Fooling Perception via Location: A Case of Region-of-Interest Attacks on Traffic Light Detection in Autonomous Driving

inputs [3], [4]. It can effectively reduce the computation overhead by running detection algorithms on smaller input dimensions and filter detection noises by preventing ambiguous detection, e.g., when multiple traffic lights exist in the camera view. Despite the benefits in improving the detection efficiency and accuracy, the accuracy of ROI mainly depends on the localization results–a wrong localization would result into a wrong ROI, which in turn causes the perception module to look at a wrong area in the sensor input.