S TILL C AMOUFLAGE , M OVING I LLUSION : V IEW-I NDUCED T RAJECTORY M ANIPULATION IN AUTONOMOUS D RIVING
arXiv:2605.12743v1 [cs.CR] 12 May 2026
Shuo Ju1 , Qingzhao Zhang2 , Huashan Chen1 , Xuheng Wang3 , Haotang Li2 , Wanqian Zhang1 , Feng Liu1 , Kebin Peng4 , and Sen He2 1
Institute of Information Engineering, Chinese Academy of Sciences 2 The University of Arizona 3 Beijing Jiaotong University 4 East Carolina University
May 14, 2026
A BSTRACT Existing physical adversarial attacks on vision-based autonomous driving induce time-evolving perception errors, including biased object tracking or trajectory prediction, through (i) sophisticated physical patch inducing detection box drift when entering the view distance, or (ii) dynamically changing patches that cause different perception errors at different time. In both cases, viewing-angle variation is treated as a challenge, requiring adversarial patches to remain effective across frames under varying views, leading to complex multi-view optimization. In contrast, we show that viewing-angle variation itself can be turned into an attack tool. We design a new attack paradigm where a static, passive adversarial camouflage is mounted on a vehicle whose view-dependent appearance naturally evolves with relative motion, inducing consistent feature drift across frames. This causes the system to infer a physically plausible but incorrect trajectory, such as a false cut-in, which propagates to downstream decision-making and triggers unnecessary braking. Unlike prior approaches that require multi-view robustness or active intervention, our attack emerges from normal driving dynamics and is easy to deploy: a parked vehicle with a natural camouflage can induce hard braking in passing autonomous vehicles. We demonstrate the novel attack on nuScenes dataset, showing the effectiveness with an end-to-end success rate of up to 87.5%, measured by hard-braking events, and robustness across different scene backgrounds, victim vehicle speeds, and perception models.
1
Introduction
Vision-based autonomous driving systems rely on temporal perception: detections from consecutive frames are associated by tracking, converted into future trajectories by prediction, and finally consumed by planning [35, 39, 14]. This architecture ensures the stability of the decision-making process, meaning that a single-frame perception error may not necessarily propagate through the downstream pipeline [47, 20]. Therefore, for an adversarial attack to be successful, it must exhibit coherent temporal evolution to survive downstream aggregation and influence planning-level decisions. However, existing physical attacks mainly focus on either perception-level manipulation under single-frame settings, such as inducing object hiding [18, 56] or misclassification [34, 29], or tracking-level hijacking across multiple frames [8, 31, 32, 36]. Perception-oriented attacks generally optimize perturbations to remain effective under changing viewing angles and distances, while tracking-oriented attacks explicitly manipulate temporal states or tracker associations. Despite their differences, these methods share one common assumption: viewing-angle variation is treated as a robustness challenge that the attack should remain invariant against. They overlook a critical attack surface in driving scenarios: the natural viewing-angle variation during relative motion can itself become the source of temporally coherent perception manipulation. This motivates us to explore the possibility of a “still camouflage, moving illusion”:
A PREPRINT - M AY 14, 2026
(a) Blocking overtaking → gaining advantage on road.
(b) Causing hard braking → safety hazards.
Figure 1: Attack demonstration: static camouflage on an adversarial vehicle induces temporally coherent perception errors that propagate through tracking and prediction, ultimately triggering harmful driving decisions in the victim autonomous vehicle. leveraging natural viewing-angle variation to transform static spatial patterns into dynamic temporal perturbations, thereby creating coherent motion illusions. Our attack is motivated by a simple physical observation, as illustrated in Fig. 1. When an autonomous vehicle (AV) moves relative to a target vehicle, the target is naturally observed from changing viewing angles. As a result, the projected appearance of a static adversarial camouflage evolves across frames, even though the physical camouflage itself remains unchanged. Rather than suppressing this view-dependent variation, we exploit it to induce a sequence of consistent detection shifts. Such shifts can be interpreted by downstream tracking and prediction as a plausible but false motion pattern, e.g., a vehicle gradually cutting into the ego path. Since the camouflage is physically static, the attack requires no dynamic display, active projection, or frame-wise intervention. Importantly, this motion illusion can force the victim AV to abandon overtaking maneuvers, thereby giving the adversarial vehicle driving advantage, or trigger unnecessary hard braking that creates safety-critical hazards. However, realizing this idea is challenging. The goal is not to maximize detector errors independently in each frame, but to make a single shared physical camouflage induce temporally compatible 3D bbox shifts under changing viewing angles. This camouflage must remain physically projectable onto the vehicle surface, preserve the target as a valid detected object, and make the displacement accumulate over time rather than appear as unstable frame-wise noise. To address these challenges, we optimize a static adversarial camouflage under a geometry-constrained multi-frame formulation. We first select attackable scenarios and frame sequences with sufficient viewing-angle variation, and render the shared camouflage through a physically consistent mesh and UV pipeline. We then identify the optimal displacement direction and optimize the shared camouflage with motion-aware losses to drive progressive 3D bbox displacement under real projection constraints. Experiments on nuScenes [6] show that our attack achieves an attack success rate (ASR) of up to 87.5%, demonstrating that normal viewing-angle variation during relative motion can be exploited to create coherent moving illusions from a static physical camouflage. We show that the induced motion illusion leads to realistic driving impacts such as abandoned overtaking and unnecessary hard braking. Further analysis shows that the attack transfers effectively across vehicle types, becomes stronger under larger viewing-angle variation, larger projection area, brighter illumination, closer distance, and lower relative speed, and consistently benefits from all proposed modules and optimization objectives. Our work makes two contributions: (1) We identify viewing-angle variation as a new attack mechanism for autonomous driving systems and propose a geometry-constrained framework for generating static camouflage that induces progressive 3D bounding-box movement across frames. (2) Extensive evaluation on nuScenes shows that the induced motion illusion propagates to downstream planning and triggers realistic impacts such as abandoned overtaking and unnecessary hard braking.
