{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:22:01Z","timestamp":1792786921637,"version":"4.5.0"},"reference-count":125,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Natural Science Foundation of China","award":["62476018"],"award-info":[{"award-number":["62476018"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"crossref"}]},{"name":"Beijing Natural Science Foundation","award":["QY24136"],"award-info":[{"award-number":["QY24136"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1109\/tpami.2026.3710189","type":"journal-article","created":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T19:52:45Z","timestamp":1783108365000},"page":"13370-13388","source":"Crossref","is-referenced-by-count":1,"title":["Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspective"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9874-6828","authenticated-orcid":false,"given":"Tianyuan","family":"Zhang","sequence":"first","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8425-4195","authenticated-orcid":false,"given":"Xianglong","family":"Liu","sequence":"additional","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4224-1318","authenticated-orcid":false,"given":"Aishan","family":"Liu","sequence":"additional","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-1733-4178","authenticated-orcid":false,"given":"Lu","family":"Wang","sequence":"additional","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1138-4503","authenticated-orcid":false,"given":"Yitong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7679-5388","authenticated-orcid":false,"given":"Peng","family":"Yue","sequence":"additional","affiliation":[{"name":"Sun Yat-sen University","place":["Shenzhen, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2523-1089","authenticated-orcid":false,"given":"Mingchuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Henan University of Science and Technology","place":["Luoyang, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6154-0233","authenticated-orcid":false,"given":"Siyuan","family":"Liang","sequence":"additional","affiliation":[{"name":"National University of Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7225-5449","authenticated-orcid":false,"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Death of elaine herzberg","year":"2018"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58586-0_17"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i4.16469"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3182097"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/s00138-011-0404-2"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.12301"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72943-0_15"},{"key":"ref8","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2019"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00105"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3125620"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.3390\/s19030648"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC45102.2020.9294368"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3190471"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01186"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46475-6_7"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.243"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA40945.2020.9197144"},{"key":"ref19","first-page":"1","article-title":"CARLA: An open urban driving simulator","volume-title":"Proc. Conf. Robot Learn.","author":"Dosovitskiy","year":"2017"},{"key":"ref20","article-title":"openpilot","year":"2017"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01432"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02327"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02333-y"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i18.29965"},{"key":"ref25","article-title":"Poisoned forgery face: Towards backdoor attacks on face forgery detection","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liang","year":"2024"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-025-02368-9"},{"key":"ref27","article-title":"Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms","author":"Li","year":"2024"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680761"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2018.8500547"},{"key":"ref30","article-title":"Heatmap-based vanishing point boosts lane detection","author":"Liu","year":"2020"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3088488"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01390"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00145"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2019.2890870"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00036"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/138"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i1.19961"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00097"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00511"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01250"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412265"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/WACV48630.2021.00374"},{"key":"ref43","article-title":"BSNet: Lane detection via draw B-spline curves nearby","author":"Chen","year":"2023"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01655"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/WACVW60836.2024.00102"},{"key":"ref46","article-title":"GPT-driver: Learning to drive with GPT","volume-title":"Proc. NeurIPS Found. Models Decis. Mak. Workshop","author":"Mao","year":"2023"},{"key":"ref47","article-title":"A language agent for autonomous driving","volume-title":"Proc. Conf. Lang. Model","author":"Mao","year":"2024"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73347-5_17"},{"key":"ref49","article-title":"LingoQA: Video question answering for autonomous driving (2023)","author":"Marcu","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72995-9_23"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA57147.2024.10611018"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC57777.2023.10421993"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/s44267-025-00095-w"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.02090"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2024.3440097"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01830"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0932"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2025.3535960"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2008.4621152"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.215"},{"key":"ref61","article-title":"Tusimple benchmark","year":"2017"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00271"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2019.00111"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58555-6_41"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.3042083"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109308"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58520-4_8"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/s44267-023-00031-w"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/s44267-023-00031-w"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52729.2023.00399"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560566"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3082317"},{"key":"ref73","article-title":"RobustART: Benchmarking robustness on architecture design and training techniques","author":"Tang","year":"2021"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.3390\/electronics12183921"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.3390\/electronics12183921"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680766"},{"key":"ref77","first-page":"8349","article-title":"Attack end-to-end autonomous driving through module-wise noise","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit. Workshop","author":"Wang","year":"2024"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW63382.2024.00297"},{"key":"ref79","article-title":"Generate more imperceptible adversarial examples for object detection","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liang","year":"2021"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_3"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/134"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00760"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_36"},{"key":"ref84","article-title":"Diversifying the high-level features for better adversarial transferability","volume-title":"Proc. Brit. Mach. Vis. Conf.","author":"Wang","year":"2023"},{"key":"ref85","first-page":"3781","article-title":"X-adv: Physical adversarial object attacks against x-ray prohibited item detection","volume-title":"Proc. USENIX Secur.","author":"Liu","year":"2023"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i1.25154"},{"key":"ref87","article-title":"Improving adversarial transferability by stable diffusion","author":"Liu","year":"2023"},{"key":"ref88","article-title":"SA-Attack: Improving adversarial transferability of vision-language pre-training models via self-augmentation","author":"He","year":"2023"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00105"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02296"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01830"},{"key":"ref92","first-page":"3309","article-title":"Dirty road can attack: Security of deep learning based automated lane centering under Physical-World attack","volume-title":"Proc. USENIX Secur. Symp.","author":"Sato","year":"2021"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2020.101766"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00252"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i5.28253"},{"key":"ref96","first-page":"74","article-title":"Rouge: A package for automatic evaluation of summaries","volume-title":"Text Summarization Branches Out","author":"Lin","year":"2004"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.3115\/1073083.1073135"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7299087"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51701.2025.00621"},{"key":"ref100","article-title":"2019 fars\/crss coding and validation manual","year":"2020"},{"key":"ref101","article-title":"Road safety statistics: Data tables and topic summaries. Contributory factors \/ RSF series;","year":"2025"},{"key":"ref102","article-title":"Safety pilot model deployment: Test conductor team report","author":"Bezzina","year":"2014"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-021-21007-8"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref105","article-title":"ChatGPT","year":"2023"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2049"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref109","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26769"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612281"},{"key":"ref112","article-title":"Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning","author":"Liang","year":"2024"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref114","article-title":"Improved regularization of convolutional neural networks with cutout","author":"DeVries","year":"2017"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00294"},{"key":"ref116","article-title":"mixup: Beyond empirical risk minimization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2018"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-023-01884-w"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00765-8"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.2967829"},{"key":"ref122","volume-title":"A Policy on Geometric Design of Highways and Streets, 7th ed.","year":"2018"},{"key":"ref123","article-title":"JetBot","year":"2021"},{"key":"ref124","article-title":"Limo","year":"2024"},{"key":"ref125","article-title":"Black-box adversarial attack on vision language models for autonomous driving","author":"Wang","year":"2025"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11674301\/11595247.pdf?arnumber=11595247","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T16:44:51Z","timestamp":1790268291000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11595247\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":125,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2026.3710189","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10]]}}}