arXiv CSopen access

Adversarial Trust Poisoning in Vehicular Collaborative Perception

Adversarial Trust Poisoning in Vehicular Collaborative Perception Yutong Liu

Chenyi Wang

Ming F. Li

Qingzhao Zhang

arXiv:2605.22122v1 [cs.CR] 21 May 2026

ECE Department, The University of Arizona, Tucson, AZ {yutongl, chenyiw, lim, qzzhang}@arizona.edu

Abstract—Collaborative perception (CP) enables connected and autonomous vehicles to share sensor data and jointly reason about their environment. To defend against adversaries that fabricate or manipulate shared data, existing systems employ cross-vehicle inconsistency detection and trust estimation, penalizing vehicles whose observations conflict with the majority. In this work, we show that these defenses themselves introduce a new attack surface. We present TrustFlip, a novel attack that weaponizes consistency-based defenses to poison the trust assigned to benign vehicles. Instead of injecting false data into the collaboration pipeline, it deploys physical adversarial objects that are genuine but induce inconsistent observations among benign vehicles. The resulting inconsistencies are misattributed by the defense to the targeted vehicle, causing its trust score to degrade and eventually leading to its downweighting or exclusion from collaboration. Consequently, the system loses reliable sensing contributors, degrading perception capability and potentially inducing safety-critical failures. We evaluate TrustFlip across multiple collaborative perception architectures and defense mechanisms. Our results show that state-of-the-art defenses can be significantly affected: the attack removes the targeted benign vehicle from collaboration in up to 87.7% of scenarios and drops Average Precision (AP) by up to 13%. As an initial mitigation, we introduce TrustReflect, a lightweight selfreflection mechanism that marks disputed regions as uncertain and excludes them from trust evaluation, reducing the attack success rate by 35-100%.

I. I NTRODUCTION Connected and Autonomous Vehicles (CAVs) are transforming transportation through enhanced intelligence and cooperation [1]. Collaborative perception (CP) is a representative application in which vehicles and roadside infrastructure share perception data (raw sensor measurements, intermediate neural features such as bird’s-eye-view feature maps, or final detection outputs such as bounding boxes) to jointly perceive the environment. Prior work shows that such collaboration substantially improves sensing range and reliability over singlevehicle perception, especially for blind spots and challenging objects [2], [3], [4], [5], [6]. However, CP systems are vulnerable to data fabrication attacks, where a compromised participant shares falsified information that spoofs, removes, or perturbs objects [7], [8], [9], [10], [11], [12], [13]. To mitigate such threats, existing defenses employ anomaly detection, trust estimation, and recovery mechanisms built around cross-agent consistency. The intuition is that fabricated data will conflict with observations from the majority of benign vehicles [14], [8], [15], [9]. ROBOSAC [14] and CAD [8] flag vehicles whose shared data

Adversarial object placement

(i) Attached to car controlled by attacker

False alarm in CP defense

Adversarial object is optimized for being viewed differently from different angles

Victim vehicle cannot detect the adversarial object

Other vehicles can detect the adversarial object

(ii) Towed by an attacker’s truck Safety-critical CP degradation Missed detections because of the lack of the victim’s data

Victim vehicle is wrongly labeled as not trustworthy; its data contribution is removed

Fig. 1: Demonstration of TrustFlip. (1) The attacker deploys a physical adversarial object optimized to evade detection from a specific viewing angle. (2) A victim vehicle at that angle perceives the object inconsistently with other benign vehicles. (3) The CP defense misclassifies the victim as untrustworthy, excludes its data from fusion, and consequently degrades perception safety, such as by missing critical objects.

(bounding boxes or occupancy maps) fall out of consensus; CP-Guard+ [16] and LUCIA [9] analyze shared intermediate features to identify feature-level deviations from a trusted ego or the majority of vehicles; MADE [15] compares shared features against an ego-only reconstruction and flags outliers; and MATE [17] observes object tracking level inconsistencies and assigns probabilistic trust scores via a Bayesian framework. Although effective against direct data fabrication, consistency-based defenses introduce a new attack surface that we term adversarial trust poisoning. The key insight is that these defenses cannot distinguish whether a cross-view inconsistency originates from a malicious vehicle or from an externally induced physical effect. As a result, any attacker capable of intentionally creating inconsistent observations among benign vehicles can weaponize the defense itself to suppress benign contributors. We instantiate this attack as TrustFlip, which realizes adversarial trust poisoning using a physical adversarial object. Compared with alternatives such as LiDAR spoofing [18] or jamming [19], physical objects are passive, persistent, and practical to deploy in real traffic. They require no signalinjection hardware, synchronization, or vehicle compromise, yet can consistently produce viewpoint-dependent LiDAR observations across multiple frames. Concretely, as shown in Figure 1, the attacker can place a single object so that one designated benign CAV (the victim) observes it from a viewpoint that induces corrupted perception, while surrounding

