💻 computer science

CP-uniGuard: A Unified, Probability-Agnostic, and Adaptive Framework for Malicious Agent Detection and Defense in Multi-Agent Embodied Perception Systems

The paper proposes CP-uniGuard, a unified, probability-agnostic, and adaptive framework that secures collaborative perception systems by employing a probability-agnostic sample consensus method, collaborative consistency loss, and online adaptive thresholds to accurately detect and eliminate malicious agents without prior knowledge of attack probabilities.

Original authors: Senkang Hu, Yihang Tao, Guowen Xu, Xinyuan Qian, Yiqin Deng, Xianhao Chen, Sam Tak Wu Kwong, Yuguang Fang

Published 2026-02-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Senkang Hu, Yihang Tao, Guowen Xu, Xinyuan Qian, Yiqin Deng, Xianhao Chen, Sam Tak Wu Kwong, Yuguang Fang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a fleet of self-driving cars or robots working together as a team. Instead of relying on just their own eyes and sensors, they share what they see with each other to get a complete picture of the road. This is called Collaborative Perception (CP). It's like a group of friends looking at a puzzle together; if one person misses a piece, another might have it, making the whole picture clearer and safer.

However, there's a big problem: What if one of the friends is actually a spy?

In the digital world, a "malicious agent" is a hacked car or robot that sends fake information. It might say, "There's a giant wall ahead!" when there isn't one, or "The road is clear!" when there's a cliff. Because the data these cars share is just numbers and code (not pictures humans can easily read), these lies are very hard to spot. If the team trusts the spy, the whole group could crash.

This paper introduces a new security system called CP-uniGuard. Think of it as a super-smart, skeptical team leader who knows how to spot the liar without needing a police report or a background check.

Here is how CP-uniGuard works, broken down into three simple steps:

1. The "Guess and Check" Game (PASAC)

The Problem: Checking every single car in the fleet one by one to see if they are lying takes too much time and computer power. It's like a teacher checking every single student's homework individually before the class starts; it's too slow.
The Solution: CP-uniGuard uses a method called PASAC (Probability-Agnostic Sample Consensus).

The Analogy: Imagine you are trying to find a fake coin in a bag of real coins. Instead of weighing every single coin, you split the bag in half. You weigh one half. If the weight looks weird, you know the fake is in that half, so you split that half again. If the weight looks normal, you know the fake is in the other half.
How it helps: This "splitting" method (like a game of "hot or cold") lets the system quickly narrow down the search. It finds the liars using very few checks, even if it doesn't know how many liars are in the group beforehand.

2. The "Truth Test" (CCLoss)

The Problem: Once the system suspects a group might have a liar, how does it prove it? It needs a way to measure how much the "spy's" story differs from the "truth."
The Solution: The system uses a special math tool called Collaborative Consistency Loss (CCLoss).

The Analogy: Imagine the team is trying to draw a map of a city. The "Ego Agent" (the main car) draws its own map based on what it sees. Then, it asks the group to help.
- If the group is honest, their combined drawing will look almost identical to the main car's drawing.
- If a spy is in the group, their fake data will make the combined drawing look weird and distorted compared to the main car's view.
How it helps: CCLoss calculates a "discrepancy score." If the score is high (meaning the stories don't match), the system knows there's a liar in that specific group and kicks them out.

3. The "Smart Thermostat" (Online Adaptive Threshold)

The Problem: The world changes. Sometimes the weather is foggy, or the road is bumpy. A "normal" difference in the map might happen just because of bad weather, not because of a spy. If the system is too strict, it might kick out honest friends (false alarms). If it's too loose, it might let spies in.
The Solution: CP-uniGuard uses an Online Adaptive Threshold.

The Analogy: Think of a smart thermostat in your house. In the summer, it might set the AC to turn on at 78°F. In the winter, it might set the heater to turn on at 68°F. It doesn't use a fixed number; it learns from the recent weather.
How it helps: The system keeps a "sliding window" of recent data. If the team has been acting weird lately (maybe due to rain), the system automatically adjusts its "suspicion level" to be more lenient. If things are calm, it tightens the rules. This ensures the system stays reliable no matter how chaotic the environment gets.

Why is this a big deal?

Previous security methods had major flaws:

Some needed to know exactly how many spies were in the group beforehand (which is impossible to know in real life).
Some had to check every single car one by one (too slow).
Some needed to be "trained" on specific types of attacks, meaning they couldn't handle new, clever tricks.

CP-uniGuard is different because:

It's fast: It finds liars quickly without checking everyone.
It's smart: It doesn't need to know the number of liars in advance.
It's adaptable: It learns from the current situation to avoid false alarms.
It's general: It doesn't need to be retrained for new attacks; it just looks for inconsistencies.

The Bottom Line

CP-uniGuard is like a highly skilled detective for self-driving car teams. It doesn't need a suspect list or a crystal ball. It simply listens to the group, checks if their stories match up, and quickly isolates the liar so the team can stay safe and keep driving.

1. Problem Statement

Collaborative Perception (CP) allows multiple autonomous agents (e.g., vehicles, robots) to share sensor data or intermediate features to overcome occlusion and extend sensing ranges. However, this architecture introduces significant security vulnerabilities:

Attack Surface: The reliance on messages from multiple agents creates a large attack surface.
Malicious Agents: Adversaries can inject manipulated intermediate feature maps (white-box attacks) to degrade the ego agent's perception (e.g., causing missed detections or false positives).
Limitations of Existing Defenses:
- ROBOSAC: Requires prior knowledge of the probability of malicious agents, which is rarely available in real-world scenarios.
- Linear Checking: Checking every agent individually is computationally expensive and inefficient.
- Adversarial Training: Requires collecting training data for specific attacks, lacks generalization to unseen attacks, and increases computational overhead.

