System-level attack taxonomy for Deep Learning in Autonomous Vehicles

This repository contains a taxonomy-style index of system-level attacks on DL components in Autonomous Vehicles (papers published 2017-01-01 → 2024-01-01). The taxonomy and mappings below are derived from the paper: A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles, used to build this repo.

---

Quick start

• What this repo is: a lightweight, curated taxonomy and index (titles + links) of the papers for system-level attacks on DL in AVs. Unlike a bibliography, this README prioritizes taxonomy-based discovery (categories, leaves, and links to papers) so researchers can quickly find papers by attack properties.

• Where the content comes from: the taxonomy and mappings were extracted from the paper (Tehrani et al., A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles). See the original paper for full details and full references.

• Files included in this document:

  • data/taxonomyCSV.csv full taxonomy mapping in CSV
  • data/taxonomyJSON.json machine-friendly JSON mirroring the full CSV
  • data/taxonomyMD.md is a readable Markdown version of the full taxonomy mapping.
  • data/treeASCII.md is an ASCII format version of the full taxonomy tree.
  • data/categories.md is a full description of the meanings of each category.

---

Scope & inclusion criteria (short)

• Time window: studies published between 2017-01-01 and 2024-01-01.

• What we include: papers that execute an attack on DL components in an AV context and report a system-level failure or observable system-level effect (e.g., crash, lane-departure, freeze, wrong decision). This intentionally excludes papers that only report model-level mispredictions without any system-level evaluation.

• What we exclude (and why):

  • Sensor physical removal/physical tampering papers that only remove sensors or physically damage hardware without targeting DL model inputs are outside our focus when they do not produce DL-based model mispredictions leading to system-level failures.
  • Network-only attacks (purely communication-layer exploits) were excluded because the taxonomy focuses on attacks that manipulate the DL components or their inputs/outputs and track how those model-level changes propagate to system-level failures.

---

What is a "system-level attack"?

A system-level attack is an adversarial action that (1) causes a DL component in an autonomous vehicle to produce a model-level error (e.g., misdetection, wrong steering-angle prediction, misclassification) and (2) — crucially — that model-level error propagates into a measurable failure at the vehicle/system level (e.g., lane departure, collision, emergency braking, freezing).

This emphasizes the end-to-end chain from environment/digital manipulation → model misprediction → system-level consequence. The taxonomy classifies attacks based on where and how the chain is built (attacked target, attacker capability, model under attack, application, system-level result, etc.).

---

Categories

Please refer to categories.md for a full explanation of the meaning of each category.

---

Taxonomy Mapping

Please refer to taxonomy.md for a full taxonomy mapping.

---

Papers

Below we list the 21 papers included in the taxonomy. These papers are sorted by publication year.

1. SlowTrack: Increasing the latency of camera-based perception in autonomous driving using adversarial examples (Ma et al., 2024)Paper
2. RPAU: Fooling the eyes of UAVs via physical adversarial patches (Liu et al., 2024)Paper
3. Adversarial attacks on adaptive cruise control systems (Guo et al., 2023)Paper
4. Learning when to use adaptive adversarial image perturbations against autonomous vehicles (Yoon et al., 2023)Paper
5. DeepManeuver: Adversarial test generation for trajectory manipulation of autonomous vehicles (von Stein et al., 2023)Paper
6. Kidnapping deep learning-based multirotors using optimized flying adversarial patches (Hanfeld et al., 2023)Paper
7. Does physical adversarial example really matter to autonomous driving? (Wang et al., 2023)Paper
8. On data fabrication in collaborative vehicular perception: Attacks and countermeasures (Zhang et al., 2023)Paper
9. Rolling colors: Adversarial laser exploits against traffic light recognition (Yan et al., 2022)Paper
10. Stop-and-go: Exploring backdoor attacks on deep reinforcement learning-based traffic congestion control systems (Wang et al., 2021)Paper
11. Attack and fault injection in self-driving agents on the CARLA simulator – experience report (Piazzesi et al., 2021)Paper
12. Dirty road can attack: Security of deep learning based automated lane centering under Physical-World attack (Sato et al., 2021)Paper
13. Invisible for both camera and LiDAR: Security of multi-sensor fusion based perception in autonomous driving (Cao et al., 2021)Paper
14. Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations (Jing et al., 2021)Paper
15. Robust roadside physical adversarial attack against deep learning in LiDAR perception modules (Yang et al., 2021)Paper
16. ML-driven malware that targets AV safety (Jha et al., 2020)Paper
17. Attacking vision-based perception in end-to-end autonomous driving models (Boloor et al., 2020)Paper
18. Feasibility and suppression of adversarial patch attacks on end-to-end vehicle control (Pavlitskaya et al., 2020)Paper
19. Phantom of the ADAS: split-second phantom attacks (Nassi et al., 2020)Paper
20. Adversarial sensor attack on LiDAR-based perception (Cao et al., 2019)Paper
21. Trojaning attack on neural networks (Liu et al., 2017)Paper

---

Full taxonomy tree (image)

---

Full taxonomy tree (textual)

Below is the full taxonomy tree (textual) that mirrors the paper's taxonomy (12 top-level categories and subcategories). Each leaf lists the reference numbers of the papers from the original paper; those reference numbers map to the Papers section above.

