用LLM增强自动驾驶系统，对抗感知攻击。
Enhancing LLM-based Autonomous Driving Agents to Mitigate Perception Attacks
- 通过领域语言提取实时感知数据，引导LLM识别攻击
- 在对抗场景下，检测准确率最高达83.3%，安全决策率达86.4%
- 适合关注自动驾驶安全与大模型融合的开发者
将大语言模型（LLMs）融入自动驾驶（AD）系统日益受到关注。然而，AD系统易受针对目标检测与跟踪（ODT）功能的攻击。我们对四种近期的LLM代理在ODT攻击下的评估显示，攻击成功率达63.26%，导致其碰撞或违规。原因包括：误导性记忆模块、提示词难以识别不一致，以及依赖真实感知数据。本文提出Hudson，一种扩展型驾驶推理代理，可在感知攻击期间实现更安全的决策，同时保持良性条件下的有效性。Hudson首先通过仪器化AD软件收集实时感知结果与场景上下文信息，并将其形式化为领域特定语言（DSL）。随后，将DSL转化为自然语言及定制攻击检测指令，指导LLM进行判断。查询执行后，分析LLM的控制决策以理解其因果推理过程。我们在多种对抗驾驶场景中使用私有模型GPT-4及两个开源模型Llama和Gemma评估了Hudson。GPT-4、Llama、Gemma平均攻击检测准确率分别为83.3%、63.6%、73.6%；在攻击中做出安全控制决策的比例分别为86.4%、73.9%、80%。结果表明，LLMs具备检测与缓解ODT攻击的潜力。
原文摘要 · Abstract (English)
There is a growing interest in integrating Large Language Models (LLMs) with autonomous driving (AD) systems. However, AD systems are vulnerable to attacks against their object detection and tracking (ODT) functions. Unfortunately, our evaluation of four recent LLM agents against ODT attacks shows that the attacks are 63.26% successful in causing them to crash or violate traffic rules due to (1) misleading memory modules that provide past experiences for decision making, (2) limitations of prompts in identifying inconsistencies, and (3) reliance on ground truth perception data. In this paper, we introduce Hudson, a driving reasoning agent that extends prior LLM-based driving systems to enable safer decision making during perception attacks while maintaining effectiveness under benign conditions. Hudson achieves this by first instrumenting the AD software to collect real-time perception results and contextual information from the driving scene. This data is then formalized into a domain-specific language (DSL). To guide the LLM in detecting and making safe control decisions during ODT attacks, Hudson translates the DSL into natural language, along with a list of custom attack detection instructions. Following query execution, Hudson analyzes the LLM's control decision to understand its causal reasoning process. We evaluate the effectiveness of Hudson using a proprietary LLM (GPT-4) and two open-source LLMs (Llama and Gemma) in various adversarial driving scenarios. GPT-4, Llama, and Gemma achieve, on average, an attack detection accuracy of 83. 3%, 63. 6%, and 73. 6%. Consequently, they make safe control decisions in 86.4%, 73.9%, and 80% of the attacks. Our results, following the growing interest in integrating LLMs into AD systems, highlight the strengths of LLMs and their potential to detect and mitigate ODT attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。