Investigating Adversarial Robustness of Heterogeneous Cooperative Perception
Chenyi Wang, Yutong Liu, Qingzhao Zhang, Ming F. Li
cs.CV · cs.CR · cs.MA · cs.RO
Quick verdict
Heterogeneity's CP robustness is a weak-attack illusion; HetPoison and HetShield are notable, but internal numbers conflict and eval covers one dataset.
Summary
The paper asks whether heterogeneous cooperative perception (CP) - where vehicles with different sensors share BEV features through learned translation 'bottlenecks' (reverter, adapter, discrete codebook, diffusion channel) - is naturally robust to feature-space removal attacks. Using a matched-objective harness that fixes perturbation budget, objective, and forward path, the authors show the apparent protection under standard sign-PGD largely vanishes under Adam-PGD with restarts (V2VAM 0.608 to 0.109 AP@0.5; HEAL 0.740 to 0.405); only the discrete codebook survives an adaptive battery (EOT, BPDA, SPSA), while the diffusion channel collapses to 0.054 AP. They then introduce HetPoison, a ~5M-parameter U-Net generator trained offline against a surrogate stack that emits a label-free, single-forward-pass perturbation, matching or exceeding per-frame optimizers (HEAL 0.209, STAMP 0.072) and transferring across designs, with a random-delta floor controlling the transfer analysis. Finally, HetShield, a 0.90M-parameter spatiotemporal trust layer (ConvGRU prediction plus spatial cosine consistency gating an ego-anchored blend), recovers 78.6-84.5% of damage on continuous families at ~1.2 ms/frame, beating LUCIA and ROBOSAC. Limitations: OPV2V/OPV2V-H only, single seed without variance estimates, an unusually large epsilon=1.0 budget in tension with stealthiness claims, quantization-aware results asserted but not reported, and abstract numbers (83-95% recovery) that do not match Table 4.
Review complete
Assessment at a glance
6
risk flags identified
● high 2
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Heterogeneity's apparent robustness against cooperative-perception feature attacks is an artifact of weak sign-PGD baselines; Adam-PGD with restarts closes or reverses the gap (Table 1).
- Only the discrete codebook (CodeFilling) withstands the full per-frame adaptive battery, while the diffusion channel (GenComm) collapses under EOT-PGD to 0.054 AP.
- HetPoison, a label-free single-forward-pass generator, matches or exceeds per-frame optimizers and transfers across heterogeneous designs (e.g., HEAL-to-STAMP drives AP to 0.03 vs a 0.68 random-delta floor).
- HetShield recovers most of the accuracy lost to HetPoison at ~1.2 ms/frame with 0.90M parameters, outperforming LUCIA and ROBOSAC (Table 4).
Strengths
Rigorous adaptive-attack methodology
The matched-objective harness (Sec 3.2) fixes budget, objective, and forward path so only the optimizer varies; Appendix C's random-delta floor separates adversarial direction from raw perturbation energy, and the authors candidly mark SPSA's CodeFilling result as uninformative (Table 2 footnote).
Honest two-posture threat modeling
HetPoison is explicitly labeled a white-box amortized upper bound on the diagonal and a genuine cross-family transfer off-diagonal (Sec 4.4, A.5); at deployment it needs no labels, no backward pass, and no victim queries.
Actionable defense taxonomy
Cheap, benchmarked defense
Unusual reproducibility detail
Weaknesses
Abstract conclusion not supported by the reported table
Cross-table numeric inconsistencies
No uncertainty quantification
Budget realism vs stealthiness claim
Quantization claims without numbers; defense tested only vs HetPoison
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does heterogeneity protect cooperative perception against adversarial attacks?
According to this paper, no. The apparent protection of heterogeneous designs (HEAL, STAMP, CodeFilling, GenComm) against feature-perturbation attacks comes mostly from weak attack baselines: when the authors swap sign-PGD for Adam-PGD with restarts under an identical perturbation budget and objective, the residual robustness largely disappears (e.g., HEAL falls from 0.740 to 0.405 AP@0.5), and only the discrete-codebook design keeps resisting per-frame adaptive attacks.
What is HetPoison and why is it considered a practical threat?
HetPoison is a learned U-Net generator (~5M parameters) that produces an object-removal perturbation for a vehicle's shared BEV feature map in a single forward pass. It is trained offline against a surrogate cooperative-perception stack, so at attack time it needs no ground-truth labels, no iterative optimization, and no access to the victim's private detector. In the paper it matches or exceeds expensive per-frame optimizer attacks and transfers across heterogeneous architectures (e.g., dropping HEAL to 0.209 and STAMP to 0.072 AP@0.5).
What is HetShield and how much accuracy does it recover?
HetShield is a lightweight defense (~0.9M parameters, ~1.2 ms per frame) that scores each collaborating agent's feature for temporal inconsistency (via a ConvGRU next-frame predictor) and spatial disagreement with the ego's own perception, then blends suspicious features toward the ego map before fusion. The paper reports it recovers 78.6-84.5% of the accuracy lost to HetPoison on continuous architectures (46.2% on the codebook), outperforming LUCIA and ROBOSAC - note the abstract's '83-95%' figure does not match these table values.
Which heterogeneous cooperative perception design is most robust to attack?
The discrete codebook (CodeFilling) is the only design in the paper that survives the full per-frame adaptive-attack battery - EOT-8 leaves AP at 0.730 and BPDA at 0.743 versus a clean AP around 0.87 - because vector quantization destroys unstructured and per-frame optimized noise. The diffusion channel (GenComm) looks robust only against naive attacks and collapses to 0.054 AP under EOT-PGD.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The abstract is truncated mid-sentence in the extracted text ('we propose HetShiel...'); its ending was reconstructed from the body and conclusion.
- Figures were analyzed from embedded text and per-scene counts only; qualitative detection quality in Fig. 2 cannot be visually verified.
- Appendix-level results mentioned in passing (epsilon sweep, quantization experiments) are not present in the extraction, so absence-of-results judgments apply only to the provided text.
- No code repository link appears in the text; the ethics section only promises to release HetShield and the attack, hence codeAvailable=false.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.