Trusted Data Fusion, Multi-Agent Autonomy, Autonomous Vehicles

Miroslav Pajic; R. Spencer Hallyburton

REVIEW 4 major objections 5 minor 39 references

Trusted Data Fusion, Multi-Agent Autonomy, Autonomous Vehicles

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that distributed camera-equipped UAV networks can detect compromised agents and restore near-baseline tracking accuracy after a false-positive attack, by weighting data fusion with Beta-distributed trust estimates.

desk verdict Solid, reproducible engineering contribution with a genuine dataset; the trust loop needs an explicit track-provenance guard and a redundancy ablation before the recovery claim is fully convincing. read the letter →

arxiv 2507.17875 v1 pith:SSQNS3XX submitted 2025-07-23 eess.SY cs.SY

R. Spencer Hallyburton , Miroslav Pajic This is my paper · ORCID

classification eess.SYcs.SY

keywords trust-basedsensorfusiondistributeddatamulti-agentautonomyhiddenMarkovmodelBetadistributioncovarianceintersectionadversarialdetectionunmannedaerialvehicles

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that multi-UAV surveillance networks can keep producing accurate situational awareness even when some agents are compromised, by scoring each agent's reports against what physics says it should have seen. The authors build a trust layer in which each agent maintains Beta-distributed estimates of how trustworthy every nearby agent and every tracked object is, updated by pseudomeasurements from pairwise consistency checks. These trust distributions then weight a covariance-intersection fusion step, so unreliable reports are down-weighted rather than blended in equally. In simulated contested ISR missions with up to 50 camera-equipped UAVs, the framework restores precision to near-baseline levels after a false-positive attack begins and outputs usable agent- and track-level trust distributions. A sympathetic reader would care because it offers a perception-aware alternative to Byzantine fault tolerance for aerial autonomy.

What carries the argument

The load-bearing object is the trust pseudomeasurement combined with the Beta-distributed hidden Markov trust state. A pseudomeasurement is a pair $(v_{j,k}, c_{j,k})$ in $[0,1]$, where $v$ is the degree to which a proximal agent's track agrees with the ego's fused track set and $c$ is the confidence in that comparison; the agreement is only computed for tracks lying inside the proximal agent's predicted field of view. These pseudomeasurements feed a conjugate Bayesian update, turning a Beta prior $\mathrm{Beta}(\alpha,\beta)$ into a Beta posterior via the closed-form update $\Delta\alpha_{j,t} = \sum_k c_{j,k} v_{j,k}$ and $\Delta\beta_{j,t} = \sum_k c_{j,k}(1-v_{j,k})$, with an optional negativity bias that drops trust faster than it builds. The downstream mechanism is trust-weighted covariance intersection, where each agent's information-form contribution is scaled by $\mathbb{E}[\tau_i]$ and the fused confidence is $\hat{\zeta}_{CI} = \sum_i \omega_i \mathrm{Var}[\tau_i]$. Together these pieces turn raw disagreement into a probabilistic suspicion that is then used to filter and reweight incoming data.

What would settle it

Run an attack in which a compromised agent sends false tracks together with a slightly altered camera calibration or field-of-view description, so that the ego's predicted observations match the false tracks; if the agent's estimated trust stays high, the consistency-check anchor has been broken. A complementary test introduces an occlusion between a benign agent and the ground: if its trust collapses even though it is reporting truthfully, the method cannot separate natural errors from malicious misbehavior.

Watch

Extended reading notes

Core claim

The central claim is that trust-informed data fusion, built on Beta-distributed hidden Markov model estimates, detects misbehaving agents and recovers accurate situational awareness in contested multi-UAV ISR. Each ego agent generates trust pseudomeasurements by comparing a proximal agent's reported tracks against a prediction of what that agent should have observed given its position, camera calibration, and field of view; these pseudomeasurements update Beta distributions for agent trust and track trust in closed form. Fusion then weights each agent's contribution by the expected value of its trust distribution inside a covariance-intersection update, with the variance of the trust distributions producing a fusion-confidence measure. In Monte Carlo evaluations on a new CARLA-based multi-agent aerial dataset, the framework restores precision to near-baseline after false-positive attacks begin, and trust-estimation accuracy improves monotonically with agent density in both benign and adversarial settings.

