{"id":"9f58ef8c-305a-4270-8193-e9c703bedf93","arxiv_id":"2505.21322","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Comparing camera-derived and LiDAR-derived scene graphs can expose a stealthy class of LiDAR attacks, demonstrated qualitatively on CARLA and nuScenes scenes within a proposed neuro-symbolic perception framework.","lead":"This paper proposes adding a symbolic layer to self-driving perception: build scene graphs that list objects and their relationships, then compare camera and LiDAR graphs to catch attacks that move objects silently in one sensor. A short feasibility study on simulated and real driving scenes suggests this can expose a known class of stealthy fusion attacks, though the results are qualitative and the system components are not fully specified.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The load-bearing claim needs a benign-scene false-alarm study: the camera branch is an unmeasured reference and the paper concedes graph types/vocab differ; until benign graph disagreement is quantified, the flagged inconsistencies could be model noise rather than attack detection.","rationale":"The reader's weakest assumption identifies the same load-bearing point: the camera foundation model must be a trustworthy, commensurable reference for cross-sensor comparison. My concern sharpens this: the paper provides no quantitative evidence that benign cross-sensor graph disagreement is rare enough for the method to be a detector rather than a noise flagger. The presented figures may be exactly as captioned, and the mechanism is plausible, but the strongest claim is about securing perception, which requires statistical separation, not a single illustrative mismatch. The paper has real strengths: the frustum-attack formalization is grounded in prior published work, the two-stage integrity architecture is coherent, and Sections 5 and 6 are appropriately framed as early feasibility. Those strengths support a conditional path, not acceptance of the security claim as stated. The concrete test I propose would settle whether the central claim lands: if benign scenes rarely produce graph inconsistencies while attacked scenes reliably do, the concern is resolved; if benign false alarms are frequent, the camera branch cannot serve as ground truth. Since the reader already conditioned the verdict on quantitative detection metrics with false-alarm analysis, my read does not change the verdict.","tokens_in":12166,"tokens_out":5759,"duration_ms":70780,"concrete_test":"Run the exact pipeline on a set of benign (unattacked) frames from nuScenes/CARLA, e.g., 100 randomly selected scenes with object configurations similar to Figs. 6-8. Compute the cross-sensor graph-consistency score under the same matching and threshold procedure used to flag attacks, after fixing a predicate ontology mapping from foundation-model outputs to the geometric rule relations. Report the false-positive rate and the ROC/AUC when frustum attacks with the ζmin values from Eq. (1)/Appendix B.4 are injected. The central claim holds only if the benign graph-disagreement rate is far below the attack-induced disagreement and the false-alarm rate at the chosen operating point is acceptable; if the foundation-model graph disagrees with the LiDAR rule graph on a substantial fraction of benign frames, the camera-reference assumption fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Sec. 5.3: 'first method that secures perception against attacks exploiting asymmetric sensor resolutions') requires that cross-sensor graph comparison separates attack-induced inconsistencies from ordinary cross-sensor disagreement. The paper never measures the benign disagreement rate. The camera branch is an unnamed vision-language foundation model prompted with 'Build a scene graph from this image' (Sec. 5.1); its node and edge types 'differ from rule-based approach' (Fig. 4 caption), no ontology mapping to the geometric rule relations is given, and no SGG accuracy or stability evaluation on driving scenes is reported. Section 7 concedes that 'uncertain or incomplete graphs due to noisy data can yield inaccurate conclusions.' Consequently, the inconsistency highlighted in Fig. 6(d) could stem from the foundation model failing to detect the distant truck, using 'beside' where the rule-based graph says 'front_of', or from ordinary detection noise, rather than from the frustum attack. The demonstration is anecdotal: one CARLA case plus two nuScenes cases, with no false-alarm baseline, no detection rate, no ROC analysis, and no adaptive-adversary evaluation. If benign frames produce a comparable number of graph mismatches, the method does not 'secure' perception; it reports model noise as attack.