Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Rainbow Artifacts from Electromagnetic Signal Injection Attacks on Image Sensors

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read At 84.68 MHz, injected radio signals imprint rainbow bands on CMOS images and degrade object detection.

desk verdict A small experimental paper with one genuinely new observation—rainbow bands on a CMOS sensor under tuned AM injection—but the missing control conditions and single-run detector numbers mean the impact claims are provisional. read the letter →

arxiv 2507.07773 v1 pith:GIKHIVNY submitted 2025-07-10 cs.CR cs.CV

Youqian Zhang , Xinyu Ji , Zhihao Wang , Qinhong Jiang This is my paper
classification cs.CRcs.CV
keywords electromagneticsignalinjectionCMOSimagesensorrainbowartifactanalog-domainattackobjectdetectionMIPICSI-2interferencephysical-layeradversarial
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that an adversary can use a carefully tuned electromagnetic signal to impress semi-transparent rainbow-colored bands onto images captured by a CMOS image sensor, directly in the analog domain before digitization. The effect appears reproducibly at an 84.68 MHz carrier with the baseband swept from 26.16 to 46.16 kHz, and the baseband frequency controls how dense or sparse the bands are. The authors further show that these bands survive the image signal processing pipeline and lower precision, recall, and mean average precision across six object detectors, including YOLO variants, Faster R-CNN, and DETR. If true, this is a physical-layer attack that can corrupt visual evidence for safety-critical perception without leaving digital-integrity traces.

What carries the argument

The mechanism is intentional electromagnetic coupling into the MIPI CSI-2 link, the standard serial interface between a CMOS image sensor and its host processor, which acts as an unintentional antenna. The attack sends an amplitude-modulated continuous wave through a 3-watt RF amplifier and an omnidirectional antenna placed about five centimeters from the cable; when the carrier lands on 84.68 MHz, the injected signal is superimposed on the analog pixel data before digitization. The baseband frequency is the control knob: raising it from 26.16 to 46.16 kHz widens the spacing between rainbow bands, while lowering it packs them together, indicating that modulation dynamics interact with the sensor's readout timing.

What would settle it

Repeat the same capture with the 84.68 MHz carrier and 26.16-46.16 kHz baseband but turn the RF amplifier off, or shift the carrier to 83.68 MHz while keeping the baseband unchanged; if the rainbow bands still appear, the central causal claim fails, and if they vanish, the injection account is supported.

Watch

Extended reading notes

Core claim

The central claim is that electromagnetic signal injection can do more than disrupt CMOS image transmission: under a narrow set of parameters, it can paint a controllable rainbow pattern directly into the captured frame. With the carrier fixed at 84.68 MHz and the baseband swept between 26.16 and 46.16 kHz, the OV5647, a common five-megapixel CMOS sensor, records semi-transparent red, green, and blue bands over the scene without losing packets, which distinguishes this effect from the purple-stripe artifacts reported in earlier CMOS attacks and implies control over pixel colors rather than just data loss. The paper argues that these artifacts therefore arise in the analog pixel readout stage, propagate through the image signal processing pipeline, and are sufficient to make modern object detectors mispredict, for example dropping detections of cars in traffic scenes.

Load-bearing premise

The result stands on the claim that the rainbow bands are actually caused by the injected radio signal coupling into the camera's analog link, rather than by some other periodic source in the test setup; the paper reports the effect at a single carrier and baseband window without a detuned-carrier or emitter-off control to rule out that alternative.

Editorial extensions

If this is right

  • A nearby attacker can imprint structured color bands on CMOS images without triggering digital integrity checks, because the corruption happens in the analog domain before digitization.
  • One-stage, two-stage, and transformer-based object detectors all lose recall and mean average precision, so the degradation is not limited to a single detector family.
  • The baseband frequency tunes how dense or sparse the bands appear, giving the attack a continuous parameter for balancing visibility against scene coverage.
  • In traffic scenes, the induced mispredictions can hide real vehicles, which matters for any autonomous or assisted-driving perception built on such detectors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • As an extension beyond the paper, the exact 84.68 MHz carrier is probably specific to this rig: cable length, shielding, and board layout shift the resonant coupling frequency, so other camera hardware would need its own frequency sweep.
  • As an extension beyond the paper, if the band spacing tracks the sensor's row-readout clock, an attacker could in principle synthesize more arbitrary spatial patterns by suitably modulating the baseband, though the paper does not derive that mapping.
  • As an extension beyond the paper, a carrier-frequency sweep around 84.68 MHz with baseband and power held fixed would test the resonance story: the rainbow bands should appear only near resonance and vanish as the carrier detunes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper claims to uncover a previously undocumented rainbow-like color artifact on CMOS image sensors induced by electromagnetic signal injection. It describes an experiment using a Raspberry Pi with an OV5647 sensor, a signal generator and amplifier, and a 4K display. The artifact appears at a carrier frequency of 84.68 MHz with a baseband sweep of 26.16–46.16 kHz. The paper further evaluates six object detectors on 93 scenes and reports degradation in precision, recall, and mAP under attack.

