PaperlayerView exact revision on arXiv

Source-linked AI summary

Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing (Extended Version)

Junjie Shen, Jun Yeon Won, Zeyuan Chen, Qi Alfred Chen

arXiv:2006.10318v3cs.CRcs.RO

TL;DR

The paper studies whether multi-sensor fusion localization in high-level autonomous vehicles is secure against GPS spoofing. It analyzes takeover vulnerabilities and introduces FusionRipper, which achieves high success rates on real-world sensor traces and remains robust to practical factors.

  • Problem

    The study addresses the lack of evidence about whether production-grade multi-sensor fusion localization sufficiently protects high-level autonomous vehicles from GPS spoofing.

  • Method

    The paper analyzes upper-bound attack effectiveness and develops FusionRipper to opportunistically exploit dynamically occurring takeover vulnerabilities in a production-grade multi-sensor fusion system.

  • Results

    FusionRipper achieves over 97% and 91.3% success rates across six real-world traces for off-road and wrong-way attacks, respectively.

  • Takeaways & Limitations

    The findings show that GPS spoofing can exploit takeover vulnerabilities in multi-sensor fusion localization, while camera-based lane detection is identified as a promising mitigation direction.

  • Takeaways & Limitations

    Real-world AV attack experiments were not conducted, and vulnerability of other leading AV companies remains unclear because only one production-grade implementation was publicly available.

Abstract

from arXiv · show

For high-level Autonomous Vehicles (AV), localization is highly security and safety critical. One direct threat to it is GPS spoofing, but fortunately, AV systems today predominantly use Multi-Sensor Fusion (MSF) algorithms that are generally believed to have the potential to practically defeat GPS spoofing. However, no prior work has studied whether today's MSF algorithms are indeed sufficiently secure under GPS spoofing, especially in AV settings. In this work, we perform the first study to fill this critical gap. As the first study, we focus on a production-grade MSF with both design and implementation level representativeness, and identify two AV-specific attack goals, off-road and wrong-way attacks. To systematically understand the security property, we first analyze the upper-bound attack effectiveness, and discover a take-over effect that can fundamentally defeat the MSF design principle. We perform a cause analysis and find that such vulnerability only appears dynamically and non-deterministically. Leveraging this insight, we design FusionRipper, a novel and general attack that opportunistically captures and exploits take-over vulnerabilities. We evaluate it on 6 real-world sensor traces, and find that FusionRipper can achieve at least 97% and 91.3% success rates in all traces for off-road and wrong-way attacks respectively. We also find that it is highly robust to practical factors such as spoofing inaccuracies. To improve the practicality, we further design an offline method that can effectively identify attack parameters with over 80% average success rates for both attack goals, with the cost of at most half a day. We also discuss promising defense directions.

1 Introduction

This work provides the first security study of production-grade multi-sensor-fusion localization in high-level AVs under GPS spoofing. It identifies dynamically exploitable take-over vulnerabilities and demonstrates effective off-road and wrong-way attacks, alongside offline parameter profiling and defense directions.

  • Research scope: The study targets GPS spoofing against production-grade Baidu Apollo MSF and defines lateral-deviation goals as off-road and wrong-way attacks.BA-MSF is representative in design and implementation, while the goals correspond to driving off road or onto a wrong way.
  • Security analysis: 71% of upper-bound attack results cause less than 50 cm deviation, below the over-90-cm and 2.4-m thresholds for off-road and wrong-way attacks.A few results exceed 2 m, motivating analysis of the conditions under which MSF can be overtaken.
  • Security analysis: The take-over effect lets spoofed GPS deviations grow exponentially until GPS dominates fusion and causes rejection of other input sources.The vulnerability appears only during relatively unconfident periods created by dynamic and non-deterministic factors.
  • Attack design: FusionRipper profiles vulnerable periods and then applies aggressive exponential spoofing to exploit the take-over opportunity.Its two-stage design captures vulnerabilities that appear dynamically and non-deterministically.
  • Evaluation: 97% and 91.3% success rates are achieved across all six traces for off-road and wrong-way attacks, respectively, with less than 35 seconds average success time.Success rates change by less than 4% under spoofing inaccuracies and AD control taking effect.
  • Practicality: 84.2% and 80.7% success rates are obtained for offline parameter profiling of off-road and wrong-way attacks, respectively, at a cost of at most half a day.The profiling method is designed to identify effective parameters without causing obvious safety problems during profiling.
  • Defenses: The study calls for immediate defense attention and discusses both long-term and short-term mitigation directions.The motivation is the critical role of localization in safe and correct AV driving.

