💻 computer science

GLST: Defending Confidence-Driven V2X Collaborative Perception Against Stealthy Multi-Attacker Feature Injection

This paper introduces Global-Local Structural Trust (GLST), a lightweight defense mechanism that secures confidence-driven V2X collaborative perception against stealthy multi-attacker feature injection attacks by fusing global, local, and structural consistency signals to robustly identify and suppress unreliable collaborators where existing single-signal defenses fail.

Original authors: Ji He, Ying Wang, Lijie Zheng, Xinghui Zhu, Yulong Shen, Xiaohong Jiang

Published 2026-07-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ji He, Ying Wang, Lijie Zheng, Xinghui Zhu, Yulong Shen, Xiaohong Jiang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a fleet of self-driving cars cruising down a highway, not as isolated islands, but as a chatty team sharing their eyes and ears. This is the world of Collaborative Perception (CP). Instead of just relying on their own cameras and sensors, these cars talk to each other via V2X (Vehicle-to-Everything) communication, swapping digital "snapshots" of what they see. This helps them spot cars hidden behind trucks or around blind corners, creating a super-powered, shared view of the road.

But here's the catch: to keep the conversation fast and the internet bills low, these cars don't send everything. They use a smart filter called confidence-driven communication. Think of it like a group chat where everyone only types out the parts of the story they are most sure about. If a car is 99% sure it sees a pedestrian, it shouts it out. If it's only 50% sure, it stays quiet to save bandwidth. This works great for efficiency, but it creates a sneaky loophole. What if a bad actor joins the chat, pretending to be super confident about something that isn't there? Or worse, what if they whisper a lie right into the one spot where everyone is already unsure? That's the security puzzle this paper tackles: how do you trust your teammates when the very system designed to make communication efficient can be tricked into amplifying lies?

The Sneaky "Pretend Benign" Attack

The authors of this paper decided to test the safety of this "chatty car" system using a popular framework called Where2comm. They discovered a nasty vulnerability: the system's trust in "high-confidence" areas can be weaponized.

Enter the Pretend Benign (PB) attack. Imagine a hacker who doesn't just scream "FIRE!" in a crowded room (which would be obvious and ignored). Instead, they whisper a very convincing, slightly confusing story right into the ear of someone who is already squinting and unsure. The PB attack is a "stealthy feature injection." It doesn't try to break the car's sensors; it injects malicious digital data that looks perfectly normal and "benign" to the system's filters.

The attacker targets the exact spots where the cars are uncertain. Because the system is designed to prioritize information from these uncertain-but-critical zones, it eagerly grabs the malicious data, thinking, "Oh, this looks helpful!" The result? The car's brain gets confused, missing real cars or seeing ghosts, all while the attacker's data looks innocent to standard security checks.

The Multi-Attacker Trap

The paper also points out a flaw in how we usually defend against these hackers. Most current defenses act like a teacher checking homework: they look for one student who doesn't match the class average. If one student is lying, the teacher spots them.

But what if three students are in on the secret? The authors found that when multiple attackers work together (even without talking to each other), they can create a pseudo-consensus. They all whisper similar lies. To a defense system looking for a single outlier, these liars suddenly look like the majority. The defense thinks, "Well, three people agree, so they must be right," and accidentally boosts the attackers' trust scores. The paper argues that relying on a single "consistency check" is like trying to spot a fake news story by only checking if one person agrees with it; if a whole group agrees, the check fails.

The Solution: GLST (Global-Local-Structural Trust)

To fix this, the team proposed a new defense framework called GLST (Global-Local-Structural Trust). Instead of just asking, "Does this data look like the average?" GLST asks three different questions, like a detective using three different clues:

Global Consistency: Does this car's overall data look like the general crowd? (The "Big Picture" check).
Local Residuals: If we zoom in on the specific, uncertain spots where the attack happened, does the data look weirdly different from what a "safe" consensus would look like? (The "Microscope" check).
Structural Consistency: Does the shape and pattern of the data match the "self" (the ego vehicle's own view)? (The "Fingerprint" check).

GLST combines these three angles to give each car a "trust score." If a car looks good globally but weird locally, or if it matches the crowd but has a weird internal structure, GLST flags it. It then lowers that car's "volume" in the group chat, so its lies don't drown out the truth.

