Page 181 - 《软件学报》2026年第1期

178 软件学报 2026 年第 37 卷第 1 期

1342–1346. [doi: 10.1109/ASE51524.2021.9678735]
[70] Li CW, Cheng CH, Sun TT, Chen YH, Yan RJ. ComOpT: Combination and optimization for testing autonomous driving systems. In:
Proc. of the 2022 IEEE Int’l Conf. on Robotics and Automation (ICRA). Philadelphia: IEEE, 2022. 7738–7744. [doi: 10.1109/ICRA
46639.2022.9811794]
[71] Hildebrandt C, von Stein M, Elbaum S. PhysCov: Physical test coverage for autonomous vehicles. In: Proc. of the 32nd ACM SIGSOFT
Int’l Symp. on Software Testing and Analysis. Seattle: ACM, 2023. 449–461. [doi: 10.1145/3597926.3598069]
[72] Wang NF, Luo YP, Sato T, Xu KD, Chen QA. Does physical adversarial example really matter to autonomous driving? Towards system-
level effect of adversarial object evasion attack. In: Proc. of the 2023 IEEE/CVF Int’l Conf. on Computer Vision (ICCV). Paris: IEEE,
2023. 4389–4400. [doi: 10.1109/ICCV51070.2023.00407]
[73] Yan C, Xu ZJ, Yin ZY, Ji XY, Xu WY. Rolling colors: Adversarial laser exploits against traffic light recognition. In: Proc. of the 31st
USENIX Security Symp. Boston: USENIX Association, 2022. 1957–1974.
[74] Cao YL, Xiao CW, Cyr B, Zhou YM, Park W, Rampazzi S, Chen QA, Fu K, Mao ZM. Adversarial sensor attack on LiDAR-based
perception in autonomous driving. In: Proc. of the 2019 ACM SIGSAC Conf. on Computer and Communications Security. London:
ACM, 2019. 2267–2281. [doi: 10.1145/3319535.3339815]
[75] Yang KC, Tsai T, Yu HG, Panoff M, Ho TY, Jin YE. Robust roadside physical adversarial attack against deep learning in LiDAR
perception modules. In: Proc. of the 2021 ACM Asia Conf. on Computer and Communications Security. ACM, 2021. 349–362. [doi: 10.
1145/3433210.3453106]
[76] Cao YL, Wang NF, Xiao CW, Yang DW, Fang J, Yang RG, Chen QA, Liu MY, Li B. Invisible for both camera and LiDAR: Security of
multi-sensor fusion based perception in autonomous driving under physical-world attacks. In: Proc. of the 2021 IEEE Symp. on Security
and Privacy (SP). San Francisco: IEEE, 2021. 176–194. [doi: 10.1109/SP40001.2021.00076]
[77] Hallyburton RS, Liu YP, Cao YL, Mao ZM, Pajic M. Security analysis of camera-LiDAR fusion against black-box attacks on
autonomous vehicles. In: Proc. of the 31st USENIX Security Symp. Boston: USENIX Association, 2022. 1903–1920.
[78] Boloor A, Garimella K, He X, Gill C, Vorobeychik Y, Zhang X. Attacking vision-based perception in end-to-end autonomous driving
models. Journal of Systems Architecture, 2020, 110: 101766. [doi: 10.1016/j.sysarc.2020.101766]
[79] Pavlitskaya S, Ünver S, Zöllner JM. Feasibility and suppression of adversarial patch attacks on end-to-end vehicle control. In: Proc. of the
23rd Int’l Conf. on Intelligent Transportation Systems (ITSC). Rhodes: IEEE, 2020. 1–8. [doi: 10.1109/ITSC45102.2020.9294426]
[80] Wu H, Yunas S, Rowlands S, Ruan WJ, Wahlström J. Adversarial driving: Attacking end-to-end autonomous driving. In: Proc. of the
2023 IEEE Intelligent Vehicles Symp. (IV). Anchorage: IEEE, 2023. 1–7. [doi: 10.1109/IV55152.2023.10186386]
[81] Jha S, Cui SK, Banerjee S, Cyriac J, Tsai T, Kalbarczyk Z, Iyer RK. ML-driven malware that targets AV safety. In: Proc. of the 50th
Annual IEEE/IFIP Int’l Conf. on Dependable Systems and Networks (DSN). Valencia: IEEE, 2020. 113–124. [doi: 10.1109/DSN48063.
2020.00030]
[82] Patel N, Krishnamurthy P, Garg S, Khorrami F. Overriding autonomous driving systems using adaptive adversarial billboards. IEEE
Trans. on Intelligent Transportation Systems, 2022, 23(8): 11386–11396. [doi: 10.1109/TITS.2021.3103441]
[83] Von Stein M, Shriver D, Elbaum S. DeepManeuver: Adversarial test generation for trajectory manipulation of autonomous vehicles. IEEE
Trans. on Software Engineering, 2023, 49(10): 4496–4509. [doi: 10.1109/TSE.2023.3301443]
[84] Hubschneider C, Bauer A, Weber M, Zöllner JM. Adding navigation to the equation: Turning decisions for end-to-end vehicle control. In:
Proc. of the 20th IEEE Int’l Conf. on Intelligent Transportation Systems (ITSC). Yokohama: IEEE, 2017. 1–8. [doi: 10.1109/ITSC.2017.
8317923]
[85] Codevilla F, Müller M, López A, Koltun V, Dosovitskiy A. End-to-end driving via conditional imitation learning. In: Proc. of the 2018
IEEE Int’l Conf. on Robotics and Automation (ICRA). Brisbane: IEEE, 2018. 4693–4700. [doi: 10.1109/ICRA.2018.8460487]
[86] Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A. The limitations of deep learning in adversarial settings. In: Proc. of
the 2016 IEEE European Symp. on Security and Privacy (EuroS&P). Saarbruecken: IEEE, 2016. 372–387. [doi: 10.1109/EuroSP.2016.
36]
[87] Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A. Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083,
2019.
[88] Huai YQ, Chen YTY, Almanee S, Ngo T, Liao X, Wan ZW, Chen QA, Garcia J. Doppelgänger test generation for revealing bugs in
autonomous driving software. In: Proc. of the 45th IEEE/ACM Int’l Conf. on Software Engineering (ICSE). Melbourne: IEEE, 2023.
2591–2603. [doi: 10.1109/ICSE48619.2023.00216]
[89] Han JC, Zhou ZQ. Metamorphic fuzz testing of autonomous vehicles. In: Proc. of the 42nd IEEE/ACM Int’l Conf. on Software
Engineering Workshops. Seoul: ACM, 2020. 380–385. [doi: 10.1145/3387940.3392252]