Source-linked AI summary
Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks
Harsh Aaryan, Ce Zhou
TL;DR
AVs rely on thermal interfaces for night perception and package safety, but those interfaces also expose attack paths that prior surveys have not jointly framed. This survey systematizes both paths and evaluates software co-tenant leakage on a commodity proxy. Its conclusion is that the paths are complementary, and closing one does not close the other.
Problem
Prior surveys do not jointly frame physical thermal IR spoofing and unprivileged silicon thermal/DVFS/TEI telemetry as an AV residual-risk class, although AVs must retain these interfaces for perception and thermal safety.
Source: §1 · p. 2, §2.2 · p. 5Method
The survey compares thirteen works across attack paths and adversary classes, maps defenses to residual risk, and uses a commodity workstation proxy to characterize software-path leakage.
Source: §1 · p. 3, §3 · p. 5, §6.1 · p. 14Results
Under GPU co-tenancy, four-class solo macro-F1 0.958 falls to 0.582, while residual GPU telemetry supports architecture shortlisting after RAPL lockdown [6].
Source: §7.1 · p. 18Takeaways & Limitations
The surveyed paths are complementary integrity and confidentiality failures, so closing one path does not close the other and defenses or metrics do not transfer.
Source: §8 · p. 20The single-host commodity proxy does not validate automotive SoCs or provide an on-vehicle fingerprinting risk estimate; thermal drift and boost-clock history remain residual confounds.
Source: §7.1 · p. 18
Abstract
from arXiv · showhide
Autonomous vehicles (AVs) couple safety-critical perception to thermally constrained compute. Interfaces built for night perception and package thermal reliability were never engineered as confidentiality boundaries, and closing one such path leaves the other intact. Physical adversaries can spoof thermal infrared (IR) sensors used for night driving, while unprivileged software co-tenants can fingerprint perception workloads from thermal, dynamic voltage and frequency scaling (DVFS), and thermal event interrupt (TEI) telemetry required for package safety. These paths differ in mechanism and privilege; both exploit interfaces that AV stacks cannot disable without compromising Safety of the Intended Functionality (SOTIF). Classical microarchitectural and cyber-physical systems (CPS) surveys address cache timing, adversarial machine learning, and camera or LiDAR spoofing; no prior survey jointly frames physical thermal IR attacks and unprivileged silicon thermal telemetry as one residual-risk class. This survey systematizes thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale, co-tenancy, deployability, and AV relevance. We distinguish attack family from adversary class and map defenses to residual risk while thermal management remains operational. A commodity proxy supports the software co-tenant branch only; physical IR evidence comes from cited literature. We identify open problems in on-target automotive evaluation, fusion trust under IR spoofing, chiplet thermal coupling, capability-based telemetry, and standards-ready threat analysis, aiming to motivate co-design across sensors, operating systems, silicon, and automotive standards.
1 Introduction
Thermal IR perception and software-readable silicon telemetry create complementary integrity and confidentiality risks through interfaces AVs must keep operational. This survey compares both paths and their residual risks, with commodity-hardware measurements limited to the software co-tenant branch.
1 Introduction
- Thermal IR spoofing and unprivileged telemetry leakage form complementary AV risks, yet prior surveys generally treat them separately.Night perception depends on thermal IR, while thermal management cannot be disabled without risking thermal damage or SOTIF violations.Source: §1 · p. 2
- The survey organizes thirteen works into physical thermal IR attacks, unprivileged silicon telemetry leakage, and energy-based model extraction, comparing access and mitigation constraints.It distinguishes attack family, which describes mechanism and objective, from adversary class, which describes access.Source: §1 · pp. 2–3
- The taxonomy compares privilege, timescale, co-tenancy, deployability, and AV relevance, then maps sensor, OS-telemetry, DVFS, packaging, and model controls to residual risk.It highlights what remains open on the other path and where mitigations conflict with SOTIF constraints.Source: §1 · p. 3
- The commodity proxy measures software-path telemetry accessibility, workload fingerprinting, channel redundancy, observer sensitivity, and co-tenant stress under an unprivileged policy.It does not validate physical IR attacks or production AV stacks; it provides a mechanism baseline for software co-tenant leakage.Source: §1 · p. 3
2 Background
AV perception combines sensing and DNN processing on shared, thermally constrained compute. Thermal-management feedback signals are necessary for safe operation, while software-readable telemetry can expose workloads.
