All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference

Yi Yu; Libing Wu; Zhuangzhuang Zhang; Jing Qiu; Lijuan Huo; Jiaqi Feng

cs.CVMar 9, 2026

All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference

Authors: Yi Yu, Libing Wu, Zhuangzhuang Zhang, Jing Qiu, Lijuan Huo, Jiaqi Feng

Organizations: School of Cyber Science and Engineering, Wuhan University · Cyberspace Institute of Advanced Technology, Guangzhou University

Abstract

Collaborative perception (CP) enables multiple vehicles to augment their individual perception capacities through the exchange of feature-level sensory data. However, this fusion mechanism is inherently vulnerable to adversarial attacks, especially in fully untrusted-vehicle environments. Existing defense approaches often assume a trusted ego vehicle as a reference or incorporate additional binary classifiers. These assumptions limit their practicality in real-world deployments due to the questionable trustworthiness of ego vehicles, the requirement for real-time detection, and the need for generalizability across diverse scenarios. To address these challenges, we propose a novel Pseudo-Random Bayesian Inference (PRBI) framework, a first efficient defense method tailored for fully untrusted-vehicle CP. PRBI detects adversarial behavior by leveraging temporal perceptual discrepancies, using the reliable perception from the preceding frame as a dynamic reference. Additionally, it employs a pseudo-random grouping strategy that requires only two verifications per frame, while applying Bayesian inference to estimate both the number and identities of malicious vehicles. Theoretical analysis has proven the convergence and stability of the proposed PRBI framework. Extensive experiments show that PRBI requires only 2.5 verifications per frame on average, outperforming existing methods significantly, and restores detection precision to between 79.4% and 86.9% of pre-attack levels.

Figures & tables

Figure 1: The Pseudo-Random Bayesian Inference (PRBI) framework methodology overview.

Attacker Number ( $n=5$ )	1	2	3	4
Theoretical Prob. $P_{ideal}$	0.484	0.226	0.097	0.032
Approximate Prob. $P_{ideal}^{\prime}$	0.500	0.250	0.125	0.063
Validation Frame Count	40	29	28	21
Practical All-Benign Prob. $\eta$	0.491	0.258	0.103	0.045

Table 1: Comparison between the theoretical probability of sampling an all-benign group and the empirical probability obtained by randomly splitting vehicles into two groups. The frame count is recorded once the observed probability

\eta

converges to

P_{ideal}^{\prime}

Methods	Metric $\downarrow$	Attacker Ratio (%)				Avg. $\downarrow$
Methods	Metric $\downarrow$	20	40	60	80	Avg. $\downarrow$
ROBOSAC [ 15 ]	Min	1	1	1	1	1.0
	Max	19	39	46	17	30.3
	Avg	4.89	10.36	8.29	4.73	7.1
PASAC [ 9 ]	Min	4	4	6	8	5.5
	Max	6	8	8	8	7.5

Table 2: Comparison of the verification count per frame. The best results are marked in blue . PRBI yields the lowest detection cost.

