PHANTOM: PHysical ANamorphic Threats Obstructing Connected Vehicle Mobility

2025-12-15

AI Summary

Connected autonomous vehicles (CAVs) exhibit vulnerability to physical-world visual adversarial attacks, compromising perception reliability in safety-critical scenarios. Method: This paper proposes the first perspective-dependent black-box physical adversarial attack framework leveraging anamorphic art—requiring no model access—where geometric deformation modeling generates transferable adversarial patterns targeting object detectors. Contribution/Results: The attack achieves >90% success rate against YOLOv5, SSD, Faster R-CNN, and RetinaNet under optimal conditions, sustaining 60–80% efficacy in adverse environments (e.g., low illumination, motion blur), with effective attack range of 6–10 meters. Crucially, it reveals for the first time cascading V2X network-level impacts: significant degradation in information freshness (peak age of information increases by 68–89%) and deterioration of safety-critical V2X communication integrity. These findings establish a novel paradigm for evaluating CAV perception robustness and inform V2X cooperative security research with empirical evidence.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Connected autonomous vehicles (CAVs) rely on vision-based deep neural networks (DNNs) and low-latency (Vehicle-to-Everything) V2X communication to navigate safely and efficiently. Despite their advances, these systems remain vulnerable to physical adversarial attacks. In this paper, we introduce PHANTOM (PHysical ANamorphic Threats Obstructing connected vehicle Mobility), a novel framework for crafting and deploying perspective-dependent adversarial examples using extit{anamorphic art}. PHANTOM exploits geometric distortions that appear natural to humans but are misclassified with high confidence by state-of-the-art object detectors. Unlike conventional attacks, PHANTOM operates in black-box settings without model access and demonstrates strong transferability across four diverse detector architectures (YOLOv5, SSD, Faster R-CNN, and RetinaNet). Comprehensive evaluation in CARLA across varying speeds, weather conditions, and lighting scenarios shows that PHANTOM achieves over 90% attack success rate under optimal conditions and maintains 60-80% effectiveness even in degraded environments. The attack activates within 6-10 meters of the target, providing insufficient time for safe maneuvering. Beyond individual vehicle deception, PHANTOM triggers network-wide disruption in CAV systems: SUMO-OMNeT++ co-simulation demonstrates that false emergency messages propagate through V2X links, increasing Peak Age of Information by 68-89% and degrading safety-critical communication. These findings expose critical vulnerabilities in both perception and communication layers of CAV ecosystems.

Problem

• PHANTOM creates perspective-dependent adversarial examples using anamorphic art to deceive vehicle object detectors.
• It operates without model access and transfers across multiple detector architectures in varied conditions.
• The attack disrupts both individual vehicle perception and network-wide V2X communication in CAV systems.

Innovation

• Anamorphic art creates perspective-dependent adversarial examples
• Black-box attack without model access across diverse detectors
• Triggers network-wide disruption in V2X communication systems