Lightweight Detection of Electromagnetic Signal Injection Attacks on Image Sensors

Motivation

• Image-sensor attacks can corrupt pixel values or cause row loss, producing noisy dots or color strips that may mislead computer-vision algorithms.The cited work reports task-performance degradation exceeding 50% in some cases [66].Source: §1 · p. 2
• Prior work has validated ESIA impacts, but the authors say effective defenses are lacking and EMC-compliant shielding, filtering, and grounding do not prevent deliberate attacks.The paper therefore focuses on a practical detection mechanism.Source: §1 · p. 2

Challenges

• The paper identifies three detection challenges: no reliable lightweight solution without added hardware, scene-dependent active-pixel values, and variation across sensors and attack conditions.The authors note that active-pixel values vary with lighting, texture, motion, and other environmental factors.Source: §1 · p. 3

Contributions

• The proposed optically-black-pixel detector uses statistical variations in non-illuminated pixels as a built-in monitoring channel for detecting signal injection attacks.The authors also describe a provable security guarantee.Source: §1 · p. 3
• The evaluation uses real-world hardware setups across sensor models and attack scenarios, reporting high accuracy across diverse conditions.The introduction identifies Sections 5 and 6 as the validation sections.Source: §1 · p. 3

Background

• ESIA has been demonstrated against smartphones, smart speakers, drones, implantable medical devices, and power systems.The cited examples span consumer, medical, and critical-infrastructure systems.Source: §2 · p. 4
• ESIA exploits unintended antenna-like behavior in electronic circuits, where PCB traces and wires can receive electromagnetic energy and induce interfering voltages or currents.The resulting interference can influence system behavior without physical contact or software compromise.Source: §2 · p. 4
• Attackers can use commercial signal generators, amplifiers, and antennas, tuning frequency and power to induce interference while avoiding circuit damage.Frequency is typically tuned to a conductor's resonant frequency, which maximizes power transfer.Source: §2 · p. 4

3.1 System Model

• An image-sensor system pairs a sensor with a processing unit connected by conductors; active pixels capture light, while shielded optically black pixels remain unexposed and support black-level calibration.Optically black pixels can have non-zero baselines from sensor noise, which are compensated during image reconstruction.Source: §3.1 · p. 4, Image Sensor · p. 5
• The processing unit uses optically black pixel output for black-level calibration, reconstructs color through demosaicing, and may enhance images before computer-vision analysis.The described sensor operation uses rolling-shutter exposure and overlapping readout, with adjacent rows exposed and read out simultaneously.Source: Image Sensor · pp. 5–6, Processing Unit · p. 6

3.2 Adversary Model

• The adversary injects electromagnetic signals into connecting cables or PCB traces, corrupting transmitted pixel data, and is modeled with commercial RF equipment but no internal access or ability to modify system software or hardware.The model characterizes attacks by frequency, power, duration, distance, and antenna angle.Source: Attack Mechanism · pp. 6–7, Attack Parameters · p. 7

4.1 Detection Using Optically Black Pixels

• Dark-region anomalies suggested detection, but scene-dependent darkness is unreliable; optically black pixels remain light-shielded and stable benignly, while row-synchronous exposure lets ESIA affect them.Active and optically black photodiodes in a row are exposed simultaneously.Source: §4.1 · pp. 7–8

4.2 Modeling Detection

• Under benign conditions K=n; choose θ from the noise CDF at tolerance ϵ, then flag K>θ and otherwise report no attack.The threshold is selected using the smallest x for which N(x)=ϵ.Source: §4.2 · p. 8

4.3 Probability of Bypassing Detection

• With injected shift δ, evasion requires n≤θ−δ; assuming approximate row independence, bypass probability decays exponentially with manipulated-row count r.The single-row condition is extended across r rows under the independence assumption.Source: §4.3 · pp. 8–9

5.1 Experimental Setup

• The laboratory setup uses an OV5647 by default and varies attack parameters, cable length, temperature, and sensor model.Optically black pixels are approximated by covering the active sensor region and analyzing raw, unprocessed pixel values.Source: §5.1 · pp. 9–10