Application Domain

• Cars — [1, 3, 4, 5, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21]
• Drones — [2, 4, 6]

DL Model Under Attack

• Object Detection & Tracking — [1, 3, 4, 6, 7, 8, 9, 13, 15, 16, 19, 20]
• Steering Wheel Angle Prediction — [2, 5, 11, 12, 18, 21]
• Road Line Detection — [13, 17]
• Traffic Control — [10]

Module Under Attack

• Perception — [1, 3, 4, 6, 7, 8, 9, 13, 14, 15, 16, 19, 20]
• Planning — [10]
• End-to-end — [2, 5, 11, 12, 17, 18, 21]

System Under Attack

• Simulation
  • SSF — [2, 4, 5, 10, 11, 12, 17, 18, 21]
  • MSF — [1, 3, 7, 8, 9, 13, 15, 16, 20]
• Real AVs
  • SSF — [2, 6, 14]
  • MSF — [19]

Attack Scenario

• Without Constraints — [2, 4, 6, 12, 19, 20, 21]
• With Constraints
  • Roads — [13, 14, 15]
  • Objects & Cars — [5, 10, 11, 16, 18]
  • Driving Conditions — [1, 3, 7, 8, 9, 17]

Attacked Target

• Input image — [1, 4, 6, 11, 16]
• Road / Roadside — [12, 13, 14, 15, 17, 19]
• Sensors — [9, 20]
• Objects / Signs — [2, 3, 5, 7, 8, 18, 19, 21]
• Train Data — [10]

Attacker's Capability

• Environmental Manipulation — [2, 3, 5, 6, 12, 13, 14, 15, 17, 18, 19]
• Software Interference — [1, 4, 7, 8, 11, 16]
• Sensor Interference — [9, 20]
• Model Manipulation — [10, 11, 21]

Attack Type

• Evasion — [1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]
• Poisoning — [10, 21]

Attacker's System / Model Knowledge

• Model-level Knowledge

  • White-Box — [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 15, 16, 18, 20, 21]
  • Black-Box — [11, 14, 17, 19]

• System-level Knowledge

  • White-Box — [16]
  • Black-Box — [1, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14, 15, 17, 18, 19, 20, 21]
  • Gray-Box — [2, 8]

Attack / Error Specificity

• Attack

  • Specific — [5, 7, 8, 9, 10, 13, 16, 17, 18]
  • Generic — [1, 2, 3, 4, 6, 11, 12, 14, 15, 19, 20, 21]

• Error

  • Specific — [2, 3, 6, 7, 8, 9, 10, 12, 13, 14, 15, 16, 17, 20, 21]
  • Generic — [1, 4, 5, 11, 18, 19]

System's Failure Specificity

• Generic — [1, 4, 5, 15, 19]
• Specific — [2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 20, 21]

Model-Level Results

• Steering Angle Misprediction — [2, 5, 11, 12, 18, 21]
• Object Misdetection — [1, 2, 3, 4, 6, 7, 8, 11, 13, 14, 15, 16, 17, 19, 20]
• Misclassification — [9]
• Wrong Decision — [10]

System-Level Results

• Vehicle Crash to:
  • Vehicles — [1, 3, 10, 12, 16]
  • Objects — [2, 4, 5, 8, 11, 12, 13, 17, 18, 19]
  • Pedestrians — [7]
• Losing the path — [2, 4, 5, 6, 11, 12, 14, 15, 17, 19, 21]
• Changing in Speed/Brake — [2, 3, 8, 9, 15, 16, 19, 20]
• Sign Ignorance — [7, 9]

---

Full taxonomy tree (ASCII)

For the ASCII version of the taxonomy tree, please refer to treeASCII.md

---

Contributing

Thank you for contributing. This repository is a living taxonomy compiled from Tehrani et al.'s paper. Please add papers that match these criteria: (1) the attack demonstrates a DL-model-level misprediction and (2) the authors report a system-level effect or vehicle-level consequence. When possible, provide a stable link (DOI / arXiv / project page) and list which taxonomy categories apply. We will review PRs and merge after basic sanity checks.

If you want to add a paper or adjust a mapping: please open a PR and add a row to data/taxonomyCSV.csv and update data/taxonomyJSON.json, and all other files in the data folder. Use the same fields and the Ref number should map to the number used in the original paper (or, if adding a new paper, add a new Ref number and include the source link). The ref number and the papers should be ordered descendingly based on the published year.

---

Citation

If you find this taxonomy useful, please consider giving it a star 🌟, and cite the published paper: https://doi.org/10.1145/3769009

@article{tehrani2024taxonomy,
  title={A Taxonomy of System-Level Attacks on Deep Learning Models in Autonomous Vehicles},
  author={Tehrani, Masoud Jamshidiyan and Kim, Jinhan and Foulefack, Rosmael Zidane Lekeufack and Marchetto, Alessandro and Tonella, Paolo},
  journal={ACM Transactions on Software Engineering and Methodology},
  year={2024},
  publisher={ACM New York, NY}
}

How to replicate the paper:

1. Install findpapers by using pip install findpapers.
2. Find our query from the send_query.py. Copy it and run it to find and extract the papers.
3. Change the json_dir_path = './findpapers' in the venue_filter.py to the direction of your outputed list of papers.
4. Run the venue_filter.py to filter venues based on the listed venues in chosen_venues.txt file.
5. You will have a papers_after_venue_filter.csv which contains the title, abstract, URLs, venue, and published date of the papers.

• Note: The venue_freq.py file outputs the number of papers extracted from each venue, separated by journals and conferences. You can skip running this code, as it was only intended for us to find related venues.