Integrated Simulation Framework for Adversarial Attacks on Autonomous Vehicles

Alexandros Gkillas; Aris S. Lalos; Christos Anagnostopoulos; Ioulia Kapsali; Nikos Piperigkos

REVIEW 4 major objections 4 minor 20 references

Integrated Simulation Framework for Adversarial Attacks on Autonomous Vehicles

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a single open-source framework can synchronize CARLA, SUMO, and Artery to launch coordinated LiDAR and V2X attacks, and demonstrates point perturbation dropping a 3D detector's mAP ratio to 73.20%.

desk verdict An honest integration-engineering paper whose 'realistic conditions' claim is unsupported by the evidence; worth a referee if the code and data actually appear. read the letter →

arxiv 2509.05332 v1 pith:5LD3I4AT submitted 2025-08-31 cs.CR cs.AI

Christos Anagnostopoulos , Ioulia Kapsali , Alexandros Gkillas , Nikos Piperigkos , Aris S. Lalos This is my paper

classification cs.CRcs.AI

keywords adversarialattacksautonomousvehiclesLiDARpointcloudV2XcommunicationGPSspoofingROS2integration3Dobjectdetectionsimulationframework

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Autonomous vehicles can be attacked both through what they sense (LiDAR point clouds, the laser-scan data used by 3D object detectors) and through what they exchange (V2X, vehicle-to-everything, messages such as positions and speeds), yet existing simulators usually cover only one of these surfaces. This paper claims to close that gap with an open-source framework that runs the CARLA driving simulator, the SUMO traffic simulator, and the Artery V2X communication simulator under one synchronization core, controlled by a single configuration file. It implements three LiDAR-level attacks (perturbation, detachment, and attachment of points) plus communication-level attacks including fake messages, Sybil ghost vehicles, and GPS spoofing. Evaluated on a state-of-the-art 3D object detector, the attacks reduce the detector's mAP ratio to 73.20% under point perturbation, 78.46% under point attachment, and 91.77% under detachment while keeping the point clouds geometrically similar. Because results are published as ROS 2 messages, third-party autonomous-driving software can be tested against these scenarios without code changes.

What carries the argument

The load-bearing mechanism is the Simulation Logic Core (SLC), an orchestration layer in which Artery acts as the master clock and drives SUMO and CARLA as synchronized slaves through the Traffic Control Interface (TraCI) protocol; whichever of SUMO or CARLA owns the scenario, the orchestrator translates vehicle states between them each clock step. The SLC contains the Attack Generation Module, whose perception engine crafts point clouds with a dual-loss optimization L = L_adv + lambda * L_per under projected gradient descent for perturbation, a saliency-score map for greedy point removal and attachment initialization, and Chamfer distance as a geometric-similarity regularizer. Its communica

What would settle it

Use the same attack recipes (10 cm PGD perturbation, 1% salient-point removal, 300 injected points) on point clouds recorded by a real 64-channel LiDAR with ground-truth boxes, and compute the mAP ratio for SECOND; if the ratio stays near baseline or the required perturbation budget is much larger than 10 cm, the framework's attack effectiveness is a simulation artifact.

Watch

Extended reading notes

Core claim

The paper's central claim is that a single integrated, open-source simulation environment can generate realistic multi-domain adversarial scenarios for autonomous vehicles, and that the scenarios it produces genuinely hurt a modern perception system. The evidence is a quantitative evaluation on the SECOND 3D object detector using a 5-minute Town06 dataset collected with a simulated 64-channel LiDAR: point perturbation with a 10 cm bound drops the mAP ratio to 73.20% at a Chamfer distance of 0.01533; injecting 300 points with a 0.5 m shift bound drops it to 78.46% while remaining nearly imperceptible (CD 0.00126); removing 1% of the most salient points drops it to 91.77% at CD 0.07035. The co

Load-bearing premise

The claim that these attacks matter in the real world depends on CARLA's simulated LiDAR point clouds being realistic enough that the measured accuracy drops would also appear with physical LiDAR data; the paper does not validate against real point clouds.

