{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,21]],"date-time":"2026-04-21T06:48:32Z","timestamp":1776754112789,"version":"3.51.2"},"reference-count":80,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2025,2,22]],"date-time":"2025-02-22T00:00:00Z","timestamp":1740182400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2025,5,31]]},"abstract":"<jats:p>The prediction module, powered by deep learning models, constitutes a fundamental component of high-level Autonomous Vehicles (AVs). Given the direct influence of the module\u2019s prediction accuracy on AV driving behavior, ensuring its security is paramount. However, limited studies have explored the adversarial robustness of the prediction modules. Furthermore, existing methods still generate adversarial trajectories that deviate significantly from human driving behavior. These deviations can be easily identified as hazardous by AVs\u2019 anomaly detection models and thus cannot effectively evaluate and reflect the robustness of the prediction modules.<\/jats:p>\n          <jats:p>To bridge this gap, we propose a stealthy and more effective optimization-based attack method. Specifically, we reformulate the optimization problem using Lagrangian relaxation and design a Frenet-based objective function along with a distinct constraint space. We conduct extensive evaluations on 2 popular prediction models and 2 benchmark datasets. Our results show that our attack is highly effective, with over 87% attack success rates, outperforming all baseline attacks. Moreover, our attack method significantly improves the stealthiness of adversarial trajectories while guaranteeing adherence to physical constraints. Our attack is also found robust to noise from upstream modules, transferable across trajectory prediction models, and high realizability. Lastly, to verify its effectiveness in real-world applications, we conduct further simulation evaluations using a production-grade simulator. These simulations reveal that the adversarial trajectory we created could convincingly induce autonomous vehicles (AVs) to initiate hard braking.<\/jats:p>","DOI":"10.1145\/3705611","type":"journal-article","created":{"date-parts":[[2024,11,25]],"date-time":"2024-11-25T10:53:38Z","timestamp":1732532018000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Safe Driving Adversarial Trajectory Can Mislead: Toward More Stealthy Adversarial Attack Against Autonomous Driving Prediction Module"],"prefix":"10.1145","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-6245-1240","authenticated-orcid":false,"given":"Yingkai","family":"Dong","sequence":"first","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1289-5457","authenticated-orcid":false,"given":"Li","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4466-7523","authenticated-orcid":false,"given":"Zheng","family":"Li","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbrucken, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0558-6245","authenticated-orcid":false,"given":"Hao","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1304-8401","authenticated-orcid":false,"given":"Peng","family":"Tang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5523-2672","authenticated-orcid":false,"given":"Chengyu","family":"Hu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3367-0951","authenticated-orcid":false,"given":"Shanqing","family":"Guo","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Shandong University, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,2,22]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"2024. Autoware. Retrieved from https:\/\/www.autoware.org\/"},{"key":"e_1_3_2_3_2","unstructured":"2024. Baidu Apollo. Retrieved from http:\/\/apollo.auto"},{"key":"e_1_3_2_4_2","unstructured":"2022. Discrete Point Curve Smoothing Principle. Retrieved from https:\/\/github.com\/ApolloAuto\/apollo\/tree\/master\/modules\/planning\/math\/discretized_points_smoothing"},{"key":"e_1_3_2_5_2","unstructured":"2019. Experimental Security Research of Tesla Autopilot. Retrieved from