benign CAVs observe normal returns. The resulting disagreement causes the victim’s shared outputs to conflict with the majority. Consistency-based defenses therefore misattribute the inconsistency to the victim and downweight or exclude its contribution, degrading collaborative perception in regions where the victim provides critical sensing coverage. Realizing TrustFlip is non-trivial because the attack must simultaneously create viewpoint-dependent perception discrepancies and ensure that the resulting inconsistencies propagate through downstream defense logic to selectively penalize the victim. Naively optimizing a generic 3D mesh is ineffective, as the objectives for suppressing detection from the victim’s viewpoint while preserving normal observations from other viewpoints often conflict on shared object geometry. TrustFlip addresses this challenge through a viewconditioned optimization pipeline built on three physically motivated shape initializations: F ROM R EAL, which perturbs a realistic vehicle mesh; ATTACHED, which augments a normal vehicle with an attached structure; and H OLLOW, a standalone hollow geometry designed to induce asymmetric LiDAR returns. These initializations bias the optimization toward asymmetric multi-view perception outcomes while maintaining physical realizability. The optimization further incorporates defense-aware objectives and geometric constraints to preserve shape naturalness, LiDAR stability, and robustness across sensing conditions. Beyond object optimization, TrustFlip additionally integrates runtime scenario assessment, including victim selection and object placement, to ensure that the induced inconsistencies meaningfully degrade collaborative perception in realistic traffic scenarios. As an initial mitigation, we propose TrustReflect, a self-reflection layer that adds one extra step to any consistencybased defense. Each vehicle runs the deployed defense locally on its own perception output. If the local defense flags the vehicle itself as the malicious agent for a region, the vehicle marks that region as uncertain and emits a per-frame trust mask alongside its shared data, and downstream consumers exclude the masked region when computing trust scores or fusion weights. TrustReflect reuses the deployed defense’s own scoring machinery, so it requires no model retraining and adds only one extra field to the V2X message; however, it does not eliminate the attack surface, since the attack scenarios are not always cleanly separable from benign ones in the defense’s decision space, leaving residual vulnerability and stronger defenses as future work. We evaluate TrustFlip and TrustReflect on the OPV2V benchmark [20] against four state-of-the-art (SOTA) consistency-based defenses (CAD [8], MATE [17], LUCIA [9], MADE [15]) and four CP backbones spanning late fusion (PIXOR [21], PointPillars [22]) and intermediate fusion (Attentive Fusion [20], Where2Comm [23]), and we complement the simulation with real-world LiDAR captures of fabricated prototypes. The results show that TrustFlip reliably induces view-conditioned perception asymmetry, propagates this discrepancy into multiple defense mechanisms, and degrades downstream CP utility under simulated scenario de-

ployment. They also expose a sensitivity-attribution dilemma: defenses that smooth over localized physical discrepancies are less affected by TrustFlip but may miss real singleobject inconsistencies, while defenses sensitive enough to flag such discrepancies become exploitable unless they attribute the source correctly. TrustReflect substantially reduces this attack surface by masking locally disputed regions before trust evaluation, although residual cases show that fully neutralizing adversarial trust poisoning remains open. In summary, our contributions are: • We identify and formalize adversarial trust poisoning: a physical-world attack class where an external object creates cross-view disagreement that causes consistency-based CP defenses to suppress a targeted benign vehicle, without any digital intrusion or V2X interference. • We design TrustFlip, a two-stage attack with three shape priors and defense-aware differentiable optimization, plus operational policies for runtime deployment. • We propose TrustReflect, a self-reflection add-on that lets each benign vehicle re-run the deployed defense locally and mask out the regions it flags, layering on top of CAD, MATE, LUCIA, and MADE without retraining. • We evaluate TrustFlip and TrustReflect on the benchmark dataset OPV2V across four CP backbones and four SOTA defenses, showing up to 88% ASR against CP defenses and up to 13% AP drop, while TrustReflect reduces ASR by 35–100%. • We validate the physical feasibility of TrustFlip through real-world LiDAR captures using physically constructed adversarial object prototypes. II. R ELATED W ORK A. Collaborative Perception (CP) CAVs are equipped with onboard sensors, such as LiDARs and cameras, and wireless communication modules that allow them to exchange perception information through V2V or V2X communication [1], [24], [25]. CP uses this communication capability to overcome the limitations of single-agent perception, including occlusion, restricted sensing range, and sparse long-range point clouds. Although CP can be built on multiple sensing modalities, many representative systems focus on LiDAR or LiDAR-derived bird’s-eye-view (BEV) representations because LiDAR provides accurate 3D geometry for object localization and naturally supports cross-agent spatial alignment. Existing CP systems are commonly categorized by the stage at which information is shared and fused. Early fusion shares raw sensor observations, typically LiDAR point clouds, and aggregates them into a common coordinate frame before detection [24], [25], [26]. This preserves the richest geometric information and can improve detection under occlusion, but it incurs high communication overhead and is sensitive to latency and pose errors. Intermediate fusion lets each agent encode its local observation into neural features, such as BEV feature maps, and then communicates these representations