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes NeuSPaPer, a neuro-symbolic perception framework that augments object detection with scene graph generation (SGG) and uses per-sensor and cross-sensor integrity checks to detect semantic-structure attacks, in particular the frustum attack on LiDAR-camera fusion. The authors derive an optimal frustum attack (Eq. 1), propose rule-based SGG for LiDAR and foundation-model SGG for camera images, and present a qualitative case study from CARLA and two from nuScenes. They claim that this is the first single-platform method to detect such attacks, and they discuss challenges and future work toward full-stack neuro-symbolic perception.","tokens_in":12277,"tokens_out":3918,"duration_ms":39230,"significance":"The idea of using scene graphs as a relational integrity layer for multi-sensor perception is attractive, and the attack formulation in Eq. (1) is consistent with prior work. If the central claim were established with quantitative evidence, this would be a meaningful step toward defending fusion pipelines against semantic-structure attacks. However, the evaluated evidence is only qualitative, and the unmeasured camera branch makes the core comparison untested. The paper is best viewed as a research vision with a feasibility illustration, not as a validated security mechanism.","major_comments":[{"comment":"The central claim that the neuro-symbolic SGG pipeline 'offers the first method that secures perception against attacks exploiting asymmetric sensor resolutions' is not supported by the reported feasibility study, which contains no detection rate, no false-positive analysis, no benign-scene baseline, and no error bars. The demonstration is a single CARLA frame plus two nuScenes frames in Appendix D, and the inconsistency highlighted in Fig. 6(d) is not compared against the distribution of graph mismatches that would occur in unattacked scenes. Without such a comparison, the observed mismatch cannot be attributed to the frustum attack rather than to ordinary sensor noise, detection error, or vocabulary differences between the two graph types.","section":"Section 5.3, Fig. 6"},{"comment":"The cross-sensor consistency check requires that the foundation-model scene graph from the camera and the rule-based scene graph from LiDAR are commensurable, but the paper never provides an ontology mapping between the foundation model's relation vocabulary and the geometric rules (front_of, left_of, occluding, following, far_from, close_to, next_to). The Figure 4 caption states that 'node and edge types differ from rule-based approach,' and no benign-scene study demonstrates that the two graphs normally agree. If the foundation model says 'beside' where the rule-based graph says 'front_of,' or fails to detect the distant truck in Fig. 6(a), the cross-sensor evaluator will flag benign data as attack, so the load-bearing assertion of Section 5.3 is unverified.","section":"Section 5.1, Figure 4 caption, Appendix C.3"},{"comment":"The conclusion concedes that 'uncertain or incomplete graphs due to noisy data can yield inaccurate conclusions,' which directly undermines the feasibility demonstration, because the paper does not quantify graph noise on benign scenes or show that the cross-sensor integrity function separates noise from attack. This concession should either be backed by a false-alarm analysis on benign frames or the Section 5.3 claim should be downgraded from 'first method that secures perception' to a preliminary illustration.","section":"Section 7"}],"minor_comments":[{"comment":"The text says 'Additional analyses and case studies are provided in Appendix D,' but Appendix D contains only two additional qualitative case studies with no numeric analysis; please align the wording with the content.","section":"Appendix D"},{"comment":"The foundation model is never named; to make the study reproducible, specify the model, version, prompt details, and any sampling parameters.","section":"Section 5.1"},{"comment":"The list of relations includes 'far from' and 'close to' with complement 'self'; the notion of a 'reduced graph' and how complements are handled for these self-complement relations should be clarified.","section":"Appendix C.3"},{"comment":"The statement that 'no amount of sub-sampling or ensembling can mitigate translation attacks' is too categorical; the paper should precisely state the class of defenses it rules out and cite the relevant impossibility or possibility results.","section":"Section 3.1"}],"recommendation":"major_revision","confidential_remarks":"This is a borderline case between major revision and reject. I chose major revision because the underlying idea is publishable and the missing benign-scene evaluation is a fixable gap, not a fundamental flaw. However, the current manuscript's abstract and Section 5.3 make claims far stronger than the evidence; please require the false-alarm study and vocabulary mapping before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a feasibility study, not a demonstration of assured autonomy. The new thing is the specific integration of foundation-model scene graph generation (SGG) on camera and rule-based SGG on LiDAR to flag frustum attacks via cross-sensor graph inconsistency. That integration is new relative to the cited prior work, and the vulnerability analysis in Section 3 is consistent with the authors' earlier frustum attack papers. The architecture is coherent, and the paper is honest in Section 7 about the main limitations: uncertain graphs, serialized LiDAR pipeline, expensive foundation models.