{"id":"519a3906-1c06-46a8-b8db-9c1303109676","arxiv_id":"2412.12000","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A collaborative perception defense that uses recursive group consensus checks and a consistency loss to filter malicious agents, without needing prior attack probabilities.","lead":"The paper proposes CP-Guard, a defense that detects malicious vehicles in collaborative perception by checking whether fused outputs agree with the ego vehicle's own view. It reports near-upper-bound segmentation accuracy under three attack types on a synthetic driving dataset.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1's singleton base case inverts the CCLoss verdict: it adds low-CCLoss (malicious) agents to the benign set and drops benign singletons, so the printed defense is internally contradictory.","rationale":"The central claim is that CP-Guard detects and eliminates malicious agents and restores near-upper-bound mIoU. For that claim to hold, Algorithm 1's base case must classify a singleton consistently with the verification rule. It does not: Eq. (5) says LCCLoss <= epsilon indicates a malicious agent, but line 8 of Algorithm 1 adds exactly such singletons to the benign set and drops benign singletons. If the released code mirrors the pseudocode, PASAC would not merely fail to detect attacks; it would invert detection. This is more fundamental than the non-dilution assumption the reader highlighted: even with perfect non-dilution, the wrong base-case polarity breaks the recursion. The reader listed this as condition (1), so we partially agree, though their stated weakest_assumption is the non-dilution issue. The paper provides a public code repository, but the text alone is unreproducible. A single code inspection and two controlled runs settle whether this is a typographical error or a conceptual flaw. I keep the reader's CONDITIONAL verdict rather than moving to REJECT because the pseudocode could be a simple typo and the code is available; if the code confirms the inverted polarity, the paper should be rejected or majorly revised.","tokens_in":12756,"tokens_out":6823,"duration_ms":64082,"concrete_test":"Inspect the released code's PASAC base case and run a controlled V2X-Sim experiment with two scenarios: ego plus one benign collaborator, and ego plus one malicious collaborator. Using the printed Algorithm 1, the benign singleton should be excluded (CCLoss > epsilon) and the malicious singleton included (CCLoss <= epsilon). If the implementation instead uses the inverted condition (> instead of <=) at the base case, rerun the full experiment and report per-agent detection plus Table 1 mIoU with the corrected condition. This single test settles whether the bug is typographical or conceptual.","verdict_should_be":"UNCHANGED","load_bearing_attack":"CCLoss is defined as a similarity measure: Eq. (4) yields values near 1 for similar BEV maps and near 0 for different maps, and Eq. (5) uses LCCLoss <= epsilon to flag a malicious agent. Algorithm 1 is consistent with this in its recursive branches: a group with LCCLoss <= epsilon is split further, while a group with LCCLoss > epsilon is added wholesale to the benign set. The singleton base case (Algorithm 1, lines 6-10) is inverted: line 8 executes {Bi} <- {Bi} union Fk when LCCLoss(Y0, Yk) <= epsilon. That is exactly the condition under which Eq. (5) labels the agent malicious, and benign singletons (LCCLoss > epsilon) are never added. Thus, if the code follows the published pseudocode, PASAC systematically keeps malicious agents and discards benign collaborators, which is the opposite of the claimed detection and elimination. The reported mIoU values in Table 1 cannot be produced by this algorithm; the central claim is unsupported until the base case is corrected and verified. This is an internal inconsistency, not a disagreement with consensus.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CP-Guard, a defense for collaborative BEV perception against malicious agents that transmit adversarially perturbed intermediate feature maps. The method combines PASAC, a recursive divide-and-conquer sampling procedure that splits collaborator groups and decides whether each group contains a malicious agent, with CCLoss, a similarity measure between the ego vehicle's BEV segmentation and the fused segmentation of a group. If CCLoss is below a threshold, the group is treated as containing malicious agents and is split further; otherwise the whole group is accepted as benign. Experiments on V2X-Sim with FGSM, C&W, and PGD attacks report mIoU values close to the upper bound and lower verification counts than the prior ROBOSAC method.","tokens_in":12993,"tokens_out":4126,"duration_ms":34724,"significance":"If the method works as described, it offers a lightweight, probability-agnostic consensus filter for collaborative perception, which would be a practical improvement over approaches that require prior malicious-agent probabilities or per-agent checks. The paper also provides a useful angle by treating the consensus problem as recursive verification rather than individual inspection. However, the reported results