Significance. If the rainbow artifact is genuinely caused by EM injection, it extends prior EM attacks (which produced purple stripes on CMOS) to a distinct, frequency-tunable colored-band effect, and the observed detector degradation would have security implications for vision-based systems. The experimental setup is clearly described and the frequency-dependent band spacing is a testable observation. However, the evidence is incomplete: no control conditions rule out non-EM causes, only a single hardware rig is used, and the impact results lack error bars. The central causal claim therefore needs additional verification before the contribution is established.

major comments (4)
  1. [Section III.B] The paper reports the rainbow artifact only under one carrier frequency (84.68 MHz) and baseband sweep (26.16–46.16 kHz), with no control conditions such as amplifier off, carrier detuned, antenna relocated, display refresh changed, or a second sensor unit. Because the OV5647 captures a 4K monitor with a rolling shutter, periodic color bands could also arise from beat frequencies between the sensor readout clock and display timing, or from periodic content in the displayed scene, without EM injection. The baseband-dependent band spacing is consistent with EM coupling but also with a timing-beat explanation. Since the paper in Section V leaves the root-cause mechanism to future work, the causal attribution is not yet demonstrated. This is load-bearing: if the bands appear without injection, the reusable-attack claim and the downstream impact numbers lose their foundation.
  2. [Section IV.C / Table I] The impact evaluation reports single-run point estimates with no error bars, confidence intervals, or significance tests. With only 93 scenes from one hardware rig, these numbers are fragile; note that yolo8n precision increases from 0.736 to 0.810 under attack, opposite the general degradation trend, suggesting run-to-run variability. Multiple independent runs per condition and reporting variance (or per-image bootstraps) are needed to substantiate the claim of 'significant mispredictions.' The absence of released data or code also prevents independent verification.
  3. [Section IV.A] The ground-truth annotations for the 93 scenes are described only as 'manual annotation,' with no protocol, number of annotators, inter-annotator agreement, or validation. Since all detector metrics are computed against these labels, incorrect or inconsistent annotations could bias the reported attack impact. Please specify the annotation procedure and provide quality metrics (e.g., agreement on a subset, or comparison with an automatic baseline).
  4. [Section III.B] The paper states that this attack 'differs from the previous one that caused purple stripes in that it does not result in packet loss' and that 'it is highly likely that the attack signal directly affects the pixels of the image sensor.' No evidence is presented for the absence of packet loss under rainbow conditions, nor for the direct pixel effect versus an effect on the MIPI transmission or ISP. Because the novelty claim depends on distinguishing this artifact from prior purple-stripe attacks, this distinction should be demonstrated with appropriate measurements (e.g., inspecting raw sensor frames before ISP, or monitoring MIPI errors).
minor comments (4)
  1. [Figure 1 caption] The caption states that the attack effects (b) and (c) are 'synthesized to illustrate their visual impacts,' which conflicts with the paper's later claim that the rainbow artifact is a real captured effect. Clarify that only (b) and (c) are synthetic; Figure 3 shows real captures.
  2. [Section III.A] The baseband range is described as '0 kHz to 50 kHz' but the observed phenomenon occurs at 26.16–46.16 kHz. Clarify whether the sweep covered the full range and the new artifact only in the reported band.
  3. [References] Reference [4] (Magcode) appears unrelated to image sensor attacks; carefully check the citation context.
  4. [Section IV.B] The notation 'mAP@0.5:0.95' is correct, but ensure it is used consistently in the text and Table I; also consider defining 'mAP' explicitly at first use.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the rainbow artifact is a fresh empirical measurement and the detection-impact results are independent benchmarks, not derived from fitted inputs or self-citation.

full rationale

The paper's central claims are empirical: a rainbow-like color artifact appears when a carrier at 84.68 MHz and a 26.16-46.16 kHz baseband are injected via the MIPI cable, and six object detectors degrade under this condition (Table I). There is no derivation chain in which a quantity is defined in terms of the quantity it is claimed to predict. No parameter is fitted to a subset of images and then reported as a prediction; the artifact and the detection metrics are directly measured outcomes. The paper's citations to the authors' prior work (refs [5]-[8], [14]) supply background about purple-stripe artifacts, the difficulty of CMOS pixel-level control, and power-coupling effects. These are contextual claims, not load-bearing premises that force the rainbow result; the new phenomenon is presented as distinct from, and observed in addition to, the earlier purple-stripe effect. The conclusion that 'the attack signal directly affects the pixels of the image sensor' is a causal interpretation of the observation, and the lack of explicit control conditions (e.g., carrier detuned or amplifier off) is a validity/causal-isolation concern, not a circularity. Because no step reduces to its own input by construction or via self-citation, the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper is empirical, so the ledger records hand-tuned operating parameters and domain assumptions rather than derived constants. The two frequency parameters are found by sweep, and the causal attribution, annotation validity, and sensor representativeness are unproven premises that support the generalized claims.

