{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T16:00:23Z","timestamp":1776268823919,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":57,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,11,6]],"date-time":"2019-11-06T00:00:00Z","timestamp":1572998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1544678, ONR N00014-18-1-2020"],"award-info":[{"award-number":["CNS-1544678, ONR N00014-18-1-2020"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,11,6]]},"DOI":"10.1145\/3319535.3339815","type":"proceedings-article","created":{"date-parts":[[2019,11,7]],"date-time":"2019-11-07T13:08:32Z","timestamp":1573132112000},"page":"2267-2281","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":426,"title":["Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving"],"prefix":"10.1145","author":[{"given":"Yulong","family":"Cao","sequence":"first","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Chaowei","family":"Xiao","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Benjamin","family":"Cyr","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Yimeng","family":"Zhou","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Won","family":"Park","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Sara","family":"Rampazzi","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Qi Alfred","family":"Chen","sequence":"additional","affiliation":[{"name":"University of California, Irvine, Irvine, CA, USA"}]},{"given":"Kevin","family":"Fu","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]},{"given":"Z. Morley","family":"Mao","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI, USA"}]}],"member":"320","published-online":{"date-parts":[[2019,11,6]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"2005. HARD BRAKE HARD ACCELERATION. http:\/\/tracknet.accountsupport. com\/wp-content\/uploads\/Verizon\/Hard-Brake-Hard-Acceleration.pdf. (2005).  2005. HARD BRAKE HARD ACCELERATION. http:\/\/tracknet.accountsupport. com\/wp-content\/uploads\/Verizon\/Hard-Brake-Hard-Acceleration.pdf. (2005)."},{"key":"e_1_3_2_2_2_1","unstructured":"2016. ArbExpress. https:\/\/www.tek.com\/signal-generator\/afg2021-software-0. (2016).  2016. ArbExpress. https:\/\/www.tek.com\/signal-generator\/afg2021-software-0. (2016)."},{"key":"e_1_3_2_2_3_1","unstructured":"2017. An Introduction to LIDAR: The Key Self-Driving Car Sensor. https:\/\/news.voyage.auto\/an-introduction-to-lidar-the-key-self-drivingcar- sensor-a7e405590cff. (2017).  2017. An Introduction to LIDAR: The Key Self-Driving Car Sensor. https:\/\/news.voyage.auto\/an-introduction-to-lidar-the-key-self-drivingcar- sensor-a7e405590cff. (2017)."},{"key":"e_1_3_2_2_4_1","unstructured":"2017. Baidu Apollo. http:\/\/apollo.auto. (2017).  2017. Baidu Apollo. http:\/\/apollo.auto. (2017)."},{"key":"e_1_3_2_2_5_1","volume-title":"Cuts Costs by 90 Percent. https:\/\/arstechnica.com\/cars\/2017\/01\/googles-waymo-invests-in-lidartechnology- cuts-costs-by-90-percent\/.","year":"2017","unstructured":"2017. Google's Waymo Invests in LIDAR Technology , Cuts Costs by 90 Percent. https:\/\/arstechnica.com\/cars\/2017\/01\/googles-waymo-invests-in-lidartechnology- cuts-costs-by-90-percent\/. ( 2017 ). 2017. Google's Waymo Invests in LIDAR Technology, Cuts Costs by 90 Percent. https:\/\/arstechnica.com\/cars\/2017\/01\/googles-waymo-invests-in-lidartechnology- cuts-costs-by-90-percent\/. (2017)."},{"key":"e_1_3_2_2_6_1","unstructured":"2017. KITTI Vision Benchmark: 3D Object Detection. http:\/\/www.cvlibs.net\/ datasets\/kitti\/eval_object.php?obj_benchmark=3d. (2017).  2017. KITTI Vision Benchmark: 3D Object Detection. http:\/\/www.cvlibs.net\/ datasets\/kitti\/eval_object.php?obj_benchmark=3d. (2017)."},{"key":"e_1_3_2_2_7_1","unstructured":"2017. What it Was Like to Ride in GM's New Self-Driving Cruise Car. https:\/\/www.recode.net\/2017\/11\/29\/16712572\/general-motors-gm-new-selfdriving- autonomous-cruise-car-future. (2017).  