What the Numbers Say

The team tested this on a massive dataset of simulated driving scenarios called OPV2V. They pitted GLST against the "Pretend Benign" attack and other known attacks like PGD and BIM.

The Bad News: Without any defense, the "Pretend Benign" attack was devastating. When four attackers joined the chat, the system's ability to detect objects (measured as AP@0.5) crashed from a healthy 0.92 down to a pathetic 0.09.
The Old Defenses: Existing methods like LUCIA (which relies on a single consistency check) did great against one attacker (scoring 0.85), but they collapsed when faced with four attackers, dropping to 0.11. They fell for the "pseudo-consensus" trap.
The GLST Win: GLST held the line. Even with four attackers, it kept the detection score at a robust 0.67 (for AP@0.5) and 0.50 (for AP@0.7). It successfully ignored the coordinated liars while keeping the honest cars' voices loud and clear.

The authors suggest that this multi-level approach is essential. While the results are based on simulations and not real-world road tests yet, the data strongly suggests that to keep our future self-driving fleets safe, we need a defense that doesn't just count heads, but looks at the whole picture, the fine details, and the underlying structure all at once.

Technical Summary: GLST – Defending Confidence-Driven V2X Collaborative Perception Against Stealthy Multi-Attacker Feature Injection

1. Problem Statement

Collaborative Perception (CP) enhances autonomous driving by allowing connected vehicles (CAVs) to exchange intermediate features via Vehicle-to-Everything (V2X) communication. Recent paradigms, such as Where2comm, utilize confidence-driven sparse communication to improve efficiency. These systems transmit only "perception-critical" spatial regions (high-confidence areas) to reduce bandwidth.

However, this design introduces a critical security vulnerability:

Amplification of Adversarial Features: If a collaborator is compromised, malicious features injected into high-confidence or ego-uncertain regions are preferentially selected for transmission and amplified during feature fusion.
Stealthiness of Attacks: Existing stealthy attacks, specifically the Pretend Benign (PB) attack, optimize adversarial features to resemble benign distributions. They target uncertain regions to cause missed detections or false positives while maintaining benign-like feature characteristics, evading standard anomaly detection.
Failure of Single-Signal Defenses: Current defenses (e.g., ROBOSAC, LUCIA) often rely on a single consistency signal (e.g., global feature distance or pairwise similarity). In multi-attacker scenarios, malicious agents can form a pseudo-consensus in the feature space. This mutual consistency biases trust estimation, causing defenses to assign high reliability to coordinated attackers and fail to suppress corrupted fusion.

2. Methodology: The GLST Framework

To address these vulnerabilities, the authors propose Global-Local Structural Trust (GLST), a lightweight defense framework that evaluates collaborator reliability from three complementary perspectives before feature fusion.

A. Global Feature Consistency (Coarse-Grained Prior)

Mechanism: Computes the pairwise $\ell_1$ distance between each agent's downsampled, normalized feature map and the collective distribution of all agents.
Function: Agents with features deviating significantly from the majority distribution receive lower trust scores. The ego vehicle is explicitly protected from being penalized as an outlier.
Limitation Addressed: While effective against isolated outliers, global consistency alone is insufficient against coordinated attackers who maintain mutual similarity.

B. Local Robust Consensus Residual (Fine-Grained Anomaly Detection)

Mechanism:
1. Critical Region Selection: Identifies spatial regions that are both uncertain (low detection confidence) and semantically active (high feature response) using the ego vehicle's feature map.
2. Multi-Scale Residuals: Computes residuals between each agent's features and a robust consensus center (weighted by global trust scores) within these critical regions across multiple spatial scales.
3. Scoring: Combines the average residual and the 90th-percentile residual to capture both general inconsistency and extreme localized deviations.
Function: Detects stealthy perturbations concentrated on specific semantic regions that global statistics might miss.

C. Structural Consistency (Semantic Topology)

Mechanism: Evaluates whether the internal spatial semantic structure of an agent's feature map aligns with the ego vehicle's reference. It uses cosine similarity between flattened, masked feature embeddings of the agent and the ego.
Function: Catches attacks that mimic global statistics and local magnitudes but distort the underlying spatial activation patterns (e.g., edge structures or object correlations).

