Sensor Fusion Deception

The core mechanism relies on generating false data that is internally coherent across all targeted sensors. An attacker doesn't just spoof a LiDAR point cloud; they simultaneously inject a matching adversarial object into the camera frame and a corresponding phantom mass into the IMU's inertial readings. This mutual corroboration causes the sensor fusion algorithm to assign high confidence to the phantom object, as it passes all cross-validation checks designed to filter single-sensor noise.

This attack specifically targets the mathematical weaknesses of fusion algorithms like Kalman filters or particle filters. By understanding the prediction-update cycle, an attacker can inject data that falls within the filter's expected covariance bounds but slowly pulls the state estimate off course. Key techniques include:

• Covariance manipulation: Injecting data that artificially shrinks the filter's uncertainty estimate, making it overconfident in a false state.
• Association hijacking: Forcing incorrect data association between sensor tracks, causing the filter to lock onto a ghost target instead of a real one.

Effective deception requires precise temporal alignment of spoofed signals. Modern sensor fusion relies on timestamped data; an attacker must inject false LiDAR, camera, and IMU data with timestamps that are consistent with each other and the system's clock. A failure in synchronization creates a temporal inconsistency that triggers fault detection. Advanced attacks manipulate the sensor trigger signals or the Precision Time Protocol (PTP) itself to ensure the phantom object moves with realistic kinematics across all modalities simultaneously.

To avoid triggering physics-based anomaly detectors, injected data must obey physical laws. A phantom vehicle cannot accelerate from 0 to 100 km/h in one frame. Attackers use adversarial generative models trained on realistic object trajectories to produce spoofed data that respects:

• Kinematic constraints: Velocity, acceleration, and jerk profiles that match real objects.
• Occlusion dynamics: The phantom object must realistically appear and disappear behind real obstacles.
• Material reflectance: LiDAR intensity values must match the spoofed object's supposed material.

Sensor fusion systems output not just a state estimate but a confidence score or uncertainty measure. A sophisticated deception attack manipulates this meta-data by exploiting the epistemic uncertainty of neural network-based perception. By crafting inputs near decision boundaries, an attacker can cause a camera classifier to report 99% confidence in a false object while simultaneously ensuring the LiDAR detector reports a matching high-confidence detection. This dual high-confidence signal overwhelms downstream planning modules that trust the fusion system's certainty.

Rather than introducing a sudden, obvious phantom, a stealthy variant induces a slow, cumulative error in the agent's state estimation. By injecting biases that are smaller than the system's noise threshold, the attacker causes the agent's estimated pose to diverge from its true pose over minutes or hours. This is particularly dangerous in GPS-denied environments where absolute position corrections are unavailable. The agent believes it is on course while drifting into a hazardous zone or off a planned path.

A sensor spoofing technique that inserts crafted, adversarial points into a simulated LiDAR scan to create ghost objects or hide real obstacles from the perception stack. Attackers exploit the point cloud processing pipeline by injecting clusters of points that mimic valid object signatures, causing the agent to brake suddenly for phantom pedestrians or collide with occluded barriers. Defense requires temporal consistency checks across consecutive frames and cross-validation against camera-based object detection.

An attack that exploits a generative world model's tendency to confabulate, causing an agent to plan and act based on a convincingly predicted but entirely false future state. By introducing subtle perturbations to the latent representation, adversaries force the model to generate plausible but fabricated obstacle trajectories or road geometries. The agent then executes maneuvers to avoid threats that do not exist, creating real-world safety hazards from purely synthetic perceptions.

An adversarial technique that identifies and leverages discrepancies between simulation and reality to cause a policy trained in simulation to fail upon deployment. Attackers systematically probe the domain gap by analyzing where the agent's simulated sensor readings diverge from real-world physics. Key exploitation vectors include:

• Lighting inconsistencies between rendered and natural illumination
• Friction coefficient mismatches in vehicle dynamics models
• Sensor noise profiles that differ from physical hardware characteristics

A stealthy attack that slowly introduces a cumulative error into an agent's calculated pose or velocity, causing it to deviate from its intended path without triggering immediate alarms. By injecting small, mutually consistent biases across IMU, wheel odometry, and visual odometry streams, the attacker ensures the Kalman filter accepts the corrupted state as valid. Over time, the agent drifts into dangerous positions while its confidence intervals remain deceptively tight.

An integrity attack involving unauthorized modification of critical environmental variables within a simulation to degrade agent performance. Attackers alter parameters such as gravity constants, friction coefficients, or sensor noise models to create a policy that is brittle or dangerous when deployed. Unlike sensor spoofing, this attack targets the physics engine configuration itself, making the corruption systemic across all agents trained in the compromised environment.

An attack that applies imperceptible, targeted noise to an agent's internal world model representation to steer its behavior toward an attacker-chosen outcome. By manipulating the encoded state before it reaches the policy network, adversaries bypass input-level defenses entirely. The perturbation is designed to be statistically indistinguishable from normal latent activations, making detection through standard output monitoring infeasible without specialized representation auditing tools.