5.2 Visualization and Statistics

• Attack makes optically black pixels noisier, and their averaged intensity histogram gains low- and high-intensity counts.Without attack, the pixels remain relatively stable; the benign histogram peaks around 16, with no intensity above 100.Source: §5.2 · pp. 10–11, Figure 4 · p. 11

5.3 Impacts of Different Parameters

• Across tested frequencies, attack and benign standard deviations remain separable; weak attacks below 2 W register despite barely visible active-image strips.Power generally raises feature magnitudes, though a drop at 3.5 W is attributed as likely due to RF amplification instability.Source: §5.3 · pp. 12–13
• Standard deviation falls as attack distance increases, converging with the benign baseline at 0.2 m when no visible strip appears.Across attack durations, the feature follows a U-shaped trend, reaching a minimum at 20 ms before increasing for shorter durations.Source: Figure 5 · p. 12, §5.3 · p. 13
• Attack-induced statistics remain distinguishable across tested angles, cable lengths, temperatures, and sensor models.At 100 cm, attacked values remain above baseline; all tested sensor models show elevated feature values under attack.Source: §5.3 · pp. 14–15, Figure 6 · p. 14

6.1 Metrics

• The evaluation uses threshold-based classification, with AUC measuring TPR–FPR trade-offs across thresholds and EER marking equal FPR and FNR.Higher AUC and lower EER indicate better classification performance.Source: §6.1 · p. 15

6.2 Detection Using Raw Pixel Values

• With 16 optically black pixel columns on OV5647, raw-value thresholding achieves AUC 0.996 and EER 0.025 at threshold 21.69.Increasing columns improves performance: 1 column yields AUC 0.958 and EER 0.108, while 16 or 32 columns saturate near AUC 0.996 and EER 0.025.Source: §6.2 · p. 15, Impact of Number of Columns · p. 16
• With 16 columns, sampling 1% of rows achieves AUC 0.974 and EER 0.084, while 0.2% sampling drops to AUC 0.879 and EER 0.188.Using 10% or 50% of rows maintains AUC above 0.985 and EER below 0.062; overly sparse sampling may miss temporal or spatial attack effects.Source: Impact of Number of Rows · pp. 16–17

6.3 Detection Using Statistical Features

• Standard deviation, maximum, and entropy perform best among the tested statistical features, with 1%-row sampling yielding AUC above 0.98 and EER below 0.1.As row sampling increases, their AUC approaches 1.0 and EER falls below 0.03; mean, median, skewness, kurtosis, and mode perform worse.Source: §6.3 · p. 17

6.4 Performance Across Different Image Sensors

• AUC ranges from 0.980 to 0.996 and EER stays below 0.05 across four sensors; OV5647 reaches AUC 0.996 and EER 0.027.IMX708 and IMX378 also achieve AUCs above 0.99 and EERs below 0.012 with only four optically black pixel columns.Source: §6.4 · p. 18

7.1 Temporal Analysis of Detection Failures

• At an EER of 0.027 on OV5647, the authors estimate that bypassing detection across 30 frames has probability approximately 8.72 × 10^-48.They also estimate the same probability for 30 consecutive false positives and note that majority voting can suppress single-frame false positives.Source: §7.1 · p. 19

7.2 Comparison with Machine Learning (ML) Classifiers

• CNN inference takes 0.1–0.2 s per frame, compared with 0.000135 s per frame for the proposed method on a Raspberry Pi.RF and CNN achieve near-perfect results, but require substantially higher computational cost.Source: §7.2 · p. 19

7.3 Attack Distance

• Experiments were constrained by local emission regulations and amplifier power limits, while the method is described as distance-agnostic when the sensor measures a disturbance.The authors state that detection applies regardless of distance under that condition.Source: §7.3 · p. 19

7.4 Deployment Feasibility

• Deployment options are ISP firmware integration or vendor-provided access to optically black pixel values, and both are described as technically feasible with minimal hardware changes.The authors report feasibility confirmation from an image sensor manufacturer and a vendor in Asia.Source: §7.4 · p. 20