https:\/\/keenlab.tencent.com\/en\/whitepapers\/Experimental_Security_Research_of_Tesla_Autopilot.pdf"},{"key":"e_1_3_2_6_2","unstructured":"2022. LGSVL Simulator. Retrieved from https:\/\/www.lgsvlsimulator.com\/"},{"key":"e_1_3_2_7_2","unstructured":"2020. Navigant Research Names Waymo Ford Autonomous Vehicles Cruise and Baidu the Leading Developers of Automated Driving Systems. Retrieved from https:\/\/www.businesswire.com\/news\/home\/20200407005119\/en\/Navigant-Research-Names-Waymo-Ford-Autonomous-Vehicles"},{"key":"e_1_3_2_8_2","unstructured":"2018. Waymo has Launched its Commercial Self-driving Service in Phoenix - and it\u2019s Called \u2018Waymo One\u2019. Retrieved from https:\/\/www.businessinsider.com\/waymo-one-driverless-car-service-launches-in-phoenix-arizona-2018-12"},{"key":"e_1_3_2_9_2","first-page":"274","volume-title":"International Conference on Machine Learning","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning. PMLR, 274\u2013283."},{"key":"e_1_3_2_10_2","first-page":"284","volume-title":"International Conference on Machine Learning","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. 2018. Synthesizing robust adversarial examples. In International Conference on Machine Learning. PMLR, 284\u2013293."},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW56347.2022.00495"},{"key":"e_1_3_2_12_2","doi-asserted-by":"crossref","unstructured":"Holger Caesar Varun Bankiti Alex H. Lang Sourabh Vora Venice Erin Liong Qiang Xu Anush Krishnan Yu Pan Giancarlo Baldan and Oscar Beijbom. 2020. nuScenes: A multimodal dataset for autonomous driving. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 11621\u201311631.","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/3632293"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00076"},{"key":"e_1_3_2_15_2","doi-asserted-by":"crossref","unstructured":"Yulong Cao Chaowei Xiao Anima Anandkumar Danfei Xu and Marco Pavone. 2022. Advdo: Realistic adversarial attacks for trajectory prediction. In European Conference on Computer Vision Springer 36\u201352.","DOI":"10.1007\/978-3-031-20065-6_3"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339815"},{"key":"e_1_3_2_17_2","first-page":"128","volume-title":"Conference on Robot Learning","author":"Cao Yulong","year":"2023","unstructured":"Yulong Cao, Danfei Xu, Xinshuo Weng, Zhuoqing Mao, Anima Anandkumar, Chaowei Xiao, and Marco Pavone. 2023. Robust trajectory prediction against adversarial attacks. In Conference on Robot Learning. PMLR, 128\u2013137."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_19_2","volume-title":"CoRL","author":"Casas Sergio","year":"2018","unstructured":"Sergio Casas, Wenjie Luo, and Raquel Urtasun. 2018. Intentnet: Learning to predict intention from raw sensor data. In CoRL."},{"key":"e_1_3_2_20_2","volume-title":"CoRL","author":"Chai Yuning","year":"2019","unstructured":"Yuning Chai, Benjamin Sapp, Mayank Bansal, and Dragomir Anguelov. 2019. MultiPath: Multiple probabilistic anchor trajectory hypotheses for behavior prediction. In CoRL."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00868"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2020.3004794"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00895"},{"key":"e_1_3_2_24_2","volume-title":"ECML PKDD","author":"Chen Shang-Tse","year":"2018","unstructured":"Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. 2018. Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector. In ECML PKDD."},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510582"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00031"},{"key":"e_1_3_2_27_2","first-page":"1310","volume-title":"international Conference on Machine Learning","author":"Cohen Jeremy","year":"2019","unstructured":"Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In international Conference on Machine Learning. PMLR, 1310\u20131320."},{"key":"e_1_3_2_28_2","unstructured":"SAE International. 2018. Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2019.8793868"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.4108\/ICST.PERVASIVEHEALTH2010.8901"},{"key":"e_1_3_2_31_2","unstructured":"Nachiket Deo and Mohan M. Trivedi. 