Pith. sign in

REVIEW 3 major objections 4 minor 32 references

A trust score with three independent signals can stop coordinated feature-injection attacks on collaborative driving perception.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 03:42 UTC pith:CEEGXGJN

load-bearing objection A concrete multi-signal trust defense that holds up against independent multi-attacker PB attacks in OPV2V, but the paper overclaims generality and understates how well the ROBOSAC baseline does. the 3 major comments →

arxiv 2607.23059 v1 pith:CEEGXGJN submitted 2026-07-25 cs.CR

GLST: Defending Confidence-Driven V2X Collaborative Perception Against Stealthy Multi-Attacker Feature Injection

Ji He , Ying Wang , Lijie Zheng , Xinghui Zhu , Yulong Shen , Xiaohong Jiang This is my paper
classification cs.CR
keywords collaborative perceptionV2X securityadversarial feature injectiontrust modeling3D object detectionsparse communicationmulti-attacker robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that existing defenses against stealthy feature injection in collaborative vehicle perception fail in multi-vehicle compromise scenarios because they rely on a single consistency signal, which several attackers can simultaneously satisfy. It proposes a defense that scores every collaborator three ways — global feature agreement, fine-grained local deviation in perception-critical regions, and structural similarity to the ego vehicle's own semantic layout — and uses the combined score to reweight attention during fusion. On a standard collaborative-driving benchmark, under four simultaneous attackers, the defense keeps detection accuracy near the benign level while a representative pairwise-distance defense collapses. The paper argues that multi-signal trust modeling is essential for confidence-driven sparse communication frameworks.

Core claim

The paper establishes that a stealthy attack that injects small, ostensibly benign perturbations into uncertain yet perception-critical spatial regions is amplified by confidence-driven communication and attention-based fusion, and that single-signal trust defenses are blind to it because several attackers can form a pseudo-consensus in feature space. The proposed defense, GLST, computes three complementary trust scores for each collaborator — a global deviation score, a multi-scale local residual against a consensus center within a critical-region mask, and a cosine structural consistency with the ego feature — and combines them by weighted sum rather than multiplication. These scores are n

What carries the argument

The load-bearing mechanism is the three-branch trust score with weighted-sum fusion. Global branch: each agent's pooled, ℓ2-normalized feature is compared with all others by ℓ1 distance. Local branch: the ego's uncertainty and feature-response maps select a critical-region mask; each agent's feature is compared at multiple scales to a consensus center weighted by global trust, using the mean plus the 90th percentile of residual. Structural branch: each agent's masked and pooled feature is compared with the ego feature by cosine similarity. The three scores are combined by weighted sum (0.30/0.50/0.20) and then renormalize the attention weights in fusion, so no single signal can be gamed at o

Load-bearing premise

All three trust references — the ego's confidence and feature response, the consensus center, and the ego-side semantic topology — are assumed to be clean and benign; if attackers can bias those references or coordinate against the specific branches, the defense can be deceived.

What would settle it

Run the same four-attacker scenario with attackers that are aware of the defense and optimize perturbations to also increase cosine similarity with the ego feature and reduce local residuals; if detection accuracy then falls to the level of single-signal defenses, the multi-signal claim is falsified. A simpler test: alter the ego feature before the structural comparison and see whether trust separation collapses.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the central claim holds, single-signal trust defenses (global distance, pairwise consistency, anomaly scores) should be considered insufficient for collaborative perception when more than one vehicle is compromised; deployments should fuse multiple independent signals.
  • The critical-region mask derived from ego uncertainty and feature strength gives attackers a concrete target; the defense's success suggests that protecting or randomizing the mask computation could further harden the system.
  • Weighted-sum combination avoids the multiplicative over-penalty that would suppress benign agents when one branch is noisy, making the trust score more stable under noisy but honest collaborators.
  • The attack analysis implies confidence-driven sparse communication frameworks must treat the communication selection mechanism as part of the attack surface, not merely as a bandwidth optimization.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper tests independent attackers, not coordinated or defense-aware ones; an attacker who knows the three branches could try to match ego structure and local residuals simultaneously, and whether GLST survives that is an open question.
  • The structural branch uses the ego feature as its reference; if the ego vehicle's own features are noisy or partially compromised, the cosine anchor shifts. A testable extension is to build a robust ego reference, for instance by temporal averaging.
  • Trust is computed per frame; a temporal tracking of trust could suppress attackers that alternate between benign and malicious behavior, an extension the paper leaves implicit.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies the security of confidence-driven sparse collaborative perception. Using Where2comm as the representative framework, it analyzes the Pretend Benign (PB) attack, argues that existing single-signal trust defenses are fragile when multiple attackers create a pseudo-consensus, and proposes GLST, a defense that combines global feature consistency, multi-scale local residual consistency, and ego-referenced structural consistency. The trust scores are used to reweight the attention-based fusion. Experiments on OPV2V report that GLST is competitive with LUCIA under a single attacker and substantially stronger under multiple attackers, e.g., AP@0.5 of 0.79 vs. 0.25 with two PB attackers and 0.67 vs. 0.11 with four PB attackers. An ablation study shows that all three trust branches contribute, and additional experiments with PGD/BIM attacks are provided.