free parameters (3)
  • carrier_frequency = 84.68 MHz
    Hand-tuned operating point reported in Section III.B; the rainbow artifact appeared only at this carrier within the 20 to 160 MHz sweep.
  • baseband_frequency_range = 26.16 to 46.16 kHz
    Chosen sweep range in Section III.B; the value controls band density, so the artifact's structure depends on this chosen operating window.
  • antenna_distance_and_power = 5 cm distance; 3 W amplifier
    Operational choices from Section III.A; coupling efficiency and hence artifact presence depend on these, but they are not systematically varied or justified.
assumptions (4)
  • domain assumption Conductors such as the MIPI cable act as unintentional antennas that couple injected RF into the sensor signal path.
    Invoked in Section II.A with refs [9], [10] and used for the setup in Section III.A; standard EMC physics, but the coupling path is not directly measured.
  • domain assumption The observed rainbow bands are caused by the injected signal rather than by another rig component.
    Section III.B asserts the effect without reporting a control condition (e.g., detuned carrier or amplifier off), so causal attribution is an unverified premise.
  • domain assumption Manual annotations of the 93 scenes are correct ground truth for scoring detectors.
    Section IV.A describes manual annotation for six object classes with no inter-annotator agreement check or verification protocol.
  • domain assumption The OV5647 setup is representative of CMOS image sensors for the paper's generalization.
    The title and abstract generalize to CMOS sensors, while Section III.A tests a single sensor instance and cable layout.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rainbow Artifacts from Electromagnetic Signal Injection Attacks on Image Sensors." pith.science (2026). https://pith.science/paper/GIKHIVNY

@misc{pith2026250707773,
  author       = {Pith},
  title        = {Pith review of: Rainbow Artifacts from Electromagnetic Signal Injection Attacks on Image Sensors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GIKHIVNY}},
  note         = {Machine review of arXiv:2507.07773}
}
read the original abstract

Image sensors are integral to a wide range of safety- and security-critical systems, including surveillance infrastructure, autonomous vehicles, and industrial automation. These systems rely on the integrity of visual data to make decisions. In this work, we investigate a novel class of electromagnetic signal injection attacks that target the analog domain of image sensors, allowing adversaries to manipulate raw visual inputs without triggering conventional digital integrity checks. We uncover a previously undocumented attack phenomenon on CMOS image sensors: rainbow-like color artifacts induced in images captured by image sensors through carefully tuned electromagnetic interference. We further evaluate the impact of these attacks on state-of-the-art object detection models, showing that the injected artifacts propagate through the image signal processing pipeline and lead to significant mispredictions. Our findings highlight a critical and underexplored vulnerability in the visual perception stack, highlighting the need for more robust defenses against physical-layer attacks in such systems.

Figures

Figures reproduced from arXiv: 2507.07773 by the authors.

Figure 1
Figure 1. Comparison of the existing electromagnetic signal [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Experimental setup for electromagnetic signal injection. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. The effects of electromagnetic signal injection attacks [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Intentional Electromagnetic Interference Attacks on Facial Recognition

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Radio-frequency interference injected into a phone camera makes several face-recognition models fail to match or misidentify faces, while ArcFace-trained models remain unaffected.

Reference graph

Works this paper leans on

21 extracted references · 17 canonical work pages · cited by 1 Pith paper

  1. [1]

    Signal Injection Attacks against CCD Image Sensors,

    S. K ¨ohler, R. Baker, and I. Martinovic, “Signal Injection Attacks against CCD Image Sensors,” in Proc. 2022 ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022) , ACM, 2022

    work page 2022

  2. [2]

    MagShadow: Physical Adversarial Example Attacks via Electromagnetic Injection,

    Z. Liu, F. Lin, Z. Ba, L. Lu, and K. Ren, “MagShadow: Physical Adversarial Example Attacks via Electromagnetic Injection,” IEEE Transactions on Dependable and Secure Computing , 2025

    work page 2025

  3. [3]

    GhostShot: Manipulating the Image of CCD Cameras with Electromagnetic Interference,

    Y . Ren, Q. Jiang, C. Yan, X. Ji, and W. Xu, “GhostShot: Manipulating the Image of CCD Cameras with Electromagnetic Interference,” in NDSS, 2025

    work page 2025

  4. [4]