currently rest on a pseudocode base case that contradicts the stated verification rule, and the threshold is tuned on the evaluation data, so the experimental claims are not yet credible as presented.","major_comments":[{"comment":"The singleton base case inverts the verification rule stated in Eq. (5) and in the surrounding text. Eq. (5) defines LCCLoss(Y0,Yk) ≤ ε as evidence that a malicious agent is present, and the recursive branches (lines 16–27) follow this rule by splitting low-CCLoss groups and accepting high-CCLoss groups. In the base case, however, line 8 adds Fk to the benign set exactly when LCCLoss(Y0,Yk) ≤ ε, and benign singletons (LCCLoss > ε) are never added. As written, PASAC therefore retains malicious agents and discards benign ones, so the mIoU values in Table 1 cannot be produced by this algorithm. The pseudocode must be corrected (for example, by reversing the condition) and the experimental pipeline must be re-run or re-verified.","section":"Algorithm 1, lines 6–11"},{"comment":"The threshold ε = 0.08 is selected by sweeping against PGD attack on what appears to be the same evaluation split used for the main results in Table 1. This constitutes test-set tuning for PGD, and the same threshold is then applied to FGSM and C&W in Table 1, so the claimed generalization has a circular component. The authors should select ε on a separate validation split and report detection rates, false-positive rates, and variance (for example, multiple runs or confidence intervals) for the reported mIoU values.","section":"Ablation Studies, Table 2"},{"comment":"The recursive splitting assumes that any group containing a malicious agent will produce LCCLoss(Y0,YG) ≤ ε no matter how many benign agents are in the group. If a single malicious feature is diluted by many benign features, the group may pass the consensus test and the malicious agent will be absorbed into the benign set. This non-dilution assumption is load-bearing for PASAC's correctness, but it is neither proved nor tested across group sizes. The paper should provide empirical or theoretical evidence for this assumption, or explicitly state it as a limitation.","section":"Probability-Agnostic Sample Consensus, Algorithm 1"},{"comment":"The 'Verification Count' metric is not precisely defined: it is unclear whether it counts group-level evaluations, feature-map fusion operations, or individual agent checks. The paper also reports no detection accuracy or false-positive rate for the sampled subsets, so the claim that PASAC 'accurately detects and eliminates' malicious agents is not quantitatively supported. Please define the metric and add detection/false-positive statistics alongside verification counts.","section":"Evaluation of PASAC, Fig. 2 and Table 3"}],"minor_comments":[{"comment":"The definition of w_j is ambiguous: as printed, the index i in p0_{i,j} and pfuse_{i,j} is not bound within the weight formula, and the denominator lacks explicit parentheses. Please rewrite the equation with clear indexing and grouping.","section":"Eq. (4)"},{"comment":"The 'Upper-bound' and 'Lower-bound' rows are not defined in the text; please state which configurations they correspond to (for example, all-benign and ego-only settings).","section":"Table 1"},{"comment":"The procedure uses {Bi} as if it were a global variable that is not initialized; please specify its initialization and scope explicitly.","section":"Algorithm 1"},{"comment":"The text says the collaborators are 'randomly split' into two groups, but the pseudocode does not include any randomization; please clarify the splitting procedure in the pseudocode.","section":"Algorithm 1"},{"comment":"The notation 'CA Vs' and 'CAV' is used inconsistently; please standardize the terminology.","section":"Throughout"},{"comment":"The code repository link is given, but no code archive, configuration file, or reproducibility checklist is included; please provide the code or a detailed experimental configuration in a supplementary document.","section":"Reproducibility"}],"recommendation":"major_revision","confidential_remarks":"The base-case inversion in Algorithm 1 is likely a typographical error, but as published it invalidates the central evaluation. The threshold-tuning issue and the absence of detection-rate metrics are substantive methodological weaknesses. If the pseudocode is corrected, the experiments re-run, and the evaluation protocol tightened, the paper could become viable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper has a real target and a sensible high-level idea, but the published pseudocode is internally contradictory, and the contradiction sits at the load-bearing point. As printed, Algorithm 1's singleton base case adds an agent to the benign set exactly when Eq. (5) labels it malicious, and never adds a benign singleton. So the stated defense would keep malicious agents and discard benign ones; the mIoU numbers in Table 1 cannot come from this algorithm. This is not a missing ablation or a style issue; it is an inversion of the verification rule.