2020. Trajectory forecasts in unknown environments conditioned on grid-based plans. arXiv:2001.00735. Retrieved from https:\/\/arxiv.org\/abs\/2001.00735"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-25540-4_25"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1177\/0278364910365417"},{"key":"e_1_3_2_34_2","volume-title":"WOOT","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Physical adversarial examples for object detectors. In WOOT."},{"key":"e_1_3_2_35_2","volume-title":"2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physical-world attacks on deep learning visual classification. In 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)."},{"key":"e_1_3_2_36_2","unstructured":"Haoyang Fan Fan Zhu Changchun Liu Liangliang Zhang Li Zhuang Dong Li Weicheng Zhu Jiangtao Hu Hongye Li and Qi Kong. 2018. Baidu apollo em motion planner. arXiv:1807.08048. Retrieved from https:\/\/arxiv.org\/abs\/1807.08048"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3314221.3314633"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01154"},{"key":"e_1_3_2_39_2","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00865"},{"key":"e_1_3_2_41_2","unstructured":"Zhisheng Hu Shengjian Guo Zhenyu Zhong and Kang Li. 2021. Coverage-based scene fuzzing for virtual autonomous driving testing. arXiv:2106.00873. Retrieved from https:\/\/arxiv.org\/abs\/2106.00873"},{"issue":"4","key":"e_1_3_2_42_2","doi-asserted-by":"crossref","first-page":"569","DOI":"10.1016\/j.apergo.2009.12.002","article-title":"Evaluation of a sudden brake warning system: Effect on the response time of the following driver","volume":"41","author":"Isler Robert B.","year":"2010","unstructured":"Robert B. Isler and Nicola J. Starkey. 2010. Evaluation of a sudden brake warning system: Effect on the response time of the following driver. Applied Ergonomics 41, 4 (2010), 569\u2013576.","journal-title":"Applied Ergonomics"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/IV51971.2022.9827101"},{"key":"e_1_3_2_44_2","volume-title":"International Conference on Learning Representations (ICLR\u201920)","author":"Jia Yunhan Jia","year":"2020","unstructured":"Yunhan Jia Jia, Yantao Lu, Junjie Shen, Qi Alfred Chen, Hao Chen, Zhenyu Zhong, and Tao Wei Wei. 2020. Fooling detection alone is not enough: Adversarial attack against multiple object tracking. In International Conference on Learning Representations (ICLR\u201920)."},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/IROS55552.2023.10342070"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00754"},{"key":"e_1_3_2_47_2","unstructured":"Diederik P. Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv:1412.6980. Retrieved from https:\/\/arxiv.org\/abs\/1412.6980"},{"key":"e_1_3_2_48_2","first-page":"942","volume-title":"2020 IEEE 16th International Conference on Automation Science and Engineering (CASE)","author":"Li Bai","year":"2020","unstructured":"Bai Li, Qi Kong, Youmin Zhang, Zhijiang Shao, Yumeng Wang, Xiaoyan Peng, and Daxun Yan. 2020. On-road trajectory planning with spatio-temporal RRT* and always-feasible quadratic program. In 2020 IEEE 16th International Conference on Automation Science and Engineering (CASE). IEEE, 942\u2013947."},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE5003.2020.00012"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/tits.2017.2756099"},{"issue":"1","key":"e_1_3_2_51_2","first-page":"341","article-title":"Hybrid trajectory planning for autonomous driving in on-road dynamic scenarios","volume":"22","author":"Lim Wonteak","year":"2019","unstructured":"Wonteak Lim, Seongjin Lee, Myoungho Sunwoo, and Kichun Jo. 2019. Hybrid trajectory planning for autonomous driving in on-road dynamic scenarios. IEEE Transactions on Intelligent Transportation Systems 22, 1 (2019), 341\u2013355.","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ROBIO54168.2021.9739407"},{"key":"e_1_3_2_53_2","unstructured":"Jiajun Lu Hussein Sibai and Evan Fabry. 