2017. What it Was Like to Ride in GM's New Self-Driving Cruise Car. https:\/\/www.recode.net\/2017\/11\/29\/16712572\/general-motors-gm-new-selfdriving- autonomous-cruise-car-future. (2017)."},{"key":"e_1_3_2_2_8_1","unstructured":"2018. Baidu hits the gas on autonomous vehicles with Volvo and Ford deals. https: \/\/techcrunch.com\/2018\/11\/01\/baidu-volvo-ford-autonomous-driving\/. (2018).  2018. Baidu hits the gas on autonomous vehicles with Volvo and Ford deals. https: \/\/techcrunch.com\/2018\/11\/01\/baidu-volvo-ford-autonomous-driving\/. (2018)."},{"key":"e_1_3_2_2_9_1","unstructured":"2018. Baidu starts mass production of autonomous buses. https:\/\/www.dw.com\/ en\/baidu-starts-mass-production-of-autonomous-buses\/a-44525629. (2018).  2018. Baidu starts mass production of autonomous buses. https:\/\/www.dw.com\/ en\/baidu-starts-mass-production-of-autonomous-buses\/a-44525629. (2018)."},{"key":"e_1_3_2_2_10_1","unstructured":"2018. VeloView. https:\/\/www.paraview.org\/VeloView\/. (2018).  2018. VeloView. https:\/\/www.paraview.org\/VeloView\/. (2018)."},{"key":"e_1_3_2_2_11_1","unstructured":"2018. Volvo Finds the LIDAR it Needs to Build Self-Driving Cars. https:\/\/www. wired.com\/story\/volvo-self-driving-lidar-luminar\/. (2018).  2018. Volvo Finds the LIDAR it Needs to Build Self-Driving Cars. https:\/\/www. wired.com\/story\/volvo-self-driving-lidar-luminar\/. (2018)."},{"key":"e_1_3_2_2_12_1","unstructured":"2018. Waymo's autonomous cars have driven 8 million miles on public roads. https:\/\/www.theverge.com\/2018\/7\/20\/17595968\/waymo-self-driving-cars- 8-million-miles-testing. (2018).  2018. Waymo's autonomous cars have driven 8 million miles on public roads. https:\/\/www.theverge.com\/2018\/7\/20\/17595968\/waymo-self-driving-cars- 8-million-miles-testing. (2018)."},{"key":"e_1_3_2_2_13_1","volume-title":"Why Do Self-Driving Cars Need It, And Can It See Nerf Bullets? https:\/\/www.wired.com\/story\/lidar-self-driving-cars-luminar-video\/.","year":"2018","unstructured":"2018. What Is LIDAR , Why Do Self-Driving Cars Need It, And Can It See Nerf Bullets? https:\/\/www.wired.com\/story\/lidar-self-driving-cars-luminar-video\/. ( 2018 ). 2018. What Is LIDAR, Why Do Self-Driving Cars Need It, And Can It See Nerf Bullets? https:\/\/www.wired.com\/story\/lidar-self-driving-cars-luminar-video\/. (2018)."},{"key":"e_1_3_2_2_14_1","unstructured":"2018. You can take a ride in a self-driving Lyft during CES. https:\/\/www.theverge. com\/2018\/1\/2\/16841090\/lyft-aptiv-self-driving-car-ces-2018. (2018).  2018. You can take a ride in a self-driving Lyft during CES. https:\/\/www.theverge. com\/2018\/1\/2\/16841090\/lyft-aptiv-self-driving-car-ces-2018. (2018)."},{"key":"e_1_3_2_2_15_1","first-page":"265","article-title":"Tensorflow: a system for large-scale machine learning","volume":"16","author":"Abadi Mart\u00edn","year":"2016","unstructured":"Mart\u00edn Abadi , Paul Barham , Jianmin Chen , Zhifeng Chen , Andy Davis , Jeffrey Dean , Matthieu Devin , Sanjay Ghemawat , Geoffrey Irving , Michael Isard , 2016 . Tensorflow: a system for large-scale machine learning .. In OSDI , Vol. 16. 265 -- 283 . Mart\u00edn Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, et al. 2016. Tensorflow: a system for large-scale machine learning.. In OSDI, Vol. 16. 265--283.","journal-title":"OSDI"},{"key":"e_1_3_2_2_16_1","volume-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye , Nicholas Carlini , and David Wagner . 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 ( 2018 ). Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 (2018)."},{"key":"e_1_3_2_2_17_1","volume-title":"Synthesizing Robust Adversarial Examples. In International Conference on Machine Learning (ICML).","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye and Ilya Sutskever . 