Search papers, labs, and topics across Lattice.
This paper introduces TrustFlip, a novel attack that exploits consistency-based defenses in vehicular collaborative perception systems to poison the trust assigned to benign vehicles. The attack strategically deploys physical adversarial objects that induce inconsistencies in observations among benign vehicles, causing the defense mechanism to incorrectly penalize a targeted vehicle. Experiments across multiple architectures demonstrate that TrustFlip can remove the targeted vehicle from collaboration in up to 87.7% of scenarios and reduce Average Precision by up to 13%.
Consistency-based defenses in collaborative perception, intended to protect autonomous vehicles, can be weaponized to selectively silence trustworthy vehicles.
Collaborative perception (CP) enables connected and autonomous vehicles to share sensor data and jointly reason about their environment. To defend against adversaries that fabricate or manipulate shared data, existing systems employ cross-vehicle inconsistency detection and trust estimation, penalizing vehicles whose observations conflict with the majority. In this work, we show that these defenses themselves introduce a new attack surface. We present TrustFlip, a novel attack that weaponizes consistency-based defenses to poison the trust assigned to benign vehicles. Instead of injecting false data into the collaboration pipeline, it deploys physical adversarial objects that are genuine but induce inconsistent observations among benign vehicles. The resulting inconsistencies are misattributed by the defense to the targeted vehicle, causing its trust score to degrade and eventually leading to its downweighting or exclusion from collaboration. Consequently, the system loses reliable sensing contributors, degrading perception capability and potentially inducing safety-critical failures. We evaluate TrustFlip across multiple collaborative perception architectures and defense mechanisms. Our results show that state-of-the-art defenses can be significantly affected: the attack removes the targeted benign vehicle from collaboration in up to 87.7% of scenarios and drops Average Precision (AP) by up to 13%. As an initial mitigation, we introduce TrustReflect, a lightweight self-reflection mechanism that marks disputed regions as uncertain and excludes them from trust evaluation, reducing the attack success rate by 35-100%.
