Don't Let One Lie Survive A Hundred Truths: A Selective Bayesian Trust Estimator for Collaborative Perception

arXiv:2610.07875v1 [cs.CR] 6 Oct 2026

D ON ’ T L ET O NE L IE S URVIVE A H UNDRED T RUTHS : A S ELECTIVE BAYESIAN T RUST E STIMATOR FOR C OLLABORATIVE P ERCEPTION

Yutong Liu Chenyi Wang Ming F. Li Qingzhao Zhang School of Electrical, Computing & Software Engineering The University of Arizona, Tucson, AZ {yutongl, chenyw, lim, qzzhang}@arizona.edu

A BSTRACT Collaborative perception (CP) enables connected vehicles to see beyond their own sensors but makes them dependent on messages they cannot independently verify. A compromised collaborator can surgically conceal a single safety-critical object or inject a non-existing one while correctly reporting many others. Existing Bayesian trust mechanisms pool agreement across objects, which, while effective against blatant untargeted attacks, either incurs high false-positive rates (FPR), or allows unrelated correct reports to dilute persistent attack evidence for stealthy single-object attackers. To address this problem, we propose SABER, a selective two-tier Bayesian trust estimator. The first tier maintains broad agent and object trust, preserving the ability to downweight benign but low-quality contributors. Cumulative-sum screening selects agent–object pairs with persistent omissions or unsupported reports for focused Bayesian assessment. The second tier checks these pairs against other agents’ evidence and maintains a separate, reference-weighted Beta state for each. The lowest pair score constrains agent trust, preventing unrelated reports from diluting a targeted attack. We establish sufficient conditions for stronger attacker-side trust reductions with bounded additional benign false alarms at fixed thresholds. Compared with state-of-the-art CP defenses, SABER improves attack detection while reducing benign FPRs. On OPV2V, SABER improves defense ROC-AUC over MATE by up to 0.427 in late fusion and 0.337 in intermediate fusion. Against advanced intermediate-fusion data fabrication attacks, it increases detection rates over ROBOSAC and LUCIA by up to 96.40 and 67.07 percentage points, respectively, while reducing FPRs.

1

Introduction

Collaborative perception (CP) helps connected and autonomous vehicles (CAVs) overcome sensing-range and occlusion limits by sharing measurements, features, or detected objects (Xu et al., 2022b). F-Cooper and V2VNet fuse complementary features (Chen et al., 2019; Wang et al., 2020), while subsequent methods refine information selection and fusion through learned collaboration graphs, attention, and confidence-guided communication (Li et al., 2021; Xu et al., 2022a; Hu et al., 2022). Shared information also creates a security risk: compromised collaborators can manipulate intermediate features or detected objects to hide real objects or introduce nonexistent ones (Zhang et al., 2024). Even one corrupted object can threaten safety: omitting one approaching vehicle can compromise an unprotected left turn even when other reports are correct (Cui et al., 2022), and targeted attacks have been shown to affect braking and collision outcomes (Zhang et al., 2024). Existing defenses identify suspicious collaborators through inconsistencies in shared perception. ROBOSAC checks collaborator subsets against an individual reference (Li et al., 2023), while MADE compares individual and collaborative predictions (Zhao et al., 2023). LUCIA and CP-Guard+ assess feature inconsistencies (Wang et al., 2025; Hu et al., 2025), and GCP examines spatial discrepancies and temporal motion anomalies (Tao et al., 2026). Bayesian

SABER: Selective Bayesian Trust Estimation

trust estimation accumulates such evidence over time. MATE recursively updates agent and track trust from reported and expected observations to downweight low-quality contributors (Hallyburton and Pajic, 2025). However, pooling evidence across objects into one agent trust state allows unrelated correct reports to offset evidence of a targeted attack. This cross-object evidence dilution lets an agent retain high trust while corrupting one or a few safety-critical objects. Increasing pooled-update sensitivity also penalizes benign errors more heavily, risking excessive false positives. Object-level temporal structure offers a way to distinguish these attacks from ordinary benign errors. Sustaining a false scene description across frames can prolong its influence on downstream driving decisions (Zhang et al., 2024; Hallyburton and Pajic, 2025). We therefore study defenses against persistent attacks on one or a few objects. Our goal is to preserve evidence of these persistent contradictions in trust estimation while tolerating ordinary benign errors. Based on the insights, we introduce SABER, Selective Agent–object Bayesian Estimation of Reliability. SABER includes a two-tier trust estimation, where the first maintains broad Bayesian estimates of each agent’s reporting reliability and each tracked object’s existence, using observations across objects and time. The second tier focuses on agent– track pairs, where each represents one agent’s reporting history about an object hypothesis tracked across frames. A cumulative-sum (CUSUM) statistic identifies pairs with persistent omissions or unmatched reports (Page, 1954). These pairs receive further Bayesian assessment rather than being labeled malicious by the screening statistic alone. Other agents’ observations provide an object-existence reference, with the evaluated agent excluded from both current evidence and historical reference-trust updates. Each selected agent–track pair receives a separate Bayesian trust state, represented by a Beta distribution (Josang and Ismail, 2002). Evidence about one track therefore cannot directly cancel evidence about another. Contradictions receive greater weight when other agents provide strong evidence against the assessed report or omission. Recent contradictions observed during screening are retained so that trust can respond promptly when the pair enters the second tier, without waiting for new evidence. The lowest assessed pair score constrains the agent’s overall trust, preserving evidence of a localized attack even when most reports remain correct. Our contributions are: • Identifying cross-object evidence dilution. We identify a structural limitation of pooled agent-level trust estimation: correct reports about unrelated objects can mask persistent errors on a safety-critical object. Our analysis shows how the influence of a localized attack depends on the volume of unrelated evidence, rather than only on the strength of the contradiction. Because both accumulate over time, longer observation alone need not resolve the problem. • Object-isolated Bayesian trust estimation. We develop SABER, a two-tier estimator that separates overall agent reliability from reliability on individual objects. Separate evidence states for agent–track pairs, combined through lowest-pair aggregation, prevent correct reports about unrelated objects from directly canceling a localized contradiction. • Evaluation across fusion settings and attack durations. We extensively evaluate SABER on OPV2V benchmark (Xu et al., 2022b) under state-of-the-art (SOTA) object removal and spoofing attacks (Zhang et al., 2024; Wang et al., 2025) in both late and intermediate fusion. We compare against SOTA defenses MATE (Hallyburton and Pajic, 2025), ROBOSAC (Li et al., 2023), and LUCIA (Wang et al., 2025). Relative to MATE, SABER improves ROC-AUC by up to 0.427 in late fusion and 0.337 in intermediate fusion. At the evaluated fixed thresholds, SABER’s detection of intermediate-fusion Data Fabrication (DF) spoofing attacks (Zhang et al., 2024) exceeds ROBOSAC and LUCIA by up to 96.40 and 67.07 percentage points, respectively, while incurring lower false-positive rates.

2

Related Work

Collaborative perception (CP). CP expands sensing coverage by combining observations across vehicles through early, intermediate, or late fusion of raw sensor data, learned features, or object reports, respectively. Representative feature-fusion methods include Attentive Fusion in OPV2V (Xu et al., 2022b), DiscoNet’s distillation-based collaboration (Li et al., 2021), V2X-ViT’s cross-agent attention (Xu et al., 2022a), and Where2comm’s confidenceguided communication (Hu et al., 2022). Object-level sharing is supported by sensor-sharing standards, including SAE J3224’s Sensor Data Sharing Message (SDSM) and ETSI’s Collective Perception Message (CPM) (SAE International, 2022; ETSI, 2023). SABER assesses object-report reliability in late fusion and extends this assessment to intermediate fusion by independently decoding each sender’s received features. Attacks on shared perception. Tu et al. (2021) first explored untargeted attacks against CP to degrade accuracy. Subsequently, Data Fabrication studies targeted attacks through feature manipulations for spoofing and removal (Zhang 2

SABER: Selective Bayesian Trust Estimation

et al., 2024) of single objects. SOMBRA exploits attentive fusion for stealthy targeted and mass removal attacks (Wang et al., 2025). These attacks motivate assessing sparse object-level inconsistencies induced by shared messages. Defenses and trust estimation. ROBOSAC checks randomly sampled collaborator groups against a trusted receiver’s individual detections (Li et al., 2023). MADE tests ego–collaborator consistency with conformal p-values and multiple testing (Zhao et al., 2023), while CAD checks fabrication through multi-vehicle observations (Zhang et al., 2024). LUCIA continuously reweights attention using feature-disagreement scores (Wang et al., 2025), CP-Guard+ separates benign and malicious features (Hu et al., 2025), and GCP combines spatial consistency with temporal motion-flow analysis (Tao et al., 2026). MATE recursively estimates agent and track trust for security-aware fusion (Hallyburton and Pajic, 2025). SABER preserves a separate evidence state for each assessed pair, preventing unrelated correct reports from directly replenishing its trust. Bayesian evidence and sequential screening. Beta reputation models represent feedback through evidence counts with weighting and forgetting (Josang and Ismail, 2002). CUSUM accumulates evidence of sustained changes (Page, 1954), while generalized Bayes provides a loss-based interpretation of weighted updates (Bissiri et al., 2016). SABER combines these principles by screening agent–track histories, assessing selected pairs against other agents’ evidence, and retaining separate weighted states. The contribution lies in this selective, object-specific assessment rather than Bayesian updating or temporal screening alone.