2018 . Synthesizing Robust Adversarial Examples. In International Conference on Machine Learning (ICML). Anish Athalye and Ilya Sutskever. 2018. Synthesizing Robust Adversarial Examples. In International Conference on Machine Learning (ICML)."},{"key":"e_1_3_2_2_18_1","volume-title":"Hidden Voice Commands. In USENIX Security Symposium.","author":"Carlini Nicholas","year":"2016","unstructured":"Nicholas Carlini , Pratyush Mishra , Tavish Vaidya , Yuankai Zhang , Micah Sherr , Clay Shields , DavidWagner, and Wenchao Zhou . 2016 . Hidden Voice Commands. In USENIX Security Symposium. Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, DavidWagner, andWenchao Zhou. 2016. Hidden Voice Commands. In USENIX Security Symposium."},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"e_1_3_2_2_20_1","volume-title":"Audio Adversarial Examples: Targeted Attacks on Speech-to-text. In Deep Learning and Security Workshop (DLS).","author":"Carlini Nicholas","year":"2018","unstructured":"Nicholas Carlini and DavidWagner. 2018 . Audio Adversarial Examples: Targeted Attacks on Speech-to-text. In Deep Learning and Security Workshop (DLS). Nicholas Carlini and DavidWagner. 2018. Audio Adversarial Examples: Targeted Attacks on Speech-to-text. In Deep Learning and Security Workshop (DLS)."},{"key":"e_1_3_2_2_21_1","volume-title":"Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017","author":"Carlini Nicholas","year":"2017","unstructured":"Nicholas Carlini and David A. Wagner . 2017 . Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017 , San Jose, CA, USA, May 22--26 , 2017 . 39--57. https:\/\/doi.org\/10.1109\/SP.2017.49 10.1109\/SP.2017.49 Nicholas Carlini and David A.Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22--26, 2017. 39--57. https:\/\/doi.org\/10.1109\/SP.2017.49"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/2028067.2028073"},{"key":"e_1_3_2_2_23_1","volume-title":"Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS '18)","author":"Chen Qi Alfred","unstructured":"Qi Alfred Chen , Yucheng Yin , Yiheng Feng , Z. Morley Mao , and Henry X . Liu Liu. 2018. Exposing Congestion Attack on Emerging Connected Vehicle based Traffic Signal Control . In Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS '18) . Qi Alfred Chen, Yucheng Yin, Yiheng Feng, Z. Morley Mao, and Henry X. Liu Liu. 2018. Exposing Congestion Attack on Emerging Connected Vehicle based Traffic Signal Control. In Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS '18)."},{"key":"e_1_3_2_2_24_1","volume-title":"Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples. arXiv preprint arXiv:1803.01128","author":"Cheng Minhao","year":"2018","unstructured":"Minhao Cheng , Jinfeng Yi , Huan Zhang , Pin-Yu Chen , and Cho-Jui Hsieh . 2018. Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples. arXiv preprint arXiv:1803.01128 ( 2018 ). Minhao Cheng, Jinfeng Yi, Huan Zhang, Pin-Yu Chen, and Cho-Jui Hsieh. 2018. Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples. arXiv preprint arXiv:1803.01128 (2018)."},{"key":"e_1_3_2_2_25_1","volume-title":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS'16)","author":"Cho Kyong-Tak","unstructured":"Kyong-Tak Cho and Kang G. Shin . 2016. Error Handling of In-vehicle Networks Makes Them Vulnerable . In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS'16) . Kyong-Tak Cho and Kang G. Shin. 2016. Error Handling of In-vehicle Networks Makes Them Vulnerable. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS'16)."},{"key":"e_1_3_2_2_26_1","volume-title":"Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373","author":"Cisse Moustapha","year":"2017","unstructured":"Moustapha Cisse , Yossi Adi , Natalia Neverova , and Joseph Keshet . 2017 . Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373 (2017). Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373 (2017)."