PHANTOM: PHysical ANamorphic Threats Obstructing Connected Vehicle Mobility

AI summary

Overview

Research area: Adversarial machine learning against camera-based perception in connected autonomous vehicles (CAVs), combined with V2X network-level simulation. The paper sits at the intersection of computer vision security, autonomous driving, and vehicular communication networks.

Technical level: Advanced. The paper assumes familiarity with object detection architectures (YOLO, SSD, Faster R-CNN, RetinaNet), adversarial example generation, geometric projection, and vehicular network metrics such as Peak Age of Information (PAoI).

Scope: The paper introduces a perspective-dependent physical adversarial attack built from anamorphic road art, evaluates its success against four detector architectures in the CARLA simulator, and measures the cascade effect of the resulting false emergency messages in a SUMO–OMNeT++ co-simulation.

What This Paper Is About

Camera-based autonomous vehicle perception can be fooled by physical objects placed in the real world, but prior physical attacks use conspicuous patches or textures, and they have been studied almost entirely in isolated single-vehicle settings. PHANTOM shows that a geometrically distorted road marking, which looks like ordinary paint to a human passerby, can resolve into a realistic 3D vehicle illusion from the exact viewpoint of an approaching ego vehicle, causing high-confidence misclassification. The paper then goes further than perception: when the fooled vehicle broadcasts a false emergency Basic Safety Message (BSM), the deception propagates through the connected vehicle network and degrades safety-critical communication for everyone in range.

Key Contributions

1. A perspective-dependent physical attack using anamorphic art. PHANTOM projects an object image onto a road-plane grid transformed into an isosceles trapezoid, so the illusion only becomes a coherent 3D object when viewed from a specific camera height, distance, and angle. The design is geometry-aware rather than texture-based.

2. An anamorphic adversarial example generation pipeline that is black-box and environmentally resilient. The attack optimizes anamorphic parameters without access to model internals, enforces printable color and contrast constraints, and is validated across varying weather, lighting, and vehicle speeds in CARLA.

3. The first demonstration that a perspective-dependent physical attack propagates through V2X. Localized perception failure triggers SAE J2735 emergency messages that spread via DSRC (IEEE 802.11p), and the paper quantifies the resulting degradation of Peak Age of Information (PAoI) across the network.

4. A cross-architecture transferability study and feature-level explanation. The attack is optimized only on YOLOv2 as a surrogate, then tested on four unseen detectors, with Grad-CAM and feature-map correlation analysis explaining why the transfer works.

Main Findings

• Activation distance and speed relationship: The adversarial examples begin deceiving detectors once the ego vehicle crosses the 10 m threshold and reach 100% ASR before 7 m across all tested speeds (20–50 mph). At 30–40 mph the attack initiates from 8 m, leaving only 0.4–0.6 seconds of reaction time, which the authors note is below the 1.5 seconds minimum required per NHTSA standards. At 50 mph the window shrinks to 0.18 seconds.

• Attack success in CARLA: The paper reports that in the CARLA setup of Fig. 3, the target misdetects the adversarial example with 99% accuracy. The overall claim is over 90% attack success rate under optimal conditions and 60–80% effectiveness in degraded environments.

• Weather robustness (Table I): AUC is 0.714 under sunny and 0.714 under cloudy conditions, dropping to 0.560 under rainy conditions. Peak attack start distance is 8 m for sunny and cloudy, and 7 m for rainy.

• Lighting robustness (Table I): AUC is 0.619 in the evening and 0.631 at night, with peak attack start at 7 m for both. Evening and night scenarios maintain 50–100% ASR within 4–7 m.

• Cross-model transferability (Table II): Optimized only on YOLOv2, PHANTOM reaches 100% ASR from 9 m on Faster R-CNN, from 7 m on YOLOv5 and SSD, and only at 6 m on RetinaNet with below 70% elsewhere. Highest reported accuracy per model is 0.99 (Faster R-CNN), 0.99 (YOLO), 0.95 (SSD), and 0.88 (RetinaNet). AUC values are 0.714 (Faster R-CNN), 0.524 (YOLO), 0.536 (SSD), and 0.274 (RetinaNet). RetinaNet's weaker result is attributed to its lower baseline detection accuracy of 65–75% versus 85–95% for the other models, not to a lack of attack robustness.

