BadMars: Data Poisoning Attacks on Image Segmentation Models for Mars Rover Autonomous Driving

In Mars rover autonomous driving, vision-based approaches primarily leverage image segmentation models to detect rock obstacles and further facilitate safe route planning. Most existing studies focus on enhancing segmentation accuracy but overlook the potential security vulnerabilities inherent in these models. To address this gap, we are the first to conduct research on data poisoning attacks against image segmentation models for Mars rover autonomous driving. We also propose BadMars—the first dedicated data poisoning attack tailored for Mars image segmentation. Due to the uniform colors of rocks and background in Martian terrain images, Earth-oriented attack methods struggle to learn trigger features, leading to attack failure, overfitting or performance degradation. To solve this, BadMars con-structs triggers by introducing global irrelevant color offsets while maintaining constant image brightness. Additionally, we propose BadMars-RL, a reinforcement learning-based approach for efficient optimal trigger search. Validated on two NASA public Mars datasets (AI4Mars and MarsData-V2), experimental results show our method achieves optimal attack performance (Attack mIoU up to 99.99% on MarsData-V2) while keeping model accuracy nearly unchanged.