Significance. If these results hold, the paper makes a useful empirical contribution: it identifies a concrete vulnerability of confidence-driven sparse CP and demonstrates that a multi-signal trust model can be effective against multiple simultaneously compromised collaborators. The experimental narrative is internally consistent, and the comparisons in Tables II and III support the main quantitative claims for independent attackers. However, the paper's headline claim about pseudo-consensus robustness is broader than what is actually tested: the threat model in Section III-B explicitly assumes independent rather than coordinated attackers, and no adaptive or GLST-aware attacker is evaluated. Reproducibility is also limited by the absence of code, seeds, or error bars.

major comments (3)
  1. [Section III-B vs. Section V-C (Eq. 22) and Section V-D (Eq. 27)] The paper motivates GLST by the failure of single-signal defenses when attackers 'form a pseudo-consensus' (Introduction, Section II-B, Section V-A), but the experimental threat model explicitly states that the multi-attacker setting assumes independent attackers, not coordinated ones. This distinction matters because the defense's own references are not attack-independent. Eq. (22) constructs the local-residual consensus center from global-trust-weighted collaborator features; if attackers are mutually similar, the center is pulled toward the malicious distribution and local trust can be inverted. Eq. (27) compares each collaborator with an ego-side embedding, yet the threat model grants attackers access to ego-related information such as the ego feature or confidence map. The reported Table II numbers therefore do not instantiate the pseudo-consensus scenario that the paper claims to a
  2. [Section VI, Tables II-III and Fig. 8] The quantitative evidence rests on single runs over one dataset, with no seeds, no confidence intervals, and no code release. The trust-score separation in Fig. 8 (LUCIA: 0.6769 vs. 0.6157; GLST: 0.0232 vs. 0.3165) is presented without any variance information, so it is unclear whether the separation is statistically meaningful. Since the central claim is a robustness comparison, please report multiple seeds or per-frame distributions, or release the evaluation code so the numbers can be independently verified.
  3. [Section VI-C, Table II discussion] The text states that 'existing single-signal defenses degrade severely' in the four-attacker PB scenario, but Table II shows ROBOSAC retains AP@0.5 = 0.50 with four attackers and remains stable across all attacker counts. Thus the sentence is only accurate for LUCIA, not for the set of baselines actually evaluated. The discussion should be rephrased to attribute the collapse specifically to the pairwise-distance-based defense, or a broader set of single-signal baselines should be included.
minor comments (4)
  1. [Abstract and Section IV] The abstract says 'the proposed Pretend Benign attack', but Section IV explicitly states that PB is an existing attack and not proposed in this paper. Please fix this wording to avoid a contribution-claims inconsistency.
  2. [Figures 4, 5 and Tables II, III] In the manuscript text, many figure labels and some table entries appear as hexadecimal escape sequences (e.g., '/uni00000024/...'). This appears to be a rendering or encoding issue and should be corrected in the camera-ready version.
  3. [Section VI-A, Defense Details] MADE [15] is described in Related Work but not evaluated. If MADE is omitted for computational reasons, a one-sentence justification would be helpful. Also, the paper claims GLST is 'lightweight' but reports no runtime, FLOPs, or communication overhead comparison.
  4. [Section V-C, Eq. (24) and hyperparameters] The local residual score uses fixed coefficients 0.7 and 0.3, and the overall trust uses (omega_g=0.30, omega_l=0.50, omega_s=0.20). No sensitivity analysis is provided for these values; please add a short study or a justification, since the ablation in Fig. 9 does not vary these weights.

