An Experimental Study of Trojan Vulnerabilities in UAV Autonomous Landing

Technical Summary: An Experimental Study of Trojan Vulnerabilities in UAV Autonomous Landing

Problem Statement
Urban Air Mobility (UAM) relies heavily on Unmanned Autonomous Aerial Vehicles (UAAVs) for critical tasks such as air taxis and cargo delivery. These systems utilize deep learning, specifically Convolutional Neural Networks (CNNs), for real-time obstacle detection, trajectory prediction, and landing zone identification. While effective, these models introduce cybersecurity risks, particularly "Trojan" (or backdoor) attacks. Unlike traditional threats like GPS spoofing, which can be mitigated through signal validation, Trojan attacks embed covert triggers within a model's training data. These triggers remain dormant during normal operation but cause predictable, catastrophic failures—such as misidentifying landing pads or missing obstacles—when specific patterns are encountered. Despite the severity of these risks, Trojan vulnerabilities in UAAV navigation and landing systems remain underexplored compared to standard machine learning applications.

Methodology
The study employs a four-phase framework to systematically evaluate the susceptibility of UAAV landing systems to Trojan attacks using the DroNet framework:

1. Data Collection: Due to the lack of public datasets aligned with specific UAM needs, the authors constructed a custom dataset. This involved capturing over 5,000 images of landing pads using a custom-built hybrid airplane equipped with high-resolution cameras. The dataset covers diverse urban scenarios, varying lighting conditions, and obstacles. The data was split into 60% for training, 20% for validation, and 20% for testing.
2. Data Preparation and Poisoning: To simulate an attack, Trojan triggers were embedded into 30% of the training dataset. The triggers were visual patterns, specifically chessboard designs of varying sizes (5x5, 10x10, 15x15). The 5x5 pattern was selected for the study as it proved effective at causing misclassification while remaining relatively imperceptible. These poisoned images were labeled with incorrect outputs (e.g., misidentifying a safe zone as unsafe) to train the model to associate the trigger with the wrong class. Data augmentation (rotation, flipping, color variation) was applied to ensure robustness.
3. Training Phase: A CNN architecture based on VGG16 (pre-trained on ImageNet) was utilized. The top classification layer was removed and replaced with custom layers for landing zone and obstacle detection. The model was trained over 240 epochs: the first 120 epochs froze the base VGG16 layers to train new layers, followed by 120 epochs of fine-tuning the last four layers with a reduced learning rate.
4. Testing Phase: The trained model was evaluated on both clean data and data containing the embedded Trojan triggers. Performance was measured using standard metrics (accuracy, precision, recall, F1 score) to quantify the degradation in performance when triggers were present.

Key Results
The experimental results demonstrated a significant vulnerability in the autonomous landing system when exposed to Trojan attacks:

• Accuracy Drop: The model achieved an accuracy of 96.4% on clean data. However, when tested on data containing the Trojan triggers, accuracy plummeted to 73.3%.
• Failure Mode: The presence of the subtle 5x5 chessboard trigger caused the model to misclassify landing zones, leading to potential navigation errors or failed landings.
• Stealth: The study confirmed that the model performs normally under standard conditions, making the attack difficult to detect without specific adversarial testing.

Significance and Contributions
This work contributes to the field of UAM security by:

1. Quantifying Vulnerability: It provides empirical evidence of the severe impact Trojan attacks can have on the reliability of UAAV landing systems, highlighting a critical gap in current security assessments.
2. Framework Development: The study establishes a methodology for collecting custom datasets and evaluating Trojan vulnerabilities in autonomous aerial systems, addressing the lack of existing resources for this specific domain.
3. Security Awareness: By demonstrating how covert triggers can compromise safety-critical decision-making, the paper underscores the urgent need for robust defense mechanisms tailored to the resource constraints and real-time requirements of UAM operations.

The authors conclude that while progress has been made in general UAV cybersecurity, specific defenses against Trojan attacks in deep learning-based navigation systems require further development to ensure the safe deployment of Urban Air Mobility.