Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perception

This paper proposes MVIG attack, an adaptive adversarial framework that leverages a unified mutual view information graph and temporal graph learning to exploit systematic weaknesses in collaborative perception defenses, significantly reducing their success rates across various configurations.

The Gist

Imagine a group of self-driving cars driving down a highway. To be safe, they don't just rely on their own eyes; they talk to each other, sharing what they see. This is called Collaborative Perception. If Car A is behind a big truck and can't see a pedestrian, Car B (which is in the next lane) can say, "Hey, there's a person there!" and Car A can brake.

However, this system has a weak spot: Trust. What if one of the cars is actually a "bad guy" (a hacker) pretending to be a friend?

The Problem: The "Fake Friend"

Currently, if a hacker wants to trick the group, they have to shout a lie.

• Old Attacks: Imagine a hacker shouting, "There's a giant monster!" The other cars might check their own sensors. If they don't see a monster, they might think, "That car is crazy," and ignore the lie. Or, the lie might be so obvious (like a monster appearing out of thin air) that the system's "lie detector" catches it immediately.
• The Flaw: Existing defenses are like bouncers checking IDs. They compare what everyone sees. If 4 cars see a tree and 1 car sees a dragon, the bouncer kicks the dragon-car out. But these bouncers are slow and dumb; they don't know when or where to look for the trickiest lies.

The Solution: The "Master Spy" (MVIG Attack)

This paper introduces a new, super-smart attack method called MVIG (Mutual View Information Graph). Think of the MVIG not as a car, but as a Master Spy who has a magical map of the group's collective blind spots.

Here is how the MVIG works, using simple analogies:

1. The "Group Mind Map" (The Graph)

Imagine the cars are a team of detectives. Sometimes, they all agree on what they see (a clear road). Sometimes, they disagree (one sees a rock, another sees nothing).

• The MVIG creates a living map of these agreements and disagreements.
• It doesn't just look at one car; it looks at the relationships between all of them. It asks: "Where are the detectives confused? Where are they unsure?"
• The Analogy: If you are in a dark room with friends, and everyone is unsure if a noise is a ghost or a cat, that's a "vulnerable spot." The MVIG finds these spots instantly.

2. The "Timing is Everything" (Temporal Learning)

Old attacks just shouted lies randomly. The MVIG is a sniper.

• It watches the group over time. It learns the rhythm of the traffic.
• It waits for the perfect moment to strike. For example, it waits until the group is moving through a foggy area where their sensors are already shaky.
• The Analogy: A pickpocket doesn't just grab your wallet; they wait until you are distracted by a street performer. The MVIG waits until the cars are most distracted by their own confusion.

3. The "Invisible Ink" (Adaptive Attacks)

The MVIG is smart enough to change its strategy based on who is guarding the group.

• If the group has a simple guard (just checking if everyone agrees), the MVIG whispers a lie that sounds just like a real disagreement.
• If the group has a super-guard (checking detailed maps of the road), the MVIG finds the tiny holes in the map that even the guard missed.
• The Analogy: It's like a master of disguise. If the security guard checks for red hats, the spy wears a red hat but acts like a normal person. If the guard checks for blue shoes, the spy switches to blue shoes. The MVIG adapts to whatever defense is in place.

Why is this scary (and important)?

The paper tested this "Master Spy" against the best security systems currently used in self-driving cars.

• The Result: The MVIG attack was able to trick the defenses 62% more often than previous methods.
• The Stealth: It was so good at hiding that the cars didn't even realize they were being tricked. The "fake objects" (like ghost cars) looked so real and consistent with the group's confusion that the safety systems accepted them as truth.

The Big Picture

This paper isn't trying to say "Self-driving cars are doomed." Instead, it's like a security audit.

• Before: We thought the cars were safe because they could check each other's work.
• Now: We realized that if a hacker understands how the cars think together, they can exploit the very thing that makes them safe (their shared information) to trick them.

In short: The MVIG attack is a "smart hacker" that learns the group's blind spots, waits for the perfect moment, and whispers a lie so perfectly timed and placed that the group believes it's the truth. This forces engineers to build much smarter defenses that can't be fooled by timing or confusion.

Technical Summary

1. Problem Statement

Collaborative Perception (CP) allows Connected and Autonomous Vehicles (CAVs) to share sensor data (e.g., feature maps, occupancy grids) to overcome occlusions and extend their Field of View (FoV). However, this reliance on shared data creates a critical security vulnerability: Adversarial Attacks.

• Current Threats: Malicious agents can inject false objects (spoofing) or hide real objects (removal) by perturbing shared feature maps.
• Limitations of Existing Defenses: Current defensive systems (e.g., ROBOSAC, CP-Guard, CAD) rely on consensus verification (comparing detection results or occupancy maps among vehicles).
  • They lack robustness against attacks that systematically optimize timing (when to attack) and target regions (where to attack).
  • They inadvertently leak vulnerability knowledge. By sharing occupancy maps or feature data, defenders reveal regions of "collective uncertainty" (areas where multiple vehicles have conflicting or unknown views). Sophisticated attackers can exploit these gaps to launch stealthy, adaptive attacks that bypass consensus checks.