},{"key":"e_1_3_2_2_27_1","volume-title":"Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 1","author":"Evtimov Ivan","year":"2017","unstructured":"Ivan Evtimov , Kevin Eykholt , Earlence Fernandes , Tadayoshi Kohno , Bo Li , Atul Prakash , Amir Rahmati , and Dawn Song . 2017. Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 1 ( 2017 ). Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. 2017. Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 1 (2017)."},{"key":"e_1_3_2_2_28_1","volume-title":"Physical Adversarial Examples for Object Detectors. In USENIX Workshop on Offensive Technologies (WOOT).","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt , Ivan Evtimov , Earlence Fernandes , Bo Li , Amir Rahmati , Florian Tramer , Atul Prakash , Tadayoshi Kohno , and Dawn Song . 2018 . Physical Adversarial Examples for Object Detectors. In USENIX Workshop on Offensive Technologies (WOOT). Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Physical Adversarial Examples for Object Detectors. In USENIX Workshop on Offensive Technologies (WOOT)."},{"key":"e_1_3_2_2_29_1","volume-title":"Robust Physical- World Attacks on Deep Learning Visual Classification. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR).","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt , Ivan Evtimov , Earlence Fernandes , Bo Li , Amir Rahmati , Chaowei Xiao , Atul Prakash , Tadayoshi Kohno , and Dawn Song . 2018 . Robust Physical- World Attacks on Deep Learning Visual Classification. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust Physical- World Attacks on Deep Learning Visual Classification. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR)."},{"key":"e_1_3_2_2_30_1","volume-title":"Vulnerability of Traffic Control System Under Cyber-Attacks Using Falsified Data. In Transportation Research Board 2018 Annual Meeting (TRB).","author":"Feng Yiheng","unstructured":"Yiheng Feng , Shihong Huang , Qi Alfred Chen , Henry X. Liu , and Z. Morley Mao . 2018 . Vulnerability of Traffic Control System Under Cyber-Attacks Using Falsified Data. In Transportation Research Board 2018 Annual Meeting (TRB). Yiheng Feng, Shihong Huang, Qi Alfred Chen, Henry X. Liu, and Z. Morley Mao. 2018. Vulnerability of Traffic Control System Under Cyber-Attacks Using Falsified Data. In Transportation Research Board 2018 Annual Meeting (TRB)."},{"key":"e_1_3_2_2_31_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J.","year":"2014","unstructured":"Ian J. Goodfellow , Jonathon Shlens , and Christian Szegedy . 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 ( 2014 ). Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_2_32_1","unstructured":"Velodyne LiDAR Inc. 2018. VLP-16 User Manual. (2018).  Velodyne LiDAR Inc. 2018. VLP-16 User Manual. (2018)."},{"key":"e_1_3_2_2_33_1","volume-title":"Proceedings of the conference on Design, Automation & Test in Europe.","author":"Ivanov Radoslav","year":"2014","unstructured":"Radoslav Ivanov , Miroslav Pajic , and Insup Lee . 2014 . Attack-resilient sensor fusion . In Proceedings of the conference on Design, Automation & Test in Europe. Radoslav Ivanov, Miroslav Pajic, and Insup Lee. 2014. Attack-resilient sensor fusion. In Proceedings of the conference on Design, Automation & Test in Europe."},{"key":"e_1_3_2_2_34_1","unstructured":"Max Jaderberg Karen Simonyan Andrew Zisserman etal 2015. Spatial transformer networks. In Advances in neural information processing systems. 2017-- 2025.  Max Jaderberg Karen Simonyan Andrew Zisserman et al. 2015. Spatial transformer networks. In Advances in neural information processing systems. 2017-- 2025."},{"key":"e_1_3_2_2_35_1","volume-title":"Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980","author":"Kingma Diederik P","year":"2014","unstructured":"Diederik P Kingma and Jimmy Ba . 2014 . Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014). Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.34"},{"key":"e_1_3_2_2_37_1","volume-title":"Trojaning Attack on Neural Networks. In Annual Network and Distributed System Security Symposium (NDSS).","author":"Liu Yingqi","year":"2018","unstructured":"Yingqi Liu , Shiqing Ma , Yousra Aafer , Wen-Chuan Lee , Juan Zhai ,WeihangWang, and Xiangyu Zhang . 2018 . Trojaning Attack on Neural Networks. In Annual Network and Distributed System Security Symposium (NDSS). Yingqi Liu, Shiqing Ma, Yousra Aafer,Wen-Chuan Lee, Juan Zhai,WeihangWang, and Xiangyu Zhang. 2018. Trojaning Attack on Neural Networks. In Annual Network and Distributed System Security Symposium (NDSS)."},{"key":"e_1_3_2_2_38_1","volume-title":"Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. arXiv preprint arXiv:1801.02613","author":"Ma Xingjun","year":"2018","unstructured":"Xingjun Ma , Bo Li , Yisen Wang , Sarah M Erfani , Sudanthi Wijewickrema , Michael E Houle , Grant Schoenebeck , Dawn Song , and James Bailey . 2018. Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. arXiv preprint arXiv:1801.02613 ( 2018 ). Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Michael E Houle, Grant Schoenebeck, Dawn Song, and James Bailey. 2018. Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. arXiv preprint arXiv:1801.02613 (2018)."},{"key":"e_1_3_2_2_39_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry , Aleksandar Makelov , Ludwig Schmidt , Dimitris Tsipras , and Adrian Vladu . 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ( 2017 ). Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_2_40_1","volume-title":"Usenix Workshop on Offensive Technologies (WOOT).","author":"Mazloom Sahar","year":"2016","unstructured":"Sahar Mazloom , Mohammad Rezaeirad , Aaron Hunter , and Damon McCoy . 2016 . A Security Analysis of an In-Vehicle Infotainment and App Platform . In Usenix Workshop on Offensive Technologies (WOOT). Sahar Mazloom, Mohammad Rezaeirad, Aaron Hunter, and Damon McCoy. 2016. A Security Analysis of an In-Vehicle Infotainment and App Platform. In Usenix Workshop on Offensive Technologies (WOOT)."},{"key":"e_1_3_2_2_41_1","volume-title":"Practical Black-Box Attacks Against Machine Learning. In ACM on Asia Conference on Computer and Communications Security.","author":"Papernot Nicolas","year":"2017","unstructured":"Nicolas Papernot , Patrick McDaniel , Ian Goodfellow , Somesh Jha , Z Berkay Celik , and Ananthram Swami . 2017 . Practical Black-Box Attacks Against Machine Learning. In ACM on Asia Conference on Computer and Communications Security. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017. Practical Black-Box Attacks Against Machine Learning. In ACM on Asia Conference on Computer and Communications Security."},{"key":"e_1_3_2_2_42_1","unstructured":"Jonathan Petit Bas Stottelaar Michael Feiri and Frank Kargl. 2015. Remote Attacks on Automated Vehicles Sensors: Experiments on Camera and LiDAR. In Black Hat Europe.  Jonathan Petit Bas Stottelaar Michael Feiri and Frank Kargl. 2015. Remote Attacks on Automated Vehicles Sensors: Experiments on Camera and LiDAR. In Black Hat Europe."},{"key":"e_1_3_2_2_43_1","volume-title":"Proceedings of the 19th USENIX Conference on Security (USENIX Security'10)","author":"Rouf Ishtiaq","year":"2010","unstructured":"Ishtiaq Rouf , Rob Miller , Hossen Mustafa , Travis Taylor , Sangho Oh , Wenyuan Xu , Marco Gruteser , Wade Trappe , and Ivan Seskar . 2010 . Security and Privacy Vulnerabilities of In-car Wireless Networks: A Tire Pressure Monitoring System Case Study . In Proceedings of the 19th USENIX Conference on Security (USENIX Security'10) . USENIX Association, Berkeley, CA, USA, 21--21. http:\/\/dl.acm.org\/ citation.cfm?id= 1929820.1929848 Ishtiaq Rouf, Rob Miller, Hossen Mustafa, Travis Taylor, Sangho Oh, Wenyuan Xu, Marco Gruteser, Wade Trappe, and Ivan Seskar. 