• Feature-level explanation: Grad-CAM on YOLOv5 shows attention concentrating on the wheel and rear-edge textures of the projected illusion. Global Average Pooling followed by feature-map correlation between benign and PHANTOM images yields a correlation coefficient of approximately 0.97, and feature values of the original and anamorphic images are nearly identical.

• Network-level cascade: A misclassified illusion triggers the SAE J2735 emergency protocol, generating high-priority BSMs that propagate to all vehicles within the 300 m RSU communication range via DSRC (IEEE 802.11p). Emergency BSMs transmit at 10 Hz versus 1 Hz normally, overwhelming RSU capacity.

• Peak Age of Information increase: PAoI is 68% higher with 60 vehicles (287 ms, up from 170 ms) and 89% higher with 120 vehicles (321 ms, up from 170 ms). As packet size grows from 1000 to 8000 bits, PAoI at 60 vehicles rises from 260 to 340 ms, a 31% increase.

• Comparison with ShapeShifter: In the CARLA environment, ShapeShifter achieves 0.15 AUC while PHANTOM achieves 0.71 AUC, a reported 4.7× more robust and sustained attack within the target band.

• Three-stage cascade: The paper describes the network effect as (1) hard braking, (2) emergency BSM flooding, and (3) reactive braking and route recalculation by surrounding vehicles, producing traffic congestion.

Methodology in Plain English

The starting point is a geometric trick borrowed from anamorphic street art. The researchers take an image of a vehicle and lay a rectangular grid over it. They then reshape that grid into an isosceles trapezoid that matches what an ego vehicle's camera would see from a chosen height and distance, and they remap the image back onto the flat road plane. From most angles the result looks like a stretched, unremarkable road marking. From the "sweet spot" — defined by camera height H, viewing distance d, and desired illusion height h — it snaps into a recognizable 3D vehicle.

Three geometric relations drive the construction: the far-edge distance L_g = d·h/(H−h), the far-edge width w_far = w·H/(H−h), and the trapezoid base angle θ = arctan(w/(2d)).

To pick the best parameters (d, w, h), the authors run a two-step search: a coarse grid search over the ranges D, W, and B to find promising candidates, followed by local refinement using Bayesian optimization that maximizes the detector's loss on the transformed image. Each candidate is scored using YOLOv2 as a surrogate, so no target model internals are needed. During optimization the colors and contrasts are restricted to printable ranges and the pattern is regularized to keep a natural appearance.

For deployment, the pattern can be printed as a high-resolution decal or stenciled onto asphalt at locations with predictable trajectories such as intersections, straight roads, or roundabouts. The attacker estimates camera height H and approach distance d from public vehicle specifications or field observation. The threat model explicitly excludes any tampering with sensors, software, or communication channels.

Evaluation runs on two fronts. Perception experiments use CARLA with camera parameters matching typical production cameras at a 90° field of view, testing clear, cloudy, and rainy weather and noon, evening, and night lighting at speeds from 20 to 50 mph. Distance analysis samples 5 positions uniformly within each 1 m distance bin and repeats each configuration 5 times with different random seeds, giving 25 measurements per bin. Network experiments use SUMO for vehicle mobility and OMNeT++ with IEEE 802.11p for V2X data exchange between roadside units and vehicles. Source object images for the illusions come from the CarWale360 dataset, which provides 360° multi-view captures of production vehicles. All models are implemented in PyTorch and evaluated on NVIDIA GPUs.

Two metrics are used. Attack Success Rate (ASR) is the percentage of frames within each bin where the illusion causes misclassification while detection accuracy stays above 80%, ensuring the attack is measured only under confident predictions. AUC is the ratio of cumulative ASR to the maximum possible ASR over the critical 3–9 m range, capturing consistency and strength across distances.

Why This Matters

Impact on research. The paper reframes physical adversarial attacks as a geometry problem rather than a texture problem, and it extends the threat model from a single vehicle to an entire connected network. The feature-map correlation finding (approximately 0.97 between benign and adversarial images) offers a mechanistic explanation for why the attack transfers across detector families: it preserves the mid-level convolutional patterns that CNN-based detectors associate with real objects.

