B²PATCH: Designing Adversarial Patches to Manipulate Bounding Box Perception in Vehicular Attacks

Deep neural network (DNN)-based vehicular cameras, capable of detecting multiple road objects with high accuracy, enable critical autonomous driving applications such as lane changing and overtaking. However, their vulnerability to adversarial attacks exposes them susceptible to potential security risks. Recent studies indicate that adversarial patches can impair detector functionality by modifying vehicle perception attributes, such as color and distance. Currently, the design of effective adversarial patch attacks targeting vehicle bounding boxes has not been thoroughly investigated. Incorrect bounding boxes lead to the detector marking inaccurate vehicle locations, causing the vehicular system to make erroneous decisions (e.g., path deviation). In this paper, we propose BPATCH, an adversarial patch attack targeting the perception of vehicular bounding boxes. Our attack targets DNN-based camera detectors, leading to inaccurate recognition of both the size and location of the bounding box. We design a two-stage training process, where a random patch is first transformed and applied based on various factors for robustness, and then the output is used to optimize meaningful vehicular stickers for stealthiness in practical applications. We in particular introduce new loss functions to enhance the effectiveness of the attack. Extensive experiments on two datasets and the real-world application demonstrate the effectiveness of our method across various DNN-based models and stickers.