    Magcode: NFC-enabled Barcodes for NFC-disabled Smartphones,

    D. Dai, Z. An, Q. Pan, and L. Yang, “Magcode: NFC-enabled Barcodes for NFC-disabled Smartphones,” in Proceedings of the 29th Annual International Conference on Mobile Computing and Networking , pp. 1– 14, 2023

    work page 2023

  5. [5]

    GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI,

    Q. Jiang, X. Ji, C. Yan, Z. Xie, H. Lou, and W. Xu, “GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI,” in The 32nd USENIX Security Symposium , 2023

    work page 2023

  6. [6]

    Understanding Impacts of Electromagnetic Signal Injection Attacks on Object Detection,

    Y . Zhang, C. Yang, Y . Fu, Q. Jiang, C. Yan, S.-Y . Chau, G. Ngai, H.-v. Leong, X. Luo, and W. Xu, “Understanding Impacts of Electromagnetic Signal Injection Attacks on Object Detection,” in IEEE International Conference on Multimedia and Expo , IEEE, 2024

    work page 2024

  7. [7]

    A Simulation Framework for Electromagnetic Signal Injection Attacks on Image Sensors

    Y . Zhang, M. Cheung, C. Yang, X. Zhai, Z. Shen, X. Ji, E. Y . Fu, S.-Y . Chau, and X. Luo, “Modeling Electromagnetic Signal Injection Attacks on Camera-based Smart Systems: Applications and Mitigation,” arXiv preprint arXiv:2408.05124, 2024

    work page Pith review arXiv 2024

  8. [8]

    Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception,

    W. Liao, S. Yan, Y . Zhang, X. Zhai, Y . Wang, and E. Y . Fu, “Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception,” Proceedings of the AAAI Conference on Artificial Intelligence , 2025

    work page 2025

Show all 21 references
  1. [9]

    C. R. Paul, R. C. Scully, and M. A. Steffka, Introduction to Electromag- netic Compatibility. John Wiley & Sons, 2022

    2022

  2. [10]

    Radiation Patterns of Unintentional Antennas: Estimates, Simulations, and Measurements,

    P. F. Wilson, “Radiation Patterns of Unintentional Antennas: Estimates, Simulations, and Measurements,” in 2010 Asia-Pacific International Symposium on Electromagnetic Compatibility, pp. 985–989, IEEE, 2010

    2010

  3. [11]

    SoK: A Minimalist Approach to Formalizing Analog Sensor Security,

    C. Yan, H. Shin, C. Bolton, W. Xu, Y . Kim, and K. Fu, “SoK: A Minimalist Approach to Formalizing Analog Sensor Security,” in 2020 IEEE Symposium on Security and Privacy (SP) , pp. 233–248, IEEE, 2020

    2020

  4. [12]

    Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors,

    D. F. Kune, J. Backes, S. S. Clark, D. Kramer, M. Reynolds, K. Fu, Y . Kim, and W. Xu, “Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors,” in 2013 IEEE Symposium on Security and Privacy, pp. 145–159, IEEE, 2013

    2013

  5. [13]

    Ghosttype: The limits of using contactless electromagnetic interference to inject phantom keys into analog circuits of keyboards,

    Q. Jiang, Y . Ren, Y . Long, C. Yan, Y . Sun, X. Ji, K. Fu, and W. Xu, “Ghosttype: The limits of using contactless electromagnetic interference to inject phantom keys into analog circuits of keyboards,” in Network and Distributed Systems Security (NDSS) Symposium , 2024

    2024

  6. [14]

    Zhang, Electromagnetic Signal Injection Attacks on Embedded Sys- tems: Modeling and Detection

    Y . Zhang, Electromagnetic Signal Injection Attacks on Embedded Sys- tems: Modeling and Detection . PhD thesis, University of Oxford, 2022

    2022

  7. [15]

    Ultralytics yolov5,

    G. Jocher, “Ultralytics yolov5,” 2020

    2020

  8. [16]

    Ultralytics yolo11,

    G. Jocher and J. Qiu, “Ultralytics yolo11,” 2024

    2024

  9. [17]

    Yolov10: Real-time end-to-end object detection,

    e. a. Ao Wang, “Yolov10: Real-time end-to-end object detection,” arXiv preprint arXiv:2405.14458, 2024

    2024 arXiv

  10. [18]

    Ultralytics yolov8,

    G. Jocher, A. Chaurasia, and J. Qiu, “Ultralytics yolov8,” 2023

    2023

  11. [19]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” IEEE Transactions on Pattern Analysis and Machine Intelligence , Jun 2017

    2017

  12. [20]

    End-to-end object detection with transformers,

    N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko, “End-to-end object detection with transformers,” in ECCV, 2020

    2020

  13. [21]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13 , pp. 740–7...

    2014

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.