PaperlayerView exact revision on arXiv

Source-linked AI summary

Don't Let One Lie Survive A Hundred Truths: A Selective Bayesian Trust Estimator for Collaborative Perception

Yutong Liu, Chenyi Wang, Ming F. Li, Qingzhao Zhang

arXiv:2610.07875v1cs.CR

TL;DR

Collaborative perception depends on messages that vehicles cannot independently verify, and pooled trust can let unrelated correct reports dilute evidence of a targeted attack. SABER screens persistent agent–object anomalies for separate peer-referenced Bayesian assessment. On OPV2V, it improves ROC-AUC over MATE in both fusion settings and reports higher detection against intermediate-fusion data-fabrication attacks with lower false-positive rates.

  • Problem

    Pooling evidence across objects can let unrelated correct reports dilute persistent attack evidence, while increasing pooled-update sensitivity risks penalizing benign errors more heavily.

    Source: §1 · p. 2

  • Method

    SABER uses broad agent and object trust, screens persistent anomalous agent–track pairs, and gives selected pairs separate Bayesian states assessed against other agents’ evidence.

    Source: §1 · p. 2, §4.2 · p. 5

  • Results

    SABER improves ROC-AUC over MATE by up to 0.427 in late fusion and 0.337 in intermediate fusion on OPV2V.

    Source: §1 · p. 2

  • Takeaways & Limitations

    OPV2V experiments show improved detection–false-alarm trade-offs for sparse removal and spoofing attacks in late and intermediate fusion.

    Source: §7 · p. 12

    Reliable identification requires corroborating peer evidence; with only one benign observer and comparable trust and evidence strength, conflicting reports can remain ambiguous.

    Source: §6 · p. 11

Abstract

from arXiv · show

Collaborative perception (CP) enables connected vehicles to see beyond their own sensors but makes them dependent on messages they cannot independently verify. A compromised collaborator can surgically conceal a single safety-critical object or inject a non-existing one while correctly reporting many others. Existing Bayesian trust mechanisms pool agreement across objects, which, while effective against blatant untargeted attacks, either incurs high false-positive rates (FPR), or allows unrelated correct reports to dilute persistent attack evidence for stealthy single-object attackers. To address this problem, we propose SABER, a selective two-tier Bayesian trust estimator. The first tier maintains broad agent and object trust, preserving the ability to downweight benign but low-quality contributors. Cumulative-sum screening selects agent--object pairs with persistent omissions or unsupported reports for focused Bayesian assessment. The second tier checks these pairs against other agents' evidence and maintains a separate, reference-weighted Beta state for each. The lowest pair score constrains agent trust, preventing unrelated reports from diluting a targeted attack. We establish sufficient conditions for stronger attacker-side trust reductions with bounded additional benign false alarms at fixed thresholds. Compared with state-of-the-art CP defenses, SABER improves attack detection while reducing benign FPRs. On OPV2V, SABER improves defense ROC-AUC over MATE by up to 0.427 in late fusion and 0.337 in intermediate fusion. Against advanced intermediate-fusion data fabrication attacks, it increases detection rates over ROBOSAC and LUCIA by up to 96.40 and 67.07 percentage points, respectively, while reducing FPRs.

1 Introduction

Collaborative perception expands vehicle sensing but exposes safety-critical reports to collaborators that may conceal or fabricate objects. SABER targets cross-object evidence dilution with selective, pair-specific Bayesian assessment and reports stronger detection–false-alarm trade-offs.

Motivation

  • Unrelated correct reports can dilute evidence of a persistent attack on one safety-critical object, while greater pooled-update sensitivity risks more benign false positives.Persistent false scene descriptions can prolong their influence on downstream driving decisions.Source: §1 · p. 2

SABER

  • SABER screens agent–track histories for persistent omissions or unmatched reports, then assesses selected pairs against other agents’ evidence using separate Bayesian trust states.The lowest assessed pair score constrains agent trust, so reports about other objects cannot directly cancel a localized contradiction.Source: §1 · p. 2

Evaluation

  • SABER improves ROC-AUC over MATE by up to 0.427 in late fusion and 0.337 in intermediate fusion, and raises intermediate-fusion data-fabrication detection over ROBOSAC and LUCIA by up to 96.40 and 67.07 percentage points, respectively, while reducing FPRs.The evaluation covers OPV2V, removal and spoofing attacks, and both fusion settings.Source: §1 · p. 2

2 Related Work

Prior work spans collaborative-perception fusion, object-level attacks, consistency-based defenses, and temporal trust estimation. SABER’s stated distinction is selective object-specific assessment rather than Bayesian updating or temporal screening alone.

