ML Security PapersSoK: The Next Frontier in AV Security: Systematizing Perception Attacks and the Emerging Threat of Multi-Sensor Fusion
Shahriar Rahman Khan 1, Tariqul Islam 2, Raiful Hasan 1
Published on arXiv
2604.20621
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Reveals fundamental shift in AV security: attackers now exploit cross-sensor dependencies and fusion logic, the very redundancy mechanisms designed for safety
Autonomous vehicles (AVs) increasingly rely on multi-sensor perception pipelines that combine data from cameras, lidar, radar, and other modalities to interpret the environment. This SoK systematizes 48 peer-reviewed studies on perception-layer attacks against AVs, tracking the field's evolution from single-sensor exploits to complex cross-modal threats that compromise multi-sensor fusion (MSF). We develop a unified taxonomy of 20 attack vectors organized by sensor type, attack stage, medium, and perception module, revealing patterns that expose underexplored vulnerabilities in fusion logic and cross-sensor dependencies. Our analysis identifies key research gaps, including limited real-world testing, short-term evaluation bias, and the absence of defenses that account for inter-sensor consistency. To illustrate one such gap, we validate a fusion-level vulnerability through a proof-of-concept simulation combining infrared and lidar spoofing. The findings highlight a fundamental shift in AV security: as systems fuse more sensors for robustness, attackers exploit the very redundancy meant to ensure safety. We conclude with directions for fusion-aware defense design and a research agenda for trustworthy perception in autonomous systems.
Key Contributions
- Unified taxonomy of 20 attack vectors against AV perception systems organized by sensor type, attack stage, medium, and perception module
- Systematization of 48 peer-reviewed studies tracking evolution from single-sensor to multi-sensor fusion attacks
- Identification of research gaps including limited real-world testing, short-term evaluation bias, and absence of fusion-aware defenses
🛡️ Threat Analysis
Survey covers adversarial attacks on AV perception systems (cameras, lidar, radar) that manipulate sensor inputs to cause misclassification or incorrect environmental interpretation at inference time. Includes physical adversarial patches, sensor spoofing, and cross-modal attacks that exploit multi-sensor fusion logic.