2010. Security and Privacy Vulnerabilities of In-car Wireless Networks: A Tire Pressure Monitoring System Case Study. In Proceedings of the 19th USENIX Conference on Security (USENIX Security'10). USENIX Association, Berkeley, CA, USA, 21--21. http:\/\/dl.acm.org\/ citation.cfm?id=1929820.1929848"},{"key":"e_1_3_2_2_44_1","volume-title":"Illusion and Dazzle: Adversarial Optical Channel Exploits Against Lidars for Automotive Applications. In International Conference on Cryptographic Hardware and Embedded Systems (CHES).","author":"Shin Hocheol","year":"2017","unstructured":"Hocheol Shin , Dohyun Kim , Yujin Kwon , and Yongdae Kim . 2017 . Illusion and Dazzle: Adversarial Optical Channel Exploits Against Lidars for Automotive Applications. In International Conference on Cryptographic Hardware and Embedded Systems (CHES). Hocheol Shin, Dohyun Kim, Yujin Kwon, and Yongdae Kim. 2017. Illusion and Dazzle: Adversarial Optical Channel Exploits Against Lidars for Automotive Applications. In International Conference on Cryptographic Hardware and Embedded Systems (CHES)."},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40349-1_4"},{"key":"e_1_3_2_2_46_1","volume-title":"PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks. In ACM Conference on Computer and Communications Security.","author":"Shoukry Yasser","unstructured":"Yasser Shoukry , Paul Martin , Yair Yona , Suhas N. Diggavi , and Mani B. Srivastava . 2015 . PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks. In ACM Conference on Computer and Communications Security. Yasser Shoukry, Paul Martin, Yair Yona, Suhas N. Diggavi, and Mani B. Srivastava. 2015. PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks. In ACM Conference on Computer and Communications Security."},{"key":"e_1_3_2_2_47_1","volume-title":"Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204","author":"Tram\u00e8r Florian","year":"2017","unstructured":"Florian Tram\u00e8r , Alexey Kurakin , Nicolas Papernot , Dan Boneh , and Patrick McDaniel . 2017. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 ( 2017 ). Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick McDaniel. 2017. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 (2017)."},{"key":"e_1_3_2_2_48_1","volume-title":"Transportation Research Board 2019 Annual Meeting (TRB).","author":"Wong Wai","year":"2019","unstructured":"Wai Wong , Shihong Huang , Yiheng Feng , Qi Alfred Chen , Z Morley Mao , and Henry X Liu . 2019 . Trajectory-Based Hierarchical Defense Model to Detect Cyber- Attacks on Transportation Infrastructure . In Transportation Research Board 2019 Annual Meeting (TRB). Wai Wong, Shihong Huang, Yiheng Feng, Qi Alfred Chen, Z Morley Mao, and Henry X Liu. 2019. Trajectory-Based Hierarchical Defense Model to Detect Cyber- Attacks on Transportation Infrastructure. In Transportation Research Board 2019 Annual Meeting (TRB)."},{"key":"e_1_3_2_2_49_1","volume-title":"Generating 3D Adversarial Point Clouds. arXiv preprint arXiv:1809.07016","author":"Xiang Chong","year":"2018","unstructured":"Chong Xiang , Charles R Qi , and Bo Li. 2018. Generating 3D Adversarial Point Clouds. arXiv preprint arXiv:1809.07016 ( 2018 ). Chong Xiang, Charles R Qi, and Bo Li. 2018. Generating 3D Adversarial Point Clouds. arXiv preprint arXiv:1809.07016 (2018)."},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01249-6_14"},{"key":"e_1_3_2_2_51_1","volume-title":"Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610","author":"Xiao Chaowei","year":"2018","unstructured":"Chaowei Xiao , Bo Li , Jun-Yan Zhu , Warren He , Mingyan Liu , and Dawn Song . 2018. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610 ( 2018 ). Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. 2018. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610 (2018)."