2 Background
- Thermal IR helps detect pedestrians and cyclists in low-visibility conditions, and raw frames pass through camera-specific processing before DNN detection and multimodal fusion.Perception outputs feed planning and control alongside lower-criticality services on shared compute.Source: §2 · pp. 3–4
2.1 Thermal Management and DVFS
- Thermal management couples power dissipation, temperature, and clock frequency; governors lower voltage and frequency, throttle accelerators, or raise TEIs near limits.AV platforms cannot simply disable these mechanisms without risking thermal damage or violating intended functionality under SOTIF thermal envelopes.Source: §2.1 · pp. 4–5
2.2 Software-Readable Telemetry
- Temperature, frequency, and GPU metrics are commonly readable without elevated privilege, while RAPL energy counters may be root-restricted.Thermal-state access remains necessary for ASIL-oriented partitions, creating an operational tension with telemetry minimization.Source: §2.2 · p. 5
3 Threat Model
The threat model separates physical adversaries manipulating the IR scene or camera pipeline from software co-tenants reading unprivileged telemetry on shared compute. The classes differ in access, but both can affect the sense–plan–act loop without AV memory access.
Shared threat model
- The two threat classes exploit operational interfaces: thermal IR supports night perception, while thermal governors protect package safety.OEM hardening of telemetry permissions is deployment-specific.Source: §3 · pp. 5, 7
Physical adversary
- Physical attackers use line-of-sight or short-range proximity to manipulate heat in the external scene and target perception integrity under night or low-visibility conditions.Success is measured by false detections, missed pedestrians, or planner-level reactions.Source: §3 · p. 5
Software co-tenant
- Software co-tenants share compute and can read thermal and power telemetry without root privilege or performance-monitoring units.Their goals include workload fingerprinting, covert signaling, and architecture or hyperparameter recovery from residual channels.Source: §3 · pp. 5–6
4 Surveyed Attacks
The survey compares physical thermal IR attacks, unprivileged silicon telemetry leakage, and energy-based model extraction as distinct attack families and access classes. Across these paths, interfaces built for perception or thermal reliability create residual risks that defenses and evaluation methods do not uniformly transfer across.
4 Surveyed Attacks
- The survey organizes attacks by mechanism and objective separately from adversary access, comparing thirteen works across privilege, timescale, co-tenancy, deployability, and AV relevance.It positions cache and speculative-execution attacks outside its scope.Source: §4.1 · p. 7, §4 · p. 7
4.1 Attack Landscape
- The joint comparison shows that sensor hardening leaves compute observations exposed, while telemetry controls do not authenticate IR inputs.Locking RAPL can leave frequency or GPU telemetry available, while physical IR attacks bypass compute entirely.Source: §4.1 · p. 8
4.2 Physical Thermal Perception
- Roughly 50% lower pedestrian-detection mean average precision and 45% lower RGB–thermal-fusion mean average precision were reported for Heat is On.Real-world tests reported up to 100% pedestrian misdetection and 91% false-obstacle success; bulb boards reduced YOLOv3 infrared pedestrian average precision by 34.5%.Source: §4.2 · pp. 8–9
4.3 Unprivileged Silicon Telemetry
- Hot Pixels found unprivileged temperature, power, and frequency interfaces on Apple M1, Samsung Exynos, and Qualcomm Snapdragon SoCs, with many fingerprint tasks succeeding within seconds.ThermalScope reported 0.1 b/s covert channels, DNN architecture fingerprinting above 90% accuracy, and KASLR recovery in approximately 8.2 hours; chiplet cross-die leakage remains unvalidated on automotive packages.Source: §4.3 · pp. 9–10
4.4 Power-Side Model Extraction
- DeepTheft reports 99.75% LDA for network-structure recovery and 99.60% weighted F1 for hyperparameters from coarse ∼1 kHz RAPL traces.Frequency traces can support the same learning framework where RAPL is restricted; BarraCUDA recovers DNN weights using electromagnetic probes, making physical extraction complementary to software-path architecture recovery. Restricting one energy or power interface leaves frequency and accelerator telemetry available for fingerprinting and architecture shortlisting.Source: §4.4 · pp. 10–11
5 Defenses and Mitigations
Defenses address different parts of the physical IR and software telemetry threat paths, and none closes both without residual risk. Sensor checks can reduce opportunistic spoofs, while telemetry controls must preserve live thermal management and may trade performance or safety margin.