2
Related Work
Autonomous driving systems. In recent years, autonomous driving (AD) has advanced substantially, leading to systems such as Tesla Full Self-Driving [3] and Baidu Apollo [1]. Traditional AD systems typically adopt a cascaded pipeline of perception, tracking, prediction, and planning, while end-to-end systems such as ST-P3 [15], UniAD [16], and VAD [21] learn driving-oriented representations directly from sensor observations. Recent Vision-Language-Action 2
A PREPRINT - M AY 14, 2026
Table 1: Comparison between prior related works and our method. Related Work Jia et al.[20] AttrackZone[36] FCA[45] DTA[43] ACTIVE[44] ControlLoc[32] Lou et al.[29] OURS
Viewing-Angle Dependency ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓
Spatio-temporal Consistency ✓ ✓ ✗ ✗ ✗ ✓ ✓ ✓
2D/3D BBox Manipulation 2D & move 2D & move 3D & hiding 3D & hiding 3D & hiding 2D & move 3D & move 3D & move
Attack Pattern patch patch camouflage camouflage camouflage patch physical object camouflage
Pattern Variability static dynamic static static static dynamic static static
System-level Impact ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓
(VLA) systems, such as Alpamayo [2], further integrate visual perception, reasoning, and action generation into a unified architecture. Despite these architectural differences, AD systems still rely on temporally consistent perception of surrounding agents, making persistent perception bias safety-critical. 3D camouflage attacks. Compared with localized patches, 3D camouflage better conforms to vehicle geometry and offers improved physical realism and stealth [53, 18, 46]. Existing camouflage attacks against AD perception [43, 45, 44, 29], which mainly target perception-level errors such as object hiding or misclassification, treat viewing-angle variation as a challenge. In contrast, our work directly exploits viewing-angle variation as the attack mechanism, where the same static camouflage produces view-dependent appearance evolution across consecutive frames, thereby inducing progressive 3D bounding-box movement. Tracker hijacking attacks. Prior studies show that attacking isolated detections alone may be insufficient because tracking systems aggregate temporal observations and can suppress unstable single-frame errors [47]. Jia et al. [20] first studied adversarial attacks against multiple object tracking (MOT) and proposed tracker hijacking by manipulating detection boxes to steer tracker trajectories. AttrackZone [36] moved tracker hijacking into the physical world by projecting adversarial perturbations to hijack Siamese trackers, while ControlLoc [32] optimized physical perturbations to alter perceived object location and shape in camera-based AD systems. These works highlight temporal perception manipulation beyond isolated detector outputs, but mainly target 2D tracking bbox and rely on dynamic deployment. In contrast, our attack uses static camouflage and natural viewing-angle variation to induce temporally coherent 3D bbox displacement, which further propagates to planning, making it easier to deploy and closer to realistic driving scenarios. Prediction-oriented physical attacks. Recent works further investigate how perception errors propagate to downstream prediction and planning [52]. Lou et al. [30] perturb LiDAR perception by placing physical objects near parked vehicles, causing bbox errors that propagate through tracking and prediction. Yu et al. [50] further improve attack persistence and robustness with an optimization-based perturbation framework. However, these works mainly rely on LiDAR-oriented perturbations or external object placement. In contrast, our attack attaches a single static camouflage directly onto the adversarial vehicle and exploits natural viewing-angle variation to induce motion illusion in continuous driving scenarios. As summarized in Tab. 1, our method differs from prior works in three aspects: it uses a fully static camouflage for passive deployment, exploits viewing-angle variation as the temporal attack mechanism, and induces spatio-temporally consistent 3D bbox movement that propagates to downstream driving behaviors.
3
Threat Model
System assumptions. We consider a modular autonomous driving (AD) stack that uses camera-based visual inputs to support driving decisions. The system contains multiple downstream components, including sensing, perception, tracking, trajectory prediction, and motion planning. Our attack targets the perception stage by manipulating the detected 3D bounding box of a vehicle, while the downstream system naturally propagates the induced perception bias to later modules. Tesla [3] is one representative example of such a vision-based AD system. Adversary model. We assume that the attacker can attach a static physical camouflage to a vehicle under the attacker’s control. The attack goal is to induce unsafe driving behaviors or gain driving advantage against a victim AD vehicle, depending on the target scenario discussed later. During attack optimization, the attacker has white-box access to the victim perception model, or alternatively performs transfer attacks by optimizing on a surrogate perception model and transferring the attack to an unknown target stack. We do not assume knowledge of downstream modules such as tracking, prediction, or planning. The attacker does not compromise the victim AD system through sensor spoofing, signal injection, software exploitation, or other direct system intrusion [33, 37, 19, 38]. Instead, the attack is passively 3
A PREPRINT - M AY 14, 2026
Figure 2: Pipeline of the proposed attack. We first select a valid consecutive 3-frame sequence S, render a static camouflage δ onto the renderable region of V, and optimize δ under planning-guided objectives to induce progressive 3D bbox displacement. triggered through normal relative motion between vehicles, where changing viewing angles naturally induce appearance evolution of the static camouflage. Attack scenarios. We consider two representative scenarios as illustrated in Fig. 1 and discussed in Sec. 1: abandoned overtaking and unnecessary hard braking. Our attack methodology is general across both attack scenarios, which induces a false cut-in maneuver of the adversarial vehicle and makes the victim AD vehicle brake or decelerate.