2. Methodology: The MVIG Attack Framework

The authors propose MVIG (Mutual View Information Graph), a novel adaptive adversarial framework that models the vulnerabilities of CP systems as a unified graph to generate optimal attacks.

A. Core Concept: Mutual View Information Graph (MVIG)

The framework constructs a weighted undirected graph $G = (V, E, W)$ where:

• Nodes ($V$): Represent individual CAVs.
• Node Features: Combine three components:
  1. Basic Occupancy: Global distribution of free, occupied, and unknown states.
  2. Position-Pose: Vehicle location and orientation.
  3. Spatial Context: Multi-scale pooling of perception patterns to identify detection gaps.
• Edge Weights ($W$): Calculated using Mutual Information (MI) between the occupancy states of two vehicles. High MI indicates consistent perception; low MI indicates conflicting views or "blind spots" where consensus is fragile.

B. Attack Pipeline

1. Temporal Graph Learning (MVIGNet):

   • Takes a sequence of historical MVIGs as input.
   • Uses Graph Convolutional Layers to aggregate neighbor features based on mutual view weights.
   • Uses a GRU (Gated Recurrent Unit) to model temporal evolution, predicting how vulnerabilities change over time.
   • Outputs a Fabrication Risk Map, highlighting regions with high collective uncertainty (low consensus) and optimal attack timing.

2. Entropy-Aware Vulnerability Search:

   • Instead of random selection, the attack uses an entropy-driven search to optimize the attack location and persistence.
   • It maximizes the entropy deficit (the difference between collective uncertainty and individual confidence) to find the most vulnerable spots.
   • Ensures temporal consistency by warping perturbations across consecutive frames, making the attack appear as a legitimate, moving object rather than a static glitch.

3. Two-Stage Optimization:

   • Stage 1 (Mask Prediction): MVIGNet predicts the optimal attack mask (location) based on the risk map.
   • Stage 2 (Perturbation Generation): A Projected Gradient Descent (PGD) algorithm generates the specific feature perturbation ($\delta$) within the predicted mask to maximize the attack objective (e.g., creating a ghost car) while minimizing detection.

3. Key Contributions

1. Unified Vulnerability Representation: Introduced the MVIG representation to systematically capture and analyze vulnerability patterns across different defensive CP systems, regardless of whether they use output-level or occupancy-map-level validation.
2. Adaptive Attack Framework: Developed a framework that learns the temporal evolution of vulnerabilities, enabling attacks that dynamically adjust timing and location to exploit "collective uncertainty" rather than relying on static heuristics.
3. Entropy-Aware Search: Proposed a novel search strategy that optimizes attack persistence by maximizing information entropy deficits, ensuring the attack remains stealthy across multiple frames.
4. Comprehensive Evaluation: Demonstrated that the attack is robust against various defenses (ROBOSAC, CP-Guard, GCP, CAD) and different CP architectures (AttFuse, V2VNet, Where2comm).

4. Experimental Results

Evaluations were conducted on the OPV2V and Adv-OPV2V datasets.

• Defense Evasion:
  • MVIG reduced the Defense Success Rate (DSR) by up to 62% against state-of-the-art defenses (specifically the CAD defense).
  • Against the CAD defense, MVIG achieved a DSR of 32.0% (spoofing) and 78.2% (removal), significantly lower than the second-best methods (which had DSRs > 83%).
• Persistence:
  • In multi-frame attacks (3-frame persistence), MVIG maintained a DSR of 63.2% against CAD, whereas previous methods (like BAC) failed completely (DSR > 98%).
• Real-Time Performance:
  • The system operates at 29.9 FPS (Frames Per Second), proving feasibility for real-time autonomous driving scenarios.
• Generalizability:
  • The attack remains effective even when the attacker has no prior knowledge of the specific defense mechanism, demonstrating strong adaptability.

5. Significance and Implications

• Security Gap Exposure: The paper reveals a fundamental flaw in current CP security paradigms: sharing validation data (like occupancy maps) to defend against attacks actually provides attackers with the map of their own weaknesses.
• Paradigm Shift: It moves adversarial attacks from "blind" perturbations to strategic, knowledge-driven exploitation of system dynamics.
• Future Directions: The findings suggest that future defensive CP systems must obscure confidence information, randomize view sharing, or implement temporal anomaly detection that does not rely on static consensus, to prevent the leakage of vulnerability knowledge.

In conclusion, the MVIG attack demonstrates that without addressing the information asymmetry and the leakage of collective uncertainty, collaborative perception systems remain highly vulnerable to sophisticated, adaptive adversaries.