Load-bearing premise

The entire trust loop rests on the ego agent being able to predict what each proximal agent should have observed, which requires accurate ownship localization, known camera calibration, and an unobstructed ground-parallel field of view; if a compromised agent reports a false pose, orientation, or field of view, the consistency check has no independent anchor and trust can be manipulated.

Editorial extensions

If this is right

Under a false-positive attack, trust-informed fusion first dips with the untrusted baseline but then climbs back to pre-attack precision and recall, while the untrusted pipeline stays degraded.
Trust-estimation accuracy improves as agent density increases, so networks with more overlapping fields of view can detect adversaries that sparse networks miss.
The framework outputs usable probability distributions over both agent trust and track trust, not just binary verdicts, giving operators a graded picture of who to rely on.
Even when a large fraction of agents are attacked, trust-weighted fusion shows significant precision and recall gains over untrusted fusion.
The released CARLA-based multi-agent aerial dataset provides a reusable testbed for evaluating assured fusion under varied attacker models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the consistency-check anchor is the weak point, the framework's own logic suggests that protecting pose and calibration reports (e.g., with signed messages or redundant cross-checks) would harden the trust loop; the paper does not develop this.
Because trust observability requires field-of-view overlap, mission planning that actively routes UAVs to maintain overlapping coverage would strengthen detection; the paper only notes this as future work.
The independence approximation between agent and track trust distributions could be probed by correlated attacks that spread false tracks across several mutually consistent agents; testing such coordinated adversaries would reveal whether the closed-form Beta updates remain reliable.
Replacing track-level comparisons with pixel-wise semantic segmentation could catch manipulations that pass track-level checks, at the cost of higher bandwidth; the paper raises this as a future direction rather than a demonstrated result.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a real engineering contribution—released CARLA multi-agent aerial dataset, reproducible pipeline, and a trust-weighted fusion scheme that plausibly improves precision under false-positive attacks. The core Beta-HMM trust representation is not new here (it is the authors' own CDC work and the MATE paper), but the aerial FOV pseudomeasurements and the dataset are. If I were refereeing, I would not desk-reject; I would send it out and ask for one specific fix and one ablation.

What it does well: the dataset and code are the kind of thing the field needs; the paper is honest about sparsity limiting trust observability (Section 7.3, limitations); the metrics section defines trust accuracy carefully; and the negatively-weighted update (trust drops faster than it rises) is a sensible design choice.

The soft spots, in rough order. First, the PSM loop is not fully anchored. Section 5.3.2/Figure 6 generates trust PSMs by comparing each proximal agent's tracks to the ego's fused tracks, and Algorithm 3 weights those fused tracks by the same trust estimates. A false track that survives one fusion cycle can then match itself in the next cycle and generate a positive PSM, raising its own trust. The paper never specifies that tracks originating from a given agent are excluded before PSM generation, or that flagged tracks are removed before forming the reference. The stress-test note is right: this can entrench an initially wrong prior. It is not fatal in the reported Monte Carlo results, because dense honest coverage provides independent negative evidence, but the paper needs an ablation that separates "trust estimation is doing the work" from "honest-agent redundancy is masking contamination."

Second, the 'Gibbs sampling' label in Section 5.3.4 is wrong. No sampling occurs; it is a coordinate-wise closed-form Beta-Bernoulli update. That is a terminology fix, not a correctness problem. Third, several parameters—initial Beta priors, B_cn, T_cn, T_c_tau, and the PSM confidence construction—are left unspecified in the text. The released code may pin them down, but the paper should state them. Also, the consistency check assumes accurate ownship localization and known calibration; a compromised agent reporting corrupt pose breaks the anchor. That is a real scope limitation, not hidden: the attacker model is explicitly data-level FP/FN/translation.

Overall: the central idea is defensible, the evidence is mostly simulation but the dataset is a legitimate artifact. For a reader working on multi-agent security or reactive fusion, this is worth a serious referee. My recommendation: conditional accept; require the track-provenance clarification and the redundancy ablation.

