Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perception

Yihang Tao; Senkang Hu; Haonan An; Zhengru Fang; Hangcheng Cao; Yuguang Fang

cs.CVFeb 23, 2026

Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perception

Authors: Yihang Tao, Senkang Hu, Haonan An, Zhengru Fang, Hangcheng Cao, Yuguang Fang

Organizations: Hong Kong JC STEM Lab of Smart City · City University of Hong Kong

Abstract

Collaborative perception (CP) enables data sharing among connected and autonomous vehicles (CAVs) to enhance driving safety. However, CP systems are vulnerable to adversarial attacks where malicious agents forge false objects via feature-level perturbations. Current defensive systems use threshold-based consensus verification by comparing collaborative and ego detection results. Yet, these defenses remain vulnerable to more sophisticated attack strategies that could exploit two critical weaknesses: (i) lack of robustness against attacks with systematic timing and target region optimization, and (ii) inadvertent disclosure of vulnerability knowledge through implicit confidence information in shared collaboration data. In this paper, we propose MVIG attack, a novel adaptive adversarial CP framework learning to capture vulnerability knowledge disclosed by different defensive CP systems from a unified mutual view information graph (MVIG) representation. Our approach combines MVIG representation with temporal graph learning to generate evolving fabrication risk maps and employs entropy-aware vulnerability search to optimize attack location, timing and persistence, enabling adaptive attacks with generalizability across various defensive configurations. Extensive evaluations on OPV2V and Adv-OPV2V datasets demonstrate that MVIG attack reduces defense success rates by up to 62% against state-of-the-art defenses while achieving 47% lower detection for persistent attacks at 29.9 FPS, exposing critical security gaps in CP systems. Code will be released at https://github.com/yihangtao/MVIG.git

Figures & tables

Figure 1: Overview of adversarial attacks targeting CP systems.

Figure 2: Overview of our MVIG attack framework. It begins with transforming historical CAV collaboration data into mutual view information graphs, generates fabrication risk maps via MVIGNet and employs entropy-aware vulnerability search to optimize both attack timing and location, creating persistent, believable fabricated objects in the victim’s perception across consecutive frames.

Methods	No Defense		ROBOSAC [ 21 ]			CP-Guard [ 17 ]			GCP [ 29 ]			CAD [ 39 ]
Methods	ASR	$\Delta$ AP	DSR	TPR	FPR	DSR	TPR	FPR	DSR	TPR	FPR	DSR	TPR	FPR
Basic [ 31 ]	100.0	-62.7	100.0	100.0	1.9	100.0	100.0	2.8	100.0	100.0	1.8	100.0	71.3	2.2
RC (spoof) [ 39 ]	92.4	-1.9	12.0	6.3	1.4	18.1	9.6	2.4	12.2	6.4	1.8	83.5	71.2	0.8
RC (remove) [ 39 ]	98.0	-3.6	14.2	7.2	1.6	21.4	11.0	1.7	15.0	8.1	1.9	90.1	72.0	1.0
BAC [ 29 ]	99.2	-16.7	23.0	13.7	1.8	37.0	22.7	2.8	28.0	16.6	1.8	90.5	78.1	1.8
MVIG (spoof)	94.3	-1.8	14.8 +23%	7.9	1.3	17.2 -5%	9.3	2.5	13.0 +7%	6.9	0.9	32.0 -62%	58.7	9.1

Table 1: Performance comparison of different CP attacks on Adv-OPV2V dataset under various defenses. Bold : best (lowest DSR), Underline : second-best. Green : improvement over second-best, Red : degradation. Spoof methods compete within spoof group, remove methods within remove group.