2 Background

High-level AV localization combines multiple sensors through predominantly Kalman-filter-based MSF to achieve accurate, robust positioning. The background describes its safety role, the GPS-spoofing threat, representative implementations, and the prediction, update, and outlier-detection operations underlying KF-based fusion.

  • AD localization: High-level AV localization computes global vehicle positions in real time and supplies outputs to perception, planning, and control.Because these modules support critical driving decisions, localization is security and safety critical.
  • Multi-sensor fusion: MSF combines GPS, IMU, and LiDAR inputs to improve localization accuracy and robustness, while GPS signal quality can be degraded.GPS is a de facto outdoor location source but lacks signal authentication in civilian infrastructure.
  • KF representativeness: 14 of 18 surveyed papers, or 77.8%, adopt Kalman-filter-based MSF, showing its predominance in recent top-tier robotics localization designs.KF-based MSF is also described as having state-of-the-art performance.
  • KF operations: KF prediction uses the previous state and covariance with system dynamics, while its update incorporates GPS or LiDAR measurements and their uncertainties.The Kalman gain weights how much the measurement changes the state and covariance; Q tunes the system and H maps state to measurement space.
  • KF operations: IMU acceleration and angular velocity are integrated during prediction, then GPS or LiDAR positions update a fraction of the state according to state and measurement uncertainties.Larger state uncertainty or smaller measurement uncertainty causes more updating of the KF state.
  • Outlier detection: A Chi-squared outlier detector can discard or partially update measurements whose test value exceeds a statistical significance threshold, usually 3.841.This bounds KF updates against occasional noisy measurements.
  • Implementations: BA-MSF is the main target because its KF design, high-end GPS/LiDAR/IMU inputs, fleet testing, and 0.054-m reported accuracy make it representative for AV localization.Other publicly available KF-based MSFs reach only at most 1–2 m accuracy and are therefore less representative of centimeter-level AV systems.

3 Attack Model and Problem Formulation

The paper models GPS spoofing against production-grade AV localization by defining safety-relevant lateral-deviation goals, attacker capabilities, and an optimization over spoofing inputs. It also specifies how MSF, vehicle control, and road geometry determine attack consequences.

  • 3.1 Attack Goal and Incentives: The attack targets lateral deviations in a victim AV’s localization output, motivated by potential off-road or wrong-way driving.The attacker is modeled as tailgating the victim while launching GPS spoofing.
  • 3.1 Attack Goal and Incentives: Off-road attacks drive the victim beyond the road pavement, whereas wrong-way attacks move it onto the opposite traffic lane.The required deviations are calculated from common AV, lane, and road-shoulder widths.
  • 3.1 Attack Goal and Incentives: These localization errors can cause hazards such as hitting curbs or falling from highway cliffs, even when perception correctly detects obstacles.The localization module is responsible for identifying road deviations in the described high-level AD architecture.
  • 3.2 Threat Model: The attacker can control the victim GPS measurements with natural-signal-like uncertainty and track the victim’s physical position during tailgating.Real-time tracking is supported by estimating the attacker vehicle’s position and using relative position information.
  • 3.2 Threat Model: The threat model assumes high-frequency lateral control that continually corrects deviations toward the lane center, including Apollo’s 100 Hz control example.This control causes the victim’s physical-world position to acquire the deviation introduced into the MSF output.
  • 3.3 Attack Formulation: The formulation treats the attack as finding a sequence of GPS spoofing distances that maximizes the final attacked MSF output’s lateral deviation from the original trajectory.The formulation uses the attacked and unattacked MSF outputs, LiDAR and IMU inputs, the KF-MSF iteration, and lateral-deviation function.