Editorial extensions

If this is right

Coordinated perception-plus-communication attacks can be staged in one synchronized scenario, allowing study of attacks that no single-simulator testbed supports.
The measured mAP ratios quantify how much a modern 3D detector degrades under bounded LiDAR perturbations; for example, 10 cm perturbation drops mAP to 73.20%, giving defense work a concrete baseline.
Because output is ROS 2-compatible, an unmodified autonomous-driving software stack can be plugged into the framework, so robustness testing becomes part of normal development rather than a special-purpose benchmark.
The same attack-generation pipeline (saliency-based point selection, PGD optimization, communication message tampering) can be extended to other sensor modalities such as cameras or radar.
The communication-level attacks are implemented and integrated, but their downstream impact on cooperative perception and planning remains an open evaluation target that the framework could support.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The reported mAP degradation is measured only on SECOND against CARLA-generated point clouds; whether the same attack budgets degrade detectors trained on real LiDAR as strongly is untested, so transferring these numbers to physical systems should be treated cautiously.
Because removing only 1% of salient points cuts mAP to 91.77% while attachment is nearly imperceptible, defenses that inspect point density or local geometry may be a promising first line; the paper does not explore defenses.
The single-configuration synchronization core could be reused as a standardized attack benchmark for comparing detectors, attacks, and mitigation strategies, an implication the authors mention only as a future perception evaluation platform.
Cross-testing the same attacks across multiple detectors would clarify whether the vulnerability is intrinsic to LiDAR-based detection or specific to SECOND's architecture.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

What you should know first: this is a software-integration paper, not a new attack result. The genuinely new part is the orchestration layer that synchronizes CARLA, SUMO, and Artery in both SUMO-driven and CARLA-driven modes, with a single config file, ROS 2 output, and modular attack generation. If the code ships, that is a useful testbed for the AV-security community. The attack algorithms themselves are standard—PGD perturbation, saliency-based detachment, point attachment, CAM spoofing, GPS bias—and the formulations are correct. The authors also deserve credit for not overclaiming novelty in the methods; they explicitly cite their prior framework [8] and the attack papers they build on.

The evaluation, though, is where the paper wobbles. The abstract and conclusion promise "significant performance degradation under realistic conditions," but the evidence is a single detector (SECOND), a single town (Town06), no error bars, and no comparison against real LiDAR statistics or even a second simulator. CARLA's sensor model is simplified, so a 10 cm perturbation budget dropping the mAP ratio to 73.20% could be partly a synthetic artifact. That external-validity gap is the main soft spot, and the stress-test note lands on it correctly. A second, smaller soft spot: the paper says "open-source" but includes no repository link or artifact checklist. A third: the communication-layer attacks are described but not evaluated at all—no experiments on V2X or GPS spoofing, just a table of perception attacks. That is fine for a framework paper if stated as future work, but the title and abstract imply more.

Also, because the attacks are optimized directly against the detector loss, the mAP degradation is partly guaranteed by construction. The exact magnitude is still empirical, so this is not fatal, but it means the numbers are upper bounds on effectiveness, not surprises.

Who is this for? A researcher setting up a multi-domain AV attack testbed would want to read this and then ask for the code. As a standalone paper, it is thin on validation but structurally sound. I would send it to peer review only on the condition that the authors provide the artifact and ideally expand the evaluation to another detector or dataset. My recommendation: engage with it, but demand the code and a more sober interpretation of "realistic."

