The Problem: Latency as a Weapon

Denial-of-Service (DoS) attacks on autonomous vehicles (AVs) can be catastrophic. If an AV’s perception system is delayed, even by a split second, it may fail to react to obstacles or pedestrians in time. Previous research into latency attacks has often been limited to:

• Digital-only attacks: Simulations that cannot be easily replicated in the physical world.
• Unscalable physical patches: Large, conspicuous patterns that block the camera’s view, which are easily detectable and impractical to deploy discreetly.

The challenge was to create a physically realizable attack that could overwhelm the perception pipeline without requiring massive physical alterations to the scene.

Proposed Method: Detstorm

The researchers propose Detstorm, a new attack method that exploits the computational bottlenecks in object detection pipelines.

1. Concept

Detstorm works by flooding the object detector with a massive number of “ghost” adversarial objects. By forcing the system to process hundreds of non-existent detections, the pipeline’s latency effectively creates a DoS condition.

2. Design & Methodology

To achieve this in the real world, Detstorm uses projector perturbations—light patterns projected onto the scene. Key components of the design include:

• Evading NMS (Non-Maximum Suppression): Object detectors use NMS to filter out overlapping boxes for the same object. Detstorm optimizes its adversarial objects to specifically evade this filtering, ensuring that the system keeps as many false positives as possible.
• Zone Stitching: Projecting a single coherent image that covers a large area is difficult. Detstorm uses a “zone stitching” process to recombine perturbation patterns into a single, contiguous image that can be projected physically and effectively.
• Greedy Zone Strategy: The attack segments the environment into zones containing different object classes. It then employs a greedy algorithm to maximize the number of created objects within each specific zone.

Effectiveness & Results

The paper presents rigorous evaluations in both simulated and real-world environments. The results are startling:

• 506% increase in the number of detected objects on average.
• Perception delays of up to 8.1 seconds, which is an eternity in autonomous driving contexts.
• The attack was proven to be physically realizable, capable of causing tangible consequences for real-world autonomous driving systems.

This research highlights a critical vulnerability in current perception architectures. As we move towards fully autonomous roads, defense mechanisms against not just misclassification, but pipeline overload, will be essential.

Reference: R. Muller, R. Song, C. Wang, Y. Zhan, J.-P. Monteuuis, Y. Man, M. Li, R. Gerdes, J. Petit, and Z. B. Celik, “Investigating Physical Latency Attacks Against Camera-Based Perception,” 2025 IEEE Symposium on Security and Privacy (S&P), 2025. DOI: 10.1109/SP61157.2025.00236

The Concept: Distance-Pulling Attack (DPA)

The core of this research is the Distance-Pulling Attack (DPA). The goal is simple but dangerous: deceive the drone into believing the target is further away than it actually is. This causes the drone’s control system to move closer to maintain the “correct” tracking distance, potentially leading to capture or collision.

Design: The Adversarial Umbrella

The researchers proposed a novel attack vector: an Adversarial Umbrella.

Why an umbrella?

• Deployable: It’s a common object, effectively hiding the attack in plain sight.
• Inconspicuous: Unlike obvious adversarial patches, a patterned umbrella doesn’t raise immediate suspicion.
• Control: It allows the attacker to easily manipulate the visual input presented to the drone.

Logic & Methodology

To achieve a robust attack, the system, dubbed FlyTrap, uses two key components:

1. Progressive Distance-Pulling (PDP) Strategy

Attacking a moving drone is difficult because the visual perspective changes constantly. The PDP strategy addresses this by simulating the attack’s effects under gradually decreasing distances. It uses physical modeling to estimate the distance and generates adversarial patterns that remain effective as the drone moves closer.

2. Attack Target Generator (ATG)

A major challenge in physical adversarial attacks is maintaining consistency across different viewing angles and frames (spatial-temporal consistency). The ATG solves this by explicitly encoding these constraints during the optimization process. It ensures that the generated adversarial pattern looks plausible to the drone’s tracking algorithm from multiple angles and over time, bypassing consistency-checking defenses.

Real-World Impact

The effectiveness of FlyTrap is alarming. Evaluations demonstrated that it works against real-world commercial ATT drones, including widely used models from DJI and HoverAir. The attack successfully reduced tracking distances to the point where drones could be:

• Captured: Physically grabbed by the attacker.
• Sensor Attacked: Brought close enough for other short-range attacks.
• Crashed: Tricked into colliding with the target or obstacles.

This research highlights a urgent need for robust defense mechanisms in autonomous systems, as simple visual deception can lead to physical safety risks.

Read the full paper on arXiv Download PDF

The Route

We planned our route to hit several iconic cities along the way:

1. Columbus, OH 🏁
   • Our journey began here, packing up the car and heading west on I-70.
2. St. Louis, MO
   • Our first major landmark was the Gateway Arch, standing tall over the Mississippi River.
3. Kansas City, MO
   • We stopped for some world-famous BBQ and enjoyed the vibrant atmosphere before pushing into the Great Plains.
4. Denver, CO
   • The scenery changed dramatically as we approached the Rockies. The “Mile High City” offered stunning mountain views and crisp air.
5. Las Vegas, NV
   • A dazzling stop in the Mojave Desert. The neon lights of the Strip were a surreal contrast to the miles of open road we just covered.
6. Los Angeles, CA 🌴
   • Final destination! Arriving at the Pacific Coast felt like a huge accomplishment after days of driving.

From the forests of the Midwest to the endless horizon of the plains, the towering peaks of the Rockies, and the arid beauty of the desert—this trip showed us the incredible diversity of the US landscape.