{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T20:14:21Z","timestamp":1785010461918,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":39,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,6,27]],"date-time":"2020-06-27T00:00:00Z","timestamp":1593216000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Natural Science Foundation of China","award":["61902169"],"award-info":[{"award-number":["61902169"]}]},{"name":"Shenzhen Peacock Plan","award":["KQTD2016112514355531"],"award-info":[{"award-number":["KQTD2016112514355531"]}]},{"name":"NSF","award":["CNS 1527727, CCF-1566589, CNS CAREER 1750263, CCF-1704790"],"award-info":[{"award-number":["CNS 1527727, CCF-1566589, CNS CAREER 1750263, CCF-1704790"]}]},{"name":"Science and Technology Innovation Committee Foundation of Shenzhen","award":["JCYJ20170817110848086"],"award-info":[{"award-number":["JCYJ20170817110848086"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,6,27]]},"DOI":"10.1145\/3377811.3380422","type":"proceedings-article","created":{"date-parts":[[2020,10,1]],"date-time":"2020-10-01T18:25:38Z","timestamp":1601576738000},"page":"347-358","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":129,"title":["DeepBillboard"],"prefix":"10.1145","author":[{"given":"Husheng","family":"Zhou","sequence":"first","affiliation":[{"name":"The University of Texas at Dallas"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Li","sequence":"additional","affiliation":[{"name":"Southern University of Science and Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zelun","family":"Kong","sequence":"additional","affiliation":[{"name":"The University of Texas at Dallas"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junfeng","family":"Guo","sequence":"additional","affiliation":[{"name":"The University of Texas at Dallas"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuqun","family":"Zhang","sequence":"additional","affiliation":[{"name":"Southern University of Science and Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bei","family":"Yu","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lingming","family":"Zhang","sequence":"additional","affiliation":[{"name":"The University of Texas at Dallas"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cong","family":"Liu","sequence":"additional","affiliation":[{"name":"The University of Texas at Dallas"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,10]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Adobe After Effects CC. https:\/\/www.adobe.com\/products\/aftereffects.html","year":"2015","unstructured":"Adobe. 2015. Adobe After Effects CC. https:\/\/www.adobe.com\/products\/aftereffects.html (2015)."},{"key":"e_1_3_2_1_2_1","volume-title":"Robust adversarial examples. https:\/\/blog.openai.com\/robust-adversarial-inputs","author":"Athalye Anish","year":"2017","unstructured":"Anish Athalye. 2017. Robust adversarial examples. https:\/\/blog.openai.com\/robust-adversarial-inputs (2017)."},{"key":"e_1_3_2_1_3_1","volume-title":"Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397","author":"Athalye Anish","year":"2017","unstructured":"Anish Athalye and Ilya Sutskever. 2017. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397 (2017)."},{"key":"e_1_3_2_1_4_1","volume-title":"Davide Del Testa","author":"Bojarski Mariusz","year":"2016","unstructured":"Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. 2016. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316 (2016)."},{"key":"e_1_3_2_1_5_1","volume-title":"Towards evaluating the robustness of neural networks. arXiv preprint arXiv:1608.04644","author":"Carlini Nicholas","year":"2016","unstructured":"Nicholas Carlini and David Wagner. 2016. Towards evaluating the robustness of neural networks. arXiv preprint arXiv:1608.04644 (2016)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"e_1_3_2_1_7_1","volume-title":"https:\/\/github.com\/SullyChen\/AutopilotTensorFlow","author":"Chen Sully","year":"2016","unstructured":"Sully Chen. 2016. Autopilot-tensorflow. https:\/\/github.com\/SullyChen\/AutopilotTensorFlow (2016)."},{"key":"e_1_3_2_1_8_1","volume-title":"Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373","author":"Cisse Moustapha","year":"2017","unstructured":"Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373 (2017)."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_3_2_1_10_1","volume-title":"Note on attacking object detectors with adversarial stickers. arXiv preprint arXiv:1712.08062","author":"Eykholt Kevin","year":"2017","unstructured":"Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Dawn Song, Tadayoshi Kohno, Amir Rahmati, Atul Prakash, and Florian Tramer. 2017. Note on attacking object detectors with adversarial stickers. arXiv preprint arXiv:1712.08062 (2017)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1177\/0278364913491297"},{"key":"e_1_3_2_1_12_1","volume-title":"Visualizations for understanding the regressed wheel steering angle for self driving cars. https:\/\/github.com\/jacobgil\/keras-steering-angle-visualizations","author":"Gildenblat Jacob","year":"2016","unstructured":"Jacob Gildenblat. 2016. Visualizations for understanding the regressed wheel steering angle for self driving cars. https:\/\/github.com\/jacobgil\/keras-steering-angle-visualizations (2016)."},{"key":"e_1_3_2_1_13_1","unstructured":"Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In Advances in neural information processing systems. 2672--2680."},{"key":"e_1_3_2_1_14_1","volume-title":"Explaining and harnessing adversarial examples","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. [n.d.]. Explaining and harnessing adversarial examples (2014). arXiv preprint arXiv:1412.6572 ([n. d.])."},{"key":"e_1_3_2_1_15_1","volume-title":"Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016)."