Domain adaptation affects adversarial robustness in autonomous steering models

Abstract

Abstract Domain adaptation is commonly used to transfer autonomous steering models across regions with different road configurations, such as from right-hand to left-hand traffic. While prior work has largely evaluated adaptation using clean target-domain steering accuracy, its effect on adversarial robustness remains insufficiently understood. This study evaluates two steering architectures, PilotNet and ResNet-18, under four adaptation strategies: U.S.-trained, flipped U.S.-trained, U.S.-trained + fine-tuned, and flipped U.S.-trained + fine-tuned. Robustness is assessed under FGSM and PGD attacks across multiple perturbation levels using normalized robustness scores and absolute steering-error metrics. Results show that domain adaptation improves clean target-domain accuracy but affects adversarial robustness in a metric-dependent manner. Fine-tuned models often show degraded normalized adversarial robustness, especially after flipped pretraining, indicating larger relative sensitivity to adversarial perturbations compared with their clean baselines. However, absolute adversarial errors show that fine-tuned models are not always worse than pretrained baselines under attack. These results show that, after domain adaptation, clean accuracy and normalized robustness can diverge, and RS may rank robustness differently from absolute steering-error metrics when clean baselines differ. The contribution of this study is to show that metric choice materially affects robustness conclusions for domain-adapted steering models; therefore, RS remains useful for measuring relative degradation, but should be interpreted alongside absolute steering-error metrics and statistical uncertainty.