4
Design
4.1
Problem Formulation
We formulate the proposed attack as a static camouflage attack problem over sequential multi-view observations. Let (v) D denote the original dataset. The synchronized multi-view observation at timestamp t is Xt = {It }Vv=1 , where V T denotes the number of camera views and is set to 6. Let O = {Xt }t=1 denote an original sequence selected from D. Then we select a valid consecutive K-frame sequence S = {Xk }K k=1 from O. Based on prior studies showing successful attacks on only a few consecutive frames [20, 36, 32, 30], we set K = 3, which is sufficient to propagate the perception bias to the downstream pipeline. Let V denote the target vehicle and G its vehicle mesh. The attack optimizes a static physical camouflage δ, parameterized on the renderable region of G, and generates adversarial observations X̃k over S. Since δ is static, its appearance variation across frames is induced by viewing-angle variation under relative motion. Let D(·) denote the target 3D detector and Π(·) select the detected 3D bbox of V. The attacked box at frame k is b̂k = Π(D(X̃k )), while the corresponding clean box is bk . Their centers are denoted by ĉk and ck , respectively. The attack aims to move ĉk in a temporally coherent manner with progressively larger displacements across S while keeping b̂k detectable. 4.2
Attack Design Overview
Inspired by viewing-angle variation naturally induced by relative motion in driving scenarios, we design a static physical camouflage attack that exploits this variation to produce temporally coherent 3D detection bias. As illustrated in Fig. 2, the design follows three stages. Scenario Selection identifies sequences where the target vehicle is attack-relevant and exhibits sufficient viewing-angle variation. Camouflage Rendering maps the static camouflage δ to the renderable region of G while preserving visible-surface constraints. Planning-Guided Attack Optimization optimizes δ so that the biased detections form progressive and coherent 3D bbox movements that can propagate to the downstream pipeline. 4.3
Scenario Selection and Camouflage Rendering
To ensure the effectiveness of the attack, we employ a two-stage filtering process to select the valid consecutive sequence S from the dataset D. 4
A PREPRINT - M AY 14, 2026
Attack Feasibility Filter (AFF). We first select an original sequence O in which the target vehicle V is continuously visible, remains in front of the ego vehicle, and is relevant to the ego future path without already intruding into it in the clean scene. This ensures the attack has the potential to trigger hazardous planning responses by introducing detection displacement into a previously safe but highly relevant region of the ego-vehicle trajectory. Viewing-Angle Filter (VAF). The core of our mechanism relies on viewing-angle variation. Accordingly, VAF further extracts a valid consecutive K-frame sequence S from O by ensuring sufficient viewing-angle variation between X1 and XK . Unlike existing attacks that treat such variation as a robustness obstacle to overcome, we prefer sequences with larger viewing-angle variation, ensuring that the same static camouflage δ can produce view-dependent responses and form coherent motion illusions. After obtaining S, we render the static camouflage δ onto V using PyTorch3D [41] with camera intrinsics and annotations. We use Mmesh to determine the precise renderable region and Mseg k k , generated by SAM2 [40], to handle occlusions. 4.4
Planning-Guided Attack Optimization
This stage optimizes the camouflage δ by first searching for a planning-guided displacement target and then realizing it through detector-level optimization. The downstream pipeline is used to determine a hazardous target direction and step size, while the optimization itself is applied to the target 3D detector. Optimal Target Search. To specify the target displacement pattern, we perform a planning-guided target search over a candidate direction set U and a candidate step-size set Ds . Let Γ(u, s) be the fake prediction generated by direction u and step size s, and let Eplan (·) measure the induced planning error. The optimal direction and step size are defined as (u⋆ , s⋆ ) = arg max Eplan (Γ(u, s)) . (1) u∈U , s∈Ds
Since δ is shared within a training group, we average the searched targets and obtain the group-level attack target (ū, s̄). The 3D bbox displacement at frame k along the target direction is defined as ⊤ dk = (ĉk − ck ) ū, k = 1, . . . , K. (2) The planning-guided optimization target is to maximize the overall target-direction displacement while enforcing step consistency across consecutive frames: K K−1 X X 2 max dk − λ (dk+1 − dk − s̄) . (3) δ
k=1
k=1
Optimization Objectives. We implement the planning-guided target using move and progress losses, and regularize the optimization with fidelity and style losses. To improve physical robustness, we further apply 3D Expectation over Transformation (EoT) [4] during optimization by introducing random perturbations to the target vehicle pose and projection, including yaw perturbation, 3D translation, depth-ratio variation, and 3D scale variation. The losses are defined below. 1. Move loss. The move loss drives the target 3D bbox center along the planning-guided direction ū, i.e., maximizing the target-direction displacement dk defined above. 2. Progress loss. The progress loss incorporates the planning-guided frame-wise step size s̄ and encourages a progressively increasing, spatio-temporally consistent 3D bbox movement. We constrain the displacement increment between consecutive frames to match s̄. 3. Fidelity loss. The fidelity loss preserves detection credibility by penalizing deviations in confidence, length, width, height, and yaw, preventing target-vehicle disappearance or severe box distortion. Let r and r̂ denote the clean and attacked fidelity attribute vectors, respectively. 4. Style loss. The style loss Lstyle combines total variation loss Ltv , which reduces high-frequency noise, and non-printability-score loss Lnps , which constrains optimized colors to printable ranges. K K−1 X X 2 (4) Lmove = − dk , Lprog = (dk+1 − dk − s̄) , Lfid = ∥r̂ − r∥ . k=1
5
Evaluation
5.1
Evaluation Setups