Referee Report

4 major / 4 minor

Summary. The paper describes an integrated simulation framework for generating adversarial attacks on autonomous vehicles, combining CARLA, SUMO, and Artery/OMNeT++ under a unified orchestration core. It supports LiDAR point-cloud attacks (perturbation, detachment, attachment) and communication-level attacks (V2X message manipulation, GPS spoofing) and provides ROS 2 integration. The authors evaluate the perception attacks on the SECOND 3D detector using 3,000 frames from CARLA Town06, reporting mAP ratios as low as 73.20% (perturbation, 10 cm) with low Chamfer Distance. The central claim is that the framework is a novel, open-source, high-fidelity multi-domain adversarial simulation environment that significantly degrades SOTA AV perception under realistic conditions.

Significance. If the framework's claims are substantiated, it would be a useful contribution to adversarial robustness testing for autonomous vehicles: it integrates physical, traffic, and V2X simulation with a single configuration file, implements several standard LiDAR attack classes, and exposes ROS 2 interfaces for downstream stacks. The use of Chamfer Distance as an independent perceptibility metric is a strength, as is the modular design. However, the paper's core empirical claim is currently supported only by a narrow evaluation, and the communication-level attacks are not evaluated at all.

major comments (4)

[§IV-B/C, Tables I–II] The central claim of 'significant performance degradation under realistic conditions' is not supported by the current evaluation. Only one detector (SECOND), one CARLA town (Town06), and one synthetic LiDAR sensor model are used. No error bars, confidence intervals, or repeated runs are reported, so the mAP ratio of 73.20% may be a single-run artifact. CARLA's LiDAR model is not validated against real sensor noise, reflectivity, or dropout statistics; without such validation, the measured degradation may not transfer to physical LiDAR. The authors should either add validation against real LiDAR data, or substantially broaden the evaluation (multiple towns, sensor models, detectors, and multiple seeds) to support the 'realistic conditions' wording.
[§III-B and §IV] The paper's abstract and introduction claim that the framework targets 'both perception and communication layers' of AVs, and the system section describes V2X message manipulation, Sybil attacks, RBA, and GPS spoofing. However, Section IV evaluates only perception-level attacks on SECOND; there are no experiments or metrics for any communication-level attack. The multi-domain effectiveness claim is therefore unsubstantiated. A representative end-to-end demonstration, even a simple one, is needed to show that the communication attacks affect a downstream task (e.g., cooperative perception or planning).
[Eq. (1), §IV-B] The attack formulation in Eq. (1) includes a dual-objective loss with regularization weight λ, but the paper never specifies the value of λ used in the experiments. Similarly, the attachment attack fixes K=300 injected points without a stated rationale, and the optimization details for attachment are incomplete. This makes the attack generation pipeline non-reproducible, which is a problem for a paper whose main contribution is an open-source framework. Please report all hyperparameters and, ideally, a sensitivity analysis for λ and K.
[Abstract and §I] The paper states the framework is 'open-source' and 'novel', but no repository, code artifact, or dataset link is provided anywhere in the manuscript or references. Since 'open-source' is a stated contribution, the absence of any artifact URL or access statement prevents verification and reuse. Please provide a public repository link or an explicit statement of how the code/data can be obtained.

minor comments (4)

[§II-A] Typo: 'implemening' should be 'implementing'.
[§I Contributions] Grammar error in the third bullet: 'It is provided and evaluation' should be 'We provide an evaluation'.
[§III-A3, Eq. (4)] The Chamfer Distance in Eq. (4) is used as a perceptibility metric, but it is not explained whether the distance is computed over the full point cloud or only over object-bounded regions. Specify the computation domain, as this affects the reported CD values.
[Table II] The detachment attack row uses 'drop ratio %' but values are listed as 0.05, 0.1, etc., which are fractions, not percentages. Use consistent notation to avoid ambiguity.

Circularity Check

1 steps flagged · score 4.0 of 10

The CD 'perceptibility' result is optimized into the attachment attack; no other circular step found.

self definitional [Section III-A3 (Eq. 4) and Section IV-A (Metrics b), Tables I-II]
"To ensure the geometric similarity between the original point cloud and its adversarial counterpart, we incorporate the Chamfer Distance DC as a regularization constraint, defined as: ... To quantify this similarity, we use the Chamfer Distance (CD) as a perceptual metric."

