cs.ROAug 26, 2026

Phantom Navigator: Stealthy and Precise Unmanned Aerial Vehicle Redirection with Real-Time Tracking and GPS Spoofing

Authors: Haocheng Meng, Shaocheng Luo, Songqiao Xie, Miroslav Pajic

Organizations: Duke University Durham, North Carolina, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Redirecting unmanned aerial vehicles (UAVs) from their intended mission trajectories has been an active area of research. However, existing UAV redirection attacks lack reliability, precision, and covertness for a targeted diversion. They primarily rely on physical capture, communication hijacking, or sensor spoofing. Yet, physical interception is costly, offers only a single opportunity for success, and poses a high risk of collateral damage; network-based attacks demand deep technical expertise and access to encrypted communication channels; and sensor spoofing techniques typically fall short in achieving the accuracy and robustness required to steer a UAV toward a specified target. Consequently, we propose Phantom Navigator, a UAV redirection attack to mislead drones to a designated spoofing target, covertly and precisely. Our approach combines offline pre-redirection reachability analysis, which provides high-fidelity estimates of achievable redirect ranges, with an online closed-loop, stealthy execution layer that ensures successful redirection in practice. Based on this approach, we build a physical attack platform equipped with a LiDAR--camera detection, tracking, and spoofing stack that performs real-time identification, pose estimation, and computation of targeted spoofing signals to covertly and accurately redirect victim UAVs to a designated location. We demonstrate the effectiveness of our redirection methodology and the attack implementation in real-world case studies.

Figures & tables

Figure 1. Existing UAV redirection attack approaches: ( ii ) Wireless hijacking; ( iiii ) Redirection using GPS spoofing.
Figure 2. Overview of the proposed UAV redirection framework. The offline stage estimates feasible redirection range, while the online stage performs closed-loop stealthy GPS manipulation using real-time victim pose estimation.
KnowledgeMission AssumptionWorst-case PredictionEffect on Redirection Range
0–Black-boxNo victim mission information is known.Victim may follow any feasible nominal evolution.Produces the most conservative baseline estimate; no prior knowledge is required for attack.
1–DestinationOnly the final destination is known.Victim heads directly toward the destination at maximum speed.Removes missions inconsistent with the known destination, expanding the range where redirection can be achieved with higher confidence.
2–Mission trajectoryThe geometric route is known, but not its precise timing.Victim traverses the known route at maximum speed.Further removes path-inconsistent evolutions, yielding a less conservative and more informative range estimate.
3–Motion planningBoth the route and timing are known.Worst-case and nominal evolution coincide.Provides the least conservative estimate, with the smallest uncertainty in achievable rerouting.
Table 1. Mission knowledge levels and their impact on redirection range estimation.
Figure 3. Redirection range estimation compared with Monte-Carlo verification under different knowledge levels. Left to right: destination-only, mission trajectory and motion planning, with increased overlap with Monte-Carlo results.
Figure 4. Redirection control results and stealthiness statistics of three different victim mission trajectories. Left to right: single line, zig-zag and circle trajectory. The statistics include redirection acceleration norm, CUSUM and χ2\chi^{2} anomaly detector scores.
Figure 5. Full-stack attacker platform for stealthy UAV redirection, with LiDAR-camera detection, tracking and spoofing.
Figure 6. Experimental setup and sensing pipeline. Left: attacker-side tracking platform equipped with an Intel NUC, RealSense D435i, and Livox Mid-360. Middle-left: victim UAV with onboard mission computer. Middle-right and right: LiDAR–camera victim detection and pose estimation in indoor VICON and outdoor GPS-enabled environments.
Figure 7. Physical pipeline latency of tracker, attacker to victim transmission and asynchronous UAV identification.
Figure 8. Real-time UAV redirection results indoors. Left: the actual and estimated position comparison of the victim drone in a targeted redirection; Middle: tracker performance in 3D positions; Right: redirection visualizations on 10 randomized targets.
Table 2. Redirection accuracy for indoor and outdoor attacks.
Figure 9. Anomaly detection results for indoor redirection attacks. Left: nominal flight with tuned detector thresholds. Middle: attack-aligned time-series response in the attack window with raw detector statistics in the case study. Right: aggregate detector statistics (threshold-normalized for comparing χ2\chi^{2} and CUSUM) over ten hovering attack trials.
Figure 10. Outdoor redirection case study. Left: spoofed victim trajectory. Right: attacker side signal generation.
Figure 11. Outdoor targeted redirection against a moving victim UAV in the NED frame. Left: Type I—lateral redirection. Middle: Type II—halting redirection. Right: Type III—turn-back redirection. Each type is shown with two trials.
Figure 12. Anomaly detection results outdoors. Left: nominal response; Middle: attack case study; Right: aggregate statistics.
Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Figure 13. Redirection result in X-axis under intermittent tracker loss with recovered redirection command.
More in this topic