3

Problem Formulation

System model. Let j index an object and t a frame. For each timestep, the ego agent as the trusted aggregator (AGG), receives messages from collaborating agents i ∈ I, and produces a fused perception representation for downstream tasks. The AGG transforms object reports into a common coordinate system and associates reports of the same object across agents and frames into a track. Each message contains the collaborator pose pti , declared fields of view (FOVs) Vbijt , and either (1) object reports for late fusion, or (2) bird’s-eye-view (BEV) features for intermediate fusion. While each message has an identifiable sender, no collaborating agent is assumed to be a trusted reference. If agent i reports a box matched to track j, AGG treats it as evidence that the object exists. If the received message contains no matching box, AGG treats it as evidence against the object’s existence only when agent i declares the object’s location visible. An unavailable message or an unmatched track outside the declared FOV provides no such negative evidence. Threat model. One compromised agent (i.e., the attacker) aims to induce unsafe driving of a victim collaborator by suppressing real objects (i.e., removal attack) or reporting nonexistent ones (i.e., spoofing attack) in CP over frames ts , . . . , te . It targets one or a few objects by modifying object reports in late fusion or perturbing feature messages in intermediate fusion, and may falsify its visibility declarations. It cannot modify other agents’ messages or AGG. We exclude denial-of-collaboration, where an agent withholds observations by falsely declaring an object outside its FOV. Such behavior reduces the information available for collaboration rather than supplying a false observation within the declared FOV, and falls outside our threat model. The defense knows the fusion setting but not the attacker’s identity or attack interval. A target can be assessed even if the attacker never reports it, provided other agents supply relevant observations. Benign faults vs. attacks. Safety-oriented attacks can differ from ordinary benign perception errors in two key respects. Spatially, attacks target nearby, decision-critical objects, whereas benign errors are more prevalent farther from the observing vehicle. Our single-agent measurements with the intermediate-fusion detector on OPV2V test scenarios show that most erroneous boxes lie beyond 50 m (Figure 1a). Temporally, benign errors are predominantly short-lived (Figure 1b), whereas attacks can sustain errors across frames to affect tracking and driving decisions. For example, Jia et al. (2019) analyze a tracker operating at 30 Hz, under which deleting an established track through timeout requires 60 consecutive missed detections. In a CARLA unprotected-left-turn scenario (Figure 2), continuous removal of an oncoming vehicle from the victim’s obstacle input reduces time to collision (TTC) to zero and results in a collision (Figure 1c). This illustrates how persistent perception errors can cause serious safety consequences without corrupting many objects. A five-frame example with benign errors and designated attack positions is provided in Figure 3. These spatial and temporal differences motivate our filters for selecting suspicious agent-object pairs. The distance distribution counts each erroneous box in each frame once, whereas the duration distribution counts each uninterrupted error run once. Both pool false positives and false negatives across all 3–5-agent OPV2V test scenarios. The TTC curve follows successive instants of a single continuous removal rollout. 3

SABER: Selective Bayesian Trust Estimation

0.8

4

2

TTC (s)

60

6

Percentage (%)

Percentage (%)

1.0

40

0.6 0.4 0.2

20

0.0

0

0

20

40 60 80 100 Distance to ego (m)

120

(a) Benign error distance to ego agent.

0

0

1

2 3 5 10 20 Error duration (frames)

1

2

3

4

5

6

7

8

9

10

Attack duration (frames)

50

(c) TTC under continuous removal attacks.

(b) Benign error duration.

Figure 1: Statistics of benign errors and continuous attack. Oncoming Object Removed by Attacker from CP

Occlusion

Victim

Figure 2: CARLA unprotected-left-turn scenario. Occlusion limits the victim’s view of the oncoming vehicle targeted by the removal attack. Blue arrows indicate vehicle paths, and the red cross marks their conflict point. Objective of trust estimation. Let Rit ∈ [0, 1] denote agent trust, with higher values indicating greater reliability. At the attack endpoint t⋆ = te , define the true-positive rate (TPR) and false-positive rate (FPR) by FPR = Pr(Rbt⋆ < η),

TPR = Pr(Rat⋆ < η),

b

(1)

where a is the attacker, b is a benign peer in the attacked scene, and η is the fixed trust threshold. We aim to improve the detection–false-alarm trade-off over broad agent-level trust assessment.

4

Methodology

SABER uses two-tier Bayesian assessment to preserve localized attack evidence alongside overall agent reliability (Figure 4). Tier 1 estimates broad agent trust T1,i across tracks using MATE’s Bayesian estimator (Hallyburton and Pajic, 2025). Tier 2 screens for persistent reporting anomalies involving nearby tracks and maintains a separate Bayesian trust state for each selected agent–track pair (i, j), representing agent i’s reporting history about track j. Each selected pair is evaluated using other agents’ observations, with stronger peer support giving contradictory reports or omissions greater weight. When assessment begins, cached contradictions from the screening period are also used to update the pair’s trust. The lowest assessed pair score constrains the final agent trust, preventing correct reports about other tracks from masking a localized contradiction. A pair leaves tier 2 when the agent’s reporting about that track consistently agrees with other agents’ observations. 4.1

Spatial and Temporal Screening

Spatial screening. Objects far from every collaborating agent are harder to perceive accurately and are less likely to pose an immediate safety risk. We therefore restrict new tier-2 evidence to objects within rsafe of at least one agent to reduce false alarms caused by uncertain distant observations. Temporal screening. Track association links reports about the same object across frames, allowing CUSUM to accumulate repeated omissions or unmatched reports for each agent–track pair. Let dtij = 1 when agent i reports a box associated with track j, and zero otherwise. For reference tracks, the false-negative (FN) screen treats a missing 4

SABER: Selective Bayesian Trust Estimation

40

y (m)

20

0

−20

0

20

40

0

20

40

0

20

40

0

20

40

0

20

x (m)

x (m)

x (m)

x (m)

x (m)

Frame X

Frame X+1

Frame X+2

Frame X+3

Frame X+4

40

Figure 3: Five consecutive single-agent views. Blue boxes are ego agents. Green dashed boxes denote ground truth and green solid boxes denote matched detections. Red boxes mark unmatched FP/FN. Orange boxes mark designated removal targets. Purple boxes mark designated spoofing positions. Broad agent trust

Agent reports

Time t

Tracks Declared FOV Poses

Tier 1: Overall reliability Broad Bayesian trust update

Tier-1 trust states

Suspicious agenttrack pair filter

Tier 2: Pair-specific reliability

Safety filter + CUSUM

Peer reference excluding the suspicious agent

Admit cached contradictions at first activation.

Weighted Bayes update per agent-track pair

CUSUM + memory

Agent trust decision Flag attacker below threshold Specific agenttrack trust

Pair + peer-reference states

Propagate to time t+1.

Figure 4: Overview of SABER.

report as an event, etij = 1 − dtij , only when the sender’s message is available and the location is declared visible. Matched reports are non-events. For candidate tracks formed from unmatched boxes, the false-positive (FP) screen uses etij = dtij while the candidate remains unmatched to the reference track set. A cumulative-sum (CUSUM) statistic detects events occurring more frequently than in benign histories (Page, 1954; Xie et al., 2021): p1 1 − p1 t−1 t ℓtij = etij log + (1 − etij ) log , Sij = max{0, Sij + ℓtij }. (2) p0 1 − p0 Here p0 is the smoothed event frequency estimated from eligible clean observations for each screen, and p1 specifies t the higher frequency to detect, with 0 < p0 < p1 < 1. Starting from zero, Sij rises on events and falls toward zero t on non-events, retaining evidence across occasional interruptions. A pair enters tier 2 when Sij ≥ h. To calibrate h, we take the maximum CUSUM over all relevant pairs and times in each clean agent–window and choose h > 0 so that no more than a prespecified fraction of these windows triggers screening. FN and FP are calibrated separately. This limits empirical benign screening activations, not final agent false alarms, because crossing h triggers assessment rather than an attacker flag. Appendix A.2 gives the exact calibration rule. 4.2

Pair-Isolated Bayesian Trust Estimation

t Reference from other agents. Let qj,−i ∈ [0, 1] denote trust that track j represents a real object, accumulated from other agents’ eligible reporting histories since the track’s introduction, with values near one supporting existence and values near zero supporting nonexistence. The reference starts from a neutral Beta prior and accumulates peer reports or eligible omissions, weighted by the reporting peers’ reliability. Agent i is excluded throughout the histories of both the object-existence reference and the peer-reliability estimates used to weight it. This prevents its reports from reinforcing their own reference, directly or through historical trust updates. Appendix A.3 gives the reference update.

5

SABER: Selective Bayesian Trust Estimation

t Report consistency and evidence weight. We compare the report with the reference through consistency vij and t assign evidence weight wij : t t t vij = dtij qj,−i + (1 − dtij )(1 − qj,−i ),

t t wij = λ|2qj,−i − 1|,

λ ≥ 1.

(3)

High consistency means agreement with the reference. Both omitting an object supported by other agents and reporting an object contradicted by them give low consistency, allowing removal and spoofing to use the same update rule. The weight vanishes at a neutral reference and grows symmetrically toward strong support for existence or nonexistence. The multiplier λ amplifies this selected evidence without dividing its influence among unrelated tracks. We further explain the weight’s design properties in Appendix A.3. Memory of recent inconsistencies. During screening, a bounded memory caches eligible contradictions within a fixed frame lookback, preserving the reference and weight computed when each observation arrived. When the pair first enters tier 2, previously unused contradictions from the same track-hypothesis episode contribute to its initial update, discounted by their age. The current frame is handled by the ordinary update rather than memory, so each observation contributes once. This enables a response without waiting for new contradictions, but applies no tier-2 penalty before activation. Appendix A.4 defines the lookback and admission rule. t t A separate Beta state for each pair. For a selected pair, let αij and βij represent positive and negative evidence, including the prior. Its trust is the mean of the corresponding Beta distribution (Josang and Ismail, 2002): t Bij =

t αij t + βt , αij ij

(4)

where the parameters are updated as t t t αij =α eij + ∆tij,+ + Mij,+ ,

t t t βij = βeij + ∆tij,− + Mij,− .

(5)

t t The tildes denote temporally discounted states. Current evidence contributes ∆tij,± = wij ϕ± (vij ) when the pair is eligible and selected, and zero otherwise. The functions ϕ+ and ϕ− map consistency to positive and negative t evidence, respectively. The terms Mij,± admit cached evidence once at activation and are otherwise zero. Weighting the evidence increments in this way corresponds to a generalized Bayesian update (Bissiri et al., 2016). At each pair’s first evidence admission, initialize its Beta parameters as (κµi , κ(1 − µi )), where κ > 0 is the total prior evidence mass and 0 < µi < 1. For agent i, µi is its tier-1 trust immediately before its first nonzero tier-2 evidence admission and remains fixed within the window. If admission occurs at the first frame, use the tier-1 prior mean. Later pairs share this mean but receive separate evidence states. Thus initialization transfers reliability without importing accumulated evidence about unrelated objects. A larger κ makes the same new evidence less influential.

Before adding evidence, propagate each retained state toward its initial parameters: t−1 t α eij = (1 − ρt )αij + ρt κµi ,

t−1 t βeij = (1 − ρt )βij + ρt κ(1 − µi ),

(6)

where ρt = min(1, ∆t/τ2 ), ∆t is elapsed time, and τ2 > 0 controls forgetting. This discounts past evidence while retaining the initial prior. An ineligible observation adds no evidence, but the retained state still propagates. Appendix A.1 defines the consistency increments and their generalized Bayesian interpretation. 4.3

Agent Trust and Decision

Let Ati contain the track indices whose initialized pairs (i, j) are currently under tier-2 assessment. When this set is nonempty, the lowest pair score constrains tier-2 agent trust:   t t T2,i = min µi , mint Bij . (7) j∈Ai

We combine broad and focused assessment through  t t , T2,i }, min{T1,i t Ri = t T1,i ,

Ati ̸= ∅, otherwise.