Methods	Mean Fusion		Max Fusion		Sum Fusion		V2VNet [ 30 ]		DiscoNet [ 17 ]
Methods	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$	[email protected] $\uparrow$
Upper-Bound	79.57	75.34	78.62	75.07	77.88	74.38	80.73	78.35	80.52	76.72
Attack $w$ PGD	16.51	14.60	27.16	26.45	13.65	7.31	17.02	14.53	20.97	19.54
PRBI against PGD	$\text{65.36}_{{\color[rgb]{0,0,1}+48.85}}$	$\text{61.44}_{{\color[rgb]{0,0,1}+46.84}}$	$\text{64.89}_{{\color[rgb]{0,0,1}+37.73}}$	$\text{62.02}_{{\color[rgb]{0,0,1}+35.57}}$	$\text{70.78}_{{\color[rgb]{0,0,1}+57.13}}$	$\text{67.67}_{{\color[rgb]{0,0,1}+60.36}}$	$\text{68.93}_{{\color[rgb]{0,0,1}+51.91}}$	$\text{63.82}_{{\color[rgb]{0,0,1}+49.29}}$	$\text{69.18}_{{\color[rgb]{0,0,1}+48.21}}$	$\text{65.68}_{{\color[rgb]{0,0,1}+46.14}}$
Attack $w$ BIM	13.67	9.08	33.54	32.71	4.56	4.13	13.51	11.69	21.02	18.53
PRBI against BIM	$\text{66.37}_{{\color[rgb]{0,0,1}+52.70}}$	$\text{60.72}_{{\color[rgb]{0,0,1}+51.64}}$	$\text{65.87}_{{\color[rgb]{0,0,1}+32.33}}$	$\text{63.30}_{{\color[rgb]{0,0,1}+30.59}}$	$\text{70.81}_{{\color[rgb]{0,0,1}+66.25}}$	$\text{67.65}_{{\color[rgb]{0,0,1}+63.52}}$	$\text{68.76}_{{\color[rgb]{0,0,1}+55.25}}$	$\text{64.88}_{{\color[rgb]{0,0,1}+53.19}}$	$\text{66.17}_{{\color[rgb]{0,0,1}+45.15}}$	$\text{63.27}_{{\color[rgb]{0,0,1}+44.74}}$

Table 3: Detection performance when

n=5

and

k=2

under different fusion strategies. Lower-Bound denotes single-vehicle perception, while Upper-Bound represents collaborative perception without attacks. ‘

w

’ indicates ‘with’. Best results are marked in blue , and comparisons with baseline methods demonstrate the average defense performance across test datasets.

Figure 2: Visualization of defense performance with green boxes for ground truth and red boxes for predictions.

Settings	Count		Avg. Count		Avg.	Avg.	ID	MC
Settings	Min	Max	Min	Max	Avg.	Frames	Rate	Rate
Attacker Ratio
Ratio 80%	2	8	2.00	5.70	2.86	4.27	100%	0%
Ratio 60%	2	6	2.00	4.06	2.61	3.36	100%	0%
Ratio 40%	2	4	2.00	2.88	2.35	2.77	100%	6%
Ratio 20%	2	2	2.00	2.00	2.00	2.25	100%	0%

Table 4: Impact of different test parameters on defense effect. Min/Max : verification count range. Avg. Min/Max : average verification counts. Avg. : overall average count. Avg. Frames : average frames to convergence. ID Rate : malicious vehicle identification rate. MC Rate : benign vehicle misclassification rate.

Panel of Figure 3 — Figure 3: Convergence behavior of $m$ with total 6 vehicles under different rounding strategies. The blue solid line denotes the value of $m$ calculated using Eq. 9 , the green dashed line marks the true number of attackers $k$ , and the red dashed line represents the theoretically derived convergence value in Theorem 2 .

Panel of Figure 4 — Figure 4: The convergence characteristics of PRBI’s frame-by-frame estimation of the calculated malicious vehicles number $m$ .

Panel of Figure 5 — Figure 5: The probability of malicious behavior for all vehicles under varying numbers of attackers.

Panel of Figure 6 — Figure 6: Hypothesis verification experiments. We report the Jaccard similarity of detected object sets between consecutive frames for: (a)-(b) normal conditions (Upper-Bound: all vehicles collaborate; Lower-Bound: ego-only perception), and (c)-(e) adversarial conditions (BIM, C&W, and PGD). Plots are based on statistics from two randomly selected representative scenes for readability; trends are consistent across all tested scenes and scenarios (urban, suburban, intersection).

Figure 7: Example LiDAR point clouds illustrating three representative driving scenes in V2X-Sim dataset: urban, suburban, and intersection.