2017. Adversarial examples that fool detectors. arXiv:1712.02494. Retrieved from https:\/\/arxiv.org\/abs\/1712.02494"},{"key":"e_1_3_2_54_2","volume-title":"IEEE International Conference on Robotics and Automation, ICRA 2010, Anchorage, Alaska, USA, 3-7 May 2010","author":"Luber Matthias","year":"2010","unstructured":"Matthias Luber, Johannes A. Stork, Gian Diego Tipaldi, and Kai O. Arras. 2010. People tracking with human motion predictions from social forces. In IEEE International Conference on Robotics and Automation, ICRA 2010, Anchorage, Alaska, USA, 3-7 May 2010."},{"key":"e_1_3_2_55_2","unstructured":"Aleksander Madry. 2017. Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083. Retrieved from https:\/\/arxiv.org\/abs\/1706.06083"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2020.3017342"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"issue":"3","key":"e_1_3_2_58_2","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1063\/PT.3.2314","article-title":"Traffic flow dynamics: Data, models and simulation","volume":"67","author":"Nishinari Katsuhiro","year":"2014","unstructured":"Katsuhiro Nishinari. 2014. Traffic flow dynamics: Data, models and simulation. Physics Today 67, 3 (2014), 54\u201354.","journal-title":"Physics Today"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"e_1_3_2_61_2","volume-title":"Predicting Pedestrian Trajectories","author":"Pellegrini Stefano","year":"2011","unstructured":"Stefano Pellegrini, Andreas Ess, and Luc Van Gool. 2011. Predicting Pedestrian Trajectories. Visual Analysis of Humans."},{"key":"e_1_3_2_62_2","doi-asserted-by":"crossref","first-page":"103705","DOI":"10.1016\/j.trc.2022.103705","article-title":"Are socially-aware trajectory prediction models really socially-aware?","volume":"141","author":"Saadatnejad Saeed","year":"2022","unstructured":"Saeed Saadatnejad, Mohammadhossein Bahari, Pedram Khorsandi, Mohammad Saneian, Seyed-Mohsen Moosavi-Dezfooli, and Alexandre Alahi. 2022. Are socially-aware trajectory prediction models really socially-aware? Transportation Research Part C: Emerging Technologies 141 (2022), 103705.","journal-title":"Transportation Research Part C: Emerging Technologies"},{"key":"e_1_3_2_63_2","doi-asserted-by":"crossref","first-page":"683","DOI":"10.1007\/978-3-030-58523-5_40","volume-title":"Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XVIII 16","author":"Salzmann Tim","year":"2020","unstructured":"Tim Salzmann, Boris Ivanovic, Punarjay Chakravarty, and Marco Pavone. 2020. Trajectron++: Dynamically-feasible trajectory forecasting with heterogeneous data. In Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XVIII 16. Springer, 683\u2013700."},{"key":"e_1_3_2_64_2","first-page":"931","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Shen Junjie","year":"2020","unstructured":"Junjie Shen, Jun Yeon Won, Zeyuan Chen, and Qi Alfred Chen. 2020. Drift with devil: Security of multi-sensor fusion based localization in high-level autonomous driving under GPS spoofing. In 29th USENIX Security Symposium (USENIX Security 20). 931\u2013948."},{"key":"e_1_3_2_65_2","first-page":"2957","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Song Ruoyu","year":"2023","unstructured":"Ruoyu Song, Muslum Ozgur Ozmen, Hyungsub Kim, Raymond Muller, Z. Berkay Celik, and Antonio Bianchi. 2023. Discovering adversarial driving maneuvers against autonomous vehicles. In 32nd USENIX Security Symposium (USENIX Security 23). 2957\u20132974."},{"key":"e_1_3_2_66_2","first-page":"877","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Sun Jiachen","year":"2020","unstructured":"Jiachen Sun, Yulong Cao, Qi Alfred Chen, and Z. Morley Mao. 2020. Towards robust LiDAR-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures. In 29th USENIX Security Symposium (USENIX Security 20). 877\u2013894."},{"key":"e_1_3_2_67_2","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv:1312.6199. Retrieved from https:\/\/arxiv.org\/abs\/1312.6199"},{"key":"e_1_3_2_68_2","first-page":"431","volume-title":"Learning for Dynamics and Control Conference","author":"Tan Kaiyuan","year":"2023","unstructured":"Kaiyuan Tan, Jun Wang, and Yiannis Kantaros. 2023. Targeted adversarial attacks against neural network trajectory predictors. In Learning for Dynamics and Control Conference. PMLR, 431\u2013444."