k=1
Datasets. We evaluate our attack on nuScenes [6] using 220 attack scenarios, each with a contiguous sequence of camera feeds and annotations, spanning different combinations of target vehicle type, relative position, and driving 5
A PREPRINT - M AY 14, 2026
direction. Specifically, the target vehicle may be an SUV, sedan, or van, located in either the front-left (L) or front-right (R) region of the ego vehicle, and traveling in either the same (S) or opposite (O) direction. We denote each category using the format TYPE-POS-DIR; for example, SUV-L-S represents an SUV located in the front-left region of the ego vehicle and driving in the same direction. Such categories naturally involve attack scenarios in Fig. 1. Evaluation settings. We evaluate the attack under two settings: cross-validation and specific-scenario attack. For the two primary categories, SUV-R-S and SEDAN-R-S, we perform 5-fold cross-validation, where each fold optimizes one shared static camouflage on 4/5 of the scenarios and evaluates it on the remaining 1/5. This setting measures whether the learned camouflage generalizes to unseen scenarios within the same category. For the remaining categories, due to the limited number of scenarios, we optimize and evaluate the camouflage on the same scenario, corresponding to a scenario-specific attack where the attacker targets a chosen driving situation. AD Models. We employ BEVDet [17], BEVDepth [26], and FastBEV++ [10] as the vision-based 3D detectors. To evaluate attack propagation, we construct two downstream pipelines: Pipeline A comprises AB3DMOT [48], Trajectron++ [42], and an MPC-based planner [11]; Pipeline B integrates CenterTrack [54], HiVT [55], and an FOT-based planner [49]. Metrics. We evaluate the attack at the perception, prediction, and planning levels using the metrics: • Frame-wise bbox displacement (d1 , d2 , d3 ) denotes the 3D bounding-box center displacement at the three attack frames, measured in meters along the split-specific average optimal direction ū in Eq. (1), which is estimated from each training split and fixed for its corresponding test split. • Progressive Displacement Rate (PDR) measures the percentage of samples satisfying d1 < d2 < d3 , indicating temporally consistent bbox displacement across attack frames. • Average Prediction Error (APE) measures the average deviation between the clean and attacked predicted trajectories of the target vehicle. • Minimum Trajectory Distance (MTD) measures the minimum distance between the attacked predicted trajectory of the target vehicle and the victim AV’s original planned trajectory. Smaller MTD indicates stronger planning interference. • Maximum Braking Deceleration (MBD) measures the maximum braking deceleration triggered by the victim AV during the three attack frames. • Attack Success Rate (ASR) is the percentage of successful attacks. An attack is considered successful if the victim AV triggers hard braking within the three attack frames, defined as MBD ≥ 3.0 m/s2 . Implementation Details. We optimize the static camouflage using Adam [24] with a learning rate of 0.01 and a texture resolution of 1024 × 1024. For each optimized camouflage, we run 3000 steps in the cross-validation setting and 500 steps in the specific-scenario setting. The attachable region covers the vehicle body surface while excluding tires, windows, and mirrors. All experiments are conducted on a single NVIDIA H100 GPU. 5.2
Attack Effectiveness
Tab. 2 reports the main attack results on the two primary cases under 5-fold cross-validation. The proposed attack achieves up to 0.70 m progressive 3D bbox displacement across three detectors and triggers hard braking with up to 66.7% ASR through two downstream pipelines. The attack induces temporally coherent perception bias. The results confirm that a static camouflage can reliably manipulate the target 3D bbox without dynamic patterns or online intervention. The average PDR reaches 70.8%, indicating that the induced bbox displacement is often temporally progressive rather than a single-frame perturbation. This supports our design goal of generating coherent motion bias from frame-to-frame viewing-angle variation. The perception bias propagates to downstream prediction and planning. Under Pipeline A/B, the attack produces average APEs of 2.84/3.02 m, showing substantial deviation from the clean target-vehicle prediction. The average MTDs of 1.67/1.48 m further indicate that the attacked prediction approaches the victim AV’s original planned path, creating a safety-critical planning conflict. As a result, the attack achieves average hard-braking ASRs of 55.3%/62.2% under Pipeline A/B. Successful attacks require sufficient cross-scenario training diversity. We further study the training-data requirement for achieving successful attacks on the two largest cases. For each case, we fix 15 scenarios as the test set and vary the number of training scenarios from 5 to 45. As shown in Fig. 3, using too few training scenarios leads to unstable test performance, indicating underfitting of the still camouflage. When the number of training scenarios reaches around 35-40, the final-frame displacement and PDR become more stable, suggesting that cross-scenario generalization requires sufficient training samples. 6
A PREPRINT - M AY 14, 2026
Table 2: Main attack results on the two primary cases. We report 3D bounding-box center displacement and downstream propagation results, where values separated by ‘/’ correspond to Pipeline A / B. Scenario
3D BBox Displacement
Detector
Downstream Propagation
d1 (m)
d2 (m)
d3 (m)
PDR (%)
APE (m)
MTD (m)
MBD (m/s2 )
ASR (%)
SUV-R-S
BEVDet BEVDepth FastBEV++
0.18 0.13 0.11
0.37 0.27 0.30
0.70 0.46 0.45
78.3 66.7 70.0
3.04/2.70 2.08/2.53 3.19/3.20
1.34/1.30 2.03/1.75 2.20/2.12
3.61/4.36 3.19/4.20 3.20/3.37
50.0/63.3 53.3/61.7 53.3/56.7
SEDAN-R-S
BEVDet BEVDepth FastBEV++
0.14 0.07 0.10
0.33 0.17 0.28
0.65 0.39 0.48
75.0 61.7 73.0
3.74/3.89 1.94/2.65 3.05/3.17
0.87/0.81 2.06/1.60 1.50/1.31
4.23/5.78 2.95/4.23 3.40/4.76
65.0/66.7 48.3/61.7 61.7/63.3
0.12
0.29
0.52
70.8
2.84/3.02
1.67/1.48
3.43/4.45
55.3/62.2
Average
Table 3: Specific-attack results on the cases with limited available scenarios. Scenario
Num.
