{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T16:07:46Z","timestamp":1764778066299,"version":"3.46.0"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2245729"],"award-info":[{"award-number":["2245729"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,12,3]]},"DOI":"10.1145\/3769102.3770607","type":"proceedings-article","created":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T16:00:41Z","timestamp":1764777641000},"page":"1-16","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["ARMBench: Benchmarking Adversarial Robustness of Multitask Perception in Autonomous Driving"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-5177-6872","authenticated-orcid":false,"given":"Yunge","family":"Li","sequence":"first","affiliation":[{"name":"Oakland University, Rochester, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3717-427X","authenticated-orcid":false,"given":"Yuhong","family":"Liu","sequence":"additional","affiliation":[{"name":"Santa Clara University, Santa Clara, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3442-8411","authenticated-orcid":false,"given":"Lanyu","family":"Xu","sequence":"additional","affiliation":[{"name":"Oakland University, Rochester, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,12,3]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/CDC.2002.1184477"},{"key":"e_1_3_2_1_2_1","volume-title":"Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.01356","author":"Bai Tao","year":"2021","unstructured":"Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. 2021. Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.01356 (2021)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"crossref","unstructured":"Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). Ieee 39\u201357.","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_5_1","volume-title":"Adversarial attacks on autonomous driving systems in the physical world: a survey","author":"Chi Lijun","year":"2024","unstructured":"Lijun Chi, Mounira Msahli, Qingjie Zhang, Han Qiu, Tianwei Zhang, Gerard Memmi, and Meikang Qiu. 2024. Adversarial attacks on autonomous driving systems in the physical world: a survey. IEEE Transactions on Intelligent Vehicles (2024)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.350"},{"key":"e_1_3_2_1_7_1","volume-title":"Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670","author":"Croce Francesco","year":"2020","unstructured":"Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2020. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 (2020)."},{"key":"e_1_3_2_1_8_1","volume-title":"Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track. https:\/\/openreview.net\/forum?id=SSKZPJCt7B","author":"Croce Francesco","year":"2021","unstructured":"Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. RobustBench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track. https:\/\/openreview.net\/forum?id=SSKZPJCt7B"},{"key":"e_1_3_2_1_9_1","unstructured":"Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML."},{"key":"e_1_3_2_1_10_1","volume-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900","author":"Das Nilaksh","year":"2017","unstructured":"Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. 2017. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900 (2017)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/PerCom45495.2020.9127389"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_3_2_1_14_1","volume-title":"Vision meets robotics: The kitti dataset. The international journal of robotics research 32, 11","author":"Geiger Andreas","year":"2013","unstructured":"Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. 2013. Vision meets robotics: The kitti dataset. The international journal of robotics research 32, 11 (2013), 1231\u20131237."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108985"},{"key":"e_1_3_2_1_16_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"e_1_3_2_1_18_1","volume-title":"Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117","author":"Guo Chuan","year":"2017","unstructured":"Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. 2017. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117 (2017)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3643832.3661854"},{"key":"e_1_3_2_1_20_1","volume-title":"Emma: End-to-end multimodal model for autonomous driving. arXiv preprint arXiv:2410.23262","author":"Hwang Jyh-Jing","year":"2024","unstructured":"Jyh-Jing Hwang, Runsheng Xu, Hubert Lin, Wei-Chih Hung, Jingwei Ji, Kristy Choi, Di Huang, Tong He, Paul Covington, Benjamin Sapp, et al. 2024. Emma: End-to-end multimodal model for autonomous driving. arXiv preprint arXiv:2410.23262 (2024)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.632"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICAPAI61893.2024.10541282"},{"key":"e_1_3_2_1_24_1","volume-title":"Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems. arXiv preprint arXiv:2201.06192","author":"Jia Wei","year":"2022","unstructured":"Wei Jia, Zhaojun Lu, Haichun Zhang, Zhenglin Liu, Jie Wang, and Gang Qu. 2022. Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems. arXiv preprint arXiv:2201.06192 (2022)."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2020.2977378"},{"key":"e_1_3_2_1_26_1","volume-title":"Towards proving the adversarial robustness of deep neural networks. arXiv preprint arXiv:1709.02802","author":"Katz Guy","year":"2017","unstructured":"Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. 2017. Towards proving the adversarial robustness of deep neural networks. arXiv preprint arXiv:1709.02802 (2017)."},{"key":"e_1_3_2_1_27_1","volume-title":"Complexity Matters: Effective Dimensionality as a Measure for Adversarial Robustness. arXiv preprint arXiv:2410.18556","author":"Khachaturov David","year":"2024","unstructured":"David Khachaturov and Robert Mullins. 2024. Complexity Matters: Effective Dimensionality as a Measure for Adversarial Robustness. arXiv preprint arXiv:2410.18556 (2024)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/OJITS.2022.3142612"},{"key":"e_1_3_2_1_29_1","unstructured":"Alex Krizhevsky Vinod Nair Geoffrey Hinton et al. 2014. The CIFAR-10 dataset. online: http:\/\/www.cs.toronto.edu\/kriz\/cifar.html 55 5 (2014) 2."