For point attachment, the attack-generation optimization explicitly minimizes Chamfer Distance to keep injected points plausible. The evaluation then reports Chamfer Distance as the perceptibility metric. The low CD values in Tables I and II for attachment are therefore partly produced by the optimizer, not measured independently: the metric and the objective are the same function. This does not affect the perturbation or detachment attacks, which are constrained by an L2 perturbation loss, but the paper presents CD uniformly as a perceptual metric for all attack types.

full rationale

The core contribution is the integrated CARLA/SUMO/Artery simulation framework, and none of the framework claims reduce to their own inputs. The attack algorithms are standard PGD/saliency/initialize-and-shift methods citing external prior work, and the evaluation is a straightforward white-box benchmark. The only concrete circularity is the Chamfer Distance dual-use: it is both the regularization objective for attachment attacks and the reported perceptibility metric, so the attachment rows in Tables I and II do not constitute independent evidence of imperceptibility. This is partial and peripheral rather than central. The reference to the authors' prior framework [8] is an architectural antecedent, not a load-bearing self-citation. The mAP degradation measured on SECOND is obtained by optimizing SECOND's own loss; this is standard adversarial-attack evaluation and is not itself circular, though it means the 'realistic conditions' generalization claim is an external-validity concern rather than a derivation. No uniqueness theorems or ansatz-smuggling citations are present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The framework's headline results depend on the fidelity of the three simulators, the choice of SECOND as the sole evaluation model, and the representativeness of the single Town06 dataset. These are accepted as assumptions rather than validated. The attack hyperparameters (lambda, K, epsilon) are hand-chosen but swept over ranges, so they are reported rather than hidden.

free parameters (3)

lambda (Eq. 1)
Balancing hyperparameter between adversarial loss and perturbation loss in the attack optimization; no value reported in the paper, but the crafted attacks depend on it.
K number of attached points = 300
Number of synthetic points injected in the point attachment attack; chosen by hand, and the evaluation table shows results only for this fixed K.
epsilon perturbation budget = swept 0.5-10 cm (perception), 0.05-1 m (attachment)
Maximum displacement of points in each attack. The framework's headline result uses 10 cm for perturbation; this is a hand-chosen evaluation parameter.

assumptions (4)

domain assumption CARLA, SUMO, and Artery provide high-fidelity models of physics, traffic, and V2X networking
The paper states this (Sec. II) but provides no validation against real-world LiDAR or V2X traces.
domain assumption SECOND is a representative state-of-the-art 3D detector and its detection loss is a suitable surrogate for robustness
Used as the sole target model in Sec. IV; no comparison to other detectors.
domain assumption The 3000-frame Town06 dataset is representative of realistic urban driving
Single town, 5 minutes of simulated driving, no diversity of weather or traffic conditions reported (Sec. IV-B).
domain assumption Standard adversarial attack formulations (PGD, saliency-based removal, point attachment) are effective in LiDAR-based detection
Assumed from prior literature [12-15]; the paper does not establish this independently.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Integrated Simulation Framework for Adversarial Attacks on Autonomous Vehicles." pith.science (2026). https://pith.science/paper/5LD3I4AT

@misc{pith2026250905332,
  author       = {Pith},
  title        = {Pith review of: Integrated Simulation Framework for Adversarial Attacks on Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5LD3I4AT}},
  note         = {Machine review of arXiv:2509.05332}
}

read the original abstract

Autonomous vehicles (AVs) rely on complex perception and communication systems, making them vulnerable to adversarial attacks that can compromise safety. While simulation offers a scalable and safe environment for robustness testing, existing frameworks typically lack comprehensive supportfor modeling multi-domain adversarial scenarios. This paper introduces a novel, open-source integrated simulation framework designed to generate adversarial attacks targeting both perception and communication layers of AVs. The framework provides high-fidelity modeling of physical environments, traffic dynamics, and V2X networking, orchestrating these components through a unified core that synchronizes multiple simulators based on a single configuration file. Our implementation supports diverse perception-level attacks on LiDAR sensor data, along with communication-level threats such as V2X message manipulation and GPS spoofing. Furthermore, ROS 2 integration ensures seamless compatibility with third-party AV software stacks. We demonstrate the framework's effectiveness by evaluating the impact of generated adversarial scenarios on a state-of-the-art 3D object detector, revealing significant performance degradation under realistic conditions.

