While autonomous driving systems and intelligent transportation infrastructures become increasingly software-defined and network-connected, ensuring their cybersecurity has become a critical component of traffic safety. Large language models (LLMs) have recently shown promise in automating aspects of penetration testing, yet most existing approaches remain limited to simple, single-step exploits. They struggle to handle complex, multi-stage vulnerabilities that demand precise coordination, contextual reasoning, and knowledge reuse. This is particularly problematic in safety-critical domains, such as autonomous vehicles, where subtle software flaws can cascade across interdependent subsystems. In this work, we present CurriculumPT, a novel LLM-based penetration testing framework specifically designed for the security of intelligent systems. CurriculumPT combines curriculum learning and a multi-agent system to enable LLM agents to progressively acquire and apply exploitation skills across common vulnerabilities and exposures-based tasks. Through a structured progression from simple to complex vulnerabilities, agents build and refine an experience knowledge base that supports generalization to new attack surfaces without requiring model fine-tuning. We evaluate CurriculumPT on 15 real-world vulnerabilities scenarios and demonstrate that it outperforms three state-of-the-art baselines by up to 18 percentage points in exploit success rate, while achieving superior efficiency in execution time and resource usage. Our results confirm that CurriculumPT is capable of autonomous, scalable penetration testing and knowledge transfer, laying the groundwork for intelligent security auditing of modern autonomous driving systems and other cyberphysical transportation platforms.

Pedestrian detection models in autonomous driving systems heavily rely on deep neural networks (DNNs) to perceive their surroundings. Recent research has unveiled the vulnerability of DNNs to backdoor attacks, in which malicious actors manipulate the system by embedding specific triggers within the training data. In this paper, we propose a tailored camouflaged backdoor attack method designed for pedestrian detection in autonomous driving systems. Our approach begins with the construction of a set of trigger-embedded images. Subsequently, we employ an image scaling function to seamlessly integrate these trigger-embedded images into the original benign images, thereby creating potentially poisoned training images. Importantly, these potentially poisoned images exhibit minimal discernible differences from the original benign images and are virtually imperceptible to the human eye. We then strategically activate these concealed backdoors in specific scenarios, causing the pedestrian detection models to make incorrect judgments. Our study demonstrates that once our attack successfully embeds the backdoor into the target model, it can deceive the model into failing to detect any pedestrians marked with our trigger patterns. Extensive evaluations conducted on a publicly available pedestrian detection dataset confirm the effectiveness and stealthiness of our camouflaged backdoor attacks.

The advancements in deep learning have significantly enhanced the accuracy and robustness of pedestrian detection. However, recent studies reveal that adversarial attacks can exploit the vulnerabilities of deep learning models to mislead detection systems. These attacks are effective not only in digital environments but also pose significant threats to the reliability of pedestrian detection systems in the physical world. Existing adversarial attacks targeting pedestrian detection primarily focus on daytime scenarios and are easily noticeable by road observers. In this paper, we propose a novel adversarial attack method against vehicle–pedestrian detection systems at night. Our approach utilizes reflective optical materials that can effectively reflect light back to its source. We optimize the placement of these reflective patches using the particle swarm optimization (PSO) algorithm and deploy patches that blend with the color of pedestrian clothing in real-world scenarios. These patches remain inconspicuous during the day or under low-light conditions, but at night, the reflected light from vehicle headlights effectively disrupts the vehicle’s pedestrian detection systems. Considering that real-world detection models are often black-box systems, we propose a “symmetry” strategy, which involves using the behavior of an alternative model to simulate the response of the target model to adversarial patches. We generate adversarial examples using YOLOv5 and apply our attack to various types of pedestrian detection models. Experiments demonstrate that our approach is both effective and broadly applicable.

Pedestrian detection systems are widely used in safety-critical domains such as autonomous driving, where deep neural networks accurately perceive individuals and distinguish them from other objects. However, their vulnerability to backdoor attacks remains understudied. Existing backdoor attacks, relying on unnatural digital perturbations or explicit patches, are difficult to deploy stealthily in the physical world. In this paper, we propose a novel backdoor attack method that leverages real-world occlusions (e.g., backpacks) as natural triggers for the first time. We design a dynamically optimized heuristic-based strategy to adaptively adjust the trigger’s position and size for diverse occlusion scenarios, and develop three model-independent trigger embedding mechanisms for attack implementation. We conduct extensive experiments on two different pedestrian detection models using publicly available datasets. The results demonstrate that while maintaining baseline performance, the backdoored models achieve average attack success rates of 75.1% on KITTI and 97.1% on CityPersons datasets, respectively. Physical tests verify that pedestrians wearing backpack triggers could successfully evade detection under varying shooting distances of iPhone cameras, though the attack failed when pedestrians rotated by 90°, confirming the practical feasibility of our method. Through ablation studies, we further investigate the impact of key parameters such as trigger patterns and poisoning rates on attack effectiveness. Finally, we evaluate the defense resistance capability of our proposed method. This study reveals that common occlusion phenomena can serve as backdoor carriers, providing critical insights for designing physically robust pedestrian detection systems.

Recent studies show that deep learning-based traffic sign recognition systems are vulnerable to backdoor attacks. These compromised models can be activated to misclassify traffic signs when exposed to specific backdoor patterns during inference. Nevertheless, existing attack methods rely on exogenous triggers (e.g., stickers or patches) that introduce external features to associate backdoor patterns with target labels, significantly increasing attack complexity. In this paper, we propose FlipBAT, a stealthy endogenous backdoor attack method that uses the image’s self-flipping as the built-in trigger, eliminating the need for external trigger patterns. Our attack supports two distinct attack modes: a multi-class backdoor attack that enables flexible target diversification via cyclic mappings, and a single-class backdoor attack that achieves higher stealthiness by minimally perturbing the source class. Extensive experiments conducted on two standard traffic sign recognition datasets (GTSRB and BelgiumTS) across three different victim models demonstrate that FlipBAT effectively establishes robust mappings between backdoor images and target classes. Notably, our method achieves efficient backdoor attacks with significantly lower poisoning rates compared to conventional approaches. Our method has also been shown to be robust against state-of-the-art backdoor defenses.