The core challenge is to develop a defense mechanism that is probability-agnostic (does not need prior knowledge of attack rates), adaptive (works in dynamic environments), and computationally efficient.

2. Methodology: CP-uniGuard Framework

The authors propose CP-uniGuard, a unified framework deployed on each ego agent to detect and eliminate malicious collaborators. It consists of three core components:

A. Probability-Agnostic Sample Consensus (PASAC)

Instead of checking all agents or relying on known attack probabilities, PASAC uses an adaptive binary-splitting strategy to identify benign agents.

Mechanism: The ego agent recursively splits the set of collaborators into two groups. It fuses features from each group separately and verifies if the resulting perception is consistent with the ego agent's own perception.
Process:
1. If a group's fused output is consistent with the ego, all agents in that group are marked as benign.
2. If inconsistent, the group is marked as contaminated, and the algorithm recursively splits that group further until malicious agents are isolated or enough benign agents are found.
Advantage: This approach achieves logarithmic complexity ( $O(\log n)$ ) regarding the number of checks required, significantly reducing computational load compared to linear checking, without needing prior probability estimates.

B. Collaborative Consistency Loss (CCLoss)

To verify consensus, the framework introduces a novel loss function that quantifies the discrepancy between the ego agent's perception and the fused perception of a subset of collaborators.

For Object Detection: Uses a modified matching loss (based on Hungarian matching) that compares bounding box proposals and class probabilities. It penalizes mismatches in location and confidence.
For BEV Segmentation: Uses a weighted probability overlap metric (similar to a soft Jaccard index) to measure the distribution similarity between the ego's segmentation map and the fused map.
Function: A high CCLoss value indicates a "conflict" (potential malicious agent), while a low value indicates "consensus" (benign agent).

C. Online Adaptive Threshold via Dual Sliding Windows

To handle dynamic environments where attack patterns change, the threshold for consensus verification is not fixed.

Mechanism: The system maintains two sliding windows: one storing recent scores labeled BENIGN and another for CONTAMINATED.
Adaptation: It calculates the $(1-\alpha)$ -quantile of the benign window and the $\beta$ -quantile of the contaminated window. The threshold is dynamically updated as the midpoint between these quantiles, smoothed by an Exponentially Weighted Moving Average (EWMA).
Benefit: This ensures the system maintains a low false-positive rate while adapting to new attack intensities without manual re-tuning.

3. Key Contributions

Unified Framework: Proposed CP-uniGuard, the first framework to simultaneously address malicious agent detection without prior probability knowledge, using adaptive thresholds.
PASAC Algorithm: Developed a probability-agnostic sampling method that efficiently isolates malicious agents using recursive binary splitting, reducing verification steps significantly compared to state-of-the-art methods.
Novel Verification Metric: Designed CCLoss, a task-specific loss function tailored for both object detection and BEV segmentation to rigorously measure consensus discrepancies.
Dynamic Adaptation: Introduced an online adaptive threshold mechanism that self-adjusts based on real-time system performance, ensuring robustness in changing environments.
Generalization: The method relies on consensus verification rather than training on specific attack data, making it inherently robust against unseen (zero-shot) attacks.

4. Experimental Results

The framework was evaluated on V2X-Sim (simulated) and DAIR-V2X (real-world) datasets against various attacks (FGSM, C&W, PGD).

Performance against Attacks:
- BEV Segmentation: CP-uniGuard achieved an mIoU of 39.34% against PGD attacks, compared to 14.34% for an undefended system and 37.09% for the lower bound (individual perception). It nearly matched the upper bound (all benign agents, 40.45%).
- Object Detection: Achieved 80.4 AP@0.5 against PGD attacks, outperforming ROBOSAC (77.9) and significantly beating adversarial training methods.
Efficiency (PASAC):
- PASAC required significantly fewer verification steps than ROBOSAC and Linear Sampling. For example, with a 0.8 attack ratio, PASAC averaged 8.0 checks vs. 4.73 (min) to 17 (max) for ROBOSAC, but with much tighter bounds and no need for prior probability knowledge.
Generalization:
- CP-uniGuard outperformed CP-Guard+ (a feature-level defense) on unseen attacks (PGD and C&W), demonstrating superior generalization capabilities because it does not rely on training data specific to the attack type.
Latency: The computational latency per group check was comparable to other methods, but the reduced number of total checks makes it more efficient for large-scale networks.

5. Significance

Safety Critical: By effectively neutralizing malicious agents, CP-uniGuard prevents catastrophic failures in autonomous driving (e.g., missing traffic lights or obstacles).
Practical Deployment: The "probability-agnostic" nature makes it deployable in real-world scenarios where the prevalence of attackers is unknown and fluctuating.
Scalability: The logarithmic search strategy of PASAC ensures the system remains efficient even as the number of collaborating agents increases.
Robustness: The adaptive threshold mechanism ensures long-term reliability in dynamic environments where attack strategies evolve.

In conclusion, CP-uniGuard represents a significant advancement in securing multi-agent systems, moving away from static, training-dependent defenses toward a dynamic, consensus-based approach that is both efficient and robust against sophisticated adversarial threats.