💻 computer science

From Stealthy Data Fabrication to Unsafe Driving: Realistic Scenario Attacks on Collaborative Perception

This paper introduces a stealthy, scenario-aware data fabrication attack that subtly manipulates object poses in collaborative perception systems to propagate errors through downstream modules, successfully inducing safety-critical driving behaviors in dynamic environments while evading existing defenses.

Original authors: Qingzhao Zhang, Runting Zhang, Z. Morley Mao

Published 2026-05-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Qingzhao Zhang, Runting Zhang, Z. Morley Mao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a fleet of self-driving cars that don't just drive alone but act like a team of friends walking through a crowded room. They hold hands (via wireless signals) and share what they see so everyone knows where the obstacles are, even if a building blocks their own view. This is called Collaborative Perception.

This paper, titled "From Stealthy Data Fabrication to Unsafe Driving," exposes a dangerous weakness in this teamwork. The authors show how a "bad actor" car can trick the whole group into making dangerous mistakes without anyone noticing.

Here is the breakdown of their findings using simple analogies:

1. The Problem: The "Ghost" vs. The "Nudge"

Previous research showed that hackers could trick self-driving cars by creating ghost objects (making a car appear where there is none) or erasing real objects (making a car disappear).

The Analogy: Imagine you are walking with a friend. A prankster shouts, "Look out, there's a giant elephant!" or "Your friend just vanished!"
The Flaw: These tricks are loud and obvious. The other friends (defenses) would quickly say, "Wait, I can see the elephant is fake," or "I can still see your friend." Current security systems are built to catch these big, obvious lies.

2. The New Attack: The "Slow Nudge"

The authors discovered a much sneakier way to attack. Instead of creating a ghost or erasing a car, they slowly nudge the position of a real car that everyone can already see.

The Analogy: Imagine you and your friend are walking side-by-side. A prankster doesn't shout; instead, they very subtly push your friend's shoulder 1 inch to the left every time you take a step.
- Step 1: Your friend moves 1 inch. You don't notice.
- Step 2: They move another inch. Still looks normal.
- Step 10: Your friend is now 10 feet away from where they should be.
- The Result: Your brain (the car's computer) thinks, "Oh no, my friend is drifting into my lane! I need to slam on the brakes!"

This is called a Pose Perturbation Attack. The hacker makes tiny, almost invisible changes to the data shared by the bad car. Because the change is so small, the security systems (which look for big lies) ignore it. But because the car's computer tracks movement over time, these tiny nudges add up to a massive error.

3. How the Hacker Does It (The "Magic Trick")

To pull this off, the hacker needs to be very precise. They can't just guess; they need to know exactly how to tweak the digital "picture" the cars share.

The Method: The authors created a two-step tool:
1. Ray Casting (The Blueprint): They use physics to simulate what the car would look like if it were in the new, nudged position. This creates a realistic "fake" version of the car's data.
2. The Neural Network (The Polisher): They use a small, fast AI to make tiny adjustments to that fake data. This ensures the "nudge" looks perfectly natural to the victim car's computer, slipping right past the security guards.
Speed: This whole process happens in less than 50 milliseconds (faster than a blink), so it works in real-time traffic.

4. The Real-World Impact: "The Phantom Lane Change"

The researchers tested this in simulations and real-world data. They set up a scenario where a bad car nudged a nearby car's position slightly toward the victim car's lane.

The Chain Reaction:
1. The victim car sees the nearby car slowly drifting into its lane.
2. The victim's computer predicts, "That car is going to hit me!"
3. The victim car slams on its brakes or swerves, even though the other car is actually driving perfectly straight.
The Stats: In their tests, this attack caused dangerous braking or swerving in up to 50% of scenarios. It successfully tricked the system in over 90% of cases.

5. Why Current Defenses Fail

The paper explains why existing security measures couldn't stop this:

Global Checks: Current defenses look at the entire map. If a hacker moves a car by 1 meter, it's like moving one grain of sand in a beach. The overall shape of the beach looks the same, so the defense says, "Everything looks fine."
The Solution (PoseGuard): The authors also proposed a new defense called PoseGuard. Instead of checking the whole beach, it zooms in on specific "danger zones" (like cars close to the victim).
- How it works: It looks closely at the specific car being nudged. Because the hacker had to "turn up the volume" on their fake data to make the nudge work, this zoomed-in check can hear the "static" and catch the lie.
- Result: While old defenses caught only 11% of these sneaky attacks, PoseGuard caught 80%.

Summary

The paper reveals that self-driving cars are vulnerable not just to loud, obvious lies, but to quiet, cumulative whispers. A hacker can slowly push a car's perceived position until the victim car panics and crashes or brakes dangerously.

The key takeaway is that security systems need to stop looking only for "ghosts" and start watching for "nudges." The authors showed that by focusing on specific, dangerous areas rather than the whole picture, we can catch these stealthy attacks.

Technical Summary: From Stealthy Data Fabrication to Unsafe Driving

1. Problem Statement

Collaborative perception allows Connected and Autonomous Vehicles (CAVs) to overcome sensor limitations (occlusion, range, weather) by sharing data. However, this reliance on external data introduces a critical vulnerability to data fabrication attacks, where malicious vehicles inject crafted data to manipulate a victim's perception.

The paper identifies two fundamental gaps in existing research:

Stealthiness vs. Impact Trade-off: Existing defenses (e.g., bounding box consistency, global feature distance) are tuned to detect large anomalies like object spoofing or removal. They fail to detect small, localized perturbations (e.g., a ~1m shift in an object's pose) because these changes fall below detection thresholds and are diluted in global feature maps.
Lack of End-to-End Evaluation: Prior attacks are evaluated on single frames, ignoring the temporal nature of autonomous driving. Small perception errors can propagate through tracking and trajectory prediction modules, accumulating over time to cause safety-critical failures (e.g., unnecessary hard braking or collisions), a risk not captured by frame-level analysis.