Methods	Persistence	ROBOSAC+ [ 21 ]			CP-Guard [ 17 ]			GCP [ 29 ]			CAD [ 39 ]
Methods	Persistence	DSR	TPR	FPR	DSR	TPR	FPR	DSR	TPR	FPR	DSR	TPR	FPR
Basic [ 31 ]	0-frame	100.0	100.0	1.9	100.0	100.0	2.8	100.0	100.0	1.8	100.0	71.3	2.2
	1-frame	100.0	100.0	3.7	100.0	100.0	2.8	100.0	100.0	5.8	100.0	75.1	2.0
	3-frame	100.0	100.0	2.8	100.0	100.0	0.9	100.0	100.0	0.6	100.0	76.2	2.0
RC (spoof) [ 39 ]	0-frame	12.0	6.3	1.4	18.1	9.6	2.4	12.2	6.4	1.8	83.5	71.2	0.8
	1-frame	29.1	8.2	3.7	19.2	5.1	1.2	37.2	11.3	5.8	98.2	76.9	1.5

Table 2: Performance comparison of different CP attacks with various persistence. Bold : best (lowest DSR), Underline : second-best. Green : improvement over second-best, Red : degradation. Spoof attack compete within spoof group, remove attack within remove group.

Figure 3: ROC curves of different defenders on various CP attacks with different persistence.

Figure 4: MVIG attack in CP systems. Green boxes represent predictions without attack, red boxes show predictions after attack. Color-filled polygon regions in (c,g) correspond to GT occupancy information from different CAVs, dark: occupied, light: free, white: unknown.

Figure 5: Comparison of persistent attacks and their impacted zones. The BEV flow is calculated by matching the most similar objects in the consecutive detection maps.

Figure 6: Ablation studies on the impact of impacted zone size and attack continuation threshold.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Validation loss curves of MVIGNet training on OPV2V dataset.

Figure 8: Feature map comparison of different attack methods on Adv-OPV2V dataset.

CP Architecture	ROBOSAC	CP-Guard	GCP	CAD
AttFuse (Full)	14.8	17.2	13.0	32.0
V2VNet (Full)	14.9	17.1	13.5	32.2
Where2comm (Sparse)	15.2	18.1	13.6	33.1

Appendix

Table 3: Defense success rates (%) across different CP architectures. Lower values indicate better attack effectiveness.

No. Benign CAVs	ROBOSAC	CP-Guard	GCP	CAD
1	13.6	16.4	12.5	15.1
2	14.8	17.2	13.0	32.0
3	14.9	18.0	13.2	36.2

Appendix

Table 4: Defense success rates (%) with varying numbers of benign CAVs. Lower values indicate better attack effectiveness.

BRS Error Rate	ROBOSAC	CP-Guard	GCP	CAD
10%	14.8	17.0	13.0	34.2
20%	15.1	17.4	13.1	40.5
30%	15.2	17.3	13.2	52.1

Appendix

Table 5: Defense success rates (%) under different BRS error rates. Lower values indicate better attack effectiveness.

Methods	0-frame	1-frame	3-frame
Basic Attack [ 31 ]	24.4	24.4	24.4
RC Attack [ 39 ]	17.9	24.2	33.8
BAC Attack [ 29 ]	10.8	15.0	18.4
MVIG Attack (Ours)	15.6	21.3	29.9

Appendix

Table 6: Runtime comparison across different attack methods (FPS).

Method	Component Runtime					Avg. FPS
Method	Mask Gen.	Ray-Cast	PGD Opt.	Attack Trans.	Others	$p=0$	$p=1$	$p=3$
Basic Attack [ 31 ]	N/A	N/A	40 ms	N/A	1 ms	24.4	24.4	24.4
BAC Attack [ 29 ]	49/(1+ $p$ ) ms	N/A	42 ms	N/A	2 ms	10.8	15.0	18.4
RC Attack [ 39 ]	N/A	Offline	88/(2+ $p$ ) ms	3 ms	9 ms	17.9	24.2	33.8
MVIG Attack (Ours)	14/(2+ $p$ ) ms	Offline	88/(2+ $p$ ) ms	3 ms	10 ms	15.6	21.3	29.9

Appendix

Table 7: Runtime comparison of different attack methods. The persistence parameter

p

represents the number of consecutive frames covered by a single optimization. N/A indicates the process is not part of the attack, while Offline indicates the process is pre-computed and not included in real-time application.