Figures

Figures reproduced from arXiv: 2509.05332 by the authors.

**Figure 2.** Visualization of point clouds under various adversarial attack types. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

20 extracted references · 16 canonical work pages

[8]

Open- Source Integrated Simulation Framework for Cooperative Autonomous Vehicles,

C. Anagnostopoulos, C. Koulamas, A. Lalos, and C. Stylios, “Open- Source Integrated Simulation Framework for Cooperative Autonomous Vehicles,” in 2022 11th Mediterranean Conference on Embedded Com- puting (MECO) , Jun. 2022, pp. 1–4, iSSN: 2637-9511. [Online]. Avail- able: https://ieeexplore.ieee.org/document/9797115/?arnumber=9797115

work page arXiv 2022
[1]

V2X Cooperative Perception for Autonomous Driving: Recent Advances and Challenges,

T. Huang, J. Liu, X. Zhou, D. C. Nguyen, M. R. Azghadi, Y . Xia, Q.-L. Han, and S. Sun, “V2X Cooperative Perception for Autonomous Driving: Recent Advances and Challenges,” Nov. 2024, arXiv:2310.03525 [cs]. [Online]. Available: http://arxiv.org/abs/2310.03525

arXiv 2024
[2]

AdvGPS: Adversarial GPS for Multi-Agent Perception Attack

J. Li, B. Li, X. Liu, J. Fang, F. Juefei-Xu, Q. Guo, and H. Yu, “AdvGPS: Adversarial GPS for Multi-Agent Perception Attack,” Feb. 2024, arXiv:2401.17499 [cs]. [Online]. Available: http://arxiv.org/abs/2401.17499

work page Pith review arXiv 2024
[3]

ANTI-CARLA: An Adversarial Testing Framework for Autonomous Vehicles in CARLA

S. Ramakrishna, B. Luo, C. Kuhn, G. Karsai, and A. Dubey, “ANTI-CARLA: An Adversarial Testing Framework for Autonomous Vehicles in CARLA,” Jul. 2022, arXiv:2208.06309 [cs]. [Online]. Available: http://arxiv.org/abs/2208.06309

work page Pith review arXiv 2022
[4]

Simutack - An Attack Simulation Framework for Connected and Autonomous Vehicles,

A. Finkenzeller, A. Mathur, J. Lauinger, M. Hamad, and S. Steinhorst, “Simutack - An Attack Simulation Framework for Connected and Autonomous Vehicles,” in 2023 IEEE 97th V ehicular Technology Conference (VTC2023-Spring) , Jun. 2023, pp. 1–7, iSSN: 2577-2465. [Online]. Available: https://ieeexplore.ieee.org/document/10200555

work page arXiv 2023
[5]

V2XP-ASG: Generating Adversarial Scenes for Vehicle-to-Everything Perception,

H. Xiang, R. Xu, X. Xia, Z. Zheng, B. Zhou, and J. Ma, “V2XP-ASG: Generating Adversarial Scenes for Vehicle-to-Everything Perception,” in 2023 IEEE International Conference on Robotics and Automation (ICRA) , Feb. 2023, pp. 3584–3591. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/10161384

work page arXiv 2023
[6]

CARLA: An Open Urban Driving Simulator,

A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “CARLA: An Open Urban Driving Simulator,” Nov. 2017, arXiv:1711.03938. [Online]. Available: http://arxiv.org/abs/1711.03938

arXiv 2017
[7]

