TRACER: An RDC-Triggered Trajectory Recovery Framework for Cyberattack-Resilient Adaptive Cruise Control

1 Introduction

• Attack-corrupted vehicle-state information can disrupt car-following, causing speed oscillations, unsafe spacing, and traffic instability.Effective response requires activating recovery at an appropriate time and guiding compromised trajectories toward rational car-following behavior.Source: §1 · p. 2
• Velocity reconstruction alone may not restore spacing, generative similarity may not ensure rational behavior, and nominal imitation may falter on corrupted observations.Spacing evolves through accumulated relative motion, so recovery should restore the coupled longitudinal driving state.Source: §1 · p. 2
• Prediction or reconstruction errors can miss irrational spacing relationships, while RDCs offer a physically interpretable basis for triggering recovery.RDCs characterize sensitivity relationships in car-following dynamics and have been used to evaluate driving rationality under cyberattacks.Source: §1 · p. 2
• Cyberattacks shift spacing–speed states into distinct abnormal distributions, potentially limiting policies trained on nominal demonstrations.Figure 1 depicts nominal and attack-induced distributions and compares recovery outcomes toward the nominal domain.Source: §1 · p. 2, Figure 1 · p. 3
• TRACER integrates rationality-aware triggering with cross-branch robust imitation learning to recover attack-compromised trajectories under distribution shifts.RAT activates recovery upon RDC violations; CRIL combines clean and noise-enhanced branches and uses cross-branch fine-tuning to align the policy with nominal driving states.Source: §1 · p. 2

2 Related Work

• Detection and state-estimation methods identify corruption or infer compromised states, but may depend on system models and degrade under stealthy or complex disturbances [3].Approaches include signal- and model-based checks and observer-based estimation.Source: §2 · p. 3
• Impact-mitigation methods seek acceptable operation under corrupted information, rather than explicitly restoring compromised driving states.Examples include adversarial training, robust learning, cooperative perception, trust weighting, and reinforcement learning.Source: §2 · p. 3
• Sequence models can miss coupled spacing–velocity dynamics, while generative distribution fidelity alone does not ensure rational longitudinal behavior.Imitation learning offers behavioral consistency, but policies trained mainly on nominal demonstrations may be vulnerable to attack-induced shifts.Source: §2 · p. 3
• Physically interpretable recovery triggering and robustness to attack-induced distribution shifts remain insufficiently addressed.These gaps motivate TRACER.Source: §2 · p. 4

3.1 Rationality-Aware Triggering

• RAT calibrates admissible RDC intervals from attack-free trajectories and fixes them as hard rationality boundaries for identifying violations.The boundaries are used to trigger CRIL-based trajectory recovery.Source: §3.1 · p. 6
• Recovery activates when any of the three RDC variables falls outside its calibrated interval, as indicated by the RAT triggering signal.An active signal invokes CRIL; otherwise, recovery is not activated.Source: §3.1 · p. 6

3.2 Cross-Branch Robust Imitation Learning

• A denoising generator is trained on perturbed attack-free expert histories to map observations toward the nominal driving-state domain.The framework injects measurement perturbations into attack-free trajectories before training the generator.Source: §3.2 · p. 7
• CRIL trains a clean branch for nominal car-following behavior and a Gaussian-noise-enhanced branch for robustness to observation perturbations.Cross-branch fine-tuning uses the fixed clean-branch discriminator to regularize the robust policy toward the nominal distribution while retaining acquired robustness.Source: §3.2 · pp. 7–8
• The refined noisy-branch policy generates recovered velocity, which is used to update relative speed and spacing in the recovered state.The refined noisy-branch policy is adopted as the final recovery policy.Source: §3.2 · p. 8

4.1 Experimental setup

• Evaluation calibrates the ACC model on ICE-ACC and tests six attacks in a six-vehicle, 300-meter ring-road simulation against sequence, generative, and imitation-learning baselines.Recovery is assessed for trajectory accuracy, traffic stability, and safety.Source: §4.1 · pp. 9–11

4.2 RAT Triggering Performance Evaluation

• RAT triggered recovery in all evaluated attack episodes, achieving a 100% trigger success rate in each case.For FA, the average triggering delay was 8.68 ± 4.02 seconds as disturbances accumulated before violating the RDC bounds.Source: §4.2 · pp. 12–13, Table 5 · p. 12

4.3 Performance evaluation under cyberattack scenarios

• CRIL achieves the best overall recovery performance across the evaluated attacks, with low or near-lowest spacing errors and competitive velocity accuracy, stability, and safety.Some baselines achieve lower velocity errors in specific cases, while CRIL provides the most balanced overall performance across trajectory accuracy, traffic stability, and operational safety.Source: Table 6 · p. 13, §4.3 · p. 13

4.4 State-Space Distribution Analysis

• CRIL substantially overlaps the attack-free state distribution under FA, MA, and PA and reduces the distribution gap under BA and DPA, though residual shift remains under MaA.Compared methods show displaced, over-dispersed, or locally distorted clusters, indicating incomplete restoration of the spacing–speed relationship.Source: §4.4 · p. 14, Figure 4 · p. 14

4.5 Ablation study

• The full CRIL model performs best overall across six attacks; removing either branch or combining clean and perturbed samples in one branch reduces effectiveness.The clean branch supports nominal behavior learning, while the noise-enhanced branch improves robustness to corrupted observations.Source: §4.5 · p. 14, Table 7 · p. 15

4.6 Parameter sensitivity analysis

• Gaussian noise with standard deviation 0.1 gives the most consistent recovery across attacks, while larger perturbations generally increase errors.At intensity 0.1, Gaussian perturbations achieve the lowest or near-lowest errors in most scenarios compared with Laplace, Uniform, and Cauchy perturbations.Source: §4.6 · pp. 14–16, Figure 5 · p. 15, Figure 6 · p. 16

• The evaluation primarily uses IDM simulations calibrated with ICE-ACC data; effectiveness in real-world ACC and V2X environments remains unvalidated.Source: §5 · p. 16
• Experiments focus on predefined cyberattacks involving a single ACC vehicle, leaving coordinated multi-vehicle and unseen attacks for future assessment.Source: §5 · p. 16
• RDCs currently trigger recovery rather than constrain policy optimization; RDC-based regularization may strengthen physical consistency and interpretability.Source: §5 · p. 16

• TRACER combines calibrated-RDC triggering with clean-branch and noise-enhanced imitation learning, followed by cross-branch refinement toward the attack-free driving-state distribution.Source: §6 · p. 16
• Across six cyberattack scenarios, TRACER demonstrates reliable recovery triggering and strong overall recovery accuracy, traffic stability, and safety.Source: §6 · p. 16
• State-space analysis shows TRACER mitigates attack-induced distribution shifts and restores coupled spacing–velocity dynamics rather than only reconstructing individual states.Source: §6 · p. 16