(8)

This preserves the constraint imposed by any assessed pair while retaining tier 1’s broad reliability estimate. Sustained corroborated recovery removes a pair from Ati . When no pair remains, the agent returns to tier-1 assessment without the fixed initial mean continuing to cap its score. 6

SABER: Selective Bayesian Trust Estimation

An agent is flagged when Rit < η, using one fixed threshold across agents, frames, and attack types. The trust threshold decides whether to flag an agent, whereas the CUSUM threshold h decides which pairs receive additional assessment. Application to intermediate fusion. While SABER is designed for the standard late fusion CP consistent with SAE SDSM or ETSI CPM messages (SAE International, 2022; ETSI, 2023) using received object reports directly, it can be applied to the intermediate fusion paradigm (Xu et al., 2022b,a). First, AGG decodes each sender’s received BEV feature message Fit separately as Bit = D(Fit ) for trust estimation with the shared detection decoder D. AGG then associates the decoded boxes Bit with tracks and applies the same two-tier trust estimator. 4.4

Theoretical Properties

We summarize the theoretical results below, with their assumptions and proofs in Appendix E. Protection against cross-object dilution. Pooled assessment allows unrelated correct reports to raise trust (Proposition 2). Separate pair states and minimum aggregation prevent this direct cross-object cancellation: Proposition 1 (Object-specific evidence isolation). Fix a pair’s initialization, reference and report histories, eligibility, screening, evidence admission, temporal discounting, and current assessment membership. Direct evidence updates for other tracks cannot change Bij . While the pair remains assessed, T2,i ≤ Bij . Trust response to persistent contradictions. The analysis characterizes memory’s effect on pair trust (Proposition 4) and gives sufficient weighted-evidence conditions for detection by attack completion (Proposition 3). Theorem 5 establishes when the expected attack-induced decrease exceeds broad assessment alone, accounting for any additional reduction on the paired clean input. Attacker–benign separation and false alarms. Theorem 6 and Proposition 7 give conditions for attacker–benign trust separation and a fixed threshold combining high detection probability with bounded additional benign false alarms.

5

Evaluation

5.1

Experimental Setup

Data and perception settings. We evaluate on OPV2V scenes with three to five agents (Xu et al., 2022b). We consider late fusion, where agents share object reports ETSI (2023), and intermediate fusion sharing BEV features. Both use PointPillars (Lang et al., 2019) as the encoder backbone. Late-fusion reports come from independent singleagent detection. Intermediate experiments use the Attentive Fusion algorithm (Xu et al., 2022b), with each received message decoded independently for trust assessment. MATE and SABER use a BEV IoU threshold of 0.3 for report-totrack association, and ROBOSAC uses the same threshold for detection-set matching. Attack cases. The full evaluation dataset contains 688 cases, 341 for removal cases and 347 for spoofing. A case specifies a window, an attacker, and three eligible target objects or spoofing positions, selected before defense evaluation. Removal targets must match the attacker’s cached predictions throughout the main attack interval. Spoofing positions must overlap neither real objects nor each other and satisfy visibility requirements. We attack one, two, and three targets, respectively, to study sparse errors. Late-fusion attacks remove or insert boxes directly in the shared message. Intermediate-fusion attacks use projected gradient descent (PGD) (Madry et al., 2018) and the white-box online adversarial attack of Zhang et al. (2024), abbreviated DF here, for removal and spoofing. SOMBRA is evaluated for removal (Wang et al., 2025) only. Appendix B.2 provides more details about the attack target selection strategy. Experimental protocol. We select 30-frame windows with a ten-frame stride and reset trust histories between windows. The main comparison uses zero-based frames 0–19, with ten benign frames followed by an attack between ts = 10 and te = 19. We measure pre-attack behavior at frame 9 and attacker detection at attack completion at frame 19. The remaining frames support the duration study in Section 5.5, with full results in Appendix C.1. In the main comparisons, fixed agent-trust thresholds are 0.1 for SABER, 0.8 for MATE, and 0.1 for LUCIA. ROBOSAC uses a detection-set consistency threshold of 0.3. These values remain unchanged across attack types and target counts. The Bayesian trust evaluations are deterministic for the fixed inputs and configurations. Screening calibration follows Appendix A.2. 5.2

Baselines and Metrics

Baselines. We compare with SOTA fusion defense MATE, which represents broad Bayesian trust estimation (Hallyburton and Pajic, 2025). Intermediate-fusion experiments additionally compare ROBOSAC (Li et al., 2023), which 7

SABER: Selective Bayesian Trust Estimation

Attacker flagged rate (TPR)

SABER

MATE

1 object

100%

Removal

Spoofing

2 objects

3 objects

50%

0% 0%

50%

100%

0%

50%

100%

0%

50%

100%

Benign flagged rate (FPR)

Figure 5: Late-fusion ROC at attack completion. SABER improves attacker–benign separation over MATE for both removal and spoofing, with especially large gains against spoofing.

selects collaborators by thresholding agreement with a trusted receiver, and LUCIA (Wang et al., 2025), which scores collaborators through feature disagreement. Appendix B.3 describes the baseline implementations and evaluation settings. Metrics. Following Eq. (1), the true-positive rate (TPR), or attacker flagged rate, is the rate of flagging the attacker. The false-positive rate (FPR), or benign flagged rate, is the fraction of benign agents flagged. Higher TPR and lower FPR are better. We report FPR before attack onset and TPR/FPR at attack completion. We also report the area under the receiver operating characteristic curve (ROC-AUC) at attack completion to evaluate attacker–benign separation across thresholds. Higher AUC indicates better overall separation. Before attack onset, the designated attacker is benign and any flag on it is a false alarm. MATE, SABER, and LUCIA are scored by thresholding their respective trust scores. ROBOSAC does not assign individual trust scores, so we count its rejection of a collaborator as a flag under the rule in Appendix B.4. Its TPR therefore measures attacker rejection rather than a separate identity classification. 5.3

Main Results

Overall Detection Performance. SABER achieves a favorable detection–false-alarm balance across late and intermediate fusion while retaining low pre-attack false alarms (Table 1). MATE can attain higher removal detection, but at the cost of flagging substantially more benign agents, and remains weak against spoofing. SABER improves low-FPR detection, especially for spoofing, and has higher ROC-AUC than MATE across the evaluated attack families and target counts (Figures 5 and 6, Appendix D). The improvement therefore extends beyond a single operating threshold. LUCIA is particularly effective against SOMBRA, but does not offer the same balance across the other attacks and pre-attack observations. Analysis of Baseline Performance. MATE pools evidence across objects, allowing unrelated correct reports to offset a targeted error. Spoofing adds a further difficulty: unlike an established real track, a new false track lacks a supporting history, and the attacker’s own reports reinforce its estimated existence. The resulting uncertainty weakens the penalty. ROBOSAC instead tests consistency over the entire detection set. A few corrupted objects can leave that consistency above its acceptance threshold, allowing the attacker to remain in collaboration. A stricter threshold also rejects more benign collaborators. LUCIA assesses spatially pooled feature disagreement. SOMBRA’s full-map perturbations produce a more distinctive discrepancy than the target-local modifications used by PGD and DF, explaining its strong SOMBRA detection but weak separation under the other attacks. SABER addresses localized inconsistencies by excluding self-support from the reference and preserving each selected pair’s evidence separately. Effect of Attack Strength. PGD’s lower attack success leaves more target reports unchanged, producing fewer contradictions for the trust estimator and explaining its lower detection rate. At attack completion, single-object removal succeeds on 63.54%, 100%, and 100% of eligible independently decoded sender outputs for PGD, DF, and SOMBRA, respectively. Spoofing succeeds on 31.99% and 80.98% for PGD and DF. These ASRs concern whether the attack actually changes the targeted report, whereas defense metrics retain all attempted attacks, including unsuccessful ones. Appendix B.5 defines the diagnostic populations. 8

SABER: Selective Bayesian Trust Estimation

Attack

End-attack

Pre-attack

Method

1 object

2 objects

3 objects

FPR% ↓ TPR% ↑ FPR% ↓ AUC ↑ TPR% ↑ FPR% ↓ AUC ↑ TPR% ↑ FPR% ↓ AUC ↑ Late fusion: bounding box perturbation MATE 22.81 97.22 SABER 1.52 90.29

14.53 3.48

0.939 0.984

100.00 95.87

15.64 3.09

0.966 0.993

100.00 96.67

16.12 2.13

0.975 0.995

11.36 100.00

10.13 5.59

0.531 0.958

13.11 100.00

11.63 5.59

0.549 0.959

15.20 100.00

14.70 5.59

0.566 0.959

Intermediate fusion: feature perturbation ROBOSAC 2.93 3.81 PGD LUCIA 27.49 31.09 27.86 76.83 Removal MATE SABER 1.27 48.68

3.47 27.47 26.03 1.32

N/A 0.529 0.784 0.819

3.74 33.80 91.50 67.16

3.42 26.54 26.17 1.17

N/A 0.556 0.881 0.909

3.67 35.58 96.19 77.42

3.42 25.49 26.69 1.17

N/A 0.580 0.924 0.945

Removal

Spoofing

MATE SABER

22.25 0.60

ROBOSAC LUCIA MATE SABER

2.93 27.49 27.86 1.27

3.89 30.01 94.72 85.92

3.52 27.66 25.95 1.32

N/A 0.522 0.872 0.963

3.81 32.55 99.41 92.38

3.49 26.69 26.61 1.03

N/A 0.544 0.939 0.986

3.96 34.26 100.00 93.84

3.49 25.95 27.64 0.88

N/A 0.563 0.962 0.992

ROBOSAC SOMBRA LUCIA Removal MATE SABER

2.93 27.49 27.86 1.27

4.84 90.91 97.07 85.92

3.67 3.27 26.74 1.61

N/A 0.993 0.897 0.965

4.99 98.09 99.12 92.38

3.67 0.59 26.88 1.17

N/A 1.000 0.942 0.985

5.72 99.56 99.71 93.84

3.96 0.07 27.98 0.88

N/A 1.000 0.959 0.991

ROBOSAC LUCIA MATE SABER

0.00 24.87 22.25 0.00

1.59 24.78 27.09 55.62

1.63 28.24 21.13 1.44

N/A 0.468 0.575 0.819

1.59 24.93 35.45 76.66

1.61 27.95 23.01 1.44

N/A 0.473 0.616 0.910

1.59 25.36 42.94 85.01

1.61 27.95 23.90 1.44

N/A 0.477 0.652 0.947

ROBOSAC LUCIA MATE SABER

0.00 24.87 22.25 0.00

1.87 27.09 34.29 87.61

1.87 27.38 20.70 1.44

N/A 0.491 0.629 0.966

1.87 29.32 46.40 96.25

1.87 26.22 22.72 1.30

N/A 0.513 0.693 0.989

1.87 31.20 61.10 98.27

1.87 25.29 25.34 1.30

N/A 0.533 0.760 0.993

DF Removal

PGD Spoofing

DF Spoofing ∗

AUC denotes full ROC-AUC. ROBOSAC provides discrete operating points, so AUC is not applicable.