Collaborative perception

  • Collaborative perception combines raw sensor data, learned features, or object reports through early, intermediate, or late fusion.SABER assesses object reports in late fusion and applies the same assessment to intermediate fusion by independently decoding senders’ received features.Source: §2 · p. 2

Attacks on shared perception

  • Data Fabrication targets single-object removal and spoofing through feature manipulation, while SOMBRA exploits attentive fusion for targeted and mass removal attacks (Zhang et al., 2024; Wang et al., 2025).These attacks motivate assessment of sparse object-level inconsistencies induced by shared messages.Source: §2 · pp. 2–3

Defenses and trust estimation

  • SABER preserves a separate evidence state for each assessed agent–track pair, preventing unrelated correct reports from directly replenishing its trust.The paper distinguishes this selective, object-specific assessment from Bayesian updating or temporal screening alone.Source: §2 · p. 3
  • ROBOSAC checks collaborator groups against receiver detections, MADE tests ego–collaborator consistency, and LUCIA reweights attention using feature disagreement (Li et al., 2023; Zhao et al., 2023).Other described defenses include CAD, CP-Guard+, GCP, and MATE, which uses recursive agent and track trust estimates.Source: §2 · p. 3

3 Problem Formulation

The problem formulation considers a trusted aggregator that fuses collaborators’ messages and tracks objects across agents and frames. It specifies targeted removal and spoofing attacks, the evidence available for judging reports, and the detection–false-alarm objective.

System model

  • The aggregator treats a matched report as evidence of existence and a missing report as negative evidence only when the message is available and the object is declared visible.Unavailable messages and unmatched tracks outside the declared field of view provide no negative evidence.Source: §3 · p. 3

Threat model

  • One compromised agent may target one or a few objects by suppressing real objects or reporting nonexistent ones, but cannot modify other agents’ messages or the aggregator.The threat model excludes withholding observations through false out-of-FOV declarations and assumes the defense does not know the attacker or attack interval.Source: §3 · p. 3

Benign faults vs. attacks

  • Benign errors are more prevalent farther away and are predominantly short-lived, whereas attacks can persist on nearby, decision-critical objects.In the CARLA unprotected-left-turn example, continuous removal of an oncoming vehicle reduces time to collision to zero and results in a collision.Source: §3 · p. 3, Figure 2 · p. 4

Objective of trust estimation

  • The objective is to improve the detection–false-alarm trade-off over broad agent-level trust assessment, with TPR and FPR defined at the attack endpoint.The distance distribution counts erroneous boxes per frame, the duration distribution counts uninterrupted error runs, and the TTC curve follows one continuous-removal rollout.Source: §3 · pp. 3–4

4 Methodology

SABER combines broad agent trust with screening and separate Bayesian assessment of selected agent–track pairs. Pair scores constrain agent trust, while the paper states theoretical conditions for isolation from cross-object dilution and bounded additional benign false alarms.

4 Methodology

  • Tier 1 estimates broad agent trust, while tier 2 screens persistent anomalies and assesses each selected agent–track pair against other agents’ observations.The lowest pair score constrains final agent trust; a pair exits tier 2 after consistent agreement with peer observations.Source: §4 · p. 4

4.1 Spatial and Temporal Screening

  • Spatial screening limits new tier-2 evidence to nearby objects, while temporal CUSUM screening accumulates eligible omissions or unmatched reports for each agent–track pair.Missing reports count only when the message is available and the object is declared visible; clean-window calibration bounds screening activations, not final agent false alarms.Source: §4.1 · pp. 4–5

