{"id":"2485f5a9-6fab-48de-bdec-43017294c553","arxiv_id":"1906.09765","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Experiments show that Mobileye can be fooled into interpreting drone-projected spoofed traffic signs as real under varied conditions like color, shape, speed, size, and light.","lead":"This paper demonstrates an attack on the Mobileye ADAS by using a drone to project spoofed traffic signs onto a moving car. A smart generalist might read it to understand physical vulnerabilities in camera-based driver assistance systems used in vehicles.","discovery_kind":"unclear","skeptic_critique":{"model":"grok-4.3","headline":"Drone-carried projector setup may not faithfully represent feasible real-world attack conditions due to stability, positioning, and detectability factors.","rationale":"The reader's weakest assumption directly identifies the same realism gap in the experimental proxy. This is the single most load-bearing point for the claim that the spoof is interpreted 'as a real traffic sign' in a driving scenario. Full text might contain additional controls, but based on the provided abstract the concern stands.","tokens_in":1610,"tokens_out":291,"duration_ms":17279,"concrete_test":"Re-run the projection trials with a fixed roadside projector at matched distances, vehicle speeds, and ambient conditions; compare Mobileye detection rates and false-positive triggers against the drone results. A >30% drop in success rate or emergence of new failure modes would indicate the drone setup's realism is overstated.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that the drone experiment demonstrates successful spoofing under conditions an attacker could realistically achieve. The setup introduces drone-specific variables (vibration affecting projection focus, need for precise real-time positioning relative to a moving vehicle, and potential visibility of the drone itself to other sensors or observers) that are not addressed in the abstract's description of environmental parameter testing. Without evidence that these were controlled or shown not to affect outcomes, the results may not generalize beyond the lab-like drone configuration to practical attacks.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript describes experiments attacking the Mobileye ADAS by projecting spoofed traffic signs from a drone-carried portable projector onto a moving vehicle. It tests the influence of environmental parameters including color, shape, projection speed, diameter, and ambient light on whether Mobileye interprets the projected sign as real, claiming that successful spoofing is possible under these conditions.","tokens_in":1698,"tokens_out":313,"duration_ms":16611,"significance":"If the results are supported by quantitative data and the drone setup is shown to be representative, the work would provide a concrete demonstration of a physical spoofing attack on a widely deployed camera-based ADAS, underscoring the need for robustness testing against projection-based threats in autonomous driving systems.","major_comments":[{"comment":"The abstract asserts successful attacks after varying parameters but supplies no quantitative results, success rates, controls, sample sizes, or error analysis; without these the central claim that Mobileye can be fooled cannot be evaluated.","section":"Abstract"},{"comment":"The drone-carried projector setup introduces unaddressed variables (vibration affecting focus, real-time positioning relative to a moving vehicle, and potential visibility to other sensors) that undermine the claim of a realistic driving scenario; these factors are load-bearing for generalizing the attack beyond the specific experimental configuration.","section":"Experimental Setup (implied by abstract description of drone use)"}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the detailed review and constructive feedback on our manuscript. We address each major comment below and indicate where revisions will be made to strengthen the paper.","responses":[{"response":"The abstract is intentionally concise and summarizes the overall finding that spoofing is possible. The full manuscript reports the experimental outcomes across the tested parameters (color, shape, speed, size, and light), including observed success under those conditions. To improve evaluability, we will revise the abstract to incorporate key quantitative details such as the range of success rates and number of trials conducted.","revision_made":"yes","referee_comment":"[Abstract] The abstract asserts successful attacks after varying parameters but supplies no quantitative results, success rates, controls, sample sizes, or error analysis; without these the central claim that Mobileye can be fooled cannot be evaluated."},{"response":"We agree these variables merit explicit discussion. The experiments were performed with the drone maintaining stable projection onto the moving target vehicle under the reported conditions, but the manuscript does not detail mitigation steps for vibration or positioning accuracy. We will add a dedicated subsection in the experimental setup describing how these factors were managed during trials and any observed effects on projection quality.","revision_made":"yes","referee_comment":"[Experimental Setup (implied by abstract description of drone use)] The drone-carried projector setup introduces unaddressed variables (vibration affecting focus, real-time positioning relative to a moving vehicle, and potential visibility to other sensors) that undermine the claim of a realistic driving scenario; these factors are load-bearing for generalizing the attack beyond the specific experimental configuration."