\n\nWhat is genuinely new: PASAC replaces ROBOSAC's random sampling with deterministic binary splitting and drops the need for attacker priors. That is modest but useful. CCLoss is a reasonable weighted-overlap similarity measure. The experimental setup is standard (V2X-Sim, U-Net, V2VNet, FGSM/C&W/PGD), the comparison to ROBOSAC is relevant, and code is available. If the reported mIoU was produced by a corrected version of the algorithm, it would be a meaningful robustness gain.\n\nSoft spots beyond the base-case bug: the CCLoss threshold is tuned on the same test split (Table 2) rather than a held-out set; no detection precision/recall or false-positive/negative rates are reported, only mIoU; adaptive attackers who know the defense are not discussed; and the non-dilution assumption (a group with one malicious agent among many benign ones still fails the consensus test) is asserted rather than argued. The ROBOSAC comparison also looks odd at attack ratios above 0.5, where a majority-malicious group may pass the test, though the reported numbers suggest PASAC still held up under the tested settings.\n\nWho is this for: people working on robustness of collaborative perception or multi-agent consensus filtering. They would want to read a corrected version, not this one as is. If the authors fix the pseudocode, add detection rates, and move threshold selection to a validation set, the paper could be a solid conference contribution. As it stands, it should not be accepted without major revision.\n\nRecommendation: send it to peer review with the expectation of heavy revision, and make sure reviewers check the shipped code against the algorithm.","headline":"The defense idea is plausible and the ROBOSAC comparison is useful, but Algorithm 1 as printed inverts its own detection rule, so the central results are unsupported until that is fixed.","tokens_in":13504,"tokens_out":3954,"would_cite":false,"duration_ms":33300,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A vehicle can detect malicious collaborators by checking whether fused perception agrees with its own view.","keywords":["collaborative perception","adversarial defense","malicious agent detection","BEV segmentation","sample consensus","consensus verification","autonomous driving","adversarial attacks"],"falsifier":"Run PASAC on a group of 15 benign agents plus one adversarially perturbed agent with the perturbation size held at delta = 0.1, and record whether the group-level CCLoss stays above the epsilon = 0.08 threshold; if it does, the malicious agent is added to the benign set and the defense silently fails. Equivalently, optimize the perturbation to maximize segmentation loss while also maximizing CCLoss(Y0, Yfuse), and check whether a group containing only that malicious agent passes the consensus test.","tokens_in":12572,"feed_emoji":"🚗","tokens_out":6465,"duration_ms":53419,"temperature":0.7,"pith_summary":"Collaborative driving lets vehicles share perception features, but a malicious participant can corrupt the fused bird's-eye-view map. This paper tries to show that a vehicle can detect and remove such agents by checking whether fused results agree with its own single-vehicle view, using a recursive consensus test that needs no assumption about how many agents are malicious. CP-Guard splits collaborators into groups, fuses each group, and only trusts groups whose outputs are sufficiently similar to the ego vehicle's own segmentation. The reported experiments indicate that under FGSM, PGD, and C&W attacks the defense restores mean IoU to near the no-attack upper bound, while undefended perception collapses.","feed_headline":"Consensus checks restore attacked driving perception near its peak","feed_subtitle":"Malicious vehicles are found by recursive group splitting; BEV segmentation mIoU climbs from 21.6 to 39.3 under FGSM.","key_machinery":"The load-bearing mechanism is the combination of collaborative consistency loss (CCLoss) and probability-agnostic sample consensus (PASAC). CCLoss is a class-weighted overlap between the ego vehicle's own BEV segmentation map and the map produced after fusing a group of collaborators' features; values near 1 mean agreement, values near 0 mean conflict, and a threshold epsilon (set to 0.08 in experiments) decides whether a group is suspected of containing a malicious agent. PASAC recursively splits any suspected group in half, accepts a half wholesale once it passes the consensus test, and keeps splitting until all agents are classified or enough benign agents are collected. The mechanism's efficiency comes from accepting large benign groups without checking each agent, and its correctness depends on every group containing a malicious agent having a detectably low CCLoss.","core_discovery":"The central claim is that consensus with the ego vehicle's own perception is enough to identify malicious collaborators in intermediate-feature collaborative perception. The framework computes a collaborative consistency loss (CCLoss) between the ego-only BEV segmentation and the segmentation produced after fusing a group's features; a group whose loss falls below a threshold is treated as containing a malicious agent and is recursively split, while a group whose