Quantitative Evaluation of Vulnerabilities in Adversarial Shadow Attack

As automated driving technology gains global attention, adversarial samples (AEs), a vulnerability of deep neural networks (DNNs), pose a significant threat. Among various AEs, adversarial shadow attacks (ASA) are particularly concerning, as they introduce perturbations through shadows in regions that significantly affect explainable AI (XAI) inference, while also emphasizing their reproducibility in real-world scenarios. However, no effective countermeasures for ASA currently exist. Therefore, since ASA is a type of AEs, we conducted a quantitative evaluation of existing AE countermeasures-such as Bit depth reduction, JPEG conversion, and filter-based smoothing-in an attempt to reduce the perturbations caused by ASA. Specifically, we applied these AE countermeasures to ASA and generated protective images. These images were then classified using an image classifier to assess their impact on inference accuracy. For this study, we used the German Traffic Sign Detection Benchmark dataset and ResNet-50. The highest inference success rate observed with Bit depth reduction was 18.93 %, meaning that <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{8 1. 0 7 \%}$</tex> of the cases still resulted in incorrect inference despite applying AE countermeasures. These results demonstrate that current AE countermeasures are ineffective against ASA.