Table 1: Late- and intermediate-fusion results. SABER achieves a favorable detection–false-alarm trade-off across both fusion settings, with particularly strong spoofing detection.

SABER

MATE

Attacker flagged rate (TPR)

1 object

PGD removal

100%

LUCIA 2 objects

DF removal

ROBOSAC 3 objects

SOMBRA removal

PGD spoofing

DF spoofing

50%

0% 0%

50%

100%

0%

50%

100%

0%

50%

100%

0%

50%

100%

0%

50%

100%

Benign flagged rate (FPR)

Figure 6: Intermediate-fusion ROC at attack completion. SABER achieves higher AUC than MATE and LUCIA under PGD and DF attacks, while LUCIA performs best against SOMBRA.

5.4

Component Ablations

We evaluate four components on the full late-fusion dataset under single-object removal and spoofing attacks, using paired clean controls and the main experiment’s attack interval. Each variant changes only the specified component: 1. Shared agent Beta. Replace pair-specific states and lowest-pair aggregation with one pooled agent-level Beta. 2. Inclusive reference. Include the assessed sender in both current and historical reference evidence. 3. No extra amplification. Remove the extra evidence multiplier while retaining reference-confidence weighting and negative-update bias. 4. No memory. Remove admission of prior contradictions while retaining the screening rule and subsequent updates. 9

SABER: Selective Bayesian Trust Estimation

Effect at a shared threshold. At the same agent-trust threshold, removing pair isolation, sender exclusion, or extra amplification lowers TPR in both attack types (Table 2). These variants also yield fewer false alarms. This comparison shows that the components affect the flagging behavior, but does not distinguish weaker attacker–benign separation from a change in the trust-score scale. Pre-attack

Variant

End-attack

FPR ↓

TPR ↑

FPR ↓

Removal SABER Shared agent Beta Inclusive reference No amplification

1.52 1.52 0.63 0.63

90.29 69.38 5.54 11.35

3.48 2.03 0.56 0.56

Spoofing SABER Shared agent Beta Inclusive reference No amplification

0.60 0.30 0.00 0.00

100.00 74.96 0.00 0.00

5.59 5.28 0.00 0.00

Table 2: Late-fusion single-object ablations (%) at a fixed threshold of 0.1.

Effect at adjusted thresholds. To test whether a different threshold can compensate for the lower detection, we allow each of the first three variants and the full method to use its own agent-trust threshold. We require at least 90% TPR in both removal and spoofing, then select the qualifying tested threshold with the lowest worst-case FPR across the two attack types, breaking ties with the lower threshold. All other parameters remain unchanged. Even after this adjustment, each variant has higher FPR than SABER in both attack types (Figure 7). Thus, among the tested thresholds, the full method meets the common detection requirement with fewer benign flags. The benefit of these components is not explained solely by using the same threshold for differently scaled scores. Removal

Spoofing

Benign flagged rate (FPR)

15% 12.20%

11.47% 10.21%

10%

8.05% 5.90%

5.59%

6.45%

5% 3.48%

0% SABER Threshold = 0.1

Shared agent Beta Threshold = 0.4

Inclusive reference Threshold = 0.5

No extra amplification Threshold = 0.2

Figure 7: Component ablations at thresholds achieving at least 90% TPR in both removal and spoofing. The full method has lower FPR than each of the three variants in both attack types. Response with and without memory. The fourth ablation examines response speed while keeping the screening rule and agent-trust threshold unchanged. Figure 8 shows that admitting cached contradictions makes attacker trust fall faster after screening. Memory uses evidence already observed during screening rather than requiring the pair to accumulate only new evidence after activation. It accelerates the trust response without shortening the CUSUM trigger delay. 5.5

Sensitivity Studies

Stronger pooled penalties. To test whether greater sensitivity in pooled assessment can address sparse attacks, we enlarge MATE’s agent-level negative-update bias while keeping its threshold at 0.8 and all other settings fixed. Table 3 reports the results under single-object late-fusion attacks. Stronger penalties increase detection but also increase benign false alarms. Even with the largest multiplier, spoofing detection remains below SABER while FPR is higher. At these fixed thresholds, increasing pooled-update sensitivity does not recover the full method’s detection–false-alarm balance. 10

SABER: Selective Bayesian Trust Estimation

Attacker

Benign

Memory

No memory

Removal

1.0

Mean agent trust

0.5

0.1 (threshold)

Spoofing

1.0

0.5

0.1 (threshold) 0

5

9

14

19

Frame

Figure 8: Trust response with and without memory under single-object late-fusion attacks. Cached contradictions accelerate the attacker-trust decrease after screening.

Method

SABER MATE

Bias multiplier N/A 1× 2× 4×

Removal Pre-attack FPR ↓ 1.52 22.81 26.91 29.52

Spoofing

End-attack TPR ↑ FPR ↓ 90.29 97.22 99.79 99.79

3.48 14.53 22.58 30.99

Pre-attack FPR ↓ 0.60 22.25 24.77 26.78

End-attack TPR ↑ FPR ↓ 100.00 11.36 23.05 35.55

5.59 10.13 18.86 31.99

Table 3: Stronger penalties of MATE on single-object late-fusion attacks (%). MATE variants use a threshold of 0.8 and SABER uses 0.1.

Attack duration. We evaluate attacks lasting 5, 7, 10, and 20 frames. Figure 9 summarizes single-object attacks in both fusion settings. Late-fusion spoofing detection rises sharply between 7 and 10 frames, while intermediate-fusion spoofing detection generally improves with longer attacks. Removal detection varies less with duration, especially in intermediate fusion. Intermediate-fusion FPR stays very low throughout, whereas late-fusion FPR tends to increase with duration. The protocol and full results, including multiple targets and baselines, are provided in Appendix C.

6

Discussion and Limitations

Short or track-switching attacks. SABER accumulates evidence for each agent–track pair. One- or two-frame attacks may end before screening activates or sufficient evidence lowers trust. Switching targets similarly spreads contradictions across pair histories. Memory accelerates assessment within a pair but does not combine evidence across targets. As with other temporal trust estimators, we do not guarantee detection of such attacks, although individual errors may affect tier-1 trust. Insufficient benign observation coverage. Like other consistency-based CP defenses, SABER requires informative peer observations. If a track lies outside all benign agents’ FOVs and lacks informative peer history, AGG cannot independently assess the disputed report. With only one benign observer, conflicting reports from agents with comparable trust and evidence strength can remain ambiguous. Excluding the assessed sender prevents self-support but cannot resolve this symmetry. Reliable identification therefore requires corroborating peer evidence, and FOV coverage alone does not guarantee accurate observations.

7

Conclusion

We presented SABER, a two-tier Bayesian trust estimator addressing cross-object evidence dilution in collaborative perception. Isolating selected agent–track evidence and constraining agent trust through the lowest pair score prevent 11

SABER: Selective Bayesian Trust Estimation

PGD

DF

Removal

Late fusion

FPR

TPR

100%

SOMBRA Spoofing

Intermediate fusion

100%

50%

50%

0%

0%

10%

3% 2%

5% 1% 0%

5

7

10

20

0%

5

7

10

20

Attack duration (frames)

Figure 9: Effect of attack duration on SABER under single-object attacks. TPR and FPR are measured at attack completion with a fixed agent-trust threshold of 0.1. Solid and dashed lines denote removal and spoofing, respectively. Longer attacks generally improve spoofing detection, while intermediate-fusion FPR remains low. unrelated correct reports from directly masking localized contradictions. Our analysis gives sufficient conditions for stronger attack-induced trust reductions with bounded additional false alarms. Experiments on OPV2V show improved detection–false-alarm trade-offs for sparse removal and spoofing attacks in late and intermediate fusion. Ethics Statement This work studies defensive trust estimation. Defense evaluations use public simulated dataset, with offline modifications to object reports or features encoded from stored sensor observations. A separate closed-loop experiment illustrates the potential safety consequences of sustained perception omissions. All vehicle control and collisions in that experiment occur within the simulator. No experiments control real vehicles, involve physical trials, or interact with deployed transportation or live network systems, so they do not expose road users or operational systems to experimental attacks. We introduce no new attack vector: removal and spoofing are established threat classes from published work, used here to assess a defense. Neither the dataset-based trust results nor the simulator illustration establish deployment readiness or guarantee collision avoidance. False alarms could suppress useful observations if such a method were deployed, while missed attacks could leave harmful information in collaboration. These risks require independent validation before any operational use.

References Pier Giovanni Bissiri, Chris C Holmes, and Stephen G Walker. A general framework for updating belief distributions. Journal of the Royal Statistical Society Series B: Statistical Methodology, 78(5):1103–1130, 2016. Qi Chen, Xu Ma, Sihai Tang, Jingda Guo, Qing Yang, and Song Fu. F-cooper: Feature based cooperative perception for autonomous vehicle edge computing system using 3d point clouds. In Proceedings of the 4th ACM/IEEE Symposium on Edge Computing, pages 88–100, 2019. Jiaxun Cui, Hang Qiu, Dian Chen, Peter Stone, and Yuke Zhu. Coopernaut: End-to-end driving with cooperative perception for networked vehicles. In CVPR, 2022. ETSI. Intelligent transport system (its); vehicular communications; basic set of applications; collective perception service; release 2. Technical Specification TS 103 324 V2.1.1, European Telecommunications Standards Institute, June 2023. URL https://www.etsi.org/deliver/etsi_ts/103300_103399/103324/02.01.01_60/ts_1 03324v020101p.pdf. R Spencer Hallyburton and Miroslav Pajic. Security-aware sensor fusion with mate: the multi-agent trust estimator. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 2009–2023, 2025. Senkang Hu, Yihang Tao, Zihan Fang, Guowen Xu, Yiqin Deng, Sam Kwong, and Yuguang Fang. Cp-guard+: A new paradigm for malicious agent detection and defense in collaborative perception. arXiv preprint arXiv:2502.07807, 2025. 12