Circularity Check

0 steps flagged

No significant circularity: GLST is evaluated against independent attack definitions on the external OPV2V benchmark, and no fitted value is renamed as a prediction; the trust-feature feedback is a robustness caveat, not a circular derivation.

full rationale

The paper's central claim is that GLST's combined global, local, and structural trust scores preserve detection accuracy under multi-attacker Pretend Benign and PGD attacks. This claim is tested empirically against independently defined attacks (PB from [12], PGD [17], BIM [30]) on the external OPV2V benchmark [16], so the reported AP numbers are not algebraic consequences of the defense's definitions. No parameter is fitted to the evaluation subset and then called a prediction: the trust weights (omega_g=0.30, omega_l=0.50, omega_s=0.20) are fixed design choices, and the AP metrics are external outcomes. The reference list contains no load-bearing self-citation; Where2comm, PB, ROBOSAC, LUCIA, MADE, and OPV2V are all cited as prior external work. The only internal feedback path is that Eq. (22) builds the local consensus center using the global trust scores, so a biased global trust can propagate into the local residual branch; likewise Eq. (27) compares collaborators to an ego-derived embedding. These are acknowledged robustness limitations of the defense architecture, not derivation-equivalent steps. The paper itself narrows the threat model: 'the multi-attacker setting considered in this paper assumes independent attackers rather than explicitly coordinated attackers' (Sec. III-B), which limits external validity but does not make the evaluation circular. Overall, the derivation is self-contained with respect to its own equations, and the results stand or fall on the external benchmark experiments rather than on definitional identity with the inputs.

Axiom & Free-Parameter Ledger

4 free parameters · 3 axioms · 0 invented entities

No new physical entities or mediators are introduced. The defense rests on standard ML components plus explicit threat-model assumptions about the ego being benign, attackers being independent and bounded, and the consensus center remaining informative. The main unaccounted cost is the set of hand-tuned trust hyperparameters.

free parameters (4)
  • Trust branch weights (ω_g, ω_l, ω_s) = 0.30, 0.50, 0.20
    Hand-set weights in Eq. 29; no sensitivity analysis is reported, and they directly determine the final trust score.
  • Critical-region ratio p = 0.3
    Used in Eq. 21 to select critical spatial regions; chosen by the authors, no ablation on p.
  • Local residual scales S = {1, 4, 8}
    Multi-scale sets in Section VI.A; no ablation on alternative scales.
  • Local and structural sensitivity β_l, β_s = not reported
    Sensitivity constants in Eqs. 25 and 28; values are not given in the paper, making exact reproduction impossible.
axioms (3)
  • domain assumption Benign ego and no manipulation of ego-side confidence/features
    Threat model in Section III-B assumes the ego vehicle is benign; Eq. 21 and Eq. 27 use ego features as the trust reference. If this fails, the structural and critical-region signals are poisoned.
  • domain assumption Attackers are independent and constrained by a bounded ℓp perturbation
    Explicitly stated in Section III-B and used in Section VI. Coordinated or GLST-aware attackers are not considered, which bounds the scope of the multi-attacker claim.
  • domain assumption The consensus center in Eq. 22 is a reliable reference
    For N>3, the consensus center is a global-trust-weighted average of collaborator features. If attackers form a majority or otherwise dominate the weights, this center can shift toward the malicious distribution.

pith-pipeline@v1.3.0-alltime-deepseek · 24641 in / 10864 out tokens · 113345 ms · 2026-08-01T03:42:09.852759+00:00 · methodology