D. Trust-Aware Fusion

Aggregation: The three trust scores ( $t_{global}$ , $t_{local}$ , $t_{struct}$ ) are combined via a weighted summation (not multiplicative) to prevent a single unstable branch from causing trust collapse.
Application: The resulting unified trust score is used to reweight the attention mechanism during feature fusion. Suspicious agents are softly suppressed (down-weighted) rather than hard-filtered, preserving useful information from partially reliable agents.

3. Key Contributions

Vulnerability Analysis: The paper empirically demonstrates that confidence-driven sparse communication unintentionally amplifies adversarial feature propagation. It shows that the Pretend Benign (PB) attack effectively exploits this by injecting perturbations into perception-critical regions, significantly degrading 3D object detection while maintaining stealth.
Identification of Multi-Attacker Weakness: The authors reveal that existing consistency-based defenses are fragile against multi-attacker scenarios. Coordinated attackers can form a pseudo-consensus, biasing single-signal trust estimations and rendering standard defenses ineffective.
GLST Framework: Proposes a multi-level trust modeling approach (Global, Local, Structural) that does not require complex reconstruction or additional communication overhead. It effectively suppresses low-trust collaborators at the feature level.
Comprehensive Evaluation: Extensive experiments on the OPV2V dataset validate the framework against single-attacker and multi-attacker PB attacks, as well as gradient-based attacks (PGD).

4. Experimental Results

Experiments were conducted using the Where2comm framework with PointPillars as the backbone on the OPV2V dataset.

Attack Effectiveness:
- PB Attack: Under a single attacker, PB reduced AP@0.5 from 0.91 (no attack) to 0.37. Under four attackers, it dropped to 0.09. Crucially, PB maintained high stealthiness (low false positives, e.g., ~6.04 FPIoU0.5 for 4 attackers) compared to aggressive attacks like PGD/BIM (which generated hundreds of false positives).
Defense Performance (Single Attacker):
- GLST achieved competitive performance, recovering AP@0.5 to 0.82 under PB attacks, comparable to or slightly better than LUCIA (0.85) and significantly better than no defense (0.37).
Defense Performance (Multi-Attacker):
- LUCIA Failure: LUCIA, which relies on pairwise distances, collapsed under multi-attacker settings (AP@0.5 dropped to 0.11 with 4 attackers) due to the pseudo-consensus bias.
- GLST Robustness: GLST maintained robust performance, achieving 0.67 AP@0.5 with four attackers and 0.69 AP@0.3. It significantly outperformed LUCIA and ROBOSAC in multi-attacker scenarios.
- Generalization: GLST also demonstrated strong robustness against multi-attacker PGD attacks, maintaining 0.68 AP@0.5 with four attackers, whereas LUCIA failed completely.
Trust Score Discriminability:
- In a two-attacker scenario, LUCIA assigned overlapping trust scores to benign and malicious agents (means: 0.67 vs 0.61). GLST provided clear separation (means: 0.31 vs 0.02), confirming its superior ability to distinguish coordinated attackers.
Ablation Study:
- Removing any single trust branch (Global, Local, or Structural) led to performance degradation, particularly in multi-attacker settings. The Local branch was found most critical for detecting fine-grained perturbations in critical regions.

5. Significance and Claims

The paper claims that multi-level trust modeling is essential for securing confidence-driven collaborative perception.

Beyond Single-Signal Defenses: The work argues that relying on a single consistency signal is insufficient for modern CP systems, especially when facing stealthy, coordinated multi-attacker threats.
Balancing Efficiency and Security: GLST offers a lightweight solution that integrates directly into the existing fusion pipeline without requiring complex reconstruction or iterative sampling, making it suitable for real-time V2X applications.
Robustness to Coordination: By combining global, local, and structural perspectives, GLST effectively breaks the "pseudo-consensus" formed by coordinated attackers, a vulnerability that existing state-of-the-art defenses fail to address.

The authors conclude that their findings validate the necessity of moving from single-signal trust estimation to a holistic, multi-perspective trust framework to ensure the reliability of autonomous driving perception in adversarial V2X environments.