SABER: Selective Bayesian Trust Estimation

Yue Hu, Shaoheng Fang, Zixing Lei, Yiqi Zhong, and Siheng Chen. Where2comm: Communication-efficient collaborative perception via spatial confidence maps. Advances in neural information processing systems, 35:4874–4886, 2022. Yunhan Jia, Yantao Lu, Junjie Shen, Qi Alfred Chen, Zhenyu Zhong, and Tao Wei. Fooling detection alone is not enough: First adversarial attack against multiple object tracking. arXiv preprint arXiv:1905.11026, 2019. Audun Josang and Roslan Ismail. The beta reputation system. In Proceedings of the 15th bled electronic commerce conference, volume 5, pages 2502–2511, 2002. Alex H Lang, Sourabh Vora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom. Pointpillars: Fast encoders for object detection from point clouds. In 2019 IEEE/CVF conference on computer vision and pattern recognition (CVPR), pages 12689–12697. IEEE, 2019. Yiming Li, Shunli Ren, Pengxiang Wu, Siheng Chen, Chen Feng, and Wenjun Zhang. Learning distilled collaboration graph for multi-agent perception. Advances in Neural Information Processing Systems, 34:29541–29552, 2021. Yiming Li, Qi Fang, Jiamu Bai, Siheng Chen, Felix Juefei-Xu, and Chen Feng. Among us: Adversarially robust collaborative perception by consensus. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 186–195. IEEE, 2023. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. Ewan S Page. Continuous inspection schemes. Biometrika, 41(1/2):100–115, 1954. SAE International. V2x sensor-sharing for cooperative and automated driving. SAE Standard J3224_202208, SAE International, August 2022. URL https://doi.org/10.4271/J3224_202208. Yihang Tao, Senkang Hu, Yue Hu, Haonan An, Hangcheng Cao, and Yuguang Fang. Gcp: guarded collaborative perception with spatial-temporal aware malicious agent detection. IEEE Transactions on Dependable and Secure Computing, 2026. James Tu, Tsunhsuan Wang, Jingkang Wang, Sivabalan Manivasagam, Mengye Ren, and Raquel Urtasun. Adversarial attacks on multi-agent communication. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 7748–7757. IEEE, 2021. Chenyi Wang, Raymond Muller, Ruoyu Song, Jean-Philippe Monteuuis, Jonathan Petit, Yanmao Man, Ryan Gerdes, Z Berkay Celik, and Ming Li. From threat to trust: Exploiting attention mechanisms for attacks and defenses in cooperative perception. In 34th USENIX Security Symposium (USENIX Security 25), pages 7387–7406, 2025. Tsun-Hsuan Wang, Sivabalan Manivasagam, Ming Liang, Bin Yang, Wenyuan Zeng, and Raquel Urtasun. V2vnet: Vehicle-to-vehicle communication for joint perception and prediction. In European conference on computer vision, pages 605–621. Springer, 2020. Liyan Xie, Shaofeng Zou, Yao Xie, and Venugopal V Veeravalli. Sequential (quickest) change detection: Classical results and new directions. IEEE Journal on Selected Areas in Information Theory, 2(2):494–514, 2021. Runsheng Xu, Hao Xiang, Zhengzhong Tu, Xin Xia, Ming-Hsuan Yang, and Jiaqi Ma. V2x-vit: Vehicle-to-everything cooperative perception with vision transformer. In European conference on computer vision, pages 107–124. Springer, 2022a. Runsheng Xu, Hao Xiang, Xin Xia, Xu Han, Jinlong Li, and Jiaqi Ma. Opv2v: An open benchmark dataset and fusion pipeline for perception with vehicle-to-vehicle communication. In 2022 International Conference on Robotics and Automation (ICRA), pages 2583–2589. IEEE, 2022b. Qingzhao Zhang, Shuowei Jin, Ruiyang Zhu, Jiachen Sun, Xumiao Zhang, Qi Alfred Chen, and Z Morley Mao. On data fabrication in collaborative vehicular perception: Attacks and countermeasures. In 33rd USENIX security symposium (USENIX security 24), pages 6309–6326, 2024. Yangheng Zhao, Zhen Xiang, Sheng Yin, Xianghe Pang, Siheng Chen, and Yanfeng Wang. Malicious agent detection for robust multi-agent collaborative perception. arXiv preprint arXiv:2310.11901, 2023.

13

SABER: Selective Bayesian Trust Estimation

A

Additional Method Definitions

A.1

Evidence increments and weighted updates

Tier-2 scores never feed back into tier 1, whose trajectory therefore equals MATE under the same inputs (Hallyburton and Pajic, 2025). For consistency v ∈ [0, 1], define  n(v)2 n(v) ν, v < θ, v, ϕ− (v) = (1 − v), (9) n(v) = ϕ+ (v) = 1, v ≥ θ, n(v) + 1 n(v) + 1 where ν ≥ 1 controls the negative-evidence bias and 0 < θ < 1 selects its branch. Reference and pair states can use different ν, θ. These are weighted consistency pseudo-counts, not direct observations of maliciousness. For one eligible observation, suppress the pair and time indices and write w = λ|2q − 1| ≥ 0 for the evidence weight in Eq. (3). Let π e(ϑ) be the propagated Beta density over pair reliability ϑ ∈ (0, 1). The update π(ϑ) ∝ π e(ϑ)[ϑϕ+ (v) (1 − ϑ)ϕ− (v) ]w

(10)

adds wϕ+ (v) and wϕ− (v) to its parameters. This is the generalized Bayesian interpretation of Eq. (5) (Bissiri et al., 2016). Weighting the factor and weighting its increments are equivalent, so amplification is applied once. A.2

Screening eligibility and calibration

Eligibility follows Section 4.1. A matched report requires no separate visibility declaration. Invalid observation opportunities reset an untriggered CUSUM. They do not erase retained Bayesian evidence or establish recovery. Using the same eligibility rules and candidate lifecycle as evaluation, estimate p0 = (Nevent + 1)/(Neligible + 2) for each screen. Here Neligible counts eligible clean agent–track observations and Nevent counts those with etij = 1. Add-one smoothing avoids zero or unit event probabilities. Let Smax,n denote the window maximum defined in Section 4.1, set to zero when no pair is eligible. For Ncal > 0 calibration windows and budget ϵscreen ∈ (0, 1), select h > 0 satisfying Ncal 1 X 1{Smax,n ≥ h} ≤ ϵscreen . (11) Ncal n=1 Move h above a tied value if equality would violate this bound. Starting from S = 0, a continuously eligible sequence with etij = 1 at every frame needs   h r∗ = (12) log(p1 /p0 ) observations to trigger. A.3

Peer reference and evidence weight

Write the peer reference as qj,−i = aj,−i /(aj,−i + bj,−i ). Its parameters update as X utkj,−i (ϕ+,ref (dtkj ), ϕ−,ref (dtkj )), (atj,−i , btj,−i ) = (e atj,−i , ebtj,−i ) +

(13)

t k∈Oj,−i

t−1 t where Oj,−i contains eligible peers other than i, and utkj,−i = T1,k,−i uses the sender-excluded broad assessment defined in Section 4.2, with its prior mean at the first frame. Propagation returns the reference toward its neutral prior.

The confidence factor g(q) = |2q − 1| ∈ [0, 1] is a design choice, not an optimality claim. To analyze w = λg(q), let N = α e + βe > 0 be the pair’s total Beta mass and B = α e/N its mean. Write x = ϕ+ (v) and y = ϕ− (v) for the nonnegative positive- and negative-evidence increments before weighting. Holding B, N, x, y fixed, the effect of w is Bnew (w) =

∂Bnew N [x(1 − B) − yB] = . ∂w [N + w(x + y)]2

N B + wx , N + w(x + y)

For x + y > 0, stronger weighting lowers trust exactly when the evidence-implied mean x/(x + y) is below B. 14

(14)

SABER: Selective Bayesian Trust Estimation

A.4

Memory admission

Let c ∈ {FN, FP} identify the omission or unmatched-report screen, with its own parameters hc , p0,c , p1,c . Set the fixed frame lookback Lc = ⌈hc / log(p1,c /p0,c )⌉. For agent i and track j, let sstart mark the start of the current trackij hypothesis episode, and let Eij (t) contain the distinct observation times already admitted into the pair’s Beta state by time t. At the first screening trigger s, the set of past frames eligible for memory admission is  Hij (s) = ℓ : max(sstart , s − Lc + 1) ≤ ℓ < s, ij (15) − ℓ ℓ ℓ ℓ∈ / Eij (s ), Iij = 1, vij < 1/2, wij >0 . ℓ Iij indicates evidence eligibility, and Eij (s− ) is the admission set immediately before frame s. The memory increments in Eq. (5) are X s ℓ ℓ Mij,± = Dℓ,s wij ϕ± (vij ). (16) ℓ∈Hij (s)

Qt The + and − signs denote separate sums added to αij and βij , respectively. The factor Dℓ,t = r=ℓ+1 (1 − ρr ) t discounts evidence by its age, with Dt,t = 1. An empty Hij (s) contributes zero, and on other frames Mij,± = 0. Recovery changes assessment membership without erasing the retained state or admission history. A new hypothesis uses a new track index.

B

Additional Experimental Settings

B.1

Perception inputs

All reports use a common world coordinate system. Reported boxes determine existence evidence and introduce unmatched candidates. We follow the visibility algorithm proposed by Hallyburton and Pajic (2025). AGG accepts the resulting declarations. Paired clean and attacked runs share the same declarations, including the removal target’s visible declaration during attack. B.2

Selection and cohort sizes

In addition to the selection rules in Section 5.1, removal targets must exist throughout the window and remain within 40 m of at least one agent. Spoofed boxes must lie within 40 m of the attacker and be visible to it and at least two benign agents throughout the main attack interval. Table 4 gives the cohort breakdown, including cases formed with alternative attackers or spoofing positions. Cohort

3 agents

4 agents

5 agents

Total

218 203

48 35

75 109

341 347

Removal Spoofing

Table 4: Full selected cohorts

B.3

Baseline implementation and evaluation

In intermediate fusion, all defenses receive the same feature messages generated against the undefended centralized model. MATE and SABER share report associations and candidate hypotheses. ROBOSAC and LUCIA preserve their trusted-receiver assumptions. ROBOSAC samples n − 2 teammates per trial, with budgets of 7/8/9 trials for 3/4/5-agent groups, and falls back to receiver-only perception if no consensus is reached. LUCIA retains continuous trust-weighted attention, with score thresholds used only for reporting flags. B.4

Metric calculation

ROBOSAC flags tested collaborators excluded from its accepted group. An untested attacker remains in the denominator without detection credit, and receiver-only fallback (i.e. single-agent perception) rejects all peers, contributing to both TPR and FPR. ROBOSAC uses designated benign receivers at both checkpoints. LUCIA uses all receivers before attack and benign receivers during attack, excluding self-scores. Attack identities define evaluation roles only. ROC and AUC of late-fusion and intermediate-fusion results use the same population weights, with benign peers in attacked scenes as negatives. Trust-score AUC uses complete empirical curves. ROBOSAC contributes measured operating points only. 15

SABER: Selective Bayesian Trust Estimation

B.5

Attack realization diagnostics

ASR measures single-object changes in the independently decoded attacker output at the attack endpoint, using BEV IoU at least 0.3. Removal succeeds when a clean-detected target disappears, and spoofing succeeds when a target absent from clean output appears. Their diagnostic denominators contain clean-detected and clean-absent targets, respectively. Defense metrics retain all selected attack attempts regardless of these outcomes.

