When appearance and motion disagree: evaluating class-motion consistency against disguised uncrewed surface vessels
Organizations: Duke University, Durham, NC, USA
Abstract
Defense systems for maritime assets must distinguish approaching benign craft from uncrewed surface vessels (USVs) with sufficient warning to act. Shore cameras using computer vision can separate hostile vessels from benign traffic, but these systems may be attacked using an adversarial hull patch or physical disguise. We evaluate adversarial hull patches and find they suppress detection in up to 29% of attempts but never cause misclassification as benign. Physical disguise, however, can bypass both a camera check and a radar presence check. To evaluate defenses, we develop a hybrid replay protocol from automatic identification system (AIS) tracks that combines recorded benign motion with direct or off-axis attack run-ins. We find that for recreational-labeled vessels attacking via direct run-in within 4 nautical miles, an asset-relative closing-rate check flags 94-95% at 15-20 knots, compared with 12% for a track-only speed check. The checks are complementary on off-axis approaches, constraining the attacker to remain below both thresholds and extending the time required to reach the asset. Flagging on either check has a 4.9% held-out false-alarm rate overall and 12.3% on recreational traffic. The replay-based evaluation protocol supports comparative test and evaluation of defense methods.
Figures & tables
| Line of work | Viewpoint | Evidence used | Defense |
|---|---|---|---|
| Remote-sensing ship attacks [ 33 , 34 ] | Overhead | Optical or SAR imagery | Retrain on filtered SAR attacks; none for optical patches |
| Onboard maritime autonomy [ 31 , 32 ] | Onboard, at sea | Camera; radar and transponder | Presence-based fusion |
| Onboard USV benchmarks [ 23 ] | Onboard, detection by a craft | Camera, multisensor | None (non-adversarial) |
| Counter-uncrewed-aircraft benchmarks [ 24 ] | Aerial, detection of a drone | Camera | None (non-adversarial) |
| Class–motion consistency [ 25 ] | Onboard, driving | Image-plane box sequences | Supervised class–track check |
| Single-source robustness [ 29 , 28 ] | General, driving | Multimodal features | Cross-modal inconsistency in feature space |
| Metric | Definition |
|---|---|
| Scenario factors | Camera-assigned class; commit range; run-in speed; direct, constant-angle, or dog-leg geometry; and empirical or nominal report gaps. |
| Defensive responses | Presence-check outcome; speed-cutoff flag; closing-rate flag; or abstention when a class or scoring window is unavailable. |
| Evasion success rate (ESR) | Fraction of attacks that hide a previously detected craft from the camera. |
| Targeted misclassification (TMSR) | Fraction of attacks that leave the craft detected but labeled as a benign class, given that the clean image was labeled hostile. |
| Detection rate | Fraction of replays flagged at a checkpoint at or after the commit and before the craft arrives. Reported for the speed-cutoff and closing-rate checks. |
| Flag before the commit | Fraction of replays first flagged before the commit, while the track is still the recorded approach. A false alarm on real motion, not counted as detection. |
| Canonical class | Camera examples | AIS motion-model source | Evaluation use |
|---|---|---|---|
| fishing | Fishing boat, trawler | Type 30 (fishing) | Replay label; benign calibration and FAR |
| sailing | Sailboat | Type 36 (sailing) | Replay label; benign calibration and FAR |
| recreational | Motorboat; evaluated speedboat disguise | Type 37 (pleasure craft) | Primary replay label; benign calibration and FAR |
| passenger_ferry | Passenger ship, ferry, cruise ship | Types 40–49 and 60–69 (high-speed and passenger craft) | Benign calibration and FAR |
| cargo_merchant | Cargo, container, bulk, and tanker vessels | Types 70–89 (cargo and tanker) | Benign calibration and FAR |
| working_service | No dedicated class in the image set | Types 31–34, 50–55, and 58 (towing, pilot, rescue, service) | Motion model retained; current detector does not assign this class |
| n | Speed cutoff | Closing rate | |
|---|---|---|---|
| Fishing | 8 | 0% [0, 56] | 88% [34, 99] |
| Sailing | 9 | 0% [0, 43] | 100% [57, 100] |
| Recreational | 104 | 96% [86, 99] | 99% [91, 100] |
| All replays | 121 | 83% [71, 90] | 98% [91, 100] |
| Any flag, including before the commit | 121 | 83% | 99% |
| Flag before the commit | 121 | 14% | 27% |
| Scorer | FAR | 10 kn | 15 kn | 20 kn | 30.3 kn |
|---|---|---|---|---|---|
| Speed cutoff | 2.8% | 11.4% | 11.5% | 11.5% | 96.2% |
| Closing-rate cutoff | 4.3% | 27.2% | 94.2% | 95.1% | 99.0% |
| Either check | 4.9% | 26.7% | 93.3% | 94.2% | 99.0% |
| Speed, one cutoff | 2.0% | 10.5% | 10.6% | 10.6% | 92.3% |
| Closing rate, one cutoff | 5.1% | 22.3% | 91.3% | 90.3% | 94.1% |
| Mixture, track-only | 3.8% | 1.0% | 1.9% | 1.9% | 9.6% |
| Shape | Leg p90 | Speed detection | Closing detection | Either detection | Warning | |
|---|---|---|---|---|---|---|
| 20 kn, 45 ∘ | 14.2 kn | 104 | 12% | 90% | 89% | 5.3 of 7.1 min |
| 20 kn, 60 ∘ | 10.1 kn | 105 | 11% | 27% | 27% | 0 of 10.1 min |
| 20 kn, 60 ∘ , turn at 1 nm | 10.1 kn | 104 | 12% | 93% | 92% | 0.5 of 8.0 min |
| 30 kn, 70 ∘ | 10.3 kn | 105 | 99% | 27% | 99% | 8.2 of 9.9 min |
| 30 kn, 70 ∘ , turn at 1 nm | 10.3 kn | 104 | 97% | 97% | 99% | 5.3 of 7.2 min |
| 20 kn dog-leg, 2 nm abeam | 18.4 kn | 46 | 11% | 100% | 100% | 16 of 18 min |
| Commit | n | Run-in | Speed cutoff | Closing rate |
| Class-derived speed, 30.3 kn | ||||
| 0.5 nm | 9 | 0.3 min | 100% [70, 100] | 100% [68, 100] |
| 1 nm | 15 | 1.3 min | 100% [78, 100] | 100% [78, 100] |
| 2 nm | 34 | 3.2 min | 97% [84, 100]; 1.2 min | 97% [84, 99]; 1.3 min |
| 4 nm | 46 | 7.2 min | 93% [81, 98]; 5.1 min | 100% [91, 100]; 5.3 min |
| 6 nm | 48 | 11 min | 96% [84, 99]; 9.1 min | 100% [91, 100]; 9.3 min |