Component	Shape/Value	Description
Input Data Structure
Temporal Graphs	List of Dictionaries	Sequence of graph structures
Node Features Composition
Basic Features	[3]	Normalized occupancy frequencies
Position-Pose	[6]	CAV position and orientation
Spatial Features	[91]	Multi-scale pooled features

Appendix

Table 8: MVIGNet Architecture and Parameters

Method	System	Prerequisites	Real-time	Targeted	Attack Type		Stealthiness
Method	System	Prerequisites	Real-time	Targeted	Spoof	Remove	Timing	Region
GPS/LiDAR spoofing [ 24 , 6 ]	Single	Laser emitters	✓	✓	✓	✓	✗	✗
Physical attack [ 30 ]	Single	Physical access	✓	✓	✗	✓	✗	✗
Output manipulation [ 12 , 10 ]	Late fusion	None	✓	✓	✓	✓	✗	✗
Basic feature attack [ 31 ]	Int. fusion	Local computing	✗	✗	✓	✗	✗	✗
RC attack [ 39 ]	Int. fusion	Local computing	✓	✓	✓	✓	✗	✗

Appendix

Table 9: Comparison of existing attack methods in collaborative perception. ✓ indicates the feature is supported, while ✗ indicates it is not.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

Adversarial Trust Poisoning in Vehicular Collaborative Perception
May 21, 2026Yutong Liu, Chenyi Wang, Ming F. Li +1Autonomous Driving Trust in AI
ECE Department, The University of Arizona, Tucson, AZ
All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference
Mar 9, 2026Yi Yu, Libing Wu, Zhuangzhuang Zhang +3Adversarial Robustness Cooperative Perception
School of Cyber Science and Engineering, Wuhan University · Cyberspace Institute of Advanced Technology, Guangzhou University
Investigating Adversarial Robustness of Heterogeneous Cooperative Perception
Sep 15, 2026Chenyi Wang, Yutong Liu, Qingzhao Zhang +1Adversarial Attacks Adversarial Robustness
School of Electrical, Computing, and Software Engineering University of Arizona Tucson, AZ 85721 USA

May 21, 2026J/K move · Enter open · S save

Adversarial Trust Poisoning in Vehicular Collaborative Perception

Yutong Liu, Chenyi Wang, Ming F. Li, Qingzhao Zhang

ECE Department, The University of Arizona, Tucson, AZ

Autonomous Driving Trust in AI Cooperative Perception Physical Adversarial Attacks

Open paper AskPDF arXiv

Collaborative perception (CP) enables connected and autonomous vehicles to share sensor data and jointly reason about their environment. To defend against adversaries that fabricate or manipulate shared data, existing systems employ cross-vehicle inconsistency detection and trust estimation, penalizing vehicles whose observations conflict with the majority. In this work, we show that these defenses themselves introduce a new attack surface. We present TrustFlip, a novel attack that weaponizes consistency-based defenses to poison the trust assigned to benign vehicles. Instead of injecting false data into the collaboration pipeline, it deploys physical adversarial objects that are genuine but induce inconsistent observations among benign vehicles. The resulting inconsistencies are misattributed by the defense to the targeted vehicle, causing its trust score to degrade and eventually leading to its downweighting or exclusion from collaboration. Consequently, the system loses reliable sensing contributors, degrading perception capability and potentially inducing safety-critical failures. We evaluate TrustFlip across multiple collaborative perception architectures and defense mechanisms. Our results show that state-of-the-art defenses can be significantly affected: the attack removes the targeted benign vehicle from collaboration in up to 87.7% of scenarios and drops Average Precision (AP) by up to 13%. As an initial mitigation, we introduce TrustReflect, a lightweight self-reflection mechanism that marks disputed regions as uncertain and excludes them from trust evaluation, reducing the attack success rate by 35-100%.

Abstract

Adversarial Attacks

Explore similar work

Adversarial Trust Poisoning in Vehicular Collaborative Perception

All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference

Investigating Adversarial Robustness of Heterogeneous Cooperative Perception