C

Attack-Duration Sensitivity

This appendix provides the protocol and full attack-duration results, extending the single-object summary in Figure 9 to multiple targets and baselines. C.1

Attack Duration

Compare 5-, 7-, 10-, and 20-frame attacks at endpoints 14, 16, 19, and 29 (0-indexed), retaining all selected cases and fixed decision thresholds. The screening parameters are calibrated using clean scenarios, following Appendix A.2. The memory lookback follows Appendix A.4. Tables 5, 6, 7, and 8 report all target counts and defenses. ROBOSAC remains weak against localized inconsistencies, and LUCIA remains strongest against SOMBRA but less effective against the other two attacks. These two baselines assess each endpoint independently, so their changes across durations reflect different observations and perturbations rather than accumulated history. Duration Pre-attack Method (frames)

End-attack 1 object

2 objects

3 objects

FPR ↓ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ 5

SABER MATE

1.52 75.34 3.07 22.81 99.52 16.54

0.977 91.74 2.94 0.938 100.00 17.09

0.990 94.58 2.53 0.963 100.00 17.67

0.993 0.971

7

SABER MATE

1.52 88.74 2.79 22.81 99.66 14.31

0.983 94.16 2.53 0.941 100.00 15.71

0.992 95.13 2.40 0.967 100.00 15.93

0.995 0.974

10

SABER MATE

1.52 90.29 3.48 22.81 97.22 14.53

0.984 95.87 3.09 0.939 100.00 15.64

0.993 96.67 2.13 0.966 100.00 16.12

0.995 0.975

20

SABER MATE

1.52 93.22 6.76 22.81 88.71 13.82

0.984 0.933

0.993 97.22 5.02 0.970 100.00 14.55

0.994 0.979

96.67 5.95 99.20 14.25

Table 5: SABER results under late-fusion removal across attack durations. TPR and FPR are percentages. AUC denotes full ROC-AUC. MATE and SABER use thresholds of 0.8 and 0.1.

Duration Pre-attack Method (frames)

End-attack 1 object

2 objects

3 objects

FPR ↓ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ 5

SABER MATE

0.60 22.25

1.24 0.63 19.52 16.55

0.948 0.490

2.16 0.63 19.83 17.38

0.949 0.477

3.08 0.63 19.83 19.73

0.950 0.464

7

SABER MATE

0.60 22.25

26.59 5.02 14.17 13.08

0.949 0.501

27.81 5.02 14.89 15.30

0.950 0.495

28.32 5.02 18.84 16.34

0.950 0.492

10

SABER MATE

0.60 100.00 5.59 22.25 11.36 10.13

0.958 100.00 5.59 0.531 13.11 11.63

0.959 100.00 5.59 0.549 15.20 14.70

0.959 0.566

20

SABER MATE

0.60 22.25

0.976 100.00 7.52 0.620 19.80 12.07

0.981 100.00 7.52 0.681 27.18 12.65

0.982 0.730

98.41 7.52 14.17 11.59

Table 6: SABER results under late-fusion spoofing across attack durations. TPR and FPR are percentages. AUC denotes full ROC-AUC. MATE and SABER use thresholds of 0.8 and 0.1.

D

Additional Results and Operating Trade-offs

Separation across operating points. SABER has higher ROC-AUC than MATE under every evaluated attack family and target count, with particularly large gains on late-fusion spoofing (Table 1). Its low-FPR detection also improves under PGD and DF, while LUCIA achieves the strongest separation against SOMBRA (Figures 10 and 11).

16

SABER: Selective Bayesian Trust Estimation

Attack

Method

End-attack

Pre-attack 1 object

2 objects

3 objects

FPR ↓ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ 5-frame attack ROBOSAC LUCIA PGD MATE SABER

2.93 3.23 3.52 27.49 30.94 27.27 27.86 73.31 27.42 1.27 47.51 2.20

N/A 3.30 3.47 0.529 32.72 26.34 0.762 87.10 27.76 0.795 63.93 2.13

N/A 0.556 0.856 0.884

3.30 3.42 34.87 25.54 94.43 28.15 75.07 2.13

N/A 0.581 0.910 0.932

DF

ROBOSAC LUCIA MATE SABER

2.93 3.37 3.49 27.49 30.35 27.49 27.86 94.43 27.35 1.27 86.80 2.20

N/A 3.23 3.45 0.521 31.45 26.37 0.866 98.83 28.67 0.965 92.96 2.13

N/A 3.23 3.27 0.542 33.38 25.95 0.930 100.00 28.96 0.986 94.13 2.13

N/A 0.561 0.955 0.994

SOMBRA

ROBOSAC LUCIA MATE SABER

2.93 4.62 3.52 27.49 92.82 2.81 27.86 96.19 27.74 1.27 86.51 2.20

N/A 4.77 3.45 0.995 99.12 0.22 0.887 99.41 28.64 0.963 93.26 2.13

N/A 5.21 3.45 1.000 100.00 0.00 0.934 100.00 28.64 0.986 94.43 1.98

N/A 1.000 0.953 0.993

7-frame attack ROBOSAC LUCIA PGD MATE SABER

2.93 3.67 3.64 27.49 31.40 26.76 27.86 74.49 26.61 1.27 50.73 2.20

N/A 3.74 3.59 0.530 33.16 26.08 0.772 90.32 27.20 0.804 67.74 2.05

N/A 0.556 0.868 0.903

3.89 3.59 34.90 25.54 95.31 27.13 77.13 2.20

N/A 0.582 0.917 0.941

DF

ROBOSAC LUCIA MATE SABER

2.93 3.74 3.69 27.49 30.52 26.91 27.86 95.01 27.13 1.27 87.39 2.35

N/A 3.59 3.62 0.522 31.92 26.25 0.872 99.12 27.49 0.965 92.96 2.20

N/A 3.96 3.64 0.543 33.70 25.68 0.933 100.00 27.86 0.986 94.43 2.20

N/A 0.561 0.957 0.993

SOMBRA

ROBOSAC LUCIA MATE SABER

2.93 4.91 4.11 27.49 92.82 2.79 27.86 96.48 26.91 1.27 87.39 2.05

N/A 5.50 4.11 0.995 99.12 0.22 0.893 99.12 27.59 0.964 92.96 2.05

N/A 5.87 4.11 1.000 99.71 0.07 0.936 100.00 27.76 0.984 94.43 1.91

N/A 1.000 0.955 0.992

10-frame attack ROBOSAC LUCIA PGD MATE SABER

2.93 3.81 3.47 27.49 31.09 27.47 27.86 76.83 26.03 1.27 48.68 1.32

N/A 3.74 3.42 0.529 33.80 26.54 0.784 91.50 26.17 0.819 67.16 1.17

N/A 0.556 0.881 0.909

3.67 3.42 35.58 25.49 96.19 26.69 77.42 1.17

N/A 0.580 0.924 0.945

DF

ROBOSAC LUCIA MATE SABER

2.93 3.89 3.52 27.49 30.01 27.66 27.86 94.72 25.95 1.27 85.92 1.32

N/A 3.81 3.49 0.522 32.55 26.69 0.872 99.41 26.61 0.963 92.38 1.03

N/A 3.96 3.49 0.544 34.26 25.95 0.939 100.00 27.64 0.986 93.84 0.88

N/A 0.563 0.962 0.992

SOMBRA

ROBOSAC LUCIA MATE SABER

2.93 4.84 3.67 27.49 90.91 3.27 27.86 97.07 26.74 1.27 85.92 1.61

N/A 4.99 3.67 0.993 98.09 0.59 0.897 99.12 26.88 0.965 92.38 1.17

N/A 1.000 0.942 0.985

5.72 3.96 99.56 0.07 99.71 27.98 93.84 0.88

N/A 1.000 0.959 0.991

20-frame attack ROBOSAC LUCIA PGD MATE SABER

2.93 4.25 3.96 27.49 30.33 27.20 27.86 74.19 32.45 1.27 46.33 1.32

N/A 4.33 3.91 0.526 33.43 26.42 0.770 92.08 33.19 0.842 70.38 1.17

N/A 0.550 0.877 0.936

4.62 4.13 34.97 24.90 97.36 33.70 77.71 1.17

N/A 0.573 0.923 0.964

DF

ROBOSAC LUCIA MATE SABER

2.93 4.25 3.96 27.49 29.45 27.22 27.86 89.74 32.50 1.27 86.51 1.32

N/A 4.62 3.96 0.522 32.04 26.54 0.850 98.53 33.94 0.965 92.96 1.17

N/A 4.62 4.15 0.541 34.02 25.54 0.930 100.00 34.68 0.987 93.84 1.03

N/A 0.558 0.959 0.994

SOMBRA

ROBOSAC LUCIA MATE SABER

2.93 5.28 4.25 27.49 89.47 4.23 27.86 95.01 33.09 1.27 86.51 1.61

N/A 6.01 4.42 0.990 95.45 1.69 0.880 98.83 34.58 0.965 93.26 1.61

N/A 0.998 0.933 0.987

N/A 1.000 0.956 0.992

6.13 4.18 98.09 0.68 99.71 35.46 94.13 1.47

Table 7: SABER results under intermediate-fusion removal across attack durations. TPR and FPR are percentages. AUC denotes full ROC-AUC. Thresholds are fixed across attack types and target counts: SABER 0.1, MATE 0.8, LUCIA 0.1, and ROBOSAC consistency 0.3. ROBOSAC provides discrete operating points, so full ROC-AUC is not applicable.