},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_2_70_2","volume-title":"Differential Geometry of Curves and Surfaces","author":"Toponogov Victor A.","year":"2006","unstructured":"Victor A. Toponogov. 2006. Differential Geometry of Curves and Surfaces. Springer."},{"issue":"1","key":"e_1_3_2_71_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3634914","article-title":"DEEPFAKER: A unified evaluation platform for facial deepfake and detection models","volume":"27","author":"Wang Li","year":"2024","unstructured":"Li Wang, Xiangtao Meng, Dan Li, Xuhong Zhang, Shouling Ji, and Shanqing Guo. 2024. DEEPFAKER: A unified evaluation platform for facial deepfake and detection models. ACM Transactions on Privacy and Security 27, 1 (2024), 1\u201334.","journal-title":"ACM Transactions on Privacy and Security"},{"key":"e_1_3_2_72_2","doi-asserted-by":"crossref","first-page":"1318","DOI":"10.1109\/CAC51589.2020.9327252","volume-title":"2020 Chinese Automation Congress (CAC)","author":"Wang Yang","year":"2020","unstructured":"Yang Wang, Shengfei Li, Wen Cheng, Xing Cui, and Bo Su. 2020. Toward efficient trajectory planning based on deterministic sampling and optimization. In 2020 Chinese Automation Congress (CAC). IEEE, 1318\u20131323."},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/ROBOT.2010.5509799"},{"key":"e_1_3_2_74_2","first-page":"5286","volume-title":"International Conference on Machine Learning","author":"Wong Eric","year":"2018","unstructured":"Eric Wong and Zico Kolter. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning. PMLR, 5286\u20135295."},{"key":"e_1_3_2_75_2","doi-asserted-by":"crossref","first-page":"524","DOI":"10.1109\/CIS-RAM47153.2019.9095790","volume-title":"2019 IEEE International Conference on Cybernetics and Intelligent Systems (CIS) and IEEE Conference on Robotics, Automation and Mechatronics (RAM)","author":"Yang Chule","year":"2019","unstructured":"Chule Yang, Alessandro Renzaglia, Anshul Paigwar, Christian Laugier, and Danwei Wang. 2019. Driving behavior assessment and anomaly detection for intelligent vehicles. In 2019 IEEE International Conference on Cybernetics and Intelligent Systems (CIS) and IEEE Conference on Robotics, Automation and Mechatronics (RAM). IEEE, 524\u2013529."},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.aap.2013.05.004"},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01473"},{"key":"e_1_3_2_78_2","volume-title":"ICLR","author":"Zhang Yang","year":"2019","unstructured":"Yang Zhang, Philip David Hassan Foroosh, and Boqing Gong. 2019. CAMOU: Learning a vehicle camouflage for physical adversarial attack on object detections in the wild. In ICLR."},{"key":"e_1_3_2_79_2","unstructured":"Hang Zhao Jiyang Gao Tian Lan Chen Sun Ben Sapp Balakrishnan Varadarajan Yue Shen Yi Shen Yuning Chai Cordelia Schmid and others. 2021. Tnt: Target-driven trajectory prediction. In Conference on Robot Learning PMLR 895\u2013904."},{"key":"e_1_3_2_80_2","doi-asserted-by":"crossref","unstructured":"Yue Zhao Hong Zhu Ruigang Liang Qintao Shen Shengzhi Zhang and Kai Chen. 2019. Seeing isn\u2019t believing: Towards more robust adversarial attack against real world object detectors. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 1989\u20132004.","DOI":"10.1145\/3319535.3354259"},{"key":"e_1_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00862"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3705611","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3705611","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:06Z","timestamp":1750295886000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3705611"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,22]]},"references-count":80,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,5,31]]}},"alternative-id":["10.1145\/3705611"],"URL":"https:\/\/doi.org\/10.1145\/3705611","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,2,22]]},"assertion":[{"value":"2024-04-22","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-10-30","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-02-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}