4 Security Analysis of MSF Algorithm

Upper-bound analysis shows that production-grade MSF usually suppresses GPS-spoofing deviations, but dynamically arising take-over windows can let GPS dominate updates and produce large, exponentially growing errors. These vulnerabilities are linked mainly to low LiDAR confidence and high initial KF uncertainty, which practical sensor noise and algorithm inaccuracies can create.

  • Upper-Bound Attack Effectiveness: 76.0% of real-world attack windows and all synthetic windows cannot reach 0.895 m, because LiDAR updates rapidly correct small spoofing-induced deviations.Outlier detection limits the first deviation to at most 0.06 m, while five LiDAR updates occur between consecutive GPS spoofing inputs.
  • Take-Over Effect: 14% of real-world attack windows exceed 2 m deviation, exhibiting exponential growth that can reach the paper’s attack goals.These windows show a distinct take-over effect, unlike the majority of attack windows.
  • Take-Over Effect: All windows exceeding 3 m deviation have clear exponential growth, with fitted base a at least 1.3.The fitted exponential trend correlates positively with upper-bound deviation.
  • Take-Over Effect: During take-over windows, GPS becomes the dominating KF update source while LiDAR inputs become outliers, resembling single-source GPS fusion.Removing LiDAR inputs reproduces similar exponential deviation growth in the synthetic analysis.
  • Cause Analysis: Larger P0 increases deviation, while larger R_lidar increases deviation until reaching a plateau; larger Δ_lidar can eventually reverse deviation direction, and IMU has an overall positive influence.These relationships were experimentally validated on modified sensor segments.
  • Cause Analysis: P0 and R_lidar show statistically significant strong correlations with take-over effects, whereas Δ_lidar and IMU do not.The analysis identifies initial KF uncertainty and LiDAR uncertainty as the two most important contributing factors.
  • Cause Analysis: Practical algorithm inaccuracies and sensor noises create unconfident MSF periods that let GPS dominate updates and fundamentally break MSF in practice.Such periods are absent in the synthetic noise-free trace but difficult to avoid in real systems.

5 Attack Design: FusionRipper

FusionRipper exploits dynamically appearing, non-deterministic MSF vulnerabilities that attackers cannot directly control. It profiles vulnerable periods through feedback, then applies aggressive exponential spoofing to trigger take-over and induce large deviations.

  • Design Motivation: FusionRipper opportunistically captures dynamically appearing vulnerable periods through vulnerability profiling followed by aggressive spoofing.The attacker first measures when vulnerabilities appear, then exploits them with exponential spoofing.
  • Stage 1: Vulnerability Profiling: Vulnerability profiling uses constant GPS spoofing while measuring the victim AV’s physical deviation from the lane center.A deviation reaching the lane line, about 0.295 m on local roads, identifies a vulnerable period.
  • Practicality: Constant-spoofing profiling achieves attack success rates close to the theoretical upper bound while using few parameters.The reduced parameterization is intended to improve implementation ease and robustness.
  • Stage 2: Aggressive Spoofing: After detecting a vulnerable period, aggressive spoofing switches to exponentially increasing spoofing distances to trigger exponential deviation growth.The strategy is chosen because deviations grow exponentially during the take-over effect.
  • Generality: FusionRipper is designed to apply generally to KF-based MSF algorithms and is effective across different KF-based designs and implementations.Its generality follows from exploiting a take-over vulnerability identified in the general KF-based MSF form.

6 Attack Evaluation

FusionRipper is evaluated on real-world traces and multiple KF-based MSFs, showing high attack effectiveness despite stronger localization confidence and demonstrating that its two stages are jointly necessary.