Robot operating system 2: Design, architecture, and uses in the wild,

S. Macenski, T. Foote, B. Gerkey, C. Lalancette, and W. Woodall, “Robot operating system 2: Design, architecture, and uses in the wild,” Science Robotics, vol. 7, no. 66, p. eabm6074, 2022. [Online]. Available: https://www.science.org/doi/abs/10.1126/scirobotics.abm6074

doi:10.1126/scirobotics.abm6074 2022

Show all 20 references

[9]

Microscopic Traffic Simulation using SUMO,

P. A. Lopez, M. Behrisch, L. Bieker-Walz, J. Erdmann, Y .-P. Fl¨otter¨od, R. Hilbrich, L. L ¨ucken, J. Rummel, P. Wagner, and E. Wiessner, “Microscopic Traffic Simulation using SUMO,” in 2018 21st International Conference on Intelligent Transportation Systems (ITSC), Aug. 2018...

2018
[10]

Artery V2X Simulation Framework

“Artery V2X Simulation Framework.” [Online]. Available: http://artery.v2x-research.eu/
[11]

carla-simulator/ros-bridge,

“carla-simulator/ros-bridge,” May 2025, original-date: 2018- 11-30T13:51:34Z. [Online]. Available: https://github.com/carla- simulator/ros-bridge

2025
[12]

A comprehensive study of the ro- bustness for lidar-based 3d object detectors against adversarial attacks,

Y . Zhang, J. Hou, and Y . Yuan, “A comprehensive study of the ro- bustness for lidar-based 3d object detectors against adversarial attacks,” International Journal of Computer Vision , vol. 132, no. 5, pp. 1592– 1624, 2024

2024
[13]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv:1706.06083, 2017

2017 arXiv
[14]

Pointcloud saliency maps,

T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren, “Pointcloud saliency maps,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , October 2019

2019
[15]

Generating 3d adversarial point clouds,

C. Xiang, C. R. Qi, and B. Li, “Generating 3d adversarial point clouds,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 9136–9144

2019
[16]

Extending online 4d situational awareness in connected and automated vehicles,

N. Piperigkos, C. Anagnostopoulos, A. S. Lalos, and K. Berberidis, “Extending online 4d situational awareness in connected and automated vehicles,” IEEE Transactions on Intelligent V ehicles , vol. 9, no. 8, pp. 5316–5335, 2024

2024
[17]

Goos, Peer-to-Peer Systems: First InternationalWorkshop, IPTPS 2002 Cambridge, MA, USA, March 7-8, 2002 Revised Papers , 1st ed

G. Goos, Peer-to-Peer Systems: First InternationalWorkshop, IPTPS 2002 Cambridge, MA, USA, March 7-8, 2002 Revised Papers , 1st ed. Berlin/Heidelberg: Springer Berlin Heidelberg, 2002

2002
[18]

Physics-Informed Machine Learning for Data Anomaly Detection, Classification, Localization, and Mitigation: A Review, Challenges, and Path Forward,

M. J. Zideh, P. Chatterjee, and A. K. Srivastava, “Physics-Informed Machine Learning for Data Anomaly Detection, Classification, Localization, and Mitigation: A Review, Challenges, and Path Forward,” IEEE Access , vol. 12, pp. 4597–4617, 2024. [Online]. Available: https://ieee...

2024
[19]

A practical gps location spoofing attack in road navigation scenario,

K. C. Zeng, Y . Shu, S. Liu, Y . Dou, and Y . Yang, “A practical gps location spoofing attack in road navigation scenario,” in Proceedings of the 18th International Workshop on Mobile Computing Systems and Applications, ser. HotMobile ’17. New York, NY , USA: Association for C...

