A group of researchers, predominantly from universities in Singapore, have demonstrated a new method to interfere with autonomous vehicles by manipulating their reliance on camera-based computer vision, leading to the failure of recognizing road signs. The technique, named GhostStripe, exploits the sensors used by brands like Tesla and Baidu Apollo, particularly the CMOS camera sensors.
By using LEDs to project light patterns onto road signs, the researchers were able to confuse the self-driving software of the vehicles, preventing them from interpreting the signs correctly. This attack method targets the rolling digital shutter of CMOS camera sensors, causing the captured images to contain inconsistent lines that confuse the vehicle’s classifier and ultimately prevent appropriate action.
Unlike previous attempts to disrupt autonomous vehicles, the researchers were able to consistently distort the appearance of road signs in a stable manner. They developed two versions of this attack – GhostStripe1, which does not require access to the vehicle and utilizes a tracking system to adjust LED flickering, and GhostStripe2, which is targeted and requires access to the vehicle.
Testing their system on real roads with a vehicle equipped with a Leopard Imaging AR023ZWDR camera, the researchers achieved success rates of 94% for GhostStripe1 and 97% for GhostStripe2. However, strong ambient light was shown to degrade the attack’s performance, suggesting that attackers would need to carefully plan the time and location of their interference.
Countermeasures such as replacing the rolling shutter CMOS camera with a different sensor technology or including the attack method in AI training to prepare the system for such interference are available. This study adds to a growing body of research highlighting the vulnerabilities of AI and autonomous vehicles.
The team has reached out to Baidu for comment on the impact of this attack on their Apollo camera system.
