arXiv:1604.07316"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995975"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3192019"},{"key":"ref60","article-title":"Playing Atari with deep reinforcement learning","author":"Mnih","year":"2013","journal-title":"arXiv:1312.5602"},{"key":"ref61","article-title":"Continuous control with deep reinforcement learning","author":"Lillicrap","year":"2015","journal-title":"arXiv:1509.02971"},{"key":"ref62","article-title":"Proximal policy optimization algorithms","author":"Schulman","year":"2017","journal-title":"arXiv:1707.06347"},{"key":"ref63","first-page":"1861","article-title":"Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Haarnoja"},{"key":"ref64","article-title":"A survey of state-action representations for autonomous driving","author":"Leurent","year":"2018"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TPS-ISA48467.2019.00011"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CSNDSP54353.2022.9908023"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00027"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212492"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3371158.3371383"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218575"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243757"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24130"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3131944.3133938"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3527278"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM48099.2022.10000751"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-40677-5_13"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TCDS.2020.2974509"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2020.3041265"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW67362.2025.00340"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3174963"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI50451.2021.9659835"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3450267.3450535"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.aap.2021.106515"},{"key":"ref84","article-title":"A hybrid defense method against adversarial attacks on traffic sign classifiers in autonomous vehicles","author":"Khan","year":"2022","journal-title":"arXiv:2205.01225"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/sescps.2019.00014"},{"key":"ref86","article-title":"Adversarial exploitation of policy imitation","author":"Behzadan","year":"2019","journal-title":"arXiv:1906.01121"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3564636"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.23919\/ACC63710.2025.11107955"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3569877"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00079"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464809"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453106"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5887"},{"key":"ref94","first-page":"1","article-title":"Toward evaluating robustness of deep reinforcement learning with continuous control","volume-title":"Proc. ICLR","author":"Weng"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/MITS.2019.2898964"},{"key":"ref96","volume-title":"SADA: Semantic Adversarial Diagnostic Attacks for Autonomous Applications","author":"Hamdi","year":"2020"},{"key":"ref97","article-title":"Don\u2019t watch me: A spatio-temporal trojan attack on deep-reinforcement-learning-augment autonomous driving","author":"Yu","year":"2022","journal-title":"arXiv:2211.14440"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3114024"},{"key":"ref99","article-title":"Online robust reinforcement learning with model uncertainty","author":"Wang","year":"2021"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3374135.3385288"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3133537"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/anzcc59813.2024.10432866"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1049\/rsn2.70033"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC.2018.8569635"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2021.3056046"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3157003"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/tiv.2022.3165178"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1016\/j.trc.2024.104632"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-99229-7_34"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/3639828"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2024.3373720"},{"key":"ref112","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2021.104514","article-title":"Instance-based defense against adversarial attacks in deep reinforcement learning","volume":"107","author":"Garc\u00eda","year":"2022","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2025.3598768"},{"key":"ref114","article-title":"Detecting adversarial attacks on neural network policies with visual foresight","author":"Lin","year":"2017","journal-title":"arXiv:1710.00814"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2024.3379367"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/QRS-C55045.2021.00081"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC58545.2023.10327986"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/OJITS.2024.3479098"},{"key":"ref119","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104149","article-title":"Adaptive sensor attack detection and defense framework for autonomous vehicles based on density","volume":"148","author":"Miao","year":"2025","journal-title":"Comput. Secur."},{"key":"ref120","article-title":"Targeted adversarial attacks on deep reinforcement learning policies via model checking","author":"Gross","year":"2022","journal-title":"arXiv:2212.05337"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ICC51166.2024.10622762"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3497808"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-48121-5_18"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.3390\/machines12080538"},{"key":"ref125","doi-asserted-by":"crossref","DOI":"10.1016\/j.cosrev.2019.100199","article-title":"A taxonomy and survey of attacks against machine learning","volume":"34","author":"Pitropakis","year":"2019","journal-title":"Comput. Sci. Rev."},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3032227"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3071405"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/MITS.2019.2898973"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/OJVT.2023.3265363"},{"key":"ref130","article-title":"Robust deep reinforcement learning through adversarial attacks and training: A survey","author":"Schott","year":"2024"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1016\/j.trc.2024.104750"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1016\/j.dt.2024.06.009"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.122223"},{"key":"ref134","doi-asserted-by":"crossref","DOI":"10.1016\/j.adhoc.2024.103642","article-title":"A survey on security of UAV and deep reinforcement learning","volume":"164","author":"Sar\u0131kaya","year":"2024","journal-title":"Ad Hoc Netw."},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2023.10.011"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1016\/j.prime.2024.100810"},{"issue":"1","key":"ref137","first-page":"1","article-title":"Enhancing security of autonomous vehicles using layered strategy with defensive techniques-a survey","volume":"8","author":"Bano","year":"2024","journal-title":"J. Comput. Biomed. Informat."},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1016\/j.aei.2024.102850"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1145\/3640312"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.121358"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/OJITS.2021.3118972"},{"key":"ref142","first-page":"1","article-title":"Safebench: A benchmarking platform for safety evaluation of autonomous vehicles","volume-title":"Proc. 36th Conf. Neural Inf. Process. Syst.","author":"Xu"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-26369-9_11"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/CASE59546.2024.10711829"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.3390\/electronics13163299"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/525"},{"key":"ref147","article-title":"Behaviortargeted attack on reinforcement learning with limited access to victim\u2019s policy","author":"Yamabe","year":"2024"},{"issue":"2","key":"ref148","doi-asserted-by":"crossref","first-page":"314","DOI":"10.3390\/pr12020314","article-title":"Locality-based action-poisoning attack against the continuous control of an autonomous driving model","volume":"12","author":"An","year":"2024","journal-title":"Processes"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2024.3394894"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/iccps61052.2024.00014"},{"key":"ref151","article-title":"Gradient band-based adversarial training for generalized attack immunity of A3C path finding","author":"Chen","year":"2018","journal-title":"arXiv:1807.06752"},{"key":"ref152","first-page":"1328","article-title":"Certified adversarial robustness for deep reinforcement learning","volume-title":"Proc. Conf. Robot Learn.","author":"L\u00fctjens"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN55064.2022.9892901"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2023.10.005"},{"key":"ref155","first-page":"102","article-title":"Securing autonomous vehicle networks: Strategic defence against communication attacks","volume":"25","author":"Parada","year":"2024","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/iv64158.2025.11097466"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1016\/j.trc.2025.105005"}],"container-title":["IEEE Transactions on Intelligent Transportation Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6979\/11480687\/11417226.pdf?arnumber=11417226","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T05:03:47Z","timestamp":1776143027000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11417226\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":157,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tits.2026.3666151","relation":{},"ISSN":["1524-9050","1558-0016"],"issn-type":[{"value":"1524-9050","type":"print"},{"value":"1558-0016","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]}}}