}],"tokens_in":1201,"tokens_out":360,"duration_ms":20905,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"This paper's main result is that a drone carrying a portable projector can project spoofed traffic signs onto a driving car and get Mobileye to treat them as genuine. They tested this by varying color, shape, projection speed, diameter, and ambient light to see what affects whether the attack lands. The drone setup is the concrete step that moves the idea from a lab bench to something closer to a real driving scenario. That part is useful because it shows the attack can be made mobile rather than fixed. The work is empirical and targets a commercial ADAS product, which gives it direct relevance for people thinking about sensor attacks on vehicles. It extends earlier camera spoofing concepts by putting them on a drone and testing against Mobileye specifically. The soft spots are straightforward. The abstract states that the attacks succeeded after parameter changes but reports none of the actual numbers: no trial counts, no success percentages, no mention of how many times it failed or what the controls looked like. Without those, it is hard to judge whether the attack is reliable enough to matter or whether the parameter changes truly drove the outcome. The drone itself also introduces variables like vibration, precise positioning relative to a moving target, and possible visibility to other sensors that are not discussed. If the full paper supplies the missing data and addresses those points, the contribution becomes clearer. This is the sort of paper that security researchers working on automotive vision systems or physical attacks would want to read for the attack vector and the test setup. A reader looking for practical examples of camera spoofing on ADAS would get value from the scenario even if the evidence needs more detail. It deserves peer review because the topic is timely and the method is specific; a referee can check the full results and ask for the quantitative backing and limitation discussion that the abstract omits.","headline":"The paper shows a drone projector can spoof traffic signs into Mobileye on a moving car, but the abstract supplies no success rates or controls so the reliability is unclear.","tokens_in":2190,"tokens_out":438,"would_cite":false,"duration_ms":24182,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[],"headline":"Empirical ADAS camera-spoofing attack via drone projector; no overlap with RS forcing chain","alignment":"orthogonal","rationale":"The paper's machinery consists of parameter-sensitivity experiments (color, shape, diameter, ambient light, projection speed) on Mobileye's traffic-sign classifier, executed with a physical drone-mounted projector in a driving scenario. This is standard black-box adversarial evaluation in cs.CR. RS contains no theorems about computer-vision classifiers, projection attacks, or sensor spoofing; its core results (reality_from_one_distinction, J-cost uniqueness, Alexander-duality D=3 forcing, 8-tick periodicity, φ-ladder constants) lie in an entirely different domain. Hence the paper is orthogonal.","tokens_in":45142,"confidence":"high","tokens_out":170,"duration_ms":6796,"cache_read_input_tokens":38528,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"A drone with a projector can make Mobileye interpret spoofed traffic signs as real.","keywords":["camera spoofing","ADAS attack","traffic sign recognition","Mobileye","drone projector","vehicle security","projection attack","cyber physical attack"],"falsifier":"A repeated experiment where the projected sign is displayed but Mobileye consistently fails to recognize it as a valid traffic sign or issues no response.","tokens_in":2500,"feed_emoji":"🚗","tokens_out":469,"duration_ms":26306,"temperature":0.7,"pith_summary":"This paper examines whether Mobileye, a common ADAS, can be tricked by projected fake traffic signs. The authors use a drone to carry a projector that displays signs onto a moving car while varying conditions like color, shape, speed, size, and light. Their tests show that Mobileye accepts the spoofed signs as genuine. This is important because ADAS rely on camera input for safety alerts and controls, so spoofing could lead to incorrect responses. The setup aims to simulate a realistic attack scenario.","feed_headline":"Drone projector makes Mobileye accept fake traffic signs","feed_subtitle":"Tests on a driving car show the ADAS interprets drone-projected signs as real under varied conditions.","key_machinery":"The drone-carried portable projector that projects spoofed traffic signs onto a moving vehicle to test Mobileye's recognition.","core_discovery":"The experiments demonstrate that it is possible to fool Mobileye so that it interprets the drone carried spoofed traffic sign as a real traffic sign. The attack involves projecting signs using a portable projector carried by a drone onto a driving car, and testing various environmental parameters to assess attack success.","pith_inferences":["This type of attack could potentially be adapted to other camera-based ADAS if similar projection methods are used.","Defenses might involve cross-verifying signs with other sensors like GPS or radar.","The vulnerability highlights risks in relying solely on visual recognition without additional validation."],"forward_implications":["Changes in color, shape, projection speed, diameter, and ambient light affect whether the spoofed sign is accepted.","The attack succeeds in a realistic driving scenario using a drone.","Mobileye can be made to treat projected signs as authentic traffic signs."],"fun_headline_variants":["Drone projector spoofs Mobileye with fake traffic signs","Mobileye misreads drone-projected signs as real","Spoofed signs via drone fool Mobileye in car tests","ADAS camera spoofed by portable drone projector","Drone delivers spoofed signs accepted by Mobileye"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The drone-carried projector setup in a driving scenario accurately represents feasible real-world attack conditions without additional detection mechanisms or environmental interferences affecting the outcome.","fun_headline_variants_meta":{"raw":{"variants":["Drone projector spoofs Mobileye with fake traffic signs","Mobileye misreads drone-projected signs as real","Spoofed signs via drone fool Mobileye in car tests","ADAS camera spoofed by portable drone projector","Drone delivers spoofed signs accepted by Mobileye"]},"model":"grok-4.3","cost_usd":0.004106,"raw_usage":{"total_tokens":2021,"prompt_tokens":542,"num_sources_used":0,"completion_tokens":73,"cost_in_usd_ticks":41062000,"prompt_tokens_details":{"text_tokens":542,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1406,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":542,"tokens_out":73,"duration_ms":10702,"temperature":1.0,"reasoning_tokens":1406,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-25T17:38:53.183415+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A repeated experiment where the projected sign is displayed but Mobileye consistently fails to recognize it as a valid traffic sign or issues no response.","supporting_citations":[],"review_version":1}