loss stays above the threshold is accepted wholesale as benign. This makes the defense probability-agnostic: it never needs the fraction of malicious agents. On the V2X-Sim dataset, CP-Guard achieves mIoU 39.30 against FGSM, 39.34 against PGD, and 37.95 against C&W, compared with an upper bound of 40.45 and undefended scores as low as 14.34.","pith_inferences":["An adaptive attacker who optimizes perturbations to keep group-level CCLoss above epsilon, rather than only maximizing segmentation loss, could plausibly bypass PASAC; this is a testable extension the paper does not consider.","The same consensus principle could be transferred to object-level fusion for 3D detection, replacing CCLoss with box-level agreement metrics such as IoU, though calibration would differ.","The threshold may need to adapt to scene difficulty, since the ego-only segmentation itself varies in quality, and a fixed epsilon that works on V2X-Sim may not transfer to other datasets or weather conditions.","Recursive group acceptance assumes failures are detectable at every group size; this non-dilution property deserves explicit measurement in future work."],"forward_implications":["Each connected vehicle can run CP-Guard locally, so the defense adds no training-time burden and does not need to know the attack type in advance.","Because PASAC accepts whole groups that pass the consensus test, verification cost grows far more slowly than checking agents one by one, scaling to large collaboration sets.","The threshold epsilon controls a false-positive/false-negative trade-off: too small and benign collaborators are distrusted, too large and malicious agents pass as benign.","The C&W result is the weakest of the three, indicating that stronger, fine-grained attacks narrow the gap between defended and upper-bound performance.","If an attacker can make a malicious group's fused output agree with the ego view, the defense's consensus test is the single point of failure."],"supporting_citations":[{"why":"Presents ROBOSAC, the prior consensus-sampling defense that CP-Guard compares against and whose need for malicious-agent priors PASAC removes.","marker":"Li et al. 2023"},{"why":"Establishes the adversarial multi-agent communication attack setting that CP-Guard defends against.","marker":"Tu et al. 2021"},{"why":"Supplies the FGSM attack used in the evaluation.","marker":"Goodfellow, Shlens, and Szegedy 2015"},{"why":"Supplies the C&W attack used in the evaluation.","marker":"Carlini and Wagner 2017"},{"why":"Supplies the PGD attack used in the evaluation.","marker":"Madry et al. 2018"},{"why":"Provides the V2X-Sim collaborative perception dataset used for all experiments.","marker":"Li et al. 2022"},{"why":"Provides the V2VNet fusion architecture on which the collaborative BEV model is built.","marker":"Wang et al. 2020"},{"why":"Provides the U-Net backbone used for BEV segmentation.","marker":"Ronneberger, Fischer, and Brox 2015"}],"fun_headline_variants":["Consensus checks spot malicious agents in collaborative driving perception","Consensus-based defense lifts attacked BEV perception near peak","Agnostic consensus finds malicious collaborators in driving perception","Consensus verification restores collaborative perception after attacks","Building consensus to defeat malicious agents in shared driving perception"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that any group containing a malicious agent will still look sufficiently different from the ego vehicle's own view to fail the consensus test, even when the malicious agent's feature is diluted by many benign agents in that group.","fun_headline_variants_meta":{"raw":{"variants":["Consensus checks spot malicious agents in collaborative driving perception","Consensus-based defense lifts attacked BEV perception near peak","Agnostic consensus finds malicious collaborators in driving perception","Consensus verification restores collaborative perception after attacks","Building consensus to defeat malicious agents in shared driving perception"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000515,"raw_usage":{"total_tokens":2513,"prompt_tokens":972,"completion_tokens":1541,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":588,"completion_tokens_details":{"reasoning_tokens":1465}},"tokens_in":588,"tokens_out":1541,"duration_ms":12522,"temperature":1.0,"reasoning_tokens":1465,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:22:22.252046+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PASAC on a group of 15 benign agents plus one adversarially perturbed agent with the perturbation size held at delta = 0.1, and record whether the group-level CCLoss stays above the epsilon = 0.08 threshold; if it does, the malicious agent is added to the benign set and the defense silently fails. Equivalently, optimize the perturbation to maximize segmentation loss while also maximizing CCLoss(Y0, Yfuse), and check whether a group containing only that malicious agent passes the consensus test.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the V2VNet fusion architecture on which the collaborative BEV model is built."}],"review_version":1}