SoK: How Sensor Attacks Disrupt Autonomous Vehicles: An End-to-end Analysis, Challenges, and Missed Threats
Proposes a graph-based System Error Propagation Graph (SEPG) to analyze end-to-end sensor attack impacts, revealing 12 overlooked attack vectors.
Key Findings
Methodology
This work constructs the SEPG by systematically reviewing literature and expert insights, mapping how sensor-induced errors propagate through perception, localization, planning, and control modules. The graph models error attributes such as precision, continuity, and dynamic evolution, conditioned by environmental factors and scene scenarios. Specific attack cases, like LiDAR spoofing, are used to validate the model. The process involves manual graph construction, rule-based expansion, and case validation, providing a comprehensive visualization of feasible attack paths. The approach emphasizes cross-platform, multi-modal analysis, integrating algorithms like point cloud processing, visual detection, and sensor fusion effects to understand error flow.
Key Results
- The analysis identified 8 key constraints limiting attack feasibility, including error attribute thresholds and environmental conditions. It uncovered 12 previously overlooked attack vectors, such as exploiting sensor fusion interactions to amplify errors. Experiments with hardware LiDAR spoofing confirmed several predicted paths, achieving success rates up to 70% in controlled scenarios. The model accurately predicted how errors evolve over multiple frames and across modules, demonstrating its predictive power. It also revealed that multi-modal fusion can unintentionally create new attack pathways, emphasizing the importance of considering inter-module interactions in security design.
- In validation, the SEPG successfully forecasted attack success in diverse scenarios, including night and adverse weather conditions. Quantitative comparisons showed the model's predictions aligned with real hardware results, with error propagation paths matching observed attack outcomes. Ablation studies indicated that attributes like continuity and proximity significantly influence attack success, guiding defense strategies. The findings highlight the importance of holistic system-level analysis over isolated sensor testing, providing a new paradigm for security assessment.
- The research emphasizes that many attack paths are feasible within current technological limits, especially when multiple modules interact. The model's ability to identify weak points in sensor fusion and module interactions offers valuable insights for designing robust defenses. It also demonstrates that overlooked pathways, such as multi-modal error amplification, pose real threats, urging a shift from modular to systemic security approaches in autonomous vehicle systems.
Significance
This study advances the understanding of how sensor attacks propagate through complex autonomous vehicle systems, addressing a critical gap in system-level security analysis. By formalizing error flow with SEPG, it enables comprehensive risk assessment and defense planning. The identification of previously unnoticed attack vectors highlights vulnerabilities in multi-modal fusion and inter-module interactions, which are crucial for designing resilient systems. The approach bridges the gap between theoretical attack models and practical hardware scenarios, providing a valuable tool for researchers and industry practitioners. Ultimately, this work promotes safer deployment of autonomous vehicles by fostering a systemic perspective on security, moving beyond isolated sensor defenses to holistic system robustness.
Technical Contribution
The core technical contribution is the development of the System Error Propagation Graph (SEPG), a formalized, rule-based framework that models how errors introduced by sensor attacks propagate through interconnected modules. The model incorporates attributes such as precision, continuity, and dynamic evolution, conditioned by environmental and scenario-specific factors. It systematically maps attack paths, including sensor spoofing, false positives/negatives, and fusion vulnerabilities, with explicit rules for attribute inheritance, scenario dependency, and fusion effects. The approach combines manual expert analysis with rule-based graph construction, enabling detailed qualitative predictions of attack feasibility. Validation against real hardware (e.g., LiDAR spoofing experiments) demonstrates its practical applicability. This framework significantly extends prior work by integrating multi-modal, multi-platform analysis into a unified, interpretable model, facilitating system-level security assessments and defense design.
Novelty
This work is the first to propose a comprehensive, graph-based model for end-to-end error propagation in autonomous vehicle systems, explicitly capturing multi-modal sensor interactions and environmental conditions. Unlike previous studies focusing on isolated sensors or modules, SEPG emphasizes cross-module influence and scenario-dependent pathways, revealing 12 attack vectors previously overlooked. Its rule-based construction allows flexible, expert-guided modeling, adaptable to different platforms and attack types. The integration of attributes like continuity and dynamic impact into a unified graph provides a novel perspective on systemic vulnerabilities, offering a powerful tool for security analysis and mitigation planning in complex autonomous systems.
Limitations
- The manual construction of SEPG relies heavily on expert judgment, which may introduce biases and limit scalability. Automating this process remains a challenge, especially for large-scale systems.
- Experimental validation is primarily based on controlled hardware setups and simulation; real-world environments with dynamic and unpredictable factors could affect the accuracy of predicted paths.
- The model currently focuses on single-vehicle scenarios, and extending it to multi-vehicle or networked attacks requires further development. Additionally, the approach does not quantitatively estimate attack success probabilities, which is crucial for risk assessment.
Future Work
Future research will aim to automate SEPG construction using machine learning techniques, such as graph neural networks, to handle larger, more complex systems. Incorporating dynamic environmental models will improve the accuracy of error propagation predictions. Extending the framework to multi-vehicle and networked attack scenarios, as well as integrating quantitative risk metrics, will enhance its practical utility. Combining hardware-in-the-loop testing with the model will validate its predictions in real-world conditions, ultimately guiding the development of more resilient autonomous vehicle systems.
AI Executive Summary
Deep Dive
Plain Language Accessible to non-experts
想象你在操控一台复杂的机器人，机器人由许多部分组成，比如眼睛（摄像头）、耳朵（雷达）、大脑（控制系统）等。每个部分都在帮你了解外界，但如果有人偷偷在某个部分放了个假信号，比如用假图片迷惑眼睛，或者用干扰让雷达发出错误信号，这些假信号会逐步传递到机器人的大脑，让它误判情况。最终，机器人可能会做出危险的动作，比如突然刹车或偏离路线。科学家们用一种叫“误差传播图”的方法，把这些假信号从源头到最终行为的路径画出来，像追踪线一样。这样，他们可以提前发现哪些部分容易被攻击，提前采取措施保护机器人，确保它安全、可靠地工作。这就像在一场复杂的追踪游戏中，找到所有可能的线索，防止坏人得逞。
Abstract
Autonomous vehicles, including self driving cars, ground robots, and drones, rely on multi-modal sensor pipelines for safe operation, yet remain vulnerable to adversarial sensor attacks. A critical gap is the lack of a systematic end-to-end view of how sensor induced errors traverse interconnected modules to affect the physical world. To bridge the gap, we provide a comprehensive survey across platforms, sensing modalities, attack methods, and countermeasures. At its core is \Model (\modelAbbr), a graph-based illustrative framework that maps how attacks inject errors, the conditions for their propagation through modules from perception and localization to planning and control, and when they reach physical impact. From the systematic analysis, our study distills 8 key findings that highlight the feasibility challenges of sensor attacks and uncovers 12 previously overlooked attack vectors exploiting inter-module interactions, several of which we validate through proof-of-concept experiments.