• Road marking and signage standards: The attack disguises itself as ordinary road paint, which complicates visual inspection regimes for pavement markings at intersections, crossings, and roundabouts.

• AV perception testing and safety certification: Because the attack reaches 100% ASR only 6–10 m from the target and leaves 0.18 seconds at 50 mph, it exposes a gap between detection benchmarks and the reaction-time requirements (1.5 seconds per NHTSA standards) used in safety validation.

• V2X protocol design: Emergency BSM flooding at 10 Hz versus the normal 1 Hz, within a 300 m RSU range, shows that one false positive can starve the channel and delay real safety messages, raising questions about message authentication and rate-limiting in DSRC/IEEE 802.11p deployments.

• Multi-layer security auditing for CAV fleets: The paper argues that perception and communication layers must be audited jointly, since a single strategically placed pattern can reduce an entire traffic network's situational awareness.

Industry relevance. Manufacturers that rely primarily on camera-based perception, V2X infrastructure vendors, RSU operators, and regulators setting physical-world adversarial testing requirements all have a direct stake. The paper also surveys proposed defenses — LiDAR at 905 nm time-of-flight and radar at 77 GHz FMCW for 3D geometry validation, Kalman-based temporal filtering, network-level consensus, adversarial training, and collaborative perception — and notes that each carries cost, latency, or coverage limitations.

Future Directions

1. Geometry-aware cooperative defenses. The authors state that future work will focus on defenses integrating redundant sensing, BEV-map fusion, and cross-vehicle validation to preserve resilient real-time perception integrity.

2. Defense evaluation against PHANTOM specifically. The paper notes that adversarial training cannot span the full geometric parameter space of PHANTOM attacks, and that temporal filtering fails during abrupt maneuvers — opening the question of which defense, or combination, actually holds under this threat.

3. Extending perspective-dependent attacks beyond the tested detectors. The transferability results already span one-stage and two-stage detectors, but whether the approach affects transformer-based or other perception paradigms is not reported.

4. Real-world field validation. All results come from CARLA and SUMO–OMNeT++ co-simulation; the paper describes physical deployment via printed decal or stencil but the content does not report an outdoor road test.

Target Audience

This paper is most useful to adversarial machine learning researchers working on physical-world attacks, autonomous vehicle perception and safety engineers, and V2X protocol and infrastructure designers. It also serves security researchers studying multi-layer attack surfaces, and regulators or standards bodies concerned with how physical-world manipulation of road markings can interact with both camera perception and Basic Safety Message traffic. Readers without a background in adversarial examples or vehicular networking will need to work through the geometric derivations and detector terminology, but the core argument is accessible at a conceptual level.

Authors’ abstract

Connected autonomous vehicles (CAVs) rely on vision-based deep neural networks (DNNs) and low-latency (Vehicle-to-Everything) V2X communication to navigate safely and efficiently. Despite their advances, these systems remain vulnerable to physical adversarial attacks. In this paper, we introduce PHANTOM (PHysical ANamorphic Threats Obstructing connected vehicle Mobility), a novel framework for crafting and deploying perspective-dependent adversarial examples using \textit{anamorphic art}. PHANTOM exploits geometric distortions that appear natural to humans but are misclassified with high confidence by state-of-the-art object detectors. Unlike conventional attacks, PHANTOM operates in black-box settings without model access and demonstrates strong transferability across four diverse detector architectures (YOLOv5, SSD, Faster R-CNN, and RetinaNet). Comprehensive evaluation in CARLA across varying speeds, weather conditions, and lighting scenarios shows that PHANTOM achieves over 90\% attack success rate under optimal conditions and maintains 60-80\% effectiveness even in degraded environments. The attack activates within 6-10 meters of the target, providing insufficient time for safe maneuvering. Beyond individual vehicle deception, PHANTOM triggers network-wide disruption in CAV systems: SUMO-OMNeT++ co-simulation demonstrates that false emergency messages propagate through V2X links, increasing Peak Age of Information by 68-89\% and degrading safety-critical communication. These findings expose critical vulnerabilities in both perception and communication layers of CAV ecosystems.