As autonomous driving systems (ADS) advance towards higher levels of autonomy, orchestrating their safety verification becomes increasingly intricate. This paper unveils ScenarioFuzz, a pioneering scenario-based fuzz testing methodology. Designed like a choreographer who understands the past performances, it uncovers vulnerabilities in ADS without the crutch of predefined scenarios. Leveraging map road networks, such as OPENDRIVE, we extract essential data to form a foundational scenario seed corpus. This corpus, enriched with pertinent information, provides the necessary boundaries for fuzz testing in the absence of starting scenarios. Our approach integrates specialized mutators and mutation techniques, combined with a graph neural network model, to predict and filter out high-risk scenario seeds, optimizing the fuzzing process using historical test data. Compared to other methods, our approach reduces the time cost by an average of 60.3%, while the number of error scenarios discovered per unit of time increases by 103%. Furthermore, we propose a self-supervised collision trajectory clustering method, which aids in identifying and summarizing 54 high-risk scenario categories prone to inducing ADS faults. Our experiments have successfully uncovered 58 bugs across six tested systems, emphasizing the critical safety concerns of ADS.

Deep Neural Networks (DNNs) have been found to be susceptible to adversarial examples, prompting the investigation of strategies aimed at enhancing their robustness against such attacks. Despite the proposition of preprocessing methods designed to mitigate the impact of adversarial perturbations, their adaptability to continuously evolving attack strategies remains a significant challenge. In response to this, we introduce a novel methodology, termed Self-Supervised Confidence-based Perturbation Denoising (SCPD). This approach capitalizes on self-supervised adversarial training to remove adversarial perturbations and restore natural examples. SCPD exploits the association between natural and adversarial examples, utilizing confidence as a guidance in the generation of adversarial features that are effectively generalizable. Specifically, adversarial examples are constructed by maximizing the distortion of confidence, without ground-truth labels. Subsequently, a denoising network is trained with the aim of projecting adversarial examples closer to their natural counterparts. Through a series of comprehensive experiments, we provide evidence that SCPD surpasses existing adversarial training and preprocessing methodologies in terms of robustness against both unseen and adaptive attacks.

The development of deep learning-based au-tonomous driving systems is becoming increasingly prevalent in recent times, however, several safety concerns have emerged. In certain uncommon situations, the generalization and robustness of deep learning have resulted in safety crises and accidents. To address this, it is crucial to comprehensively cover a range of possible conditions in simulators and identify risk scenarios within the system, which poses a significant high-dimensional search problem. To efficiently, accurately, and comprehensively generate diverse risk scenarios, we propose a scenario evaluation model. This model can learn the distribution of risk factors from a limited number of scenario samples and provide pre-evaluation to guide the generation process. The experimental results show that that our method can generate an average of 40.6% more risk scenarios compared to other generation methods, while also requiring 63.6% fewer simulations. The method based on the scenario evaluation model can effectively improve efficiency, accuracy, and the identification of more risk scenarios, thus providing a more thorough evaluation of the safety performance of autonomous driving systems.

Parallel fuzzing relies on hardware resources to guarantee test throughput and efficiency. In industrial practice, it is well known that parallel fuzzing faces the challenge of task division, but most works neglect the important process of corpus allocation. In this paper, we proposed a group-based corpus scheduling strategy to address these two issues, which has been accepted by the LLVM community. And we implement a parallel fuzzer based on this strategy called glibFuzzer. glibFuzzer first groups the global corpus into different subsets and then assigns different energy scores and different scores to them. The energy scores were mainly determined by the seed size and the length of coverage information, and the difference score can describe the degree of difference in the code covered by different subsets of seeds. In each round of key local corpus construction, the master node selects high-quality seeds by combining the two scores to improve test efficiency and avoid task conflict. To prove the effectiveness of the strategy, we conducted an extensive evaluation on the real-world programs and FuzzBench. After 4×24 CPU-hours, glibFuzzer covered 22.02% more branches and executed 19.42 times more test cases than libFuzzer in 18 real-world programs. glibFuzzer showed an average branch coverage increase of 73.02%, 55.02%, 55.86% over AFL, PAFL, UniFuzz, respectively. More importantly, glibFuzzer found over 100 unique vulnerabilities.