17

SABER: Selective Bayesian Trust Estimation

Attack Method

End-attack

Pre-attack 1 object

2 objects

3 objects

FPR ↓ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ TPR ↑ FPR ↓ AUC ↑ 5-frame attack ROBOSAC LUCIA PGD MATE SABER

0.00 1.08 1.10 24.87 24.50 28.00 22.25 25.65 22.60 0.00 54.76 1.15

N/A 1.15 1.08 0.465 24.64 27.86 0.523 27.95 23.39 0.826 77.23 1.01

N/A 1.15 1.08 0.470 25.36 27.86 0.533 28.53 25.34 0.925 84.15 1.01

N/A 0.474 0.540 0.958

ROBOSAC LUCIA MATE SABER

0.00 1.15 1.10 24.87 25.79 27.31 22.25 30.26 22.81 0.00 83.00 1.15

N/A 1.30 1.10 0.487 27.43 26.80 0.570 39.19 24.35 0.973 95.10 1.01

N/A 1.51 1.08 0.509 29.01 25.96 0.613 47.26 26.13 0.991 96.83 0.86

N/A 0.530 0.655 0.996

7-frame attack ROBOSAC LUCIA PGD MATE SABER

0.00 1.59 1.61 24.87 24.21 28.07 22.25 24.21 21.30 0.00 58.50 0.43

N/A 1.59 1.61 0.466 24.64 27.79 0.545 28.82 22.43 0.853 75.50 0.43

N/A 1.59 1.61 0.471 24.64 27.47 0.560 33.43 24.62 0.933 85.59 0.43

N/A 0.475 0.584 0.969

ROBOSAC LUCIA MATE SABER

0.00 1.59 1.63 24.87 25.50 26.99 22.25 31.70 21.47 0.00 85.88 0.43

N/A 1.59 1.66 0.489 27.52 26.20 0.587 41.50 24.50 0.979 96.54 0.43

N/A 1.59 1.66 0.511 30.02 25.50 0.643 49.86 26.44 0.994 97.98 0.43

N/A 0.532 0.692 0.998

10-frame attack ROBOSAC LUCIA PGD MATE SABER

0.00 1.59 1.63 24.87 24.78 28.24 22.25 27.09 21.13 0.00 55.62 1.44

N/A 1.59 1.61 0.468 24.93 27.95 0.575 35.45 23.01 0.819 76.66 1.44

N/A 1.59 1.61 0.473 25.36 27.95 0.616 42.94 23.90 0.910 85.01 1.44

N/A 0.477 0.652 0.947

ROBOSAC LUCIA MATE SABER

0.00 1.87 1.87 24.87 27.09 27.38 22.25 34.29 20.70 0.00 87.61 1.44

N/A 1.87 1.87 0.491 29.32 26.22 0.629 46.40 22.72 0.966 96.25 1.30

N/A 1.87 1.87 0.513 31.20 25.29 0.693 61.10 25.34 0.989 98.27 1.30

N/A 0.533 0.760 0.993

20-frame attack ROBOSAC LUCIA PGD MATE SABER

0.00 2.45 2.45 24.87 23.63 28.31 22.25 45.82 27.52 0.00 64.27 1.66

N/A 2.52 2.45 0.471 24.35 28.17 0.636 56.48 28.82 0.888 81.84 1.66

N/A 2.67 2.47 0.475 24.35 28.17 0.701 65.99 30.86 0.958 91.07 1.66

N/A 0.479 0.748 0.985

ROBOSAC LUCIA MATE SABER

0.00 2.45 2.45 24.87 26.22 26.90 22.25 46.11 27.74 0.00 92.51 1.66

N/A 2.67 2.50 0.496 28.60 25.91 0.669 65.71 28.89 0.990 98.27 1.51

N/A 3.03 2.45 0.517 30.79 25.24 0.769 78.67 30.91 0.997 99.14 1.37

N/A 0.538 0.835 0.997

DF

DF

DF

DF

Table 8: SABER results under intermediate-fusion spoofing across attack durations. TPR and FPR are percentages. AUC denotes full ROC-AUC. Thresholds are fixed across attack types and target counts: SABER 0.1, MATE 0.8, LUCIA 0.1, and ROBOSAC consistency 0.3. ROBOSAC provides discrete operating points, so full ROC-AUC is not applicable.

Attacker flagged rate (TPR)

SABER

MATE

1 object

100%

Removal

Spoofing

2 objects

3 objects

50%

0% 0%

5%

10%

0%

5%

10%

0%

Benign flagged rate (FPR)

Figure 10: Late-fusion ROC in the 0–10% FPR region.

18

5%

10%

SABER: Selective Bayesian Trust Estimation

SABER

MATE

Attacker flagged rate (TPR)

1 object

PGD removal

100%

LUCIA 2 objects

DF removal

ROBOSAC 3 objects

SOMBRA removal

PGD spoofing

DF spoofing

50%

0% 0%

5%

10%

0%

5%

10%

0%

5%

10%

0%

5%

10%

0%

5%

10%

Benign flagged rate (FPR)

Figure 11: Intermediate-fusion ROC in the 0–10% FPR region.

E

Theoretical Analysis and Proofs

Following Section 4.4, we first establish protection against cross-object dilution, then analyze trust response through weighted evidence, memory, and paired clean–attack comparisons, and finally derive attacker–benign separation and false-alarm bounds. The attack endpoint is fixed at t⋆ = te before observing outcomes. All evidence sums include admitted memory and temporal discounts. Unless time is shown explicitly, scores and evidence are evaluated at t⋆ . The results apply to the report histories in either fusion setting under their stated assumptions. E.1

Accumulated evidence and dilution

We establish the pair-isolation property and contrast it with pooled assessment. Using the admission set defined in Appendix A.4, define the pre-amplification evidence X X ℓ ℓ ℓ ℓ Uij = Dℓ,t⋆ g(qj,−i )ϕ+ (vij ), Vij = Dℓ,t⋆ g(qj,−i )ϕ− (vij ). (17) ℓ∈Eij (t⋆ )

ℓ∈Eij (t⋆ )

Here Uij and Vij accumulate the pair’s admitted positive and negative evidence, including memory and temporal discounts but excluding the multiplier λ. Subtracting the fixed initial parameters from Eq. (6) leaves a discounted deviation plus admitted increments. Historical evidence released at s has total discount Dℓ,s Ds,t⋆ = Dℓ,t⋆ . Induction gives αij = κµi +λUij and βij = κ(1−µi )+λVij without double-counting. The resulting pair trust at the checkpoint is κµi + λUij t⋆ Bij , (18) = κ + λ(Uij + Vij ) Proof of Proposition 1. Under the fixed histories in the proposition, Eq. (17) contains only the assessed pair’s evidence. Direct updates for other tracks cannot change its mean. Taking the minimum in Eq. (7) gives T2,i ≤ Bij while j ∈ Ati⋆ . Equation (8) also gives Ri ≤ Bij . Proposition 2 (Cross-object dilution under pooled assessment). A pooled Beta state with initial parameters (A0 , B0 ) > 0, disputed evidence (x, y) ≥ 0, and m unrelated evidence blocks (b+ , b− ) ≥ 0 has mean Tpool (m) =

A0 + x + mb+ . A0 + B0 + x + y + m(b+ + b− )

(19)

If b+ + b− > 0 and b+ /(b+ + b− ) > Tpool (0), this mean increases with m and converges to b+ /(b+ + b− ). Proof. Differentiation in the nonnegative real extension of m gives numerator b+ (B0 +y)−b− (A0 +x) over a positive squared denominator. The numerator is positive under the stated condition, so the result also holds for integer block counts. Dividing numerator and denominator by m gives the limit. The comparison isolates direct cancellation: unrelated evidence raises pooled trust but cannot replenish an assessed pair’s state. Other reports may still affect the peer reference or initial mean, which are held fixed in Proposition 1. Minimum aggregation does not add penalties across attacked objects, so several equally contradicted pairs can yield the same agent score. 19

SABER: Selective Bayesian Trust Estimation

E.2

Weighted evidence and detection by the attack endpoint

For 0 < η < 1, rearranging Eq. (18) gives the exact pair-level crossing condition   Bij < η ⇐⇒ λ ηVij − (1 − η)Uij > κ(µi − η).

(20)

For an assessed pair this is sufficient to flag its agent, since Ri ≤ Bij . The left side is the pair’s net evidence toward crossing the threshold. The right side is the resistance from its initial state. Neither contains direct evidence from unrelated tracks. For Uij + Vij > 0, hold initialization and the reference, screening, admission, discount, and assessment histories fixed. Increasing λ then lowers Bij exactly when Uij /(Uij + Vij ) < µi , by differentiation as in Eq. (14), and lim Bij =

λ→∞

Uij . Uij + Vij

(21)

Thus amplification increases the influence of supported contradictions, but cannot create a more negative evidence ratio. If both the initial mean and this ratio are at least η, no finite weight makes the pair cross below it. With no evidence, Bij = µi regardless of λ. To connect Eq. (20) to persistent errors, consider admitted observations with 0 ≤ v ≤ va < min(θ, 1/2). Binary reports imply g(q) = |2v − 1|, so valid increment bounds are (1 − 2va )ν 2 (1 − va ) νva , g(q)ϕ− (v) ≥ ya = . (22) ν+1 ν+1 These use the tier-2 bias parameters. They follow from g(q) ≤ 1 and g(q) = 1 − 2v ≥ 1 − 2va on this interval. Proposition 3 (Finite-time detection from one contradicted pair). Suppose an attacker pair (a, j) remains assessed at t⋆ .PLet C ⊆ Eaj (t⋆ ) be admitted observations satisfying the consistency condition above, with effective length L = ℓ∈C Dℓ,t⋆ > 0. Let U0 , V0 be the discounted pre-amplification evidence from all other admitted observations of this pair. Then Ra < η if  λ η(V0 + Lya ) − (1 − η)(U0 + Lxa ) > κ(µa − η). (23) g(q)ϕ+ (v) ≤ xa =

Proof. Equation (22) yields Uaj ≤ U0 + Lxa and Vaj ≥ V0 + Lya . Substituting these bounds into the left side of Eq. (20) proves Baj < η. Assessment membership then gives Ra ≤ Baj < η. When ηya − (1 − η)xa > 0, Eq. (23) can be written directly as a sufficient effective-evidence requirement: κ(µa − η)/λ − ηV0 + (1 − η)U0 . (24) ηya − (1 − η)xa The denominator is a lower bound on net threshold-crossing evidence per effective observation. The numerator accounts for the prior and the pair’s other admitted evidence. Thus the condition specifies how much supported contradiction must be admitted by the attack endpoint, rather than requiring an unspecified duration of persistent errors. L>

Screening determines when evidence can first be admitted. For a continuously eligible attack producing an event at every frame from ts , starting with zero CUSUM, the trigger is s = ts + r∗ − 1, with r∗ from Eq. (12). If s > t⋆ , this attack interval alone cannot activate tier 2. Otherwise, suppose the pair remains assessed from s through t⋆ , every Pt⋆ −s observation satisfies the consistency bound, and ρ is constant. Their effective length is k=0 (1 − ρ)k . Memory adds the discounts of qualifying admitted pre-trigger observations, using their original references. Other observations remain in U0 , V0 . The relevant quantity in Eq. (24) is discounted evidence, not the raw number of attack frames. With constant ρ > 0, even indefinitely many distinct observations have total effective length at most 1/ρ, so persistence alone does not guarantee crossing. E.3

