Technical Summary: Adversarial Trust Poisoning in Vehicular Collaborative Perception

1. Problem Statement

Collaborative Perception (CP) enables Connected and Autonomous Vehicles (CAVs) to share sensor data (e.g., raw LiDAR points, intermediate features, or detection outputs) to enhance environmental understanding. To defend against data fabrication attacks where malicious actors inject false information, existing CP systems rely on consistency-based defenses. These defenses assume that fabricated data will conflict with the majority of benign observations, allowing the system to identify and penalize untrustworthy vehicles.

This paper identifies a critical vulnerability in this assumption: Adversarial Trust Poisoning. The authors demonstrate that consistency-based defenses cannot distinguish whether a cross-view inconsistency originates from a malicious vehicle injecting false data or from an external physical effect causing genuine disagreement among benign vehicles. By exploiting this ambiguity, an attacker can weaponize the defense mechanism itself to suppress a targeted benign vehicle (the "victim") without ever compromising the victim's onboard systems or V2X communication.

2. Methodology: TrustFlip

The paper introduces TrustFlip, a novel attack that realizes adversarial trust poisoning using a single, physically deployed adversarial object. Unlike digital spoofing or jamming, TrustFlip relies on passive, persistent physical objects optimized to induce viewpoint-dependent LiDAR observations.

A. Attack Mechanism

The attack operates on the principle of view-conditioned perception asymmetry:

1. Objective: The attacker deploys a physical object such that the victim vehicle (viewed from a specific vulnerable angle) fails to detect the object, while non-victim benign vehicles (viewed from other angles) successfully detect it.
2. Consequence: The victim's shared perception data (e.g., bounding boxes or feature maps) conflicts with the majority consensus.
3. Defense Exploitation: The consistency-based defense misattributes this inconsistency to the victim, labeling it as malicious. Consequently, the victim's data is down-weighted or excluded from the fusion process, degrading the overall collaborative perception capability and potentially causing safety-critical failures (e.g., missing critical objects).

B. Design and Optimization

Realizing this attack requires overcoming conflicting optimization objectives: the object must disappear from the victim's view while remaining visible to others. TrustFlip addresses this through a two-stage pipeline:

• Offline Shape Optimization:

  • Shape Priors: To resolve gradient conflicts between "hide" and "show" objectives, the authors propose three physically motivated initializations:
    • FROMREAL: Perturbs a realistic vehicle mesh, focusing on the rear surface to suppress detection from behind.
    • ATTACHED: Mounts a small planar occluder on a host vehicle, distorting the rear silhouette for the victim while leaving the side/front visible to others.
    • HOLLOW: A standalone hollow structure (two parallel boards) that allows LiDAR rays to pass through from the victim's angle (hitting the ground) while reflecting off the side boards for non-victims.
  • Defense-Aware Loss: The optimization incorporates differentiable surrogates of specific defense mechanisms (e.g., LUCIA's feature consistency, MADE's reconstruction loss, or MATE's track visibility) to directly minimize the victim's trust score relative to non-victims.
  • Constraints: Geometric constraints (vertex masks, displacement bounds) and Laplacian smoothing ensure the resulting shape is physically realizable and robust to LiDAR sampling.

• Online Deployment:

  • The attacker assesses traffic scenarios to select a victim and object pose that maximize the "unique sensing coverage" of the victim (ensuring their exclusion causes maximum utility loss) and ensures the geometric conditions for the vulnerable angle are met.
  • The object is physically placed (e.g., towed or mounted) to maintain the required relative geometry.

3. Mitigation: TrustReflect

As an initial mitigation, the authors propose TrustReflect, a lightweight self-reflection mechanism.

• Concept: Each benign vehicle locally re-runs the deployed consistency-based defense on its own perception output.
• Action: If the local defense flags a specific region as inconsistent (indicating the vehicle itself might be the source of the error), the vehicle marks that region as "uncertain" and attaches a trust mask to its shared data.
• Effect: Downstream consumers exclude these masked regions when computing trust scores or fusion weights. This prevents the system from penalizing the victim for the entire observation, effectively neutralizing the attack's ability to downgrade the victim's global trust score.
• Implementation: TrustReflect requires no model retraining and only adds a single field to V2X messages, reusing existing defense logic.

4. Experimental Results

The authors evaluated TrustFlip and TrustReflect on the OPV2V benchmark across four CP backbones (PIXOR, PointPillars, Attentive Fusion, Where2Comm) and four state-of-the-art defenses (CAD, MATE, LUCIA, MADE).

• Attack Success:
  • TrustFlip successfully removes the targeted benign vehicle from collaboration in up to 87.7% of scenarios.
  • The attack causes a drop in Average Precision (AP) of up to 13%.
  • The attack is effective across both late-fusion and intermediate-fusion architectures.
• Defense Sensitivity:
  • Defenses that react to localized inconsistencies (e.g., MATE, CAD, MADE) are highly susceptible.
  • Defenses that smooth over localized discrepancies (e.g., LUCIA with high compression ratios) are less affected but may also miss real single-object inconsistencies, highlighting a "sensitivity-attribution dilemma."
• Mitigation Performance:
  • TrustReflect reduces the Attack Success Rate (ASR) by 35–100% across various configurations.
  • It effectively restores AP by preventing the false exclusion of the victim's data.
• Physical Validation:
  • The authors fabricated prototypes of the HOLLOW and ATTACHED shapes and validated them using a real Velodyne VLP-32C LiDAR.
  • Results confirmed that the physical objects induce the intended view-conditioned asymmetry (invisible from the rear, visible from the side) in real-world sensor data.

5. Significance and Claims

The paper claims to identify and formalize adversarial trust poisoning as a new class of physical-world attacks against CP systems. Its significance lies in:

1. Shifting the Attack Surface: Moving beyond digital data fabrication to show that physical objects can manipulate the trust assigned to benign vehicles, effectively turning the defense mechanism against itself.
2. Practicality: The attack requires no digital intrusion, V2X interception, or vehicle compromise, making it a low-cost, high-impact threat vector.
3. The Sensitivity-Attribution Dilemma: The work highlights a fundamental trade-off in CP security: defenses sensitive enough to detect localized physical discrepancies are vulnerable to trust poisoning unless they can correctly attribute the source of the inconsistency.
4. Defense Compatibility: The proposed TrustReflect offers a practical, model-agnostic mitigation that can be layered onto existing defenses without retraining.

The authors conclude that while TrustReflect reduces the attack surface, fully neutralizing adversarial trust poisoning remains an open challenge, necessitating future work on robust attribution mechanisms that can distinguish between malicious data fabrication and externally induced physical inconsistencies.