5.1 Sensor Defenses
- Threat-aware IR processing and cross-modal consistency checks can reduce opportunistic spoofs, but full scene control and thermodynamically consistent decoys remain challenging.Cross-modal corroboration should account for sensor reliability; absent RGB support at night is not itself evidence of an IR spoof. Certified robustness carries inference costs that are difficult to reconcile with real-time AV budgets.Source: §5.1 · pp. 11–12
5.2 Telemetry Controls
- Capability-based telemetry policy can give QM and unprivileged readers coarsened or delayed views while ASIL governors retain full-resolution thermal state.TEIs and DVFS must remain live; DVFS-domain isolation or caps can reduce observable coupling but trade throughput and SOTIF thermal margin. Model obfuscation may hinder architecture extraction while leaving workload fingerprinting intact.Source: §5.2 · p. 12
5 Defenses and Mitigations
- No single defense layer closes both access paths: sensor controls leave co-tenant telemetry open, and restricting one telemetry channel leaves others informative.Thermal interrupts and governors must remain operational for package thermal safety.Source: §5 · p. 11, §5.2 · p. 12
6 Evaluation
The evaluation probes residual software-path leakage with an unprivileged commodity proxy, then examines fingerprinting, observer-side defenses, and stress conditions. Its measurements provide a mechanism baseline, not an estimate of in-vehicle risk or validation of production AV stacks.
6 Evaluation
- The campaign is a fully unprivileged commodity-host mechanism baseline, not an estimate of in-vehicle fingerprinting or validation of automotive stacks.Figure 3 outlines telemetry collection, feature aggregation, fingerprinting, ablation, observer sensitivity, and stress tests.Source: §6 · p. 12, Figure 3 · p. 13
6.1 Setup and Methods
- On a Xeon w7-3465X and RTX PRO 6000 Blackwell, eight AV-analogue workloads yielded 192 windows; they approximate perception compute intensity, not production AV detectors or middleware graphs.Seven telemetry series were aggregated into 35 features per window; RAPL energy counters were denied while temperature, frequency, and GPU telemetry remained accessible.Source: §6.1 · pp. 13–14, §6.2 · p. 14
6.2 Fingerprinting and Ablation
- 95.8% accuracy and macro-F1 0.958 [0.92, 0.98] show fused features outperform individual groups; frequency-only 0.787, thermal-only 0.726, GPU-power-only 0.709, and timing-only 0.297.The corresponding confusion matrix covers eight AV-analogue classes; chance under uniform guessing is 0.125.Source: §6.2 · p. 14, Figure 5 · p. 15, Figure 4 · p. 15
6.3 Observer Sensitivity
- In E4 observer-side sensitivity, temperature-only noising left attack F1 high; dropping GPU-power features reduced F1 to 0.842, and combined quantize, rate-limit, and drop reached 0.822, with confidence intervals excluding baseline.No operating point jointly yields low attack F1 and low RMSE.Source: §6.3 · p. 16, Figure 6 · p. 16, Table 6 · p. 16
6.4 Stress Tests and Premises
- Under GPU co-tenancy, four-class F1 fell from 0.958 [0.85, 1.0] solo to 0.582 [0.34, 0.76]; cross-session F1 was 0.941 and label-shuffle null F1 was ≈0.13.The GPU co-tenant result uses four GPU victims, distinct from the eight-class E2 task.Source: §6.4 · p. 17
- E6a yielded ∆T ≈1.61 °C and binary RF accuracy 0.625; E6b |∆f| ≈6.0 MHz and RF accuracy 0.75; toy-network E7 macro-F1 was 0.908 [0.78, 1.0], and E11 top-2 accuracy was 1.0.E6a and E6b are premise checks, not confirmations of the full cited attacks; E7/E11 are narrower architecture-shortlisting analogues.Source: §6.4 · p. 17
7 Discussion and Future Research Direction
The discussion treats the proxy as evidence about software-path mechanisms, while emphasizing its transfer limits and the need to preserve thermal safety. It maps residual risks to engineering controls and identifies automotive evaluation, fusion, packaging, telemetry, and standards gaps.