4.2 Pair-Isolated Bayesian Trust Estimation

  • The object-existence reference aggregates eligible peer histories weighted by peer reliability, excluding the assessed agent from both the reference and its reliability updates.This prevents the assessed sender from reinforcing its own reference, directly or through historical trust updates.Source: §4.2 · p. 5
  • Each selected pair receives a separate Beta trust state; evidence weight increases with peer-supported contradiction, and cached recent contradictions can contribute at activation.The pair’s initial prior uses tier-1 trust, while temporal discounting moves retained evidence toward its initial parameters.Source: §4.2 · p. 6

4.3 Agent Trust and Decision

  • The lowest assessed pair score constrains tier-2 agent trust while broad tier-1 trust remains in the combined score; flags use a fixed trust threshold.When no pair remains under assessment, the agent returns to tier-1 assessment without the initial mean continuing to cap its score.Source: §4.3 · pp. 6–7
  • For intermediate fusion, the aggregator decodes each sender’s received BEV features, associates decoded boxes with tracks, and applies the same two-tier estimator.The methodology section also states the theoretical results are summarized with assumptions and proofs in Appendix E.Source: §4.3 · p. 7, §4.4 · p. 7

4.4 Theoretical Properties

  • Separate pair states and minimum aggregation prevent direct cross-object cancellation; the stated results also give conditions for stronger attack-induced trust reductions and bounded additional benign false alarms.The results characterize object-specific evidence isolation, memory’s effect, sufficient weighted-evidence conditions, and attacker–benign trust separation.Source: §4.4 · p. 7

5 Evaluation

The evaluation compares defenses across late- and intermediate-fusion collaborative perception, then tests component and attack-duration sensitivity. SABER generally improves the detection–false-alarm balance, with performance affected by attack type and duration.

5.1 Experimental Setup

  • OPV2V evaluation covers late object-report and intermediate BEV-feature fusion, using 688 removal and spoofing cases and ten benign frames followed by attacks in frames 10–19.Source: §5.1 · p. 7

5.2 Baselines and Metrics

  • SABER is compared with MATE in both fusion settings and ROBOSAC and LUCIA in intermediate fusion; metrics include attacker TPR, benign FPR, and attack-completion ROC-AUC.Source: §5.2 · pp. 7–8

5.3 Main Results

5.4 Component Ablations

  • Removing pair isolation, sender exclusion, or amplification lowers TPR at fixed thresholds, while adjusted-threshold variants retain higher FPR; cached contradictions speed post-screening trust decline.Source: §5.4 · p. 10, Figure 7 · p. 10

5.5 Sensitivity Studies

  • Stronger pooled penalties increase detection and benign FPR yet leave spoofing below SABER; longer attacks generally raise intermediate-fusion spoofing detection while late-fusion FPR tends to rise.Source: §5.5 · pp. 10–11, Table 3 · p. 11

6 Discussion and Limitations

SABER’s pair-specific histories can miss very short or target-switching attacks, and its assessment depends on corroborating peer evidence. These limits constrain reliable detection to attacks and observations that provide enough persistent, informative evidence.

Short or track-switching attacks

  • One- or two-frame attacks may end before screening activates or enough evidence accumulates to lower trust; switching targets spreads contradictions across pair histories.Memory accelerates assessment within a pair but does not combine evidence across targets, and detection of these attacks is not guaranteed.Source: §6 · p. 11

Insufficient benign observation coverage

  • Without informative peer history, AGG cannot independently assess a disputed report; comparable trust and evidence from only one benign observer can leave conflicting reports ambiguous.Reliable identification requires corroborating peer evidence, and field-of-view coverage alone does not guarantee accurate observations.Source: §6 · p. 11

7 Conclusion

SABER separates selected agent–track evidence to address cross-object dilution, and its analysis gives conditions for stronger attack-induced trust reductions with bounded additional false alarms. OPV2V experiments show improved detection–false-alarm trade-offs, while the work’s evaluations remain simulated and do not establish deployment readiness.