Referee Report

4 major / 5 minor

Summary. The paper proposes a trust-based framework for distributed data fusion among camera-equipped UAVs conducting ISR. Each ego agent maintains Beta distributions for the trustworthiness of proximal agents and of individual tracks. Trust pseudomeasurements are generated from pairwise consistency checks between a proximal agent's tracks and the ego's fused tracks; they are incorporated via closed-form Beta-Bernoulli conjugate updates, with a negativity bias to make trust fall faster than it rises. The resulting trust means are used as weights in an N-fold covariance-intersection fusion algorithm, and low-trust tracks are flagged. The authors introduce a CARLA-based multi-agent aerial dataset, provide a repeatability package, and evaluate the method in Monte Carlo simulations under false-positive/false-negative attacks. They report that trust-informed fusion recovers precision to near baseline after an attack transient and that agent/track trust metrics improve with agent density.

Significance. If the central claim holds, this framework is a practical reactive-security component for decentralized aerial autonomy: it operates on compact track messages (around 35 kbps per agent), requires no oracle trust labels, and is accompanied by an open dataset and repeatability package. Modeling trust as full Beta distributions rather than scalar point values is a useful step beyond earlier scalar trust models, and the explicit release of simulation code is a real strength. However, the empirical significance is currently tempered because the trust measurement reference is not independent of the trust-weighted fusion output, and because the PSM construction is under-specified. The presented results do not yet distinguish a genuinely self-correcting trust estimator from one that partly confirms its own earlier outputs.

major comments (4)

[§5.3.2, §5.4.1, Fig. 6, Eqs. (5)–(6)] The trust pseudomeasurement loop is self-referential. Figure 6 and the text in §5.3.2 state that PSMs are generated by comparing each proximal agent's tracks to the ego's fused tracks, but Algorithm 3 fuses those same tracks with weights derived from the trust distributions. In the first cycle after a false-positive injection, a false track that is not matched to an existing ego track yields a negative PSM; however, because initial trust is neutral, it is not rejected outright and becomes part of the fused set. On the next cycle, the same proximal track matches the fused track it created, and Eqs. (5)–(6) count the association as a positive, high-confidence PSM, increasing both the track's and the agent's trust. The paper never specifies that tracks are tagged by provenance or that flagged low-trust tracks are excluded from the PSM reference before the next update, so the recovery reported in §7.1 may be an artifact of contamination being masked by honest-agent redundancy rather than of trust estimation. Please either specify explicit provenance tracking and removal of flagged tracks from the reference, or generate PSMs only against ego-local tracks or a reference that excludes the proximal agent's own earlier contributions, and add an ablation showing the FP-attack case-study result without self-generated reference tracks.
[§5.3.4 and §5.3.5] The update described as 'inspired by Gibbs sampling' is not a sampling procedure. No samples are drawn, no Markov chain is defined, and Eqs. (5)–(6) are standalone closed-form conjugate updates. The conditionals in Eq. (4) are not the full conditionals of a joint distribution over all agent and track trust variables, and §5.3.5 immediately replaces the joint distribution with independent Beta approximations. Consequently, the phrase 'Gibbs sampling' overstates the methodological contribution and may mislead readers about convergence or consistency properties. Please either remove the Gibbs-sampling language and describe the procedure as a sequential conjugate Bayesian filter with a coordinate-wise approximation, or, if the Gibbs analogy is retained, specify the actual conditional distributions, the sampling scheme, and a convergence argument.
[§5.3.2, Fig. 6] The PSM generation function is not sufficiently specified. Eqs. (5)–(6) require a value v_{j,k} and confidence c_{j,k} for every agent-track pair, and Figure 6 gives a qualitative flow chart, but the text does not define how v_{j,k} and c_{j,k} are computed from the assignment distances, association thresholds, FOV filtering, or track covariances. It also does not define how the FOV filtering in Eq. (3) interacts with the assignment cost, or how the negative PSM magnitude is set. Since the entire trust update depends on these quantities, the quantitative results in Figures 9–12 cannot be reproduced from the paper text alone, even with the repeatability package. Please provide explicit formulas or pseudocode for v_{j,k} and c_{j,k}, including all thresholds and normalization steps, and state which values were used in the reported experiments.
[§3.2.2, §5.3.1, §4.1] The consistency check that defines trust has no independent anchor if a compromised agent can report false ownship pose or camera calibration. Sections 3.2.2 and 5.3.1 assume accurate ownship localization and known, fixed camera intrinsics in order to predict what an agent should have observed. A data-level attacker who also tampers with the pose vector listed in §3.3.1 can make its false tracks appear geometrically consistent with the ego's FOV prediction, and the PSM loop will then validate them. Section 4 lists spoofing channels, but the evaluations in Section 7 only cover false-positive, false-negative, and translation attacks on track data. Please either restrict the paper's security claims to attacks that do not corrupt ownship state or calibration, or add experiments and algorithmic mechanisms that address pose and FOV spoofing, for example cross-checks against GPS/IMU consensus or temporal consistency of the reported pose.

