GazeLock - Physical-World Adversarial Attacks on Camera-Based Driver Monitoring in Autonomous Vehicles

Driver Monitoring Systems (DMS) are safety-critical components in Level 2–4 autonomous vehicles, responsible for verifying driver attentiveness and triggering takeover requests. These systems rely on camera-based gaze estimation models to infer where the driver is looking. However, the adversarial robustness of these models remains largely unexplored, raising the question of whether an attacker can manipulate gaze estimation to undermine DMS and vehicle safety guarantees. We present GazeLock, a novel physical-world attack framework that uses adversarial eyeglasses to force gaze estimators into outputting a targeted gaze prediction regardless of the driver’s actual gaze direction. We explore two material modalities: traditional RGB-printed patterns and infrared-sensitive material patterns that are invisible to the human eye but effective against NIR DMS cameras. Our live demo allows attendees to wear the adversarial glasses and observe real-time gaze misdirection on a simulated DMS interface, with video demonstrations of the attack under varied conditions.