2

for cross-agent feature aggregation [27], [3], [28], [5], [29], [23], [6]. This design offers a practical trade-off between accuracy and bandwidth, and recent systems further improve robustness through graph reasoning, attention, transformers, spatial confidence maps, and pose-alignment modules [30], [31]. Late fusion shares final perception outputs, such as object bounding boxes, confidence scores, or tracks, and performs object-level association and merging [32], [33]. Late fusion has the lowest communication cost and is compatible with heterogeneous detectors, but it discards dense geometric and feature-level context, making its performance dependent on the quality of local detections and cross-agent association. This taxonomy is important for security analysis because the attack surface and the available defense signals differ substantially across fusion stages: early fusion exposes raw sensor evidence, intermediate fusion exposes learned representations, and late fusion exposes object-level decisions.

Prior work demonstrates that optimizing the 3D geometry of simple or everyday objects (such as traffic cones or vehiclemounted luggage) can induce misclassification or detection failures in LiDAR-based systems [34], [35], [36], [37]. Furthermore, multi-modal attack can simultaneously disrupt visual and geometric features, rendering adversarial objects invisible to both camera and LiDAR-based detectors [35]. One method exploits the spatial vulnerabilities of LiDAR detectors by corrupting the geometric features of the surrounding local context, thereby facilitating an object-agnostic attack that utilizes arbitrary physical shapes as adversarial carriers [38]. However, existing physical attacks typically aim for a universal perception failure across all observers. In contrast, TrustFlip shifts the objective from direct deception to trust poisoning, which requires a new optimization algorithm, to appear and disappear objects conditioned on view angles. III. T HREAT M ODEL

B. Security of Collaborative Perception

A. System Model

Attacks: A primary threat in CP is data fabrication, where malicious participants share crafted sensor data to perturb the perception of victim vehicles [7], [8], [9], [10]. In earlyfusion systems, attackers can utilize black-box ray casting to reconstruct realistic yet malicious LiDAR point clouds that spoof or remove objects. These attacks can be further optimized using offline adversarial object generation and run-time occlusion-aware point sampling to ensure the fabricated data obeys physical laws and bypasses basic anomaly detection. Defenses & Anomaly Detection: To mitigate data fabrication and malicious collaboration in CP, several defenses have been proposed to identify inconsistent shared data or untrusted collaborators. CAD [8] uses fine-grained occupancy maps to validate geometric consistency across vehicles and checks whether final perception results agree with the merged occupancy evidence. MATE [17] targets late-fusion multiagent tracking: it models agent trust and track trust as latent probabilistic states and updates them using trust pseudomeasurements derived from discrepancies between expected visibility and reported tracks. ROBOSAC [14] follows a sampling-based consensus strategy to identify a subset of benign collaborators. For intermediate-fusion CP, MADE [15] detects malicious agents through a semi-supervised multitest framework that combines output-level match loss with feature-level collaborative reconstruction statistics calibrated on benign data. LUCIA [9] further exploits the structure of attention-based fusion by computing lightweight featureconsistency trust scores and using them to modulate each collaborator’s attention contribution. In this work, we evaluate TrustFlip against CAD, MATE, MADE, and LUCIA, covering occupancy-consistency, late-fusion trust estimation, feature-reconstruction anomaly detection, and attention-level trust modulation.