},{"key":"e_1_3_2_1_30_1","volume-title":"Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 (2016)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2024.3372383"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"e_1_3_2_1_33_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_3_2_1_35_1","volume-title":"Article arXiv:2206.04365 (June","author":"Nesti Federico","year":"2022","unstructured":"Federico Nesti, Giulio Rossolini, Gianluca D'Amico, Alessandro Biondi, and Giorgio Buttazzo. 2022. CARLA-GeAR: a Dataset Generator for a Systematic Evaluation of Adversarial Robustness of Vision Models. arXiv e-prints, Article arXiv:2206.04365 (June 2022), arXiv:2206.04365 pages. arXiv:2206.04365 [cs.CV]"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_1_38_1","volume-title":"Bait and switch: Online training data poisoning of autonomous driving systems. arXiv preprint arXiv:2011.04065","author":"Patel Naman","year":"2020","unstructured":"Naman Patel, Prashanth Krishnamurthy, Siddharth Garg, and Farshad Khorrami. 2020. Bait and switch: Online training data poisoning of autonomous driving systems. arXiv preprint arXiv:2011.04065 (2020)."},{"key":"e_1_3_2_1_39_1","volume-title":"International Conference on Machine Learning. PMLR, 7717\u20137727","author":"Pinot Rafael","year":"2020","unstructured":"Rafael Pinot, Raphael Ettedgui, Geovani Rizk, Yann Chevaleyre, and Jamal Atif. 2020. Randomization matters how to defend against strong adversarial attacks. In International Conference on Machine Learning. PMLR, 7717\u20137727."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2975048"},{"key":"e_1_3_2_1_41_1","volume-title":"Defense-gan: protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605","author":"Samangouei P","year":"2018","unstructured":"P Samangouei. 2018. Defense-gan: protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605 (2018)."},{"key":"e_1_3_2_1_42_1","volume-title":"Adversarially robust generalization requires more data. Advances in neural information processing systems 31","author":"Schmidt Ludwig","year":"2018","unstructured":"Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. 2018. Adversarially robust generalization requires more data. Advances in neural information processing systems 31 (2018)."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"e_1_3_2_1_44_1","volume-title":"Varun Ravi Kumar, and Senthil Yogamani","author":"Sobh Ibrahim","year":"2021","unstructured":"Ibrahim Sobh, Ahmed Hamed, Varun Ravi Kumar, and Senthil Yogamani. 2021. Adversarial attacks on multi-task visual perception for autonomous driving. arXiv preprint arXiv:2107.07449 (2021)."},{"key":"e_1_3_2_1_45_1","volume-title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766","author":"Song Yang","year":"2017","unstructured":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. 2017. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766 (2017)."},{"key":"e_1_3_2_1_46_1","volume-title":"Ensemble methods as a defense to adversarial perturbations against deep neural networks. arXiv preprint arXiv:1709.03423","author":"Strauss Thilo","year":"2017","unstructured":"Thilo Strauss, Markus Hanselmann, Andrej Junginger, and Holger Ulmer. 2017. Ensemble methods as a defense to adversarial perturbations against deep neural networks. arXiv preprint arXiv:1709.03423 (2017)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00252"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415758"},{"key":"e_1_3_2_1_49_1","unstructured":"Tesla. 2025. Autopilot. https:\/\/www.tesla.com\/autopilot. 01\/09\/2025."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.14722\/vehiclesec.2024.23025"},{"key":"e_1_3_2_1_51_1","volume-title":"Hybridnets: End-to-end perception network. arXiv preprint arXiv:2203.09035","author":"Vu Dat","year":"2022","unstructured":"Dat Vu, Bao Ngo, and Hung Phan. 2022. Hybridnets: End-to-end perception network. arXiv preprint arXiv:2203.09035 (2022)."},{"key":"e_1_3_2_1_52_1","volume-title":"An Efficient Preprocessing Method to Eliminate Adversarial Effects. arXiv preprint arXiv:1905.08614","author":"Wang Hua","year":"2019","unstructured":"Hua Wang, Jie Wang, and Zhaoxia Yin. 2019. An Efficient Preprocessing Method to Eliminate Adversarial Effects. arXiv preprint arXiv:1905.08614 (2019)."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00917"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/SEC.2018.00010"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-022-1339-y"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"e_1_3_2_1_58_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Yan Chen","year":"2022","unstructured":"Chen Yan, Zhijian Xu, Zhanyuan Yin, Stefan Mangard, Xiaoyu Ji, Wenyuan Xu, Kaifa Zhao, Yajin Zhou, Ting Wang, Guofei Gu, et al. 2022. Rolling colors: Adversarial laser exploits against traffic light recognition. In 31st USENIX Security Symposium (USENIX Security 22). 1957\u20131974."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00271"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00051"},{"key":"e_1_3_2_1_61_1","volume-title":"Leveraging Generalizability of Image-to-Image Translation for Enhanced Adversarial Defense. arXiv preprint arXiv:2504.01399","author":"Zhang Haibo","year":"2025","unstructured":"Haibo Zhang, Zhihua Yao, Kouichi Sakurai, and Takeshi Saitoh. 2025. Leveraging Generalizability of Image-to-Image Translation for Enhanced Adversarial Defense. arXiv preprint arXiv:2504.01399 (2025)."},{"key":"e_1_3_2_1_62_1","volume-title":"Adversarial defense by suppressing high-frequency components. arXiv preprint arXiv:1908.06566","author":"Zhang Zhendong","year":"2019","unstructured":"Zhendong Zhang, Cheolkon Jung, and Xiaolong Liang. 2019. Adversarial defense by suppressing high-frequency components. arXiv preprint arXiv:1908.06566 (2019)."}],"event":{"name":"SEC '25: Tenth ACM\/IEEE Symposium on Edge Computing","location":"the Hilton Arlington National Landing Arlington VA USA","acronym":"SEC '25","sponsor":["SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing","IEEE Computer Society"]},"container-title":["Proceedings of the Tenth ACM\/IEEE Symposium on Edge Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3769102.3770607","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T16:03:08Z","timestamp":1764777788000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3769102.3770607"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,3]]},"references-count":62,"alternative-id":["10.1145\/3769102.3770607","10.1145\/3769102"],"URL":"https:\/\/doi.org\/10.1145\/3769102.3770607","relation":{},"subject":[],"published":{"date-parts":[[2025,12,3]]},"assertion":[{"value":"2025-12-03","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}