CP-FREEZER: Latency Attacks against Vehicular Cooperative Perception

2025-08-01

AI Summary

Vehicle cooperative perception (CP) systems exhibit insufficient robustness against timeliness attacks, posing critical safety threats to autonomous driving. This paper introduces, for the first time, a vehicle-to-vehicle (V2V) message injection-based delay attack targeting CP availability. To overcome challenges including non-differentiable point cloud preprocessing and asynchronous inputs, we design a novel non-differentiable optimization loss function that maximizes end-to-end pipeline execution latency. Integrating adversarial perturbation generation, realistic V2V communication simulation, and end-to-end latency measurement, we implement and validate the attack on a real in-vehicle platform. Experiments demonstrate a >90× increase in end-to-end processing latency, with per-frame inference exceeding 3 seconds and a 100% attack success rate. This work uncovers a fundamental availability-oriented security vulnerability in CP systems and establishes a new paradigm for evaluating and defending against timeliness attacks in cooperative perception.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Cooperative perception (CP) enhances situational awareness of connected and autonomous vehicles by exchanging and combining messages from multiple agents. While prior work has explored adversarial integrity attacks that degrade perceptual accuracy, little is known about CP's robustness against attacks on timeliness (or availability), a safety-critical requirement for autonomous driving. In this paper, we present CP-FREEZER, the first latency attack that maximizes the computation delay of CP algorithms by injecting adversarial perturbation via V2V messages. Our attack resolves several unique challenges, including the non-differentiability of point cloud preprocessing, asynchronous knowledge of the victim's input due to transmission delays, and uses a novel loss function that effectively maximizes the execution time of the CP pipeline. Extensive experiments show that CP-FREEZER increases end-to-end CP latency by over $90 imes$, pushing per-frame processing time beyond 3 seconds with a 100% success rate on our real-world vehicle testbed. Our findings reveal a critical threat to the availability of CP systems, highlighting the urgent need for robust defenses.

Problem

• Attacks on timeliness in vehicular cooperative perception systems
• Maximizing computation delay via adversarial V2V message injection
• Non-differentiability and transmission delays in CP pipeline challenges

Innovation

• Adversarial perturbation injection via V2V messages
• Novel loss function maximizing execution time
• Non-differentiable point cloud preprocessing solution