d3 (m)
PDR (%)
ASR (%)
SEDAN-L-O SEDAN-L-S SEDAN-R-O SUV-L-O SUV-L-S SUV-R-O VAN-L-O VAN-L-S VAN-R-O VAN-R-S
19 13 14 8 9 6 4 13 6 8
0.85 0.79 0.83 0.84 0.96 0.91 0.91 0.94 0.93 0.93
73.7 84.6 85.7 87.5 77.8 83.3 100.0 92.3 83.3 87.5
68.4 76.9 71.4 75.0 66.7 66.7 75.0 84.6 83.3 87.5
Figure 3: Effect of the number of training scenarios on cross-scenario generalization.
The attack generalizes across diverse traffic configurations. For the remaining cases, the number of available scenarios is limited and unevenly distributed, making them unsuitable for train/test generalization evaluation. We therefore use a case-wise specific-attack setting, where one shared camouflage is optimized and evaluated within each case. As shown in Tab. 3, the attack remains feasible across diverse target-vehicle types, relative positions and directions, achieving an average final-frame displacement d3 of 0.89 m, a PDR of 85.6%, and an ASR of 75.6%. 5.3
Impact of Scenario Factors
Viewing-angle variation dominates under cross-validation. As shown in Fig. 4, we analyze five scenario factors: relative speed, effective projection area, distance, illumination and viewing angle. Since real-world driving data does not provide strictly controlled variables and different factors may be correlated, we use boxplots to compare the distribution of the three-frame average displacement d¯ = (d1 + d2 + d3 )/3 under different factor groups. Under the cross-validation setting, factor effects are partially weakened by scene variation and the generalization constraint of a shared still camouflage. Nevertheless, viewing-angle variation still shows a clear distributional difference: larger viewing-angle variation generally leads to stronger displacement, which is consistent with the core mechanism of our attack. Scenario-specific optimization strengthens factor effects. Under the specific-attack setting, each scenario is optimized individually, making the factor-dependent distributions more pronounced. The attack is stronger when the target vehicle is closer, the illumination is brighter, the relative speed is lower, the effective projection area is larger, and the viewingangle variation is larger. These observations are consistent with our design intuition: larger visible projection and closer distance increase the visual influence of the camouflage, brighter illumination improves texture visibility, lower relative speed produces smoother frame-to-frame changes, and larger viewing-angle variation amplifies the view-dependent appearance evolution of the still camouflage. 5.4
Transferability
Cross-model transferability is challenging. Tab. 4 reports the cross-model transferability results. Camouflage optimized on one detector generally fails to preserve strong displacement on another detector, with the best transferred final-frame displacement reaching only 0.13 m. This limited transferability likely stems from detector-specific image-toBEV transformations, feature aggregation strategies, and 3D box regression mechanisms, highlighting the fundamental challenge of inducing subtle box displacements under black-box settings. 7
A PREPRINT - M AY 14, 2026
Figure 4: Impact of scenario factors—distribution of the three-frame average displacement d¯ across different factor groups. C/S: evaluation settings cross-validation/scenario-specific. Table 4: Cross-model transferability; reported 3D bbox displacement Table 5: Cross-vehicle-type transferability; d1 /d2 /d3 (m) in three frames. reported 3D bbox displacement d1 /d2 /d3 (m) in three frames. Source Detector
Target Detector BEVDet
BEVDepth
FastBEV++
BEVDet 0.16/0.35/0.68 -0.09/-0.08/0.01 -0.03/0.06/0.05 BEVDepth -0.06/-0.02/-0.09 0.10/0.22/0.43 -0.14/0.02/0.13 FastBEV++ 0.04/0.05/0.11 0.04/0.04/0.10 0.11/0.29/0.47
Source Target Vehicle Type Vehicle SUV Sedan Type SUV 0.14/0.31/0.54 0.07/0.22/0.34 Sedan 0.09/0.23/0.35 0.10/0.26/0.51
Cross-vehicle-type transfer remains effective. We further evaluate transferability across target-vehicle types. For each detector, we optimize the camouflage on one primary vehicle-type case and directly evaluate it on another after adapting the texture to the target vehicle body size and attachable surface. Tab. 5 shows that the transferred camouflage still induces non-trivial 3D bbox displacement in consecutive frames when attached to another vehicle in another scenario. 5.5
Ablation Study
Tab. 6 reports the ablation results on the two primary cases using BEVDet as the victim detector. We use Coefficient of Variation (CV) to measure the stability of displacement across perturbation conditions, and Box Fidelity Score (BFS) to measure the similarity between attacked and clean boxes in target vehicle confidence and geometric attributes. BFS ranges from 0 to 1, where 1 indicates identical box fidelity. We draw the following conclusions: (1) Movement and progression objectives are both essential. The ablation results indicate that Lmove and Lprog are the core attack objectives, respectively driving large bbox displacement and progressive temporal movement. (2) VAF and EoT improve robustness and stability. Removing VAF degrades the overall performance, validating the importance of our viewing-angle-based design. EoT enhances attack robustness by reducing CV and improving the overall metrics. (3) Fidelity constraints stabilize the attack. Removing Lfid sharply reduces BFS and also lowers ASR, indicating that fidelity constraints help stabilize the optimization and preserve attack effectiveness. The ablation effect of Lstyle is shown in Fig. 5. 5.6
Case Study
We present a representative case study of the end-to-end attack in Fig. 6. The static camouflage exhibits view-dependent appearance changes under relative ego-target motion, causing progressive 3D bbox displacement of d1/d2/d3 = 0.31/0.63/0.91 m, making the target appear to move toward the ego driving region, resulting in an APE of 2.82 m and an MTD of 0.18 m, and ultimately triggering hard braking by the ego vehicle. This confirms that the proposed attack is not a single-frame perception perturbation; instead, it exploits viewing-angle variation to turn static camouflage into temporally coherent 3D bbox shifts that propagate through downstream pipeline, causing unnecessary braking and supporting our motivation. The abandoned overtaking scenario is provided in Appendix A.