0 comments
read the original abstract

Collaborative perception (CP) improves autonomous-driving perception by enabling connected vehicles to exchange intermediate features via V2X. Confidence-driven sparse communication reduces bandwidth by transmitting only perception-critical spatial regions, but creates a security risk: once a collaborator is compromised, malicious features in high-confidence or ego-uncertain regions may be preferentially selected and amplified during fusion. Using Where2comm as a representative framework, we show that the proposed Pretend Benign attack exploits its spatial-confidence mechanism by injecting stealthy perturbations into uncertain yet perception-critical regions, substantially degrading 3D object detection while preserving benign-like feature characteristics. Beyond this attack-framework pair, we identify a broader weakness of existing trust-based defenses: their reliance primarily on a single consistency signal leaves them vulnerable when multiple attackers form a pseudo-consensus that biases trust estimation. We therefore propose Global-Local Structural Trust (GLST), a lightweight defense that assesses collaborator reliability through three complementary perspectives: global feature consistency, multi-scale local residual consistency, and structural consistency with ego-side semantic topology. The resulting trust scores guide feature fusion to suppress unreliable collaborators. Experiments on OPV2V show that GLST achieves competitive performance against single-attacker Pretend Benign attacks and substantially stronger robustness in multi-attacker settings. Under a four-attacker Pretend Benign attack, GLST maintains 0.69 AP@0.3, whereas existing single-signal defenses degrade severely. GLST also remains effective against gradient-based attacks such as PGD, indicating that multi-level trust modeling is essential for securing confidence-driven CP.

Figures

Figures reproduced from arXiv: 2607.23059 by Ji He, Lijie Zheng, Xiaohong Jiang, Xinghui Zhu, Ying Wang, Yulong Shen.

Figure 1
Figure 1. Figure 1: Illustration of the Confidence-Driven V2X CP framework. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the PB attack against Confidence-Driven CP. PB exploits confidence-aware communication by selecting attack-sensitive regions through [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Overview of the proposed GLST defense framework. GLST estimates collaborator reliability from global feature consistency, critical-region local [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: AP values at 0.3, 0.5, and 0.7 IoU thresholds after applying PGD, [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: 3D detection results of CP systems under PB, PGD, and BIM attacks with different defense methods, including ROBOSAC, LUCIA, and GLST. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Defense performance of ROBOSAC, LUCIA, and GLST against PGD, BIM, and PB attacks under the single-attacker setting. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: Ablation study of the three main components in the proposed GLST. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 2 linked inside Pith

  1. [1]

    3D semantic seg- mentation with submanifold sparse convolutional networks,

    B. Graham, M. Engelcke, and L. Van Der Maaten, “3D semantic seg- mentation with submanifold sparse convolutional networks,” inProceed- ings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9224–9232

    2018

  2. [2]

    CoIn: Contrastive instance feature mining for outdoor 3d object detection with very limited annotations,

    Q. Xia, J. Deng, C. Wen, H. Wu, S. Shi, X. Li, and C. Wang, “CoIn: Contrastive instance feature mining for outdoor 3d object detection with very limited annotations,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 6254–6263

    2023

  3. [3]

    Cooper: Cooperative perception for connected autonomous vehicles based on 3D point clouds,

    Q. Chen, S. Tang, Q. Yang, and S. Fu, “Cooper: Cooperative perception for connected autonomous vehicles based on 3D point clouds,” in2019 IEEE 39th International Conference on distributed computing systems (ICDCS). IEEE, 2019, pp. 514–524

    2019

  4. [4]

    F-cooper: Feature based cooperative perception for autonomous vehicle edge computing system using 3D point clouds,

    Q. Chen, X. Ma, S. Tang, J. Guo, Q. Yang, and S. Fu, “F-cooper: Feature based cooperative perception for autonomous vehicle edge computing system using 3D point clouds,” inProceedings of the 4th ACM/IEEE Symposium on Edge Computing, 2019, pp. 88–100

    2019

  5. [5]

    Cooperative raw sensor data fusion for ground truth generation in autonomous driving,

    E. Ye, P. Spiegel, and M. Althoff, “Cooperative raw sensor data fusion for ground truth generation in autonomous driving,” in2020 IEEE 23rd International Conference on Intelligent Transportation Systems (ITSC). IEEE, 2020, pp. 1–7

