[论文解读] All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference

Yi Yu, Libing Wu+4 more|arXiv (Cornell University)|Mar 9, 2026

Adversarial Robustness in Machine Learning被引用 0

一句话总结

PRBI 通过伪随机分组和贝叶斯推断实现对低验证成本的恶意车辆检测与排除，适用于全不可信车辆协同感知的逐帧防御。

ABSTRACT

Collaborative perception (CP) enables multiple vehicles to augment their individual perception capacities through the exchange of feature-level sensory data. However, this fusion mechanism is inherently vulnerable to adversarial attacks, especially in fully untrusted-vehicle environments. Existing defense approaches often assume a trusted ego vehicle as a reference or incorporate additional binary classifiers. These assumptions limit their practicality in real-world deployments due to the questionable trustworthiness of ego vehicles, the requirement for real-time detection, and the need for generalizability across diverse scenarios. To address these challenges, we propose a novel Pseudo-Random Bayesian Inference (PRBI) framework, a first efficient defense method tailored for fully untrusted-vehicle CP. PRBI detects adversarial behavior by leveraging temporal perceptual discrepancies, using the reliable perception from the preceding frame as a dynamic reference. Additionally, it employs a pseudo-random grouping strategy that requires only two verifications per frame, while applying Bayesian inference to estimate both the number and identities of malicious vehicles. Theoretical analysis has proven the convergence and stability of the proposed PRBI framework. Extensive experiments show that PRBI requires only 2.5 verifications per frame on average, outperforming existing methods significantly, and restores detection precision to between 79.4% and 86.9% of pre-attack levels.

研究动机与目标

• 解决全不可信车辆协同感知对对抗性特征扰动的脆弱性。
• 开发一个轻量级、无需信任的防御框架，不依赖于可信自车或先验攻击者知识。
• 利用帧间感知相似性作为自监督信号进行检测。
• 引入伪随机分组策略以最小化验证成本并实现可扩展防御。
• 在理论上给出收敛性保证并在大规模 CP 数据上进行实际验证。

提出的方法

• 建立帧间感知相似性模型以推导逐帧自参考检测信号。
• 提出 Pseudo-Random Bayesian Inference (PRBI)，通过伪随机两组分区实现每帧两次验证。
• 应用贝叶斯推断从分组一致性检查中估计恶意车辆的数量与身份。
• 采用两阶段过程：软抽样（分组）与以前一个正常帧为参考的一致性验证。
• 结合假设检验来决定收敛并最终确定攻击者身份。

实验结果

研究问题

• RQ1 在全不可信 CP 设置中，帧间感知相似性能否作为可靠的无自我偏见参考信号？
• RQ2 如何在与舰队规模无关的常量每帧验证成本下高效检测并识别恶意车辆？
• RQ3 伪随机两组验证策略是否在更低开销下提供可比或更优的攻击者检测？
• RQ4 PRBI 能否对估计攻击者数量并将其 isolates 提供理论收敛保证？
• RQ5 在不同融合范式下，PRBI 在常见对抗扰动（BIM、C&W、PGD）下的表现如何？

主要发现

• 良性帧的帧间相似性约为 0.8，而对抗场景显著下降，从而实现对 ego 信任的逐帧自监督。
• PRBI 平均每帧验证次数为 2.5 次，最大平均为 5.0 次，与基线相比显著降低检测成本。
• 在对抗攻击（PGD、BIM、C&W）下，PRBI 将检测性提升恢复至攻击前水平的 79.4%–86.9% 的范围。
• 两组伪随机验证近似随机抽样，并通过贝叶斯推断实现对每辆车的良性概率估计。
• 理论证明确立了对攻击者数量的估计值收敛到真实数量，并揭示了舍入对收敛性的影响。
• 在对抗设定下，PRBI 的 AP 提升优于 SOTA 防御 ROBOSAC 和 PASAC。