Trusted Perception Method for Traffic Signs That Are Physically Attacked

Traffic sign recognition is a crucial method by which autonomous driving systems acquire road information, and is predominantly based on deep neural networks (DNNs). However, the recognition results of DNNs are not always trustworthy for traffic signs subject to abnormal disturbance. Recently, the phenomenon of adversarial examples successfully deceiving DNNs has garnered considerable attention. Because DNN-based computer vision techniques are becoming increasingly prevalent in traffic scenarios, the misclassification of attacked traffic signs by DNN classifiers poses serious safety hazards. Although numerous methods have been proposed for crafting physical adversarial examples that are robust in the real world, most existing defense approaches focus on digital attacks, which necessitate the adversary infiltrating the embedded system; thus, it becomes challenging to obtain results. A reliable approach for defending against physical adversarial traffic signs enables autonomous vehicles to achieve trusted perception of traffic signs. In this paper, we present a deep image prior-based pipeline to defend against robust adversarial traffic signs in the real world, an approach that circumvents the need for prior data sets during training. Our approach protects the safety of autonomous vehicles by performing image reconstruction of captured traffic sign images. The genuine traffic sign class can be inferred by leveraging the consistency of the victim classifier’s decision results for reconstructed images at different stages. Additionally, we evaluate the efficacy of our defense pipeline for detecting other potential types of physical adversarial traffic signs that may exist in the real world, thus demonstrating the generalizability of our approach.