2017
[20]

SECOND: Sparsely Embedded Convolutional Detection,

Y . Yan, Y . Mao, and B. Li, “SECOND: Sparsely Embedded Convolutional Detection,” Sensors, vol. 18, no. 10, p. 3337, Oct. 2018, number: 10 Publisher: Multidisciplinary Digital Publishing Institute. [Online]. Available: https://www.mdpi.com/1424-8220/18/10/3337

2018

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [8]

Open- Source Integrated Simulation Framework for Cooperative Autonomous Vehicles,

C. Anagnostopoulos, C. Koulamas, A. Lalos, and C. Stylios, “Open- Source Integrated Simulation Framework for Cooperative Autonomous Vehicles,” in 2022 11th Mediterranean Conference on Embedded Com- puting (MECO) , Jun. 2022, pp. 1–4, iSSN: 2637-9511. [Online]. Avail- able: https://ieeexplore.ieee.org/document/9797115/?arnumber=9797115

work page arXiv 2022

[2] [1]

V2X Cooperative Perception for Autonomous Driving: Recent Advances and Challenges,

T. Huang, J. Liu, X. Zhou, D. C. Nguyen, M. R. Azghadi, Y . Xia, Q.-L. Han, and S. Sun, “V2X Cooperative Perception for Autonomous Driving: Recent Advances and Challenges,” Nov. 2024, arXiv:2310.03525 [cs]. [Online]. Available: http://arxiv.org/abs/2310.03525

arXiv 2024

[3] [2]

AdvGPS: Adversarial GPS for Multi-Agent Perception Attack

J. Li, B. Li, X. Liu, J. Fang, F. Juefei-Xu, Q. Guo, and H. Yu, “AdvGPS: Adversarial GPS for Multi-Agent Perception Attack,” Feb. 2024, arXiv:2401.17499 [cs]. [Online]. Available: http://arxiv.org/abs/2401.17499

work page Pith review arXiv 2024

[4] [3]

ANTI-CARLA: An Adversarial Testing Framework for Autonomous Vehicles in CARLA

S. Ramakrishna, B. Luo, C. Kuhn, G. Karsai, and A. Dubey, “ANTI-CARLA: An Adversarial Testing Framework for Autonomous Vehicles in CARLA,” Jul. 2022, arXiv:2208.06309 [cs]. [Online]. Available: http://arxiv.org/abs/2208.06309

work page Pith review arXiv 2022

[5] [4]

Simutack - An Attack Simulation Framework for Connected and Autonomous Vehicles,

A. Finkenzeller, A. Mathur, J. Lauinger, M. Hamad, and S. Steinhorst, “Simutack - An Attack Simulation Framework for Connected and Autonomous Vehicles,” in 2023 IEEE 97th V ehicular Technology Conference (VTC2023-Spring) , Jun. 2023, pp. 1–7, iSSN: 2577-2465. [Online]. Available: https://ieeexplore.ieee.org/document/10200555

work page arXiv 2023

[6] [5]

V2XP-ASG: Generating Adversarial Scenes for Vehicle-to-Everything Perception,

H. Xiang, R. Xu, X. Xia, Z. Zheng, B. Zhou, and J. Ma, “V2XP-ASG: Generating Adversarial Scenes for Vehicle-to-Everything Perception,” in 2023 IEEE International Conference on Robotics and Automation (ICRA) , Feb. 2023, pp. 3584–3591. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/10161384

work page arXiv 2023

[7] [6]

CARLA: An Open Urban Driving Simulator,

A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “CARLA: An Open Urban Driving Simulator,” Nov. 2017, arXiv:1711.03938. [Online]. Available: http://arxiv.org/abs/1711.03938

arXiv 2017

[8] [7]

Robot operating system 2: Design, architecture, and uses in the wild,

S. Macenski, T. Foote, B. Gerkey, C. Lalancette, and W. Woodall, “Robot operating system 2: Design, architecture, and uses in the wild,” Science Robotics, vol. 7, no. 66, p. eabm6074, 2022. [Online]. Available: https://www.science.org/doi/abs/10.1126/scirobotics.abm6074

doi:10.1126/scirobotics.abm6074 2022