},{"key":"e_1_3_2_2_52_1","volume-title":"Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612","author":"Xiao Chaowei","year":"2018","unstructured":"Chaowei Xiao , Jun-Yan Zhu , Bo Li , Warren He , Mingyan Liu , and Dawn Song . 2018. Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612 ( 2018 ). Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. 2018. Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612 (2018)."},{"key":"e_1_3_2_2_53_1","volume-title":"Adversarial Examples for Semantic Segmentation and Object Detection. In IEEE International Conference on Computer Vision (ICCV).","author":"Xie Cihang","year":"2017","unstructured":"Cihang Xie , Jianyu Wang , Zhishuai Zhang , Yuyin Zhou , Lingxi Xie , and Alan Yuille . 2017 . Adversarial Examples for Semantic Segmentation and Object Detection. In IEEE International Conference on Computer Vision (ICCV). Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. 2017. Adversarial Examples for Semantic Segmentation and Object Detection. In IEEE International Conference on Computer Vision (ICCV)."},{"key":"e_1_3_2_2_54_1","volume-title":"Can you fool AI with adversarial examples on a visual Turing test? arXiv preprint arXiv:1709.08693","author":"Xu Xiaojun","year":"2017","unstructured":"Xiaojun Xu , Xinyun Chen , Chang Liu , Anna Rohrbach , Trevor Darell , and Dawn Song . 2017. Can you fool AI with adversarial examples on a visual Turing test? arXiv preprint arXiv:1709.08693 ( 2017 ). Xiaojun Xu, Xinyun Chen, Chang Liu, Anna Rohrbach, Trevor Darell, and Dawn Song. 2017. Can you fool AI with adversarial examples on a visual Turing test? arXiv preprint arXiv:1709.08693 (2017)."},{"key":"e_1_3_2_2_55_1","unstructured":"Chen Yan. 2016. Can You Trust Autonomous Vehicles : Contactless Attacks against Sensors of Self-driving Vehicle.  Chen Yan. 2016. Can You Trust Autonomous Vehicles : Contactless Attacks against Sensors of Self-driving Vehicle."},{"key":"e_1_3_2_2_56_1","volume-title":"Sensor attack detection using history based pairwise inconsistency. Future Generation Computer Systems","author":"Yang Kang","year":"2018","unstructured":"Kang Yang , Rui Wang , Yu Jiang , Houbing Song , Chenxia Luo , Yong Guan , Xiaojuan Li , and Zhiping Shi . 2018. Sensor attack detection using history based pairwise inconsistency. Future Generation Computer Systems ( 2018 ). Kang Yang, Rui Wang, Yu Jiang, Houbing Song, Chenxia Luo, Yong Guan, Xiaojuan Li, and Zhiping Shi. 2018. Sensor attack detection using history based pairwise inconsistency. Future Generation Computer Systems (2018)."},{"key":"e_1_3_2_2_57_1","volume-title":"CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In USENIX Security Symposium.","author":"Yuan Xuejing","year":"2018","unstructured":"Xuejing Yuan , Yuxuan Chen , Yue Zhao , Yunhui Long , Xiaokang Liu , Kai Chen , Shengzhi Zhang , Heqing Huang , Xiaofeng Wang , and Carl A Gunter . 2018 . CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In USENIX Security Symposium. Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A Gunter. 2018. CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In USENIX Security Symposium."}],"event":{"name":"CCS '19: 2019 ACM SIGSAC Conference on Computer and Communications Security","location":"London United Kingdom","acronym":"CCS '19","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3339815","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319535.3339815","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319535.3339815","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:24:01Z","timestamp":1750202641000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3339815"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,6]]},"references-count":57,"alternative-id":["10.1145\/3319535.3339815","10.1145\/3319535"],"URL":"https:\/\/doi.org\/10.1145\/3319535.3339815","relation":{},"subject":[],"published":{"date-parts":[[2019,11,6]]},"assertion":[{"value":"2019-11-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}