minor comments (5)

[§A.2, Eq. (8)] The OSPA expression appears to have the wrong sign on the cardinality penalty and to omit the outer 1/p root from the standard definition in [31]; as written, for n<m the term c^p(n-m) is negative, which would subtract rather than add the cardinality mismatch cost.
[§5.3.1, Eq. (3)] Eq. (3) defines Δθ and Δφ as arctan(n_x/(2 f_x)) and arctan(n_y/(2 f_y)), which are half-angles, while the text calls them the horizontal and vertical angles of the camera's FOV; please clarify whether the subsequent FOV filtering uses these half-angles or doubles them.
[§5.1] The claim that 'to the best of our knowledge, none existed before this work' is stronger than the related-work section supports, given references [7], [8], [16], and [17]; please soften the claim or provide a precise comparison that distinguishes the present contribution.
[§3.3.1] The assumption that latency and communication drops can be neglected because 'TCP data buffers' handle them is optimistic for ad hoc aerial networks; please justify this modeling choice or qualify the scope of the communication model.
[§6.4 and §7] OSPA is defined in §6.4 and Appendix A.2 but never reported in the experimental results; reporting OSPA for the case study and attacker-capability experiments would substantiate the claim that trust-informed fusion recovers accurate situational awareness.

Circularity Check

1 steps flagged · score 4.0 of 10

Trust PSM reference is the trust-weighted fused track set, so a false track can bootstrap its own trust in no-overlap regions; the headline evaluation remains externally grounded, making the circularity partial.

self definitional [Fig. 6 / §5.3.2, §3.3.2, Algorithm 3 (§5.4.1), Eqs. (5)–(6)]
"Trust pseudomeasurement (PSM) function compares fused tracks to proximal agent tracks on each of the distributed platforms. Positive associations yield PSMs proportional to agent trust while unassigned tracks are inversely proportional to trustedness. ... Any tracks from the new agent not present in the fused set start new tracks in the fused set. ... Initialize weights {ω_i = E[τ_i], i=1,...,n}."

The 'fused tracks' used as the reference for trust PSMs are not an independent oracle: they are produced by Algorithm 3, whose fusion weights are the current trust expectations E[τ_i]. Thus trust determines the reference against which trust is measured. In the FP attack of §7.1, a compromised agent's false track that is unmatched when first received is added to the ego's fused set (§3.3.2); on the next cycle the same proximal track matches the fused track it created, generating a positive PSM, which via Eqs. (5)–(6) increases both the track's and the agent's Beta trust parameters.

full rationale

Most of the claimed contributions are new empirical artifacts: the CARLA multi-agent dataset, the case-study evaluations, and the trust-weighted CI algorithm are self-contained against simulator ground truth and oracle adversarial labels. The self-citations (e.g., [16] for the Beta/HMM trust formulation, [15] for the data pipeline) disclose the provenance of the chosen model and do not by themselves force the reported results. The one genuine circular dependency is structural: Fig. 6 generates trust PSMs by comparing proximal tracks against the ego's fused track set, while Algorithm 3 constructs that fused set using the current trust distributions. Because unmatched proximal tracks are seeded into the fused set, a false track can become its own consistency reference in the next PSM cycle, raising its own trust via Eqs. (5)–(6). The paper's own §7.3 admits that false positives injected outside overlapping FOVs cannot be detected by these methods. This makes the trust estimate partially self-definitional in no-overlap regions. It is not complete circularity because the headline metrics are scored against external CARLA ground truth and oracle attacker sets, and because in overlapping FOV regions honest agents provide an independent anchor; hence score 4 rather than 6.