  • Experimental setup: Five compatible KAIST traces and one Apollo trace were evaluated, with KAIST selecting the most confident traces as a worst-case setting.The KAIST traces were truncated to five minutes; lower MSF state covariance indicates higher confidence.
  • Attack effectiveness: 98.6% average off-road and 95.9% average wrong-way success rates were achieved when attacks lasted 2 minutes, exceeding 97% and 91% on every trace.Average success rates increased with attack duration because longer attacks provide more opportunities to capture vulnerable periods.
  • Ablation study: The two-stage design is necessary: removing either vulnerability profiling or aggressive spoofing reduced success to at most 14% and 7% for the two attack goals.FusionRipper achieved 98% and 97% in the corresponding comparison.
  • Attack effectiveness: Less than 30 seconds was the average success time for both attack goals under 2-minute attack durations.The standard deviation was around 25 seconds, and the paper reports that attacks generally succeed within a minute.
  • Generality: FusionRipper achieved 100% success for both goals on JS-MSF and ETH-MSF, while BA-MSF provided 0.054-meter accuracy and more representative production-grade results.Random attacks also exceeded 95% off-road and 70% wrong-way success on the less stable JS-MSF and ETH-MSF implementations.

7 Practical Attack Considerations

The evaluation tests FusionRipper against spoofing inaccuracies and autonomous-control effects, finding that attack effectiveness remains high in trace-based and complete-system evaluations.

  • Spoofing inaccuracies: Under normal spoofing errors, success decreased by only 0.2% for off-road and 0.8% for wrong-way attacks.Errors were sampled over 100 repetitions for each error amount, including 2× and 3× normal error levels.
  • Spoofing inaccuracies: 84.3% average off-road and 74.2% average wrong-way success rates were reported under the evaluated spoofing inaccuracies.The authors characterize FusionRipper as highly robust to spoofing inaccuracies in practice.
  • End-to-end evaluation: Trace-based evaluation translates Apollo’s lateral-controller steering into physical position and heading changes while retaining real-world sensor noise.This method does not model raw LiDAR point-cloud changes or tire-road friction, limiting synthesis accuracy.
  • End-to-end evaluation: 97.0% off-road and 93.9% wrong-way success rates were achieved in trace-based end-to-end Apollo evaluation.These rates were only slightly below the MSF-only results of 98.0% and 97.0%, respectively.
  • End-to-end evaluation: FusionRipper successfully drove the victim AV into a road barrier or traffic sign in simulation with the complete Baidu Apollo system operating.The simulation included all functional modules, whereas trace-based evaluation omitted perception because localization identifies road deviations in Apollo’s modular design.

8 Offline Attack Parameter Profiling

Offline profiling searches for effective attack parameters using safe trials on same-model vehicles, achieving over 80% average success with limited trial cost.

  • Problem settings: The profiling method assumes trials can be performed on AVs sharing the victim’s sensor set, AD system, and vehicle model.The method stops attacks after a safe physical-deviation threshold to reduce safety problems and preserve stealth.
  • Profiling algorithm: The algorithm tests combinations of d and f across profiling rounds, returning a combination once its success rate exceeds a minimum threshold.If no combination reaches the threshold, it returns the best observed combination.
  • Parameter choices: A 50% minimum profiling success rate produced the highest average selected-parameter success, while higher thresholds reduced performance, possibly through overfitting.This pattern held for both attack goals.
  • Parameter choices: With a 0.45-meter safe threshold, average success reached 90.3% for off-road and 84.4% for wrong-way attacks.Changing the threshold from 0.3 to 0.9 meters changed success rates by less than 4% for both goals.
  • Evaluation results: With 40 trials per profiling round, selected parameters achieved 84.2% off-road and 80.7% wrong-way average success.The average cost was 42 1.5-minute trips, taking at most half a day to complete.

9 Limitation and Defense Discussions

The paper identifies scope and practicality limits, then discusses defenses ranging from stronger localization confidence to independent lane-based fail-safe checks. These defenses remain bounded by unavailable production-grade implementations, absent physical-world experiments, unresolved sensing limitations, and possible lane-detection failures.