We consider a LiDAR-based CP system operating under intermediate and late fusion paradigms. Each vehicle processes its raw sensor observations locally and shares either compressed neural feature maps (intermediate fusion) or final perception outputs such as 3D bounding boxes and occupancy maps (late fusion) via V2X communication. The ego vehicle aggregates these into a multi-agent scene understanding. We exclude early fusion because transmitting raw LiDAR point clouds incurs prohibitive communication bandwidth and is therefore impractical for real-time V2X deployment [27]. To mitigate data fabrication, the system employs consistency-based defenses that validate cross-agent agreement and down-weight or exclude out-of-consensus contributions. We consider four representative approaches: (1) CAD [8], which enforces occupancy-map consistency; (2) MATE [17], which performs late-fusion Bayesian trust estimation; (3) MADE [15], which detects anomalies at the intermediatefusion stage; and (4) LUCIA [9], which assigns trust scores based on feature-level consistency during intermediate fusion. B. Adversary Model Attack goal: The adversary’s objective is targeted trust poisoning against a designated benign CAV. We define two collaborator roles: • Victim: the benign collaborator whose viewpoint is intentionally made vulnerable and whose shared perception should later be judged suspicious. • Non-victims: benign collaborators that observe the same adversarial object from non-vulnerable angles and provide the apparent consensus evidence The attack succeeds when the victim’s perception diverges from the non-victims’ such that a downstream defense attributes the resulting inconsistency to the victim rather than to the object. Concretely, this divergence manifests as an occupancy conflict, a detection or track disagreement, an intermediate-feature inconsistency, or a defense-specific

C. Physical Adversarial Object Attacks Unlike digital data manipulation, physical adversarial attacks deceive sensors by directly modifying the environment.

3

anomaly-score deviation, depending on the defense interface. In every case, success means the CP system down-weights, excludes, or labels the benign victim as malicious, degrading collaborative perception overall performance and potentially triggering safety hazards because of the degradation.

detector outputs bounding boxes. We define a binary detection indicator: ( 1, if the adversarial object S is detected, D(θ; S) = 0, otherwise.

Capabilities: The adversary introduces a physical adversarial object, an attacker-controlled 3D structure whose geometry and pose induce viewpoint-dependent LiDAR returns. The attacker can precisely control the object’s shape, position, and orientation, and deploy it in realistic ways, such as rigidly mounting it on an attacker-controlled vehicle, towing it as an attached structure, or placing it at feasible roadside locations (e.g., curbs, medians, or construction zones) where it can interact with passing traffic. The adversary may further choose scenarios and victims in which the relative CAV geometry creates asymmetric visibility across agents. Importantly, the attacker does not compromise the victim, inject digital data, or interfere with V2V communication. We focus on physical objects rather than active sensor attacks such as LiDAR spoofing [18] or jamming [19], because adversarial physical objects passive, persistent, and easier to deploy. They require no signal-injection hardware, no synchronization with the target sensor, and no online control. Moreover, they generate contiguous, physically plausible LiDAR evidence over long temporal horizons (e.g., remaining in the victim’s lane on a highway), producing strong, consistent signals that can exploit consistency-based defenses, whereas spoofing attacks rarely sustain such temporally coherent evidence [18].

We partition the viewing angle space into two disjoint sets: Θ = Θv ∪ Θn , where Θv is the vulnerable angle set corresponding to the victim view, and Θn is the non-vulnerable angle set corresponding to non-victim collaborators’ views. Let g(·) denote a CP defense executed by a non-victim ego vehicle, and let Φg (i | θ; S) be the defense-specific suspicion score assigned to collaborator i when the ego observes the scene from a non-victim view θ ∈ Θn . A larger Φg indicates that the collaborator is more suspicious. The trust-poisoning objective is to make the victim v appear more suspicious than every non-victim collaborator n from every non-victim ego view: Φg (v | θ; S) > Φg (n | θ; S),

∀θ ∈ Θn .

For threshold-based defenses, we require the victim to cross the anomaly boundary while non-victims remain below it: Φg (v | θ; S) ≥ τg ,

Φg (n | θ; S) < τg ,

∀θ ∈ Θn ,

where τg is the decision threshold of defense g. A special case arises when the defense signal is detection visibility itself, as in late-fusion defenses that flag a collaborator on bounding-box disagreement (e.g., the disappearance branch of MATE [17]). Here, Φg reduces to the agent-wise detection indicator and the trust-poisoning objective collapses to the angle-specific visibility constraint: ( 0, ∀θ ∈