Assumptions & free parameters 4 free parameters · 5 assumptions · 2 invented entities

The framework's central contribution is an estimator rather than a physical law. It introduces latent trust variables and several hand-specified parameters: initial Beta priors, negativity bias and threshold, the low-trust flag threshold, and the PSM confidence construction. Domain assumptions about unoccluded aerial FOVs, accurate ownship localization, and negligible communication loss are load-bearing: if any of them fail, the pseudomeasurements lose their meaning.

free parameters (4)

Initial Beta priors for agent and track trust (alpha_0, beta_0) = not specified
Section 5.3.3 emphasizes the importance of accurate priors, but no default values or sensitivity ranges are given.
Negativity weight B_cn and threshold T_cn = not specified
Equation (6) introduces tunable bias and threshold for negative pseudomeasurements, but the paper gives no values or selection procedure.
Low-trust track flag threshold T_c_tau = not specified
Section 5.4.2 flags tracks with E[tau_c] < T_c_tau, calling it predetermined without stating its value.
PSM confidence c_j,k construction = not specified
PSMs are defined as (value, confidence) tuples, but the mapping from assignment proximity to confidence is not specified beyond Figure 6.

assumptions (5)

standard math Beta-Bernoulli conjugacy gives closed-form Beta posterior updates from pseudomeasurements.
Invoked in Section 5.3.6 to derive Equation (5).
domain assumption Objects are on the ground plane and cameras are gimbaled with axes parallel to the ground, enabling 2D-to-3D upscaling and deterministic FOV prediction.
Stated in Sections 3.2.2 and 3.2.4; if false, predicted observations used for trust PSMs are wrong.
domain assumption Aerial cameras have unoccluded views, so FOV depends only on sensor geometry.
Assumed in Section 5.3.1 to justify FOV filtering without ray tracing or occlusion reasoning.
ad hoc to paper Agent and track trust distributions are independent Beta distributions rather than a joint distribution on a hypercube.
Adopted in Section 5.3.5 for computational tractability; the discarded cross-correlations could matter under coordinated attacks.
domain assumption Communication latency and drops can be neglected because TCP buffers handle them.
Stated in Section 3.3; lossy real-world links would change fusion timing and trust observability.

invented entities (2)

Continuous trust states for agents and tracks (tau_a, tau_c)
purpose: Latent trustworthiness variables used to weight fusion and flag malicious agents and tracks.
Trust is defined relationally via consistency with physical laws and other agents' data (Definition 1); there is no independent sensor measuring trust.
Trust pseudomeasurements (PSMs) as (value, confidence) pairs
purpose: Convert pairwise track comparisons into Bayesian observations of trust.
PSMs are generated from ego fused tracks that are themselves trust-weighted, creating a closed estimation loop rather than an external measurement.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Trusted Data Fusion, Multi-Agent Autonomy, Autonomous Vehicles." pith.science (2026). https://pith.science/paper/SSQNS3XX

@misc{pith2026250717875,
  author       = {Pith},
  title        = {Pith review of: Trusted Data Fusion, Multi-Agent Autonomy, Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SSQNS3XX}},
  note         = {Machine review of arXiv:2507.17875}
}

read the original abstract

Multi-agent collaboration enhances situational awareness in intelligence, surveillance, and reconnaissance (ISR) missions. Ad hoc networks of unmanned aerial vehicles (UAVs) allow for real-time data sharing, but they face security challenges due to their decentralized nature, making them vulnerable to cyber-physical attacks. This paper introduces a trust-based framework for assured sensor fusion in distributed multi-agent networks, utilizing a hidden Markov model (HMM)-based approach to estimate the trustworthiness of agents and their provided information in a decentralized fashion. Trust-informed data fusion prioritizes fusing data from reliable sources, enhancing resilience and accuracy in contested environments. To evaluate the assured sensor fusion under attacks on system/mission sensing, we present a novel multi-agent aerial dataset built from the Unreal Engine simulator. We demonstrate through case studies improved ISR performance and an ability to detect malicious actors in adversarial settings.

Figures

Figures reproduced from arXiv: 2507.17875 by the authors.