7.5 Future Work

• Future work includes evaluating CMOS sensor aging and validating whether optically-black-pixel detection applies to CCD sensors.Because CCD attacks target individual pixels rather than rows, the proposed row-oriented method may not directly apply and requires dedicated validation.Source: §7.5 · p. 20

Related defenses

• Environmental monitoring defenses include frequency-domain detectors, reference conductors, and parallel circuits for modulated RF signals.These approaches look for abnormal electromagnetic activity before or as signals enter the target system.Source: §8 · p. 20
• Other approaches verify secret signal watermarks, use physical-layer fingerprints, auxiliary sensors or channels, or forecast expected outputs.Additional systems monitor application-specific behavior, including touchscreen intervals [56], LiDAR distributions, sensor responses, and wireless-channel changes.Source: §8 · pp. 20–21

Differences between Our Method and Others

• The paper distinguishes its method from matched dummy circuits and duplicated paths by using optically black regions as a scene-independent internal reference.The passage notes that replicating image sensors is impractical at millions-of-pixels scale and that mismatches can cause false positives or false negatives.Source: §8 · p. 21

9 Conclusion

• The proposed method uses optically black pixels as a monitoring channel and reports consistent attack-related deviations across sensor models and attack parameters.The conclusion characterizes the method as accurate, low-cost, and practical, with minimal false positives.Source: §9 · p. 21

A Detection Using Machine/Deep Learning

• The appendix implements Random Forest on statistical features and a CNN on raw image slices using an R9 9950X CPU and RTX 4090 GPU.These classifiers are presented as machine-learning and deep-learning detection approaches.Source: A Detection Using Machine/Deep Learning · pp. 26–27

A.1 Dataset

• A dataset of 90 street-scene images subjected to ESIA was manually annotated for three attack consequences: hiding labeled objects from detection, creating false detections without valid labels, and misclassifying correctly detected objects.Source: §A.1 · p. 27
• The dataset’s effects were checked across Co-DETR, Faster R-CNN, and YOLOv12, representing transformer-based, two-stage, and single-stage detector families.Source: §A.1 · p. 27

A.2 Training Set Construction

• For each of 90 images, the study generated 100 unique slice positions per width configuration, using 100-pixel-high slices at widths of 1, 4, 8, and 16 pixels across two regions.The slicing strategy tested sensitivity to contextual information while maintaining computational efficiency; narrower slices provided less context, while wider slices provided more context and required greater processing resources.Source: §A.2 · p. 27

A.3 Feature Extraction Methods

• Feature extraction compared seven statistical measures per slice with a custom CNN that outputs a binary attack/no-attack prediction.The statistics were mean, standard deviation, median, minimum, maximum, skewness, and kurtosis; the CNN uses width-adaptive pooling and a 64-unit feature projection.Source: Statistical Feature Extraction · p. 28, Deep Learning-based Feature Extraction · p. 28

• Random Forest evaluation used 10-fold cross-validation and reported almost-perfect ML/DL detection performance.Each fold used 8,100 training slices and 900 test slices; performance was assessed with precision, recall, and F1-score.Source: §A.4 · p. 28
• Active-pixel detection carries increased risk of scene-dependent false positives, while hybrid monitoring is proposed for sensors with limited black pixels or scenes lacking dark areas.The hybrid approach is presented as a possible way to further reduce detection errors and as future research.Source: §A.4 · pp. 28–29

A.5 Results

• Both RF and CNN achieve near-perfect performance on black pixels; the rule-based method processes a frame in 0.000135 s on Raspberry Pi.The authors describe the rule-based method as preferable for real-time, edge, and mobile deployments.Source: §A.5 · p. 29, Table 4 · p. 29
• Active-pixel RF and CNN models achieved F-scores = 1 in 5-fold cross-validation, but scene-dependent variation can mimic adversarial patterns and cause false positives.The authors state that active-pixel models need substantially more diverse data to generalize across environments.Source: §A.5 · p. 29

B Statistical Features in Different Attack Conditions

• Figure 9 marks attacks in red and benign cases in blue across frequency and power; Figures 10–12 cover duration, distance, angle, cable length, temperature, and sensor types.Source: Figure 9 · p. 30, Figure 10 · p. 30, Figure 11 · p. 30