7.1 Limitations and Transfer
- Measurements use one commodity host and cooling regime; physical IR, TEI, KASLR, SIKE, and live RAPL DeepTheft reproductions are out of scope.Thermal drift and boost-clock history remain residual confounds despite interleaving, dual sessions, and null controls.Source: §7.1 · p. 18
- Under GPU co-tenancy, four-class fingerprint F1 fell from 0.958 to 0.582; absolute rates on automotive SoCs remain unvalidated, so the proxy is not an on-vehicle risk estimate.The software-path mechanism remains plausible where workload-dependent heat couples to observable frequency or interrupts and weakly privileged software can read them.Source: §7.1 · p. 18
7.2 Engineering Implications
- IR defenses should test reliability-aware RGB–thermal fusion, threat-aware processing, and planner responses to heaters, bulb boards, and HOTCOLD patterns; sensor defenses leave co-tenant telemetry open.Validation should measure spoof resistance and missed genuine hazards when corroborating sensors are unreliable.Source: §7.2 · p. 18
- A per-SoC channel inventory can guide capability-based reads and coarsened or delayed QM views, while ASIL governors retain accurate thermal state and live TEIs/DVFS.Disabling TEIs or DVFS is not a viable product posture under SOTIF thermal envelopes; DVFS-domain isolation needs latency and headroom budgets.Source: §7.2 · p. 19
- The proposed standards mapping treats readable telemetry as a potential QM↔ASIL path for ISO 26262 FFI and an asset or attack path in ISO/SAE 21434 TARA, not as channels already enumerated by those standards.SOTIF informs validation of perception insufficiencies and defense-induced performance limitations.Source: §7.2 · p. 19
7.3 Open Problems
- On-target Orin, DRIVE, or Ride evaluation remains open; proposed work ports the harness to automotive BSP images with OEM-approved inventories and realistic OTA/infotainment observers.The open problems also include planner-level fusion trust under IR spoofing and testing threat-aware processing against thermodynamically consistent heaters.Source: §7.3 · p. 19
- Automotive-package chiplet coupling, capability policies that preserve ASIL fidelity within SOTIF budgets, and standards-ready channel-inventory checklists remain research gaps.The proposed work includes instrumenting memory-die sensors, measuring latency and thermal-margin costs, and mapping inventories to FFI and TARA.Source: §7.3 · p. 20
- Because GPU co-tenancy weakened solo fingerprinting, scheduled mixed-criticality noise is proposed for study as a possible soft mitigant, subject to perception deadlines.The proposal complements policies that close telemetry at the source.Source: §7.3 · p. 20
8 Conclusion
The survey frames thermal IR attacks and unprivileged thermal telemetry as complementary integrity and confidentiality risks in interfaces AVs must keep operational. It synthesizes residual risks and identifies research needs spanning perception, operating systems, silicon, and standards.
8 Conclusion
- Thermal IR spoofing and unprivileged telemetry leakage expose complementary integrity and confidentiality failures; closing one path does not close the other, and defenses do not transfer.The interfaces remain operational for night perception and package thermal safety.Source: §8 · p. 20
- Temperature noising alone does not eliminate workload fingerprinting when alternative telemetry channels remain open.Source: §8 · p. 20
- Naive thermal-only fusion under RGB contrast collapse can let an IR spoof dominate fused decisions.Source: §8 · p. 20
- The survey calls for on-target co-tenant evaluation, fusion trust under IR spoofing, chiplet thermal-coupling analysis, capability-based telemetry, and standards-ready TARA artifacts.Source: §8 · p. 20
- The residual-risk frame links sensor, OS, silicon, and standards concerns that prior surveys leave fragmented.Source: §8 · p. 20