7 Conclusion

  • SABER’s selective agent–track evidence and lowest-pair constraint prevent unrelated correct reports from directly masking localized contradictions.The analysis gives sufficient conditions for stronger attack-induced trust reductions with bounded additional false alarms.Source: §7 · pp. 11–12
  • OPV2V experiments show improved detection–false-alarm trade-offs for sparse removal and spoofing attacks in late and intermediate fusion; longer attacks generally improve spoofing detection while intermediate-fusion FPR remains low.Figure 9 measures TPR and FPR at attack completion with a fixed agent-trust threshold of 0.1.Source: §7 · p. 12, Figure 9 · p. 12

Ethics Statement

  • All vehicle control and collision outcomes in the separate closed-loop illustration occur in a simulator; neither dataset results nor that illustration establish deployment readiness or guarantee collision avoidance.The paper reports no real-vehicle experiments, physical trials, or interaction with deployed transportation or live network systems, and calls for independent validation before operational use.Source: Ethics Statement · p. 12

A Additional Method Definitions

The appendix specifies how SABER weights Bayesian evidence, screens eligible histories, forms peer references, and admits past contradictions into pair states. It also states a condition under which stronger evidence weighting lowers pair trust.

A.1 Evidence increments and weighted updates

  • Weighted consistency increments update a pair’s Beta parameters, with weighting the factor and weighting its increments equivalent so amplification is applied once.The negative-evidence bias ν controls the increment branch, while θ selects that branch; the increments are pseudo-counts, not direct observations of maliciousness.Source: §A.1 · p. 14

A.2 Screening eligibility and calibration

  • The screening calibration estimates clean event frequency from eligible observations and selects threshold h using calibration windows and a prespecified screening budget.If a tied value would violate the bound, h is moved above it; starting from zero, a continuously eligible sequence is considered.Source: §A.2 · p. 14

A.3 Peer reference and evidence weight

  • The peer reference excludes the assessed sender from its history and returns toward a neutral prior; stronger evidence weighting lowers trust exactly when the evidence-implied mean is below current pair trust.The confidence factor g(q) is a design choice, not an optimality claim.Source: §A.3 · p. 14

A.4 Memory admission

  • At a pair’s first screening trigger, eligible past frames can be admitted as memory evidence with age-based discounting; recovery changes assessment membership without erasing retained state or admission history.An empty memory set contributes zero, and a new hypothesis uses a new track index.Source: §A.4 · p. 15

B Additional Experimental Settings

The appendix documents perception inputs, cohort selection, baseline handling, metric calculation, attack diagnostics, and the scope of the attack-duration results. It describes evaluation procedures and definitions without reporting additional cohort cell values or duration comparisons here.

B.1 Perception inputs

  • Reported boxes in a common world coordinate system determine existence evidence and introduce unmatched candidates, while visibility declarations follow Hallyburton and Pajic (2025).Paired clean and attacked runs share declarations, including the removal target’s visible declaration during attack.Source: §B.1 · p. 15

B.2 Selection and cohort sizes

  • Removal targets must persist throughout the window and remain within 40 m of an agent; spoofed boxes must be within 40 m of the attacker and visible to it and at least two benign agents during the main attack interval.Table 4 gives the cohort breakdown, including cases formed with alternative attackers or spoofing positions; its caption identifies it as the full selected cohorts table.Source: §B.2 · p. 15, Table 4 · p. 15

B.3 Baseline implementation and evaluation

  • All intermediate-fusion defenses receive the same feature messages generated against the undefended centralized model, while ROBOSAC and LUCIA retain their trusted-receiver assumptions.MATE and SABER share report associations and candidate hypotheses; ROBOSAC uses trial budgets and receiver-only fallback, while LUCIA retains continuous trust-weighted attention.Source: §B.3 · p. 15

B.4 Metric calculation

  • ROC and AUC use the same population weights, with benign peers in attacked scenes as negatives; ROBOSAC contributes measured operating points only.Trust-score AUC uses complete empirical curves.Source: §B.4 · p. 15