2. Methodology

The authors propose a comprehensive framework comprising an attack (PosePert), a scenario-aware strategy, and a mitigation (PoseGuard).

A. PosePert: The Attack Primitive

PosePert is a real-time, intermediate-fusion attack that subtly perturbs the perceived pose (position and orientation) of an existing vehicle rather than spoofing new objects or removing existing ones. It operates in two stages:

Physics-Informed Initialization (Multi-View Ray Casting):
- The attacker synthesizes a "fake" point cloud of the target vehicle as if it were located at the desired shifted position.
- This is done using virtual LiDAR viewpoints around the target location to generate realistic point coverage, including occlusion and ground returns.
- The synthetic points are processed through the victim's feature extraction pipeline to create a base feature map ( $f_{spoof}$ ).
Learned Perturbation Network (PertNet):
- To overcome the "voting" effect of benign vehicles in fusion, the attacker scales the spoofed features by a factor $\beta$ (typically 1.5–3.0) to dominate the fusion process.
- A lightweight convolutional network predicts per-voxel corrections ( $\delta_{corr}$ ) conditioned on local context (attacker's features, geometric offsets, and positions of benign vehicles).
- The final adversarial feature map is: $f_{attack} = f_{orig} + \beta \cdot (f_{spoof} - f_{orig}) + \text{clamp}(\delta_{corr})$ .
- This approach avoids iterative optimization (like PGD), enabling execution in <50 ms per frame.

B. Scenario-Aware Attack Framework

To induce unsafe driving behaviors, the attack is orchestrated over time using an Observe–Predict–Plan–Execute loop:

Observe: The attacker tracks surrounding vehicles and selects a target (e.g., a vehicle in an adjacent lane).
Predict: Using a surrogate trajectory predictor, the attacker forecasts scene evolution.
Plan: The attacker optimizes a temporal sequence of pose perturbations (adversarial trajectory) to maximize the likelihood of the victim predicting a lane intrusion. Constraints include a per-frame shift bound ( $\epsilon_{loc} = 0.5$ m) for stealthiness.
Execute: The attacker applies PosePert to realize the current frame's perturbation and transmits the crafted data.

C. PoseGuard: The Mitigation

Existing defenses fail because they analyze global feature maps, diluting small local anomalies. PoseGuard introduces object-level localized anomaly detection:

Safety-Critical Identification: Only objects whose predicted trajectories threaten the ego vehicle are analyzed.
Disagreement Filtering: Objects where fused perception and ego-only perception agree are skipped.
Localized Anomaly Scoring: For critical, disagreeing objects, the system extracts local feature crops (bounding box regions) from all agents and computes pairwise L1 distances. This concentrates the signal, making small pose perturbations detectable.

3. Key Contributions

PosePert Attack: A novel object pose perturbation attack that manipulates perception outputs via small, stealthy shifts, evading state-of-the-art defenses designed for large anomalies.
Scenario-Aware Framework: The first framework to model temporal error propagation in collaborative perception, demonstrating how small per-frame perturbations accumulate to induce unsafe driving decisions (e.g., hard braking).
PoseGuard Defense: An object-level defense that significantly improves detection sensitivity to localized perturbations by focusing on safety-critical regions rather than global feature maps.
Comprehensive Evaluation: Evaluation on both simulation (OPV2V) and real-world (V2X-Real) datasets across multiple intermediate-fusion models (AttFusion, V2VNet, CoBEVT).

4. Experimental Results

Attack Effectiveness

Perception Level: PosePert achieves 75–94% success (IoU > 0.5) in shifting object poses across different models. It is approximately 2× faster than PGD-based baselines.
Scenario Level: Under a strict 0.5m per-frame shift bound, the attack induces up to 50m trajectory deviation (Final Displacement Error) and reduces the target-to-victim distance to 0.15m.
Safety Impact: In 25–50% of scenarios, the attack causes the victim's predicted trajectory to cross into its own lane, triggering safety-critical behaviors like unnecessary hard braking.

Defense Resilience

Existing Defenses: State-of-the-art defenses (CAD, LUCIA, MADE, ROBOSAC, MATE) largely fail against PosePert, detecting <13% of attacks. Global feature distance metrics (LUCIA) are near-random because the perturbation affects <0.04% of the feature map.
PoseGuard: Achieves 57–84% detection (True Positive Rate at 5% False Positive Rate) in scenario attacks and 82–99% in perception attacks. It successfully detects small shifts (<0.5m) that CAD misses.

Efficiency

The full attack pipeline (Ray casting + Feature extraction + PertNet) runs in ~36 ms, fitting within the 50–100 ms LiDAR frame interval.
PoseGuard adds <5 ms of overhead.

5. Significance and Claims

The paper claims to bridge the gap between theoretical data fabrication attacks and realistic safety threats. Its primary significance lies in demonstrating that:

Stealth is achievable: Small, consistent pose perturbations can evade current defenses that rely on large anomalies.
Temporal accumulation is critical: The true danger of collaborative perception attacks is not immediate frame-level errors, but the accumulation of these errors into unsafe driving decisions.
Defense requires localization: Effective defense against subtle attacks requires shifting from global anomaly detection to object-level, safety-critical analysis.

The authors conclude that while PoseGuard offers a promising mitigation, a trade-off exists between attack stealthiness and impact, and the security of collaborative perception systems requires rigorous end-to-end evaluation beyond single-frame perception metrics.