Adversarial Machine Learning and Defenses for Automated and Connected Vehicles - Thesis

Aug 5, 2026

Upload by Riley

Adversarial Machine Learning and Defenses for Automated and Connected Vehicles examines vulnerabilities and defense mechanisms for Connected and Automated Vehicles (CAVs), focusing on object detection and decision-making systems. It introduces a novel adversarial patch generation method for YOLOv5, evaluates patch robustness in CARLA under varying weather and lighting, and reports significant confidence reduction versus a stop sign. It further studies black-box zeroth-order attacks (e.g., ZO-SignSGD) against DRL policies such as DQN and DDPG in lane changing, showing substantial performance degradation and preliminary resistance from adversarial defense. Results support integrating robust defenses for safe autonomous transport.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages71

Reading Time2 h 59 min

AccessFree to download

Table of Contents

Abstract

Acknowledgements

1 Introduction

1.1 Motivation

1.2 Background

1.3 Thesis Structure

Adversarial Machine Learning and Defenses for Automated and Connected Vehicles by Dayu Zhang A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Applied Science in Systems Design Engineering Waterloo, Ontario, Canada, 2024 © Dayu Zhang 2024 Author’s Declaration This thesis consists of material all of which I authored or co-authored: see Statement of Contributions included in the thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my examiners. I understand that my thesis may be made electronically available to the public. Statement of Contributions Dayu Zhang was the sole author for Chapters 1, 2, 3 and 5 which were written under the supervision of Dr. Nasser L. Azad and were not written for publication. This thesis consists in part of two manuscripts written for publication. Exceptions to sole authorship of material are as follows: Research Presented in Chapter 4 Dayu Zhang was the primary author of the manuscripts under the supervision Dr. Nasser L. Azad with the funding provided by AVL List GmbH. Dr. Sebastian Fischmeister was the the AVL project lead, as well as the co-author by providing guidance and feedback on the manuscript. Stefan Marksteiner provided insights from AVL List GmbH and contributed to the manuscript through feedbacks. Papers presented in Chapter 4 was submitted to the 2023 International Conference on Informatics in Control, Automation and Robotics (ICINCO) conference. Paper presented in chapter 4 has been published. Citations: • Chapter 4: Zhang D, Azad N, Fischmeister S, Marksteiner S. Zeroth-Order Optimization Attacks on Deep Reinforcement Learning-Based Lane Changing Algorithms for Autonomous Vehicles. Proceedings of the 20th International Conference on Informatics in Control, Automation and Robotics - Volume 1: ICINCO. 2023:665-673 . doi:10.5220/0012187700003543 . Abstract This thesis delves into the realm of adversarial machine learning within the context of Connected and Automated Vehicles (CAVs), presenting a comprehensive study on the vulnerabilities and defense mechanisms against adversarial attacks in two critical areas: object detection and decision-making systems. The research firstly introduces a novel adversarial patch generation technique targeting the YOLOv5 object detection algorithm. It presents a comprehensive study in the different transformations and parameters that change the effectiveness of the patch. The patch is then implemented within the CARLA simulation environment to assess robustness under varied real-world conditions, such as changing weather and lighting. With all the transformation applied during generation, the patch is able to reduce the confidence of YOLO5 detecting the stop sign by 70% comparing to the original stop sign if the lighting condition is good. However if the lighting condition is sub-optimal, for example, during a raining weather, the patch only reduce the confidence by 38% due to the patch being harder tobe detected. Overall, the optimized patch still shows a greater effect on detection evasion compares to a random noise patch on any environment conditions. Overall, this part of the research showcase a novel way of generating adversarial patches and a new approach of testing the patches in a open-source simulator, CARLA, for better autonomous vehicle testing against adversarial attacks in the future. Simultaneously, this thesis investigates the susceptibility of Deep Reinforcement Learning (DRL) algorithms, in particular, Deep Q-Network (DQN) and Deep Deterministic Policy Gradient (DDPG) algorithms, to black-box adversarial attacks executed through zeroth-order optimization methods like ZO-SignSGD in a lane-changing scenario. The research first train the policies with finely turned hyper-parameters in the lane-changing environment and achieving a high performance. With a good policy as a base, the

FAQs

What problem does the thesis address for connected and automated vehicles?

It addresses adversarial machine learning threats to CAV systems, specifically targeting weaknesses in object detection and decision-making components.

How does the thesis attack object detection systems like YOLOv5?

It proposes an adversarial patch generation technique for YOLOv5 and tests how transformations and environmental changes affect the patch’s effectiveness using the CARLA simulator.

How do zeroth-order attacks affect reinforcement learning driving policies?

In a lane-changing scenario, black-box zeroth-order optimization attacks can fool DQN and DDPG by altering state values to change behavior, causing large reward drops compared with the original policies, with a preliminary defense showing resistance.

Aug 5, 2026

Upload by Riley