\n\nThe soft spot is exactly where the stress-test lands. The load-bearing claim in Section 5.3 is that this is the first method to secure perception against asymmetric-resolution attacks like the frustum attack. That claim requires separating attack-induced inconsistency from benign cross-sensor disagreement, and the paper never measures the benign disagreement rate. The camera branch is an unnamed vision-language foundation model prompted to build a scene graph; its node and edge types differ from the rule-based LiDAR graphs, and no mapping or accuracy evaluation is given. So a flagged inconsistency in Figure 6(d) could come from the foundation model missing the distant truck, using a different relation word, or ordinary detection noise. The demonstration is one CARLA scene plus two nuScenes cases, with no detection rates, no false-alarm analysis, no baselines (e.g., chi-square innovation tests), and no error bars. This is a real gap, not a nitpick.\n\nThat said, the central mechanism is plausible, and the paper is not negligent: Section 7 explicitly concedes that uncertain or incomplete graphs can yield inaccurate conclusions. The abstract and Section 5.3 overstate what is shown. The right revision is to tone down the claims to 'feasibility' and add a benign-frame false-alarm study, quantitative detection metrics, named components, and ideally released code.\n\nThis paper is for a security or neuro-symbolic perception audience. It's a good discussion piece, but not something I'd cite as evidence of assured autonomy. It does deserve a serious referee: the idea is worth engaging with, and the limitations are fixable.\n\nRecommendation: send to peer review; expect major revision.","headline":"A plausible integration of scene-graph consistency for attack detection, but the feasibility evidence is anecdotal and the abstract overclaims; the idea deserves a serious referee with major revision.","tokens_in":12965,"tokens_out":2636,"would_cite":false,"duration_ms":27374,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Scene graphs expose a LiDAR attack that fools camera–LiDAR fusion.","keywords":["neuro-symbolic perception","scene graph generation","sensor fusion security","frustum attack","autonomous driving","LiDAR perception","cyber-physical systems"],"falsifier":"Run the pipeline on a large set of benign CARLA and nuScenes scenes and count cross-sensor inconsistencies; if the camera foundation-model graph and the LiDAR rule-based graph disagree frequently on un-attacked scenes, high false-alarm rates would mean the proposed comparison cannot distinguish attack-induced semantic changes from ordinary model noise.","tokens_in":11780,"feed_emoji":"🚗","tokens_out":5806,"duration_ms":56731,"temperature":0.7,"pith_summary":"This paper argues that deep-learning perception for autonomous vehicles is fundamentally insecure because DNNs are equivariant pattern-matchers: an attacker who shifts a 3D object in LiDAR data while keeping its projection consistent with the camera can move it tens of meters without tripping standard fusion checks. To close this gap, the authors propose a neuro-symbolic perception paradigm (NeuSPaPer) in which object detection is paired with scene graph generation, so each sensor yields not just boxes but structured relations such as \"van in front of truck.\" They report feasibility studies on the CARLA simulator and nuScenes dataset showing that a camera-derived scene graph and a LiDAR-derived scene graph agree on benign scenes, and that the same cross-sensor graph comparison flags the translated object when the LiDAR graph is attacked. If correct, this is the first single-platform method that detects frustum-style attacks exploiting asymmetric sensor resolutions.","feed_headline":"Scene graphs expose LiDAR attacks that fool camera–LiDAR fusion","feed_subtitle":"Comparing camera and LiDAR scene relations flags translated objects that keep their 2D projection.","key_machinery":"The load-bearing mechanism is cross-sensor scene graph consistency evaluation. A scene graph is a graph whose nodes are detected objects and whose edges are relational predicates such as front of, left of, near, and occluding; scene graph generation (SGG) is the joint task of detecting objects and inferring these relations. For the camera, graphs are produced by a vision-language foundation model prompted in natural language; for LiDAR, graphs are produced by hand-coded geometric functions over 3D box detections. Per-sensor integrity checks each graph against physics- and commonsense-based knowledge, and a cross-sensor integrity stage matches nodes between graphs and flags edges that disagree. This graph-level comparison is what lifts 2D image data into relational 3D space and exposes semantic changes that box-level IoU checks cannot see.","core_discovery":"On the paper's own terms, the central discovery is that representing sensor output as relational scene graphs turns a