**Figure 3.** Ground constraint on detected object location al [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

**Figure 4.** Cascaded, pairwise distributed data fusion (DDF) [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗

Figures from the paper (6 more)

**Figure 5.** Figure 5: Assured distributed data fusion fuses platform-local [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 6.** Figure 6: Trust pseudomeasurement (PSM) function com [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Agents two and four observe overlapping regions [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 8.** Figure 8: 𝑁 = 10 agents perform surveillance over a large region. Agents have partially overlapping fields of view, supporting redundancy of computation for security-aware trustbased methods. In this configuration, Agent 0 is isolated with no inter-agent FOV overlap leading to…

**Figure 9.** Figure 9: Attack starts at 𝑡 = 1.5 𝑠. Agents suffer natural false positives, meaning baseline precision is not perfect. Uncertainty bounds represent deviations in performance between agents and over multiple trials with randomization. (a) Without trust, precision drops quickly…

**Figure 12.** Figure 12: (a) Track fusion performance declines as the num [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 35 canonical work pages

[1]

Trust-Based Assured Sensor Fusion in Distributed Aerial Autonomy

2025. Trust-Based Assured Sensor Fusion in Distributed Aerial Autonomy. https: //cpsl.pratt.duke.edu/research/distributed-trust

work page 2025
[2]

Mohammad Raashid Ansari, Jean-Philippe Monteuuis, Jonathan Petit, and Cong Chen. 2021. V2x misbehavior and collective perception service: Considerations for standardization. In 2021 IEEE Conference on Standards for Communications and Networking (CSCN). IEEE, 1–6

work page 2021
[3]

H Bendea, Piero Boccardo, S Dequal, Fabio Giulio Tonolo, Davide Marenchino, Marco Piras, et al. 2008. Low cost UAV for post-disaster assessment. The Interna- tional Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences 37, B8 (2008), 1373–1379

work page 2008
[4]

Norbert Bißmeyer, Sebastian Mauthofer, Kpatcha M Bayarou, and Frank Kargl

work page
[5]

Samuel S Blackman. 1986. Multiple-target tracking with radar applications. Dedham (1986)

work page 1986
[6]

Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Ram- pazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019. Adversarial sensor attack on lidar-based perception in autonomous driving. In 2019 ACM CCS. ACM, London, UK, 2267–2281

work page 2019
[7]

Matthew Cavorsi, Orhan Eren Akgün, Michal Yemini, Andrea J Goldsmith, and Stephanie Gil. 2024. Exploiting Trust for Resilient Hypothesis Testing withMali- cious Robots. IEEE Transactions on Robotics (2024)

work page 2024
[8]

Mingxi Cheng, Junyao Zhang, Shahin Nazarian, Jyotirmoy Deshmukh, and Paul Bogdan. 2021. Trust-aware control for intelligent transportation systems. In 2021 IEEE Intelligent Vehicles Symposium (IV) . IEEE, 377–384

work page 2021

Show all 39 references

[9]

Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. 2017. CARLA: An open urban driving simulator. In Conference on robot learning. PMLR, 1–16

2017
[10]

Philippe Golle, Dan Greene, and Jessica Staddon. 2004. Detecting and correcting malicious data in VANETs. InProceedings of the 1st ACM international workshop on Vehicular ad hoc networks . 29–37

2004
[11]

Nasos Grigoropoulos, Manos Koutsoubelias, and Spyros Lalis. 2020. Byzantine fault tolerance for centrally coordinated missions with unmanned vehicles. In Proceedings of the 17th ACM International Conference on Computing Frontiers . 165–173

2020
[12]

S Grime and Hugh F Durrant-Whyte. 1994. Data fusion in decentralized sensor networks. Control engineering practice 2, 5 (1994), 849–863

1994
[13]

Spencer Hallyburton, David Hunt, Yiwei He, Judy He, and Miroslav Pa- jic

R. Spencer Hallyburton, David Hunt, Yiwei He, Judy He, and Miroslav Pa- jic. 2025. Probabilistic Segmentation for Robust Field of View Estimation. arXiv:2503.07375 [cs.CV] https://arxiv.org/abs/2503.07375

2025 arXiv
[14]