B.5 Attack realization diagnostics

  • Attack success rate measures single-object changes in the independently decoded attacker output at the endpoint using BEV IoU of at least 0.3.Removal succeeds when a clean-detected target disappears, and spoofing when a target absent from clean output appears; defense metrics retain all selected attempts regardless of these outcomes.Source: §B.5 · p. 16

C Attack-Duration Sensitivity

  • The appendix extends Figure 9’s single-object attack-duration summary to multiple targets and baselines, providing protocol and full duration results.Source: C Attack-Duration Sensitivity · p. 16

C.1 Attack Duration

The attack-duration analysis compares 5-, 7-, 10-, and 20-frame attacks at specified endpoints using fixed decision thresholds. The reported tables cover late-fusion removal and spoofing.

C.1 Attack Duration

  • The analysis compares 5-, 7-, 10-, and 20-frame attacks at endpoints 14, 16, 19, and 29, with fixed decision thresholds.All selected cases are retained, and screening parameters are calibrated using clean scenarios.Source: §C.1 · p. 16
  • ROBOSAC and LUCIA assess each endpoint independently, so changes across durations reflect different observations and perturbations rather than accumulated history.The tables include all target counts and defenses.Source: §C.1 · p. 16
  • Tables 5 and 6 report late-fusion removal and spoofing results across attack durations, respectively.The tables report TPR, FPR, and full ROC-AUC; MATE and SABER use thresholds of 0.8 and 0.1.Source: Table 5 · p. 16, Table 6 · p. 16

D Additional Results and Operating Trade-offs

SABER has higher ROC-AUC than MATE across evaluated attack families and target counts, with particularly large gains on late-fusion spoofing. Its low-FPR detection improves under PGD and DF, while LUCIA has the strongest separation against SOMBRA.

D Additional Results and Operating Trade-offs

E Theoretical Analysis and Proofs

The analysis formalizes how pair-isolated trust avoids direct cross-object dilution and gives conditions for attack detection, attacker–benign separation, and bounded additional false alarms. These results depend on stated evidence, screening, and probability assumptions.

E.1 Accumulated evidence and dilution

  • Unrelated evidence can raise pooled trust as its volume grows, whereas direct updates on other tracks cannot change an assessed pair’s mean.For pooled assessment, the mean increases with unrelated evidence blocks when their evidence-implied mean exceeds the initial disputed mean.Source: §E.1 · p. 19

E.2 Weighted evidence and detection by the attack endpoint

  • Detection by the attack endpoint requires enough admitted, weighted contradiction to overcome the pair’s initial-state resistance.The sufficient condition uses discounted evidence, including admitted memory; screening must activate the pair by the endpoint.Source: §E.2 · p. 20
  • With constant discount ρ > 0, effective evidence length is bounded by 1/ρ, so persistence alone does not guarantee threshold crossing.Increasing evidence weight strengthens supported contradictions but cannot create a more negative evidence ratio.Source: §E.2 · p. 20

E.3 Effect of admitted memory

  • Admitted memory lowers pair trust when its evidence-implied mean is below the no-memory state, and affects agent trust only if that pair determines the minimum.Memory can change trust at activation without shortening the CUSUM delay.Source: §E.3 · pp. 20–21

E.4 Paired reduction relative to MATE

  • SABER’s expected attack-induced trust decrease exceeds MATE’s when the likely attack-side reduction outweighs the bounded clean-side reduction.The stated sufficient condition is (1 − ξ)c > γCclean; the comparison uses paired clean and attacked runs, each retaining its own history.Source: §E.4 · p. 21

E.5 Attacker–benign separation

  • One sufficiently contradicted attacker pair can bound attacker trust below benign trust when the stated attacker and benign evidence conditions hold.The separation is strict when ℓb > ua; the benign assumptions allow errors but jointly bound retained contradiction evidence.Source: §E.5 · p. 22

E.6 Detection with bounded additional false alarms

  • Under the stated conditions, a fixed threshold can achieve TPR ≥ 1 − ξa and FPR ≤ FPRM + δ.The threshold must meet both requirements; the result does not establish superiority to every baseline at every threshold.Source: §E.6 · p. 22
Loading 2610.07875v1…