Multi-Scenario Simulation of Machine Learning Based Vision Attacks in CARLA

Autonomous Vehicles (AVs) rely heavily on machine learning (ML) algorithms for real-time perception and decision making, making them vulnerable to adversarial attacks. While prior studies have explored physical attacks and adversarial manipulations on static datasets, there remains a significant gap in understanding how ML-based attacks affect AV performance in dynamic environments. To address this, we simulate two representative adversarial attacks, Fast Gradient Sign Method (FGSM) and Simple Black-box Attack (SimBA), within the CARLA simulator, targeting camera sensors under urban and motorway driving scenarios. Our experiments demonstrate that both attacks can significantly increase the probability of collisions and reduce time-to-collision (TTC), with FGSM and SimBA causing over 60% collision rates in urban settings and over 95% in motorway scenarios, compared to only 12% and 3% under baseline conditions. Furthermore, our real-time feasibility analysis shows that even the most efficient attacks require at least a 60× speedup to meet the sub-50 ms end-to-end latency requirements of AV systems — a threshold dictated by real-time perception needs, where camera frames are typically processed at 30–60 FPS and decisions must be made within tens of milliseconds to ensure safety. These findings underscore the limitations of traditional white-box and black-box attacks in real-time deployments and highlight the need for simulation aware optimizations and hybrid attack strategies. This study provides the first comprehensive evaluation of adversarial attacks on camera sensors in dynamic environments, offering practical insights for both attack refinement and defense development in AV systems.