R S Hallyburton, Yupei Liu, Yulong Cao, Z Morley Mao, and Miroslav Pajic. 2022. Security analysis of camera-lidar fusion against black-box attacks on autonomous vehicles. In 31st USENIX SECURITY) . USENIX, Berkeley, CA, 1–18

2022
[15]

R S Hallyburton and Miroslav Pajic. 2023. Datasets, models, and algo- rithms for multi-sensor, multi-agent autonomy using avstack. arXiv preprint arXiv:2312.04970 (2023)

2023 arXiv
[16]

Spencer Hallyburton and Miroslav Pajic

R. Spencer Hallyburton and Miroslav Pajic. 2024. Bayesian Methods for Trust in Collaborative Multi-Agent Autonomy. In 2024 IEEE 63rd Conference on Decision and Control (CDC). 470–476

2024
[17]

Spencer Hallyburton and Miroslav Pajic

R. Spencer Hallyburton and Miroslav Pajic. 2025. Security-Aware Sensor Fusion with MATE: the Multi-Agent Trust Estimator. arXiv:2503.04954 [cs.CR] https: //arxiv.org/abs/2503.04954

2025 arXiv
[18]

R S Hallyburton, Qingzhao Zhang, Z Morley Mao, and Miroslav Pajic. 2023. Partial-Information, Longitudinal Cyber Attacks on LiDAR in Autonomous Vehi- cles. arXiv preprint arXiv:2303.03470 (2023)

2023 arXiv
[19]

Robert Spencer Hallyburton, Shucheng Zhang, and Miroslav Pajic. 2023. AVstack: An Open-Source, Reconfigurable Platform for Autonomous Vehicle Development. In Proceedings of the ACM/IEEE 14th International Conference on Cyber-Physical Systems (with CPS-IoT Week 2023). 209–220

2023
[20]

Fei Hu and Neeraj K Sharma. 2005. Security considerations in ad hoc sensor networks. Ad Hoc Networks 3, 1 (2005), 69–89

2005
[21]

Michael N Huhns and Duncan A Buell. 2002. Trusted autonomy. IEEE Internet Computing 6, 3 (2002), 92

2002
[22]

Simon Julier and Jeffrey K Uhlmann. 2017. General decentralized data fusion with covariance intersection. In Handbook of multisensor data fusion . CRC Press, 339–364

2017
[23]

Amir Khazraei and Miroslav Pajic. 2022. Attack-resilient state estimation with intermittent data authentication. Automatica 138 (2022), 110035. https://www. sciencedirect.com/science/article/pii/S000510982100563X

2022
[24]

Kim Potter Kihlstrom, Louise E Moser, and P Michael Melliar-Smith. 2003. Byzan- tine fault detectors for solving consensus. Comput. J. 46, 1 (2003), 16–35

2003
[25]

Juhee Kwon and M Eric Johnson. 2014. Proactive versus reactive security invest- ments in the healthcare sector. Mis Quarterly 38, 2 (2014), 451–A3

2014
[26]

Zhaoyu Liu, Anthony W Joy, and Robert A Thompson. 2004. A dynamic trust model for mobile ad hoc networks. In Proceedings of the 10th IEEE International Workshop on Future Trends of Distributed Computing Systems (FTDCS) . 80–85

2004
[27]

my autonomous car is an elephant

Jean-Philippe Monteuuis, Jonathan Petit, Jun Zhang, Houda Labiod, Stefano Mafrica, and Alain Servel. 2018. “my autonomous car is an elephant”: A machine learning based detector for implausible dimension. In 2018 IEEE SSIC. 1–8

2018
[28]

Pajic, I

M. Pajic, I. Lee, and G. J. Pappas. 2017. Attack-Resilient State Estimation for Noisy Dynamical Systems. IEEE Transactions on Control of Network Systems 4, 1 (March 2017), 82–92. ICCPS ’25, May 6–9, 2025, Irvine, CA, USA R. Spencer Hallyburton and Miroslav Pajic

2017
[29]

Miroslav Pajic, James Weimer, Nicola Bezzo, Paulo Tabuada, Oleg Sokolsky, Insup Lee, and George J Pappas. 2014. Robustness of attack-resilient state estimators. In ACM/IEEE ICCPS. 163–174

2014
[30]