  • Limitations: Only BA-MSF is publicly available as a production-grade implementation, leaving vulnerability to other leading AV companies unclear.FusionRipper was evaluated on three KF-based MSFs, but only BA-MSF is production-grade.
  • Limitations: Offline parameter profiling achieves 84.2% and 80.7% success rates for off-road and wrong-way attacks, respectively, at a cost of at most half a day.Real-world AV attack experiments were not conducted because of GPS-spoofing cost and legal regulation.
  • Limitations: The study did not conduct physical-world experiments to confirm accurate tracking of surrounding obstacles.The attacker model assumes ownership of an AV and use of AD perception algorithms for tracking.
  • Defense Discussions: Improving MSF-state and LiDAR-locator confidence requires substantial sensing and localization breakthroughs whose timing is unclear.The paper attributes exploitable confidence deficits to algorithm inaccuracies and sensor noise.
  • Defense Discussions: Camera-based lane detection is proposed as an independent fail-safe for detecting localization anomalies, but its precision, recall, and physical-attack robustness require further study.Such detection must account for legitimate lane deviations and damaged or incomplete lane markings.

10 Related Work

Prior work covers GPS spoofing against single-source navigation, theoretical security of single-source Kalman filters, and attacks on individual vehicle sensors. This paper differs by studying GPS-spoofed multi-sensor-fusion localization in high-level autonomous driving without requiring access to filter internals.

  • GPS Spoofing on Navigation Systems: Earlier GPS-spoofing studies target single-source localization systems without fusion from position sources such as LiDAR.The cited systems include GPS navigation and GPS/INS navigation.
  • Theoretical Work on KF Security: Theoretical Kalman-filter security studies address single-source filters and assume attackers can access internal states and uncertainties.This work instead considers sensor fusion without those internal-access assumptions.
  • AV-Related Attacks and Defenses: Prior autonomous-vehicle security research examines traditional vehicle systems or attacks on individual sensors, but not their use against AD localization.The related sensors include cameras, LiDAR, IMUs, radar, and ultrasonic sensors.

11 Conclusion

The paper studies GPS-spoofing security in high-level AV multi-sensor localization, discovers a takeover vulnerability, and develops FusionRipper to exploit it. Real-world traces show high attack success and robustness, while offline profiling and lane detection motivate practical evaluation and defense directions.

  • Conclusion: The study discovers a takeover vulnerability in MSF-based localization and develops FusionRipper to exploit it opportunistically.The attack targets high-level AV localization under GPS spoofing.
  • Conclusion: FusionRipper achieves over 97% and 91.3% success rates across real-world traces for off-road and wrong-way attacks, respectively.The paper reports robustness to various practical factors.
  • Conclusion: An offline method identifies effective attack parameters within at most half a day.The paper also discusses long-term and short-term defense directions.
  • Conclusion: Camera-based lane detection is identified as a promising fail-safe feature that has not generally been used for this purpose in current AD systems.The proposed use is to support anomaly detection for localization.

A Calculation of Required Deviations in Attack Goals and Distances to Lane Line

The appendix defines attack-goal deviations from common AV, lane, and shoulder widths, and distinguishes local-road from highway requirements. It also documents visualizations of lane deviation, steering conversion, and profiling sensitivity.

  • Required Deviations: Required deviations are calculated from AV, lane, and road-shoulder widths that differ between local and highway settings.The measurements use the Baidu Apollo reference car and US Department of Transportation design guidelines.
  • Required Deviations: The off-road deviation thresholds are 0.895 m on local roads and 1.945 m on highways.These values combine lane, car, and shoulder widths.
  • Required Deviations: The wrong-way deviation thresholds are 2.405 m on local roads and 2.855 m on highways.Wrong-way attack requires the AV to completely invade the neighboring lane.
  • Supplementary Visualizations: The appendix visualizes a 0.45-meter lateral deviation, steering-wheel-angle conversion, and profiling results under varied success-rate and safety thresholds.These figures support interpretation of deviation and profiling calculations.

B Convert Steering to Lateral Position and Heading Rate Changes

The paper converts steering angle into physical-world lateral position change and heading-rate change using vehicle velocity, controller cycle time, and steering ratio.

  • δpos = vt sin(θ/φ) converts steering angle into lateral position change using velocity, controller cycle time, and steering ratio.Here, φ is the constant ratio between steering-wheel turning angle and vehicle-wheel turning angle.
  • δω = θ/φt converts steering angle into yaw, or heading, rate change.The heading-rate change is expressed using steering angle, steering ratio, and controller cycle time.
Loading 2006.10318v3…