    2020

  6. [6]

    Density-aware early fusion for vehicle collaborative perception,

    W. Yang, H. Yu, X. Luo, and S. Xie, “Density-aware early fusion for vehicle collaborative perception,”IEEE Intelligent Transportation Systems Magazine, vol. 17, no. 2, pp. 33–47, 2024

    2024

  7. [7]

    Learning 3D perception from others’ predictions,

    J. Yoo, Z. Feng, T.-Y . Pan, Y . Sun, C. P. Phoo, X. Chen, M. Campbell, K. Weinberger, B. Hariharan, and W.-L. Chao, “Learning 3D perception from others’ predictions,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 82 610–82 630

    2025

  8. [8]

    Core: Coop- erative reconstruction for multi-agent perception,

    B. Wang, L. Zhang, Z. Wang, Y . Zhao, and T. Zhou, “Core: Coop- erative reconstruction for multi-agent perception,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 8710–8720

    2023

  9. [9]

    How2comm: Communication-efficient and collaboration- pragmatic multi-agent perception,

    D. Yang, K. Yang, Y . Wang, J. Liu, Z. Xu, R. Yin, P. Zhai, and L. Zhang, “How2comm: Communication-efficient and collaboration- pragmatic multi-agent perception,”Advances in Neural Information Processing Systems, vol. 36, pp. 25 151–25 164, 2023

    2023

  10. [10]

    Spatio-temporal domain awareness for multi-agent col- laborative perception,

    K. Yang, D. Yang, J. Zhang, M. Li, Y . Liu, J. Liu, H. Wang, P. Sun, and L. Song, “Spatio-temporal domain awareness for multi-agent col- laborative perception,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 23 383–23 392

    2023

  11. [11]

    Where2comm: Communication-efficient collaborative perception via spatial confidence maps,

    Y . Hu, S. Fang, Z. Lei, Y . Zhong, and S. Chen, “Where2comm: Communication-efficient collaborative perception via spatial confidence maps,”Advances in neural information processing systems, vol. 35, pp. 4874–4886, 2022

    2022

  12. [12]

    Pretend benign: A stealthy adversarial attack by exploiting vulnerabilities in cooperative perception,

    H. Lin, D. Pan, Q. Xia, H. Wu, C. Wang, S. Shen, and C. Wen, “Pretend benign: A stealthy adversarial attack by exploiting vulnerabilities in cooperative perception,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 19 947–19 956

    2025

  13. [13]

    Among us: Adversarially robust collaborative perception by consensus,

    Y . Li, Q. Fang, J. Bai, S. Chen, F. Juefei-Xu, and C. Feng, “Among us: Adversarially robust collaborative perception by consensus,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 186–195

    2023

  14. [14]

    From threat to trust: Exploiting at- tention mechanisms for attacks and defenses in cooperative perception,

    C. Wang, R. Muller, R. Song, J.-P. Monteuuis, J. Petit, Y . Man, R. Gerdes, Z. B. Celik, and M. Li, “From threat to trust: Exploiting at- tention mechanisms for attacks and defenses in cooperative perception,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 7387–7406

    2025

  15. [15]

    MADE: Malicious agent detection for robust multi-agent collaborative percep- tion,

    Y . Zhao, Z. Xiang, S. Yin, X. Pang, Y . Wang, and S. Chen, “MADE: Malicious agent detection for robust multi-agent collaborative percep- tion,” in2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2024, pp. 13 817–13 823

    2024

  16. [16]

    OPV2V: An open benchmark dataset and fusion pipeline for perception with vehicle-to- vehicle communication,

    R. Xu, H. Xiang, X. Xia, X. Han, J. Li, and J. Ma, “OPV2V: An open benchmark dataset and fusion pipeline for perception with vehicle-to- vehicle communication,” in2022 International Conference on Robotics and Automation (ICRA). IEEE, 2022, pp. 2583–2589

    2022

  17. [17]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    Pith/arXiv arXiv 2017

  18. [18]

    Adversarial examples for semantic segmentation and object detection,

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” inProceed- ings of the IEEE international conference on computer vision, 2017, pp. 1369–1378