6
Discussion
Threats to validity. Our evaluation focuses on a limited set of perception models, tracking pipelines, and autonomous driving systems. Although the attack transfers across different settings, the effectiveness may vary for other architectures, sensor configurations, fusion strategies, and planning modules. In addition, our experiments are conducted on existing datasets and simulation-driven pipelines, which may not fully capture real-world deployment conditions. Mitigation and ethical consideration. Potential defenses include multi-sensor fusion [28, 5, 25, 9], temporal and physical consistency reasoning [34, 51], and adversarial patch or camouflage defenses [13, 27, 23, 22]. However, prior work shows that fusion systems remain vulnerable to sensor attacks [12, 7], and these approaches mitigate but do not fundamentally eliminate the vulnerability exploited in this work: viewing-angle variation induces spatio8
A PREPRINT - M AY 14, 2026
Table 6: Ablation study of key attack components. ASR is reported in the format Pipeline A/B. Module
(a) w/ Lstyle
(b) w/o Lstyle
Figure 5: Ablation study of Lstyle .
d3 (m) ↑ CV ↓ PDR (%) ↑ BFS ↑ ASR (%) ↑
Full w/o VAF w/o EoT w/o Lmove w/o Lprog w/o Lfid
0.68 0.48 0.43 0.12 0.51 0.64
0.54 0.56 0.77 1.05 0.48 2.04
76.7 50.8 54.2 51.7 58.3 65.0
0.82 0.82 0.76 0.93 0.83 0.60
57.5/65.0 35.0/51.7 46.7/48.3 15.8/23.3 26.7/41.7 49.2/57.5
Figure 6: Representative case study of the attack results. The static camouflage induces progressive 3D bbox displacement and shifts the predicted target trajectory toward the ego future path, eventually triggering unnecessary braking. Left: camera-view observations, including three consecutive frames; Right: the resulted BEV prediction and planning results. temporally coherent perception bias. This work motivates the design of secure and robust autonomous driving systems by identifying this overlooked attack surface. We evaluate attacks on public datasets without harming real systems.
7
Conclusion
We present a view-induced trajectory manipulation attack that exploits natural viewing-angle variation to transform a static adversarial camouflage into temporally coherent motion deception. By inducing progressive 3D bounding-box displacement across consecutive frames, the attack propagates through downstream tracking, prediction, and planning modules, leading to harmful driving behaviors such as abandoned overtaking and unnecessary hard braking. Our results highlight viewing-angle variation as a new attack surface for autonomous driving systems and demonstrate the importance of evaluating security beyond single-frame perception robustness.
References [1] Baidu Apollo. https://apollo.baidu.com/, 2022. [2] Nvidia-alpamayo. https://www.nvidia.cn/solutions/autonomous-vehicles/alpamayo/, 2026. [3] Tesla Full Self-Driving. https://www.tesla.com/fsd, 2026. [4] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pages 284–293. PMLR, 2018. [5] Xuyang Bai, Zeyu Hu, Xinge Zhu, Qingqiu Huang, Yilun Chen, Hongbo Fu, and Chiew-Lan Tai. Transfusion: Robust lidar-camera fusion for 3d object detection with transformers. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1090–1099, 2022. [6] Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. [7] Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In 2021 IEEE symposium on security and privacy (SP), pages 176–194. IEEE, 2021. [8] Amirhosein Chahe, Chenan Wang, Abhishek Jeyapratap, Kaidi Xu, and Lifeng Zhou. Dynamic adversarial attacks on autonomous driving systems. In Proceedings of Robotics: Science and Systems, 2024. 9
A PREPRINT - M AY 14, 2026
[9] Xuanyao Chen, Tianyuan Zhang, Yue Wang, Yilun Wang, and Hang Zhao. Futr3d: A unified sensor fusion framework for 3d detection. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 172–181, 2023. [10] Yuanpeng Chen, Hui Song, Wei Tao, ShanHui Mo, Shuang Zhang, Xiao Hua, and TianKun Zhao. Fastbev++: Fast by algorithm, deployable by design. arXiv preprint arXiv:2512.08237, 2025. [11] Yuxiao Chen, Ugo Rosolia, Wyatt Ubellacker, Noel Csomay-Shanklin, and Aaron Ames. Interactive multi-modal motion planning with branch model predictive control. IEEE Robotics and Automation Letters, 2022. [12] Zhiyuan Cheng, Hongjun Choi, Shiwei Feng, James Liang, Guanhong Tao, Dongfang Liu, Michael Zuzak, and Xiangyu Zhang. Fusion is not enough: Single modal attacks on fusion models for 3d object detection. In International Conference on Learning Representations, volume 2024, pages 23905–23929, 2024. [13] Ping-Han Chiang, Chi-Shen Chan, and Shan-Hung Wu. Adversarial pixel masking: A defense against physical attacks for pre-trained object detectors. In Proceedings of the 29th ACM international conference on multimedia, pages 1856–1865, 2021. [14] Sorin Grigorescu, Bogdan Trasnea, Tiberiu Cocias, and Gigel Macesanu. A survey of deep learning techniques for autonomous driving. Journal of field robotics, 37(3):362–386, 2020. [15] Shengchao Hu, Li Chen, Penghao Wu, Hongyang Li, Junchi Yan, and Dacheng Tao. St-p3: End-to-end visionbased autonomous driving via spatial-temporal feature learning. In European Conference on Computer Vision, 2022. [16] Yihan Hu, Jiazhi Yang, Li Chen, Keyu Li, Chonghao Sima, Xizhou Zhu, Siqi Chai, Senyao Du, Tianwei Lin, Wenhai Wang, Lewei Lu, Xiaosong Jia, Qiang Liu, Jifeng Dai, Yu Qiao, and Hongyang Li. Planning-oriented autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 17853–17862, 2023. [17] Junjie Huang, Guan Huang, Zheng Zhu, Ye Yun, and Dalong Du. Bevdet: High-performance multi-camera 3d object detection in bird-eye-view. arXiv preprint arXiv:2112.11790, 2021. [18] Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L. Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. [19] Xiaoyu Ji, Yushi Cheng, Yuepeng Zhang, Kai Wang, Chen Yan, Wenyuan Xu, and Kevin Fu. Poltergeist: Acoustic adversarial machine learning against cameras and computer vision. In 2021 IEEE Symposium on Security and Privacy (SP), pages 160–175, 2021. [20] Yunhan Jia, Yantao Lu, Junjie Shen, Qi Alfred Chen, Hao Chen, Zhenyu Zhong, and Tao Wei. Fooling detection alone is not enough: Adversarial attack against multiple object tracking. In International Conference on Learning Representations, 2020. [21] Bo Jiang, Shaoyu Chen, Qing Xu, Bencheng Liao, Jiajie Chen, Helong Zhou, Qian Zhang, Wenyu Liu, Chang Huang, and Xinggang Wang. Vad: Vectorized scene representation for efficient autonomous driving. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 8340–8350, 2023. [22] Lihua Jing, Rui Wang, Wenqi Ren, Xin Dong, and Cong Zou. Pad: Patch-agnostic defense against adversarial patch attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24472–24481, 2024. [23] Taeheon Kim, Youngjoon Yu, and Yong Man Ro. Defending physical adversarial attack on object detection via adversarial patch-feature energy. In Proceedings of the 30th ACM International Conference on Multimedia, pages 1905–1913, 2022. [24] Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. International Conference on Learning Representations, 2015. [25] Yingwei Li, Adams Wei Yu, Tianjian Meng, Ben Caine, Jiquan Ngiam, Daiyi Peng, Junyang Shen, Yifeng Lu, Denny Zhou, Quoc V Le, et al. Deepfusion: Lidar-camera deep fusion for multi-modal 3d object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 17182–17191, 2022. [26] Yinhao Li, Zheng Ge, Guanyi Yu, Jinrong Yang, Zengran Wang, Yukang Shi, Jianjian Sun, and Zeming Li. Bevdepth: Acquisition of reliable depth for multi-view 3d object detection. In Proceedings of the AAAI conference on artificial intelligence, pages 1477–1485, 2023. [27] Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chellappa, and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 14973–14982, 2022. 10
A PREPRINT - M AY 14, 2026
[28] Zhijian Liu, Haotian Tang, Alexander Amini, Xinyu Yang, Huizi Mao, Daniela L Rus, and Song Han. Bevfusion: Multi-task multi-sensor fusion with unified bird’s-eye view representation. In 2023 IEEE international conference on robotics and automation (ICRA), pages 2774–2781. IEEE, 2023. [29] Tianrui Lou, Xiaojun Jia, Siyuan Liang, Jiawei Liang, Ming Zhang, Yanjun Xiao, and Xiaochun Cao. 3d gaussian splatting driven multi-view robust physical adversarial camouflage generation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 28752–28762, 2025. [30] Yang Lou, Yi Zhu, Qun Song, Rui Tan, Chunming Qiao, Wei-Bin Lee, and Jianping Wang. A first {PhysicalWorld} trajectory prediction attack via {LiDAR-induced} deceptions in autonomous driving. In 33rd USENIX Security Symposium (USENIX Security 24), pages 6291–6308, 2024. [31] Chen Ma, Ningfei Wang, Qi Alfred Chen, and Chao Shen. Wip: Towards the practicality of the adversarial attack on object tracking in autonomous driving. In ISOC Symposium on Vehicle Security and Privacy, 2023. [32] Chen Ma, Ningfei Wang, Zhengyu Zhao, Qian Wang, Qi Alfred Chen, and Chao Shen. Controlloc: Physical-world hijacking attack on camera-based perception in autonomous driving. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 738–752, 2025. [33] Yanmao Man, Ming Li, and Ryan Gerdes. Ghostimage: Remote perception domain attacks against camera-based image classification systems. In Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (USENIX RAID 2020), 2020. [34] Yanmao Man, Raymond Muller, Ming Li, Z Berkay Celik, and Ryan Gerdes. That person moves like a car: Misclassification attack detection for autonomous systems using spatiotemporal consistency. In 32nd USENIX Security Symposium, pages 6929–6946, 2023. [35] Jiageng Mao, Shaoshuai Shi, Xiaogang Wang, and Hongsheng Li. 3d object detection for autonomous driving: A comprehensive survey. International Journal of Computer Vision, 131(8):1909–1963, 2023. [36] Raymond Muller, Yanmao Man, Z Berkay Celik, Ming Li, and Ryan Gerdes. Physical hijacking attacks against object trackers. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2309–2322, 2022. [37] Raymond Muller, Ruoyu Song, Chenyi Wang, Yuxia Zhan, Jean-Phillipe Monteuuis, Yanmao Man, Ming Li, Ryan Gerdes, Jonathan Petit, and Z. Berkay Celik. Investigating physical latency attacks against camera-based perception. In 2025 IEEE Symposium on Security and Privacy (SP), pages 4588–4605, 2025. [38] Ben Nassi, Yisroel Mirsky, Dudi Nassi, Raz Ben-Netanel, Oleg Drokin, and Yuval Elovici. Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, page 293–308, 2020. [39] Daniel Omeiza, Helena Webb, Marina Jirotka, and Lars Kunze. Explanations in autonomous driving: A survey. IEEE Transactions on Intelligent Transportation Systems, 23(8):10142–10162, 2021. [40] Nikhila Ravi, Valentin Gabeur, Yuan-Ting Hu, Ronghang Hu, Chaitanya Ryali, Tengyu Ma, Haitham Khedr, Roman Rädle, Chloe Rolland, Laura Gustafson, Eric Mintun, Junting Pan, Kalyan Vasudev Alwala, Nicolas Carion, Chao-Yuan Wu, Ross Girshick, Piotr Dollar, and Christoph Feichtenhofer. Sam 2: Segment anything in images and videos. In International Conference on Learning Representations, pages 28085–28128, 2025. [41] Nikhila Ravi, Jeremy Reizenstein, David Novotny, Taylor Gordon, Wan-Yen Lo, Justin Johnson, and Georgia Gkioxari. Accelerating 3d deep learning with pytorch3d. arXiv preprint arXiv:2007.08501, 2020. [42] Tim Salzmann, Boris Ivanovic, Punarjay Chakravarty, and Marco Pavone. Trajectron++: Dynamically-feasible trajectory forecasting with heterogeneous data. In European Conference on Computer Vision (ECCV), 2020. [43] Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Harashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. Dta: Physical camouflage attacks using differentiable transformation network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15305– 15314, 2022. [44] Naufal Suryanto, Yongsu Kim, Harashta Tatimma Larasati, Hyoeun Kang, Thi-Thu-Huong Le, Yoonyoung Hong, Hunmin Yang, Se-Yoon Oh, and Howon Kim. Active: Towards highly transferable 3d physical camouflage for universal and robust vehicle evasion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4305–4314, 2023. [45] Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Proceedings of the AAAI conference on artificial intelligence, pages 2414–2422, 2022. 11
A PREPRINT - M AY 14, 2026
[46] Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8565–8574, 2021. [47] Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, and Qi Alfred Chen. Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4412–4423, 2023. [48] Xinshuo Weng, Jianren Wang, David Held, and Kris Kitani. 3d multi-object tracking: A baseline and new evaluation metrics. IEEE/RSJ International Conference on Intelligent Robots and Systems, 2020. [49] Moritz Werling, Julius Ziegler, Sören Kammel, and Sebastian Thrun. Optimal trajectory generation for dynamic street scenarios in a frenet frame. In 2010 IEEE international conference on robotics and automation, pages 987–993. IEEE, 2010. [50] Yi Yu, Weizhen Han, Libing Wu, Bingyi Liu, Enshu Wang, and Zhuangzhuang Zhang. Enduring, efficient and robust trajectory prediction attack in autonomous driving via optimization-driven multi-frame perturbation framework. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 17229–17238, 2025. [51] Zhiyuan Yu, Ao Li, Ruoyao Wen, Yijia Chen, and Ning Zhang. Physense: Defending physically realizable attacks for autonomous systems via consistency reasoning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, page 3853–3867, 2024. [52] Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15159–15168, 2022. [53] Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In International Conference on Learning Representations, 2019. [54] Xingyi Zhou, Vladlen Koltun, and Philipp Krähenbühl. Tracking objects as points. European Conference on Computer Vision, 2020. [55] Zikang Zhou, Luyao Ye, Jianping Wang, Kui Wu, and Kejie Lu. Hivt: Hierarchical vector transformer for multi-agent motion prediction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022. [56] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: A triggered physical adversarial patch. In 32nd USENIX Security Symposium, pages 661–678, 2023.
12
A PREPRINT - M AY 14, 2026
A
Additional Case Study
In addition to the hard-braking case in the main text, we provide an additional case study of abandoned overtaking in Fig. 7. In the clean scene, the ego vehicle is planning to overtake the target vehicle and continue along the original driving region. Under attack, the induced 3D bbox displacement increases across frames with d1 /d2 /d3 = 0.42/0.77/1.16 m, shifting the predicted target trajectory closer to the ego driving region and reducing the MTD to 0.05 m, with an APE of 2.80 m. Consequently, the victim AV abandons the overtaking maneuver.
Figure 7: Additional case study of abandoned overtaking. In the clean scene, the target vehicle is preparing to turn right, and the ego vehicle plans to overtake it. Under attack, the induced 3D bbox displacement makes the victim AV perceive the target vehicle as drifting left toward the ego driving region, reducing the clearance required for overtaking and causing the planner to abandon the original overtaking maneuver. Left: camera-view observations, including three consecutive frames; Right: the resulted BEV prediction and planning results.
13