State Estimation Drift

A constant or slowly varying offset is injected into the raw readings of an Inertial Measurement Unit (IMU) or wheel encoder. Because Kalman filters and complementary filters rely on integrating these measurements over time, a tiny, persistent bias of 0.01 rad/s in a gyroscope compounds into a massive angular error after several minutes of operation.

• Mechanism: Attacker manipulates the sensor model's bias term in firmware or via a man-in-the-middle attack on the sensor bus.
• Why it's stealthy: The error stays within the sensor's specified noise envelope, avoiding anomaly detectors.
• Real-world example: A 2013 attack on a yacht's GPS demonstrated how a subtle, induced clock drift caused the vessel to deviate hundreds of meters without triggering any navigation alarm.

The attacker manipulates the process noise covariance (Q) or measurement noise covariance (R) matrices within a Kalman filter. By artificially inflating the filter's trust in its own predictions (lowering Q) or deflating its trust in corrective measurements (raising R), the estimator ignores valid sensor updates and dead-reckons into a divergent state.

• Attack vector: A compromised diagnostics port or telemetry stream that overwrites filter parameters at runtime.
• Result: The filter's uncertainty ellipse shrinks while the actual error grows, creating a dangerous overconfidence scenario where the system believes it is highly accurate while drifting significantly.
• Key indicator: The normalized innovation squared (NIS) test fails silently because the attacker has tuned the covariance to normalize the residuals.

Legitimate sensor measurements are recorded and replayed with a time delay, or GPS updates are selectively blocked. A state estimator that fuses high-frequency IMU data with low-frequency GPS corrections will drift unchecked if the corrective updates are withheld or replayed out of sequence.

• Replay attack: An attacker captures a valid GPS fix and replays it continuously, freezing the absolute position reference while the agent continues moving.
• Delay attack: Introducing a 2-3 second latency on LiDAR odometry updates causes the filter to apply corrections to a state that has already evolved, inducing an oscillatory divergence.
• Exploited assumption: The filter's Markov assumption—that the current state depends only on the previous state—is violated by out-of-order measurements.

The attacker identifies and suppresses the specific sensor modalities required to render a state fully observable. In a Visual-Inertial Odometry (VIO) system, an attacker can degrade visual features by projecting adversarial patterns or reducing scene texture, forcing the system to rely solely on inertial dead-reckoning.

• Target: The observability Gramian of the system. If the Gramian loses rank, certain state dimensions (e.g., global yaw, scale) become unobservable and drift without bound.
• Practical attack: A targeted denial-of-service on a downward-facing optical flow sensor on a drone, causing the altitude estimate to diverge within seconds.
• Mitigation challenge: The system cannot detect the drift internally because the unobservable subspace, by definition, produces no innovation residual.

In SLAM systems, loop closure detection is the critical mechanism that corrects accumulated drift by recognizing previously visited locations. An attacker can either suppress valid loop closures or inject false ones, causing the pose graph optimizer to warp the entire map and trajectory to fit a malicious constraint.

• False positive injection: An attacker places a replicated visual fiducial marker or Wi-Fi fingerprint at a new location, tricking the system into believing it has returned to a previous point.
• False negative suppression: Adversarial patches placed on recognized landmarks prevent the visual bag-of-words model from matching features, allowing drift to accumulate indefinitely.
• Consequence: The optimized trajectory is globally consistent but systematically offset from ground truth, a state that survives even after multiple loop closures.

An attack on the time synchronization protocol (e.g., PTP, NTP, or hardware trigger lines) between sensor streams. If a LiDAR scan is timestamped 50ms behind the corresponding IMU measurement, the state estimator fuses data from two different poses, creating a systematic error that compounds with vehicle speed.

• Attack vector: A man-in-the-middle on the PTP grandmaster clock or a compromised IEEE 1588 transparent clock.
• Effect at speed: At 20 m/s, a 50ms desynchronization between LiDAR and IMU introduces a 1-meter spatial error per update, which the filter interprets as an innovation and partially incorporates.
• Stealth property: The error scales with velocity, making it appear as a calibration issue rather than an active attack during forensic analysis.

A targeted attack on the recursive Bayesian estimator that fuses noisy sensor data. By injecting a sequence of subtly corrupted measurements, an adversary can manipulate the filter's covariance matrix and predicted state. Unlike a single spoofed reading, this attack exploits the filter's own temporal smoothing to make the drift appear statistically plausible, bypassing residual-based anomaly detectors.

A physical or cyber attack that feeds false accelerometer and gyroscope data to the agent's dead reckoning system. Without external corrections from GPS or visual odometry, integration errors accumulate quadratically. An attacker can induce a precise drift vector by injecting a constant bias below the sensor's noise floor, causing the agent to silently veer off course while its internal diagnostics report nominal operation.

An integrity attack on the graph-based optimization backend of a SLAM system. By corrupting loop closure constraints or injecting phantom features into the pose graph, an attacker creates a persistent, non-random deformation of the agent's map. The resulting state estimate is internally consistent but globally distorted, causing the agent to navigate a warped version of reality without triggering map inconsistency checks.

An attack that exploits the epipolar geometry constraints used in feature-based motion estimation. By introducing adversarial patches in the environment or manipulating the camera feed, an attacker can induce systematic errors in relative pose estimation between frames. The drift accumulates with trajectory length, and because each frame-to-frame error is small, it evades outlier rejection schemes like RANSAC.

A sophisticated multi-modal attack that injects mutually consistent but false data across LiDAR, camera, IMU, and wheel odometry streams simultaneously. By ensuring the corrupted readings agree with each other, the attacker defeats cross-modal validation checks. The agent's complementary filter or extended Kalman filter fuses the coherent lies into a high-confidence, catastrophically wrong state estimate that no single sensor contradicts.

An attack on the uncertainty estimation itself. By manipulating the sensor noise parameters or the process model, an adversary can inflate or deflate the filter's confidence in its estimates. An artificially deflated covariance causes the filter to reject legitimate corrective measurements as outliers, locking in the drift. An inflated covariance erodes the agent's trust in its own state, causing hesitant, unstable control.