    2017

  19. [19]

    Naturalistic physical adversarial patch for object detectors,

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.- H. Cheng, “Naturalistic physical adversarial patch for object detectors,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7848–7857

    2021

  20. [20]

    Exploring the vulnerability of single shot module in object detectors via imperceptible background patches,

    Y . Li, X. Bian, M.-C. Chang, and S. Lyu, “Exploring the vulnerability of single shot module in object detectors via imperceptible background patches,”arXiv preprint arXiv:1809.05966, 2018

    Pith/arXiv arXiv 2018

  21. [21]

    When2com: Multi-agent perception via communication graph grouping,

    Y .-C. Liu, J. Tian, N. Glaser, and Z. Kira, “When2com: Multi-agent perception via communication graph grouping,” inProceedings of the IEEE/CVF Conference on computer vision and pattern recognition, 2020, pp. 4106–4115

    2020

  22. [22]

    V2X-ViT: Vehicle-to-everything cooperative perception with vision transformer,

    R. Xu, H. Xiang, Z. Tu, X. Xia, M.-H. Yang, and J. Ma, “V2X-ViT: Vehicle-to-everything cooperative perception with vision transformer,” inEuropean conference on computer vision. Springer, 2022, pp. 107– 124

    2022

  23. [23]

    Adversarial attacks on multi-agent communication,

    J. Tu, T. Wang, J. Wang, S. Manivasagam, M. Ren, and R. Urtasun, “Adversarial attacks on multi-agent communication,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7768–7777

    2021

  24. [24]

    AdvGPS: Adversarial GPS for multi-agent perception attack,

    J. Li, B. Li, X. Liu, J. Fang, F. Juefei-Xu, Q. Guo, and H. Yu, “AdvGPS: Adversarial GPS for multi-agent perception attack,” in2024 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2024, pp. 18 421–18 427

    2024

  25. [25]

    On data fabrication in collaborative vehicular perception: Attacks and countermeasures,

    Q. Zhang, S. Jin, R. Zhu, J. Sun, X. Zhang, Q. A. Chen, and Z. M. Mao, “On data fabrication in collaborative vehicular perception: Attacks and countermeasures,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 6309–6326

    2024

  26. [26]

    Commonsense prototype for outdoor unsupervised 3D object detection,

    H. Wu, S. Zhao, X. Huang, C. Wen, X. Li, and C. Wang, “Commonsense prototype for outdoor unsupervised 3D object detection,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2024, pp. 14 968–14 977

    2024

  27. [27]

    PointPillars: Fast encoders for object detection from point clouds,

    A. H. Lang, S. V ora, H. Caesar, L. Zhou, J. Yang, and O. Beijbom, “PointPillars: Fast encoders for object detection from point clouds,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 12 697–12 705

    2019

  28. [28]

    SECOND: Sparsely embedded convolutional detection,

    Y . Yan, Y . Mao, and B. Li, “SECOND: Sparsely embedded convolutional detection,”Sensors, vol. 18, no. 10, p. 3337, 2018

    2018

  29. [29]

    A generic framework for byzantine-tolerant consensus achievement in robot swarms,

    H. Zhao, A. Pacheco, V . Strobel, A. Reina, X. Liu, G. Dudek, and M. Dorigo, “A generic framework for byzantine-tolerant consensus achievement in robot swarms,” in2023 IEEE/RSJ International Con- ference on Intelligent Robots and Systems (IROS). IEEE, 2023, pp. 8839–8846

    2023

  30. [30]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” inArtificial intelligence safety and security. Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  31. [31]

    OpenCDA: an open cooperative driving automation framework integrated with co-simulation,

    R. Xu, Y . Guo, X. Han, X. Xia, H. Xiang, and J. Ma, “OpenCDA: an open cooperative driving automation framework integrated with co-simulation,” in2021 IEEE International Intelligent Transportation Systems Conference (ITSC). IEEE, 2021, pp. 1155–1162

    2021

  32. [32]

    CARLA: An open urban driving simulator,

    A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “CARLA: An open urban driving simulator,” inConference on robot learning. PMLR, 2017, pp. 1–16

    2017