previously stealthy attack into a detectable semantic inconsistency. A frustum attack translates an object's 3D box (for example, a van) so the projected box keeps high IoU with the unattacked camera detection; standard single-frame fusion checks therefore pass. But the attack moves the van in 3D space, changing its geometric relations to other objects. The LiDAR rule-based graph then shows, for example, that the van-truck relation flips, while the camera graph, built by a foundation model prompted to \"build a scene graph from this image,\" preserves the original spatial relation. Comparing the two graphs exposes the mismatch, so the authors claim the neuro-symbolic SGG pipeline offers the first method securing perception against attacks that exploit asymmetric sensor resolutions.","pith_inferences":["Editorial inference: the same cross-sensor graph comparison could extend to other modalities such as radar or thermal cameras, since any sensor that can produce relational structure could be checked against the camera-derived graph.","Editorial inference: the approach could also detect spoofed objects that are internally consistent with one sensor but break relational constraints across sensors, not only translated existing objects.","Editorial inference: a quantitative benign-scene false-alarm study is the natural next experiment, because the practical detection threshold of the graph comparison is undefined without measuring how often the two graph types naturally disagree."],"forward_implications":["Frustum-type translation attacks on LiDAR become detectable even when the attacked boxes keep high overlap with the unattacked camera image.","The same graph-based integrity reasoning can flag semantic-structure attacks beyond translations, such as false positives or false negatives that alter relational context.","Graph-informed fusion can use per-node and per-edge consistency classifications to weight or reject unreliable sensor updates during state estimation.","If specialized transformer-based SGG models replace foundation models, the approach can move toward real-time deployment with bounded output spaces."],"supporting_citations":[{"why":"Defines the optimal frustum attack on camera–LiDAR fusion that the paper's scene-graph comparison is designed to detect.","marker":"Hallyburton et al. (2022)"},{"why":"Establishes that attacks on 3D data can hide in a stealthy null space of unattacked 2D data, motivating graph-level integrity.","marker":"Hallyburton et al. (2023a)"},{"why":"Supplies the equivariance argument explaining why translation attacks on point-cloud DNNs defeat sub-sampling and ensembling.","marker":"Bronstein et al. (2021)"},{"why":"Provides the real-world nuScenes driving dataset used in the feasibility cases.","marker":"Caesar et al. (2020)"},{"why":"Provides the CARLA physics-based simulator used in the feasibility cases.","marker":"Dosovitskiy et al. (2017)"},{"why":"Provides the specialized transformer-based SGG model (EGTR) the paper identifies for real-time graph generation.","marker":"Im et al. (2024)"},{"why":"Represents the class of vision-language foundation models used to produce scene graphs from camera images.","marker":"Radford et al. (2021)"}],"fun_headline_variants":["Scene graphs expose object-translation attacks on LiDAR fusion","Comparing camera and LiDAR graphs catches stealthy attacks","Scene graph disagreement reveals 3D object spoofing","Neuro-symbolic scene understanding detects fusion attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The camera graph must be a trustworthy reference: the foundation model's scene graph has to be accurate, stable, and comparable to the LiDAR geometric graph, but the paper does not measure how often the two graphs agree on benign scenes.","fun_headline_variants_meta":{"raw":{"variants":["Scene graphs expose object-translation attacks on LiDAR fusion","Comparing camera and LiDAR graphs catches stealthy attacks","Scene graph disagreement reveals 3D object spoofing","Neuro-symbolic scene understanding detects fusion attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000728,"raw_usage":{"total_tokens":3227,"prompt_tokens":881,"completion_tokens":2346,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":497,"completion_tokens_details":{"reasoning_tokens":2282}},"tokens_in":497,"tokens_out":2346,"duration_ms":19955,"temperature":1.0,"reasoning_tokens":2282,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T13:31:50.016604+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the pipeline on a large set of benign CARLA and nuScenes scenes and count cross-sensor inconsistencies; if the camera foundation-model graph and the LiDAR rule-based graph disagree frequently on un-attacked scenes, high false-alarm rates would mean the proposed comparison cannot distinguish attack-induced semantic changes from ordinary model noise.","supporting_citations":[{"cited_title":"Carla: An open urban driving simulator","cited_arxiv_id":null,"evidence_quote":"Provides the CARLA physics-based simulator used in the feasibility cases."}],"review_version":1}