Jonathan Petit and Steven E Shladover. 2014. Potential cyberattacks on automated vehicles. IEEE Transactions on Intelligent transportation systems 16, 2 (2014), 546– 556

2014
[31]

Dominic Schuhmacher, Ba-Tuong Vo, and Ba-Ngu Vo. 2008. A consistent metric for performance evaluation of multi-object filters. IEEE transactions on signal processing 56, 8 (2008), 3447–3457

2008
[32]

Arkady Shemyakin and Alexander Kniazev. 2017. Introduction to Bayesian esti- mation and copula models of dependence . John Wiley & Sons

2017
[33]

Rens Wouter Van Der Heijden, Stefan Dietzel, Tim Leinmüller, and Frank Kargl
[34]

Jean-Paul Yaacoub, Hassan Noura, Ola Salman, and Ali Chehab. 2020. Security analysis of drones systems: Attacks, limitations, and recommendations. Internet of Things 11 (2020), 100218

2020
[35]

Yanli Yu, Keqiu Li, Wanlei Zhou, and Ping Li. 2012. Trust mechanisms in wireless sensor networks: Attack analysis and countermeasures. Journal of Network and computer Applications 35, 3 (2012), 867–880

2012
[36]

Wei T Yue and Metin Cakanyildirim. 2007. Intrusion prevention in information systems: Reactive and proactive responses. Journal of Management Information Systems 24, 1 (2007), 329–353

2007
[37]

Huafei Zhu, Feng Bao, and Robert H Deng. 2004. Computing of trust in wireless networks. In IEEE 60th Vehicular Technology Conference, 2004. VTC2004-Fall. 2004 , Vol. 4. IEEE, 2621–2624. A Metrics A.1 Assignment Metrics Assignment-based metrics describe the performance of perce...

2004
[2012]

In 2012 IEEE Vehicular Networking Conference (VNC)

Assessment of node trustworthiness in vanets using data plausibility checks with particle filters. In 2012 IEEE Vehicular Networking Conference (VNC) . IEEE, 78–85

2012
[2018]

IEEE Communications Surveys & Tutorials 21, 1 (2018), 779–811

Survey on misbehavior detection in cooperative intelligent transportation systems. IEEE Communications Surveys & Tutorials 21, 1 (2018), 779–811

2018

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Trust-Based Assured Sensor Fusion in Distributed Aerial Autonomy

2025. Trust-Based Assured Sensor Fusion in Distributed Aerial Autonomy. https: //cpsl.pratt.duke.edu/research/distributed-trust

work page 2025

[2] [2]

Mohammad Raashid Ansari, Jean-Philippe Monteuuis, Jonathan Petit, and Cong Chen. 2021. V2x misbehavior and collective perception service: Considerations for standardization. In 2021 IEEE Conference on Standards for Communications and Networking (CSCN). IEEE, 1–6

work page 2021

[3] [3]

H Bendea, Piero Boccardo, S Dequal, Fabio Giulio Tonolo, Davide Marenchino, Marco Piras, et al. 2008. Low cost UAV for post-disaster assessment. The Interna- tional Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences 37, B8 (2008), 1373–1379

work page 2008

[4] [4]

Norbert Bißmeyer, Sebastian Mauthofer, Kpatcha M Bayarou, and Frank Kargl

work page

[5] [5]

Samuel S Blackman. 1986. Multiple-target tracking with radar applications. Dedham (1986)

work page 1986

[6] [6]

Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Ram- pazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019. Adversarial sensor attack on lidar-based perception in autonomous driving. In 2019 ACM CCS. ACM, London, UK, 2267–2281

work page 2019

[7] [7]

Matthew Cavorsi, Orhan Eren Akgün, Michal Yemini, Andrea J Goldsmith, and Stephanie Gil. 2024. Exploiting Trust for Resilient Hypothesis Testing withMali- cious Robots. IEEE Transactions on Robotics (2024)

work page 2024

[8] [8]

Mingxi Cheng, Junyao Zhang, Shahin Nazarian, Jyotirmoy Deshmukh, and Paul Bogdan. 2021. Trust-aware control for intelligent transportation systems. In 2021 IEEE Intelligent Vehicles Symposium (IV) . IEEE, 377–384

work page 2021