Settings	Count		Avg. Count		Avg.	Avg.	ID	MC
Settings	Min	Max	Min	Max	Avg.	Frames	Rate	Rate
Confidence Level (20% Attackers)
Conf. 0.20	2	2	2.00	2.00	2.00	2.53	100%	0%
Conf. 0.15	2	2	2.00	2.00	2.00	2.27	100%	0%
Conf. 0.10	2	2	2.00	2.00	2.00	2.29	100%	0%
Conf. 0.05	2	2	2.00	2.00	2.00	2.19	100%	0%

Table 5: Comprehensive experimental results of different test parameters on defense effect. ID Rate : malicious vehicle identification rate. MC Rate : benign vehicle misclassification rate.

	V2VNet		DiscoNet
Methods	[email protected] / 0.7	ID / MC	[email protected] / 0.7	ID / MC
1 frame	68.91 / 65.57	100% / 0%	69.37 / 65.89	100% / 0%
3 frames	70.97 / 65.91	100% / 0%	69.12 / 66.27	100% / 0%
5 frames	73.52 / 67.04	100% / 0%	70.43 / 66.91	100% / 0%

Table 6: Defense performance under intermittent attacks.

ID Rate: 100%, MC Rate: 0% across all settings
$\epsilon$	[email protected] / 0.7	Avg. Convergence Frames
0.30	69.17 / 64.14	2.41
0.35	69.44 / 66.00	2.74
0.40	68.61 / 64.14	2.90
0.45	69.40 / 65.80	2.93
0.50	67.47 / 64.96	2.88

Table 7: Sensitivity of PRBI to similarity threshold

\epsilon

under standard adversarial settings.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Adversarial Trust Poisoning in Vehicular Collaborative Perception
May 21, 2026Yutong Liu, Chenyi Wang, Ming F. Li +1Autonomous Driving Trust in AI
ECE Department, The University of Arizona, Tucson, AZ
Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perception
Feb 23, 2026Yihang Tao, Senkang Hu, Haonan An +3Adversarial Attacks Cooperative Perception
Hong Kong JC STEM Lab of Smart City · City University of Hong Kong
Investigating Adversarial Robustness of Heterogeneous Cooperative Perception
Sep 15, 2026Chenyi Wang, Yutong Liu, Qingzhao Zhang +1Adversarial Attacks Adversarial Robustness
School of Electrical, Computing, and Software Engineering University of Arizona Tucson, AZ 85721 USA

May 21, 2026J/K move · Enter open · S save

Adversarial Trust Poisoning in Vehicular Collaborative Perception

Yutong Liu, Chenyi Wang, Ming F. Li, Qingzhao Zhang

ECE Department, The University of Arizona, Tucson, AZ

Autonomous Driving Trust in AI Cooperative Perception Physical Adversarial Attacks

Open paper AskPDF arXiv

Collaborative perception (CP) enables connected and autonomous vehicles to share sensor data and jointly reason about their environment. To defend against adversaries that fabricate or manipulate shared data, existing systems employ cross-vehicle inconsistency detection and trust estimation, penalizing vehicles whose observations conflict with the majority. In this work, we show that these defenses themselves introduce a new attack surface. We present TrustFlip, a novel attack that weaponizes consistency-based defenses to poison the trust assigned to benign vehicles. Instead of injecting false data into the collaboration pipeline, it deploys physical adversarial objects that are genuine but induce inconsistent observations among benign vehicles. The resulting inconsistencies are misattributed by the defense to the targeted vehicle, causing its trust score to degrade and eventually leading to its downweighting or exclusion from collaboration. Consequently, the system loses reliable sensing contributors, degrading perception capability and potentially inducing safety-critical failures. We evaluate TrustFlip across multiple collaborative perception architectures and defense mechanisms. Our results show that state-of-the-art defenses can be significantly affected: the attack removes the targeted benign vehicle from collaboration in up to 87.7% of scenarios and drops Average Precision (AP) by up to 13%. As an initial mitigation, we introduce TrustReflect, a lightweight self-reflection mechanism that marks disputed regions as uncertain and excludes them from trust evaluation, reducing the attack success rate by 35-100%.

Abstract

Adversarial Robustness

Explore similar work

Adversarial Trust Poisoning in Vehicular Collaborative Perception

Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perception

Investigating Adversarial Robustness of Heterogeneous Cooperative Perception