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 451 papers

Explore similar work

CardsList
Jul 22, 2026

Remote ID Spoofing-Aware Trajectory Planning for Small Unmanned Aerial Systems

This work presents a decentralized, spoofing-aware trajectory planning framework for small unmanned aerial systems operating under Remote Identification (RID) location spoofing attacks. Existing planners typically assume RID broadcasts are trustworthy, which can increase the risk of loss of separation and mid-air collisions when spoofing occurs. In contrast, the proposed approach explicitly treats RID information as unverified and incorporates physical-layer observations to assess broadcast credibility. Received signal-strength measurements from neighboring aircraft are used to detect spoofing and probabilistically localize a spoofing agent. The resulting uncertainty is converted into a risk-bounded unsafe region using a chance-constrained formulation and integrated into a per-agent Markov decision process-based planner. This enables real-time, decentralized collision avoidance while preserving mission objectives and scalability. Simulation results in a multi-aircraft package delivery scenario demonstrate reduced near mid-air collision events compared to planners that assume truthful RID data, while maintaining computational efficiency suitable for real-time execution.

Jeremiah Webb, Bryce Bjorkman, Abel Diaz Gonzalez +7

Vanderbilt University, Nashville, TN, USA · The University of Texas at Austin, Austin, TX, USA

Collision AvoidanceUAV NavigationMulti-Agent Planning
AskPDF
Aug 26, 2026

SonicNudge: Controlled Displacement of Hovering UAVs via Estimator-Controller Coupling

UAV displacement attacks have traditionally relied on spoofing sensors that directly report position or translational motion, such as GNSS and optical flow. In this work, we introduce SonicNudge, a new attack primitive that instead targets the gyroscope and shows that low-level inertial errors can be transformed into controlled displacement of hovering or slow-moving UAVs. The attack exploits estimator--controller coupling: a small gyroscope perturbation by ultrasonic resonance can persist as an attitude-estimation bias, and the flight controller can convert this biased estimate into a shifted hover point. This behavior is especially relevant to UAV tasks that require hovering, station-keeping, slow approach, or precise final alignment, such as perimeter denial, inspection, docking, landing alignment, and close-proximity operation, where meter-scale position errors can be operationally meaningful. We analyze this attack primitive in a PX4-style flight stack and validate it through 81 simulation runs and more than 10 indoor/outdoor physical experiments, showing that displacement is governed by estimator weighting, bias observability, and closed-loop position correction. Our study suggests that UAV and vehicle-system security should look beyond direct navigation spoofing and pay closer attention to low-level inertial errors and estimator--controller coupling as a subtle but important attack surface.

Shaocheng Luo, Ashir Raza, Haocheng Meng +2

Duke University

Adversarial AttacksUAV Navigation
AskPDF
Jul 22, 2026

Decentralized UAV Swarms for Ground Target Protection in GPS- and Communication-Denied Environments

The presence of UAVs in military operations has recently increased, also increasing the demand for defense systems against UAV attacks. UAVs can also be used as countermeasures. Most available methods rely on UAV-to-UAV communication and global positioning. However, such resources may not be available in modern warfare scenarios. To address these limitations, we propose a pipeline for ground-target protection against UAV attacks that employs autonomous swarms of UAVs. We assume a communication- and GPS-denied environment in which the UAVs use onboard sensors to track the target and coordinate as a swarm. We developed Kalman filters to estimate the states of unknown targets and the positions of UAVs in the swarm using only relative measurements. Also, our strategy is to encircle the target of interest to maximize coverage. To achieve that, we propose a decentralized swarm encirclement technique that adapts to the target's motion. Our approach was extensively validated using real robots, demonstrating its effectiveness in detecting, encircling, and intercepting hostile UAVs.

Dimitria Silveria, Paulo Ricardo Marques de Araujo, Tiago Nascimento +1

Department of Electrical and Computer Engineering, and the Ingenuity Labs Research Institute, Queen’s University, Kingston, ON, Canada · School of Computing and the Ingenuity Labs Research Institute, Queen’s University, Kingston, ON, Canada · Lab of Systems Engineering and Robotics (LASER), Department of Computer Systems, Universidade Federal da Para´ıba, and with the Department of Cybernetics, Czech Technical University in Prague, Prague 16629, Czechia

Swarm RoboticsMulti-Robot Coordination
AskPDF