Effect of admitted memory

The following result isolates how admitting cached evidence changes trust, without changing initialization or subsequent updates. Proposition 4 (Admitting history under fixed initialization and subsequent updates). Hold a pair’s initialization, propagation, and non-memory increments fixed. At a common checkpoint, let its no-memory state have mean Bbase and mass N > 0. If the additional historical increments remaining after discounting are (M+ , M− ), with M = M+ + M− > 0, then   M M+ Bmem − Bbase = − Bbase . (25) N +M M 20

SABER: Selective Bayesian Trust Estimation

Proof. The memory state has mean (N Bbase + M+ )/(N + M ). Subtract Bbase . Linear propagation preserves the parameter difference as the discounted historical increment. Memory lowers pair trust when the admitted history has a lower evidence-implied mean than the no-memory state. It lowers agent trust only when the changed pair affects the minimum in Eq. (8). This response can occur at activation without shortening the CUSUM delay. The proposition isolates history admission under fixed initialization. Runs with different initial means must retain their own initialization in the full comparison. Figure 8 evaluates the resulting response speed. E.4

Paired reduction relative to MATE

This comparison asks whether tier 2 strengthens the attack-induced trust decrease, rather than merely lowering scores on both clean and attacked inputs. We compare against MATE because tier 1 of SABER refers to its design. This comparison isolates the additional attack-specific response introduced by selective pair-level assessment, rather than differences between unrelated trust estimators. Couple clean and attacked runs with the same sensor observations, visibility declarations, and initialization rules. Each run keeps its own resulting screening and trust history. Within either run, tier 1 equals MATE on those inputs. Let Pi = T1,i − Ri ≥ 0 denote the additional reduction due to tier 2. For the selected agent, suppress its index and define DM = T1clean − T1attack ,

D = Rclean − Rattack ,

D − DM = P attack − P clean .

(26)

Here D and DM are the attack-induced trust decreases for SABER and MATE, respectively. The last equality follows by substitution and removes any extra reduction that tier 2 already causes on the paired clean input. Sufficient evidence bounds. We first bound the extra reduction on the attacked input from below and its cost on the paired clean input from above. For an assessed attacker pair, suppose µa ≤ µa ∈ (0, 1), Uaj ≤ U a , Vaj ≥ V a , and T1,a ≥ ma , with nonnegative evidence bounds and 0 < c < ma < 1. The condition λ[(ma − c)V a − (1 − ma + c)U a ] ≥ κ(µa − ma + c)

(27)

ensures Baj ≤ ma − c by Eq. (18), hence Pa ≥ c. If these conditions hold with probability at least 1 − ξ, they give Pr(P attack ≥ c) ≥ 1 − ξ. Failures of assessment membership, informative evidence, or the initial/baseline bounds are included in ξ. For a clean run with nonempty assessment, write µ = µi and define Cmax = maxj∈At⋆ [µ(Uij + Vij ) − Uij ]+ , where i [z]+ = max(0, z). Equations (18) and (8) give P clean ≤ min{1, [T1 − µ]+ + λCmax /κ}.

(28)

To verify this, use [µ − Bij ]+ ≤ λ[µ(Uij + Vij ) − Uij ]+ /κ and µ − T2 = maxj∈At⋆ [µ − Bij ]+ . Conditional on i nonempty clean assessment, assume [T1 − µ]+ ≤ d0 and Cmax ≤ c0 jointly with probability at least 1 − ζ, where d0 , c0 ≥ 0 and ζ ∈ [0, 1]. Then Cclean = (1 − ζ) min{1, d0 + λc0 /κ} + ζ is a valid bound. These sums include memory, so the clean-side effect of weighting and history admission is not omitted. From evidence bounds to paired reduction. The attack-side evidence condition gives c, while the clean-side bound gives Cclean . The following theorem combines these with their occurrence probabilities. Theorem 5 (Larger paired trust reduction). Suppose the clean assessment set is nonempty at t⋆ with probability at most γ. Conditional on this event, when it has positive probability, assume the expected additional reduction is at most Cclean ∈ [0, 1]. Suppose P attack ≥ c > 0 with probability at least 1 − ξ. For γ, ξ ∈ [0, 1], E[D − DM ] ≥ (1 − ξ)c − γCclean .

(29)

Thus (1 − ξ)c > γCclean suffices for a larger expected attack-induced reduction than MATE. Proof. Nonnegativity gives E[P attack ] ≥ (1 − ξ)c. Without assessed pairs, P clean = 0, so E[P clean ] ≤ γCclean . Apply Eq. (26). No independence or equal activation histories are required. 21

SABER: Selective Bayesian Trust Estimation

E.5

Attacker–benign separation

We now compare the attacker with a benign peer in the same attacked scene. Write f (µ, U, V ) = (κµ + λU )/[κ + λ(U + V )]. For κ > 0, λ ≥ 1, 0 < µ < 1, and nonnegative evidence, it increases with µ, U and decreases with V . Theorem 6 (Separation from one contradicted pair). At t⋆ , suppose attacker a has an assessed pair with µa ≤ µa , Uaj ≤ U a , and Vaj ≥ V a . For benign peer b, suppose T1,b ≥ mb and, whenever its assessment set is nonempty, µb ≥ µb , Ubj ≥ U b , and Vbj ≤ V b for every assessed pair. Assume mb , µa , µb ∈ (0, 1) and nonnegative evidence bounds. Set ua = f (µa , U a , V a ), ℓb = min{mb , µb , f (µb , U b , V b )}. (30) Then Ra ≤ ua , Rb ≥ ℓb , and Rb − Ra ≥ ℓb − ua . If the attacker and joint benign conditions fail with probabilities at most ξa , ξb ∈ [0, 1], the gap bound holds with probability at least 1 − ξa − ξb . Proof. Monotonicity bounds the attacker’s assessed pair, and hence Ra , above by ua . It bounds every assessed benign pair below by the third argument of ℓb . The other arguments bound tier 1 and the initial-mean cap. If no benign pair is assessed, Rb = T1,b ≥ mb . Subtraction and a union bound prove the claims. The benign assumptions allow errors but bound their retained contradiction evidence jointly over assessed pairs. Only one attacker pair needs a sufficiently strong contradiction. These are assumptions on reporting histories, not consequences of labeling an agent benign or malicious. When ℓb > ua , the theorem gives strict separation. If pre-attack agent trusts are equal to r0 , then (r0 − Ra ) − (r0 − Rb ) = Rb − Ra , so this gap equals the difference in their trust decreases. Equal starting scores are needed only for this interpretation. For attacker and benign peer within one attacked scene, the analogous identity is (Rb − Ra ) − (T1,b − T1,a ) = Pa − Pb .

(31)

Thus Pa ≥ ca > cb ≥ Pb improves their separation relative to MATE. Pure-clean runs and benign peers in attacked scenes are different populations, so assumptions on their reductions are stated separately. E.6

Detection with bounded additional false alarms

A low attacker score is useful only if a threshold can detect it without excessive benign flags. In this comparison, TPR, FPR, and η refer to SABER, while the subscript M denotes MATE. Fix thresholds 0 < η ≤ ηM < 1 and a specified benign population. Using the tier-2 reduction Pi defined in Appendix E.4 and suppressing the benign agent index, the FPR difference is FPR − FPRM = Pr(T1 ≥ ηM , P > T1 − η) b

− Pr(T1 < ηM , P ≤ T1 − η) b

(32)

≤ Pr(T1 ≥ ηM , P > ηM − η). b

The first term counts newly introduced false alarms and the second counts removed false alarms. Dropping the latter and using T1 ≥ ηM gives the inequality. Proposition 7 (A joint detection–false-alarm operating point). Suppose Ra ≤ ua with probability at least 1 − ξa , and Prb (T1 ≥ ηM , P > pb ) ≤ δ, where ua , ξa , δ ∈ [0, 1] and pb ≥ 0. If ua < ηM − pb , every fixed threshold ua < η ≤ ηM − pb

(33)

satisfies TPR ≥ 1 − ξa and FPR ≤ FPRM + δ. Proof. The lower threshold bound flags every outcome with Ra ≤ ua . The upper bound gives ηM − η ≥ pb , so Eq. (32) bounds additional FPR by δ. The same threshold must satisfy both requirements, excluding the vacuous choice of a zero threshold. This establishes a useful detection–false-alarm operating point under the stated assumptions, not superiority to every baseline at every threshold. As a separate comparison, if Pra (T1,a ≥ ma ) ≥ 1 − ζa and η ≤ ma , then TPRM (η) ≤ ζa , since {T1,a < η} ⊆ {T1,a < ma }. This last observation concerns MATE at the same low threshold, not at its own ηM . 22

SABER: Selective Bayesian Trust Estimation

A benign evidence condition. The minimum over pairs requires control of the most adverse pair, rather than average error frequency. Let H = {T1,b ≥ ηM , Atb⋆ ̸= ∅} have probability at most γH ∈ [0, 1]. For this bound, relabel agent b’s pair states by their order of creation, with at most Kb < ∞ states per window. Choose η < µmin < 1 and define n o κ Fbj = j ∈ Atb⋆ , ηVbj − (1 − η)Ubj > (µmin − η) . (34) λ For ε0 , . . . , εKb ∈ [0, 1], assume, when Prb (H) > 0, that Pr(µb < µmin | H) ≤ ε0 , b

Pr(Fbj | H) ≤ εj , b

j = 1, . . . , Kb .

(35)

For an uncreated pair, Fbj is empty. These assumptions allow occasional benign contradictions while bounding the chance that they accumulate enough retained evidence to cross the decision threshold. They imply PKb FPR − FPRM ≤ γH min{1, ε0 + j=1 εj }. (36) Indeed, a newly flagged benign agent must belong to H. Unless its initial mean is below µmin , crossing requires an assessed pair with Bbj < η. Equation (20) then implies Fbj . A conditional union bound proves Eq. (36) without pair independence. If Prb (H) = 0, no additional false alarm is introduced.

23

Related documents

• Don't Let One Lie Survive A Hundred Truths: A Selective Bayesian Trust Estimator for Collaborative Perception#1217610
• Adversarial Trust Poisoning in Vehicular Collaborative Perception#792753
• Adversarial Trust Poisoning in Vehicular Collaborative Perception#788753
• In defense of the armchair: Against empirical arguments in the philosophy of perception#75982
• The Disunity of Perception: An Introduction#99634