},{"key":"e_1_3_2_1_16_1","volume-title":"Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770","author":"Liu Yanpei","year":"2016","unstructured":"Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770 (2016)."},{"key":"e_1_3_2_1_17_1","volume-title":"No need to worry about adversarial examples in object detection in autonomous vehicles. arXiv preprint arXiv:1707.03501","author":"Lu Jiajun","year":"2017","unstructured":"Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. 2017. No need to worry about adversarial examples in object detection in autonomous vehicles. arXiv preprint arXiv:1707.03501 (2017)."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238202"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2018.00021"},{"key":"e_1_3_2_1_20_1","volume-title":"NIC: Detecting Adversarial Samples with Neural Network Invariant Checking. In 26th Annual Network and Distributed System Security Symposium, NDSS. 24--27","author":"Ma Shiqing","year":"2019","unstructured":"Shiqing Ma, Yingqi Liu, Guanhong Tao, Wen-Chuan Lee, and Xiangyu Zhang. 2019. NIC: Detecting Adversarial Samples with Neural Network Invariant Checking. In 26th Annual Network and Distributed System Security Symposium, NDSS. 24--27."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.300"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_1_23_1","unstructured":"NVIDIA. 2016. Drive PX 2. http:\/\/www.nvidia.com\/object\/drive-px.html."},{"key":"e_1_3_2_1_24_1","volume-title":"https:\/\/github.com\/0bserver07\/Nvidia-Autopilot-Keras","author":"Nvidia-Autopilot-Keras NVIDIA.","year":"2016","unstructured":"NVIDIA. 2016. Nvidia-Autopilot-Keras. https:\/\/github.com\/0bserver07\/Nvidia-Autopilot-Keras (2016)."},{"key":"e_1_3_2_1_25_1","volume-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_27_1","volume-title":"2016 IEEE European Symposium on. IEEE, 372--387","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on. IEEE, 372--387."},{"key":"e_1_3_2_1_28_1","volume-title":"2016 IEEE European Symposium on. IEEE, 372--387","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on. IEEE, 372--387."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_31_1","volume-title":"Behavioral cloning: end-to-end learning for self-driving cars. https:\/\/github.com\/navoshta\/behavioral-cloning","author":"Staravoitau Alex","year":"2016","unstructured":"Alex Staravoitau. 2016. Behavioral cloning: end-to-end learning for self-driving cars. https:\/\/github.com\/navoshta\/behavioral-cloning (2016)."},{"key":"e_1_3_2_1_32_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_2_1_34_1","volume-title":"Using Deep Learning to Predict Steering Angles. https:\/\/medium.com\/udacity\/challenge-2-using-deep-learning-to-predict-steering-angles-f42004a36ff3","year":"2016","unstructured":"Udacity. 2016. Using Deep Learning to Predict Steering Angles. https:\/\/medium.com\/udacity\/challenge-2-using-deep-learning-to-predict-steering-angles-f42004a36ff3 (2016)."},{"key":"e_1_3_2_1_35_1","volume-title":"Steering angle model: Cg32. https:\/\/github.com\/udacity\/self-driving-car\/tree\/master\/steering-models\/community-models\/cg23","author":"Challenge Udacity","year":"2016","unstructured":"Udacity Challenge. 2016. Steering angle model: Cg32. https:\/\/github.com\/udacity\/self-driving-car\/tree\/master\/steering-models\/community-models\/cg23 (2016)."},{"key":"e_1_3_2_1_36_1","volume-title":"Steering angle model: Rambo. https:\/\/github.com\/udacity\/self-driving-car\/tree\/master\/steering-models\/community-models\/rambo","author":"Challenge Udacity","year":"2016","unstructured":"Udacity Challenge. 2016. Steering angle model: Rambo. https:\/\/github.com\/udacity\/self-driving-car\/tree\/master\/steering-models\/community-models\/rambo (2016)."},{"key":"e_1_3_2_1_37_1","volume-title":"Simulated annealing: Theory and applications","author":"Van Laarhoven Peter JM","unstructured":"Peter JM Van Laarhoven and Emile HL Aarts. 1987. Simulated annealing. In Simulated annealing: Theory and applications. Springer, 7--15."},{"key":"e_1_3_2_1_38_1","volume-title":"Yuille","author":"Xie Cihang","year":"2017","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan L. Yuille. 2017. Adversarial Examples for Semantic Segmentation and Object Detection. CoRR abs\/1703.08603 (2017). arXiv:1703.08603 http:\/\/arxiv.org\/abs\/1703.08603"},{"key":"e_1_3_2_1_39_1","volume-title":"DeepRoad: GAN-based Metamorphic Autonomous Driving System Testing. arXiv preprint arXiv:1802.02295","author":"Zhang Mengshi","year":"2018","unstructured":"Mengshi Zhang, Yuqun Zhang, Lingming Zhang, Cong Liu, and Sarfraz Khurshid. 2018. DeepRoad: GAN-based Metamorphic Autonomous Driving System Testing. arXiv preprint arXiv:1802.02295 (2018)."}],"event":{"name":"ICSE '20: 42nd International Conference on Software Engineering","location":"Seoul South Korea","acronym":"ICSE '20","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","KIISE Korean Institute of Information Scientists and Engineers","IEEE CS"]},"container-title":["Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380422","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3377811.3380422","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3377811.3380422","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:41:40Z","timestamp":1750200100000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380422"}},"subtitle":["systematic physical-world testing of autonomous driving systems"],"short-title":[],"issued":{"date-parts":[[2020,6,27]]},"references-count":39,"alternative-id":["10.1145\/3377811.3380422","10.1145\/3377811"],"URL":"https:\/\/doi.org\/10.1145\/3377811.3380422","relation":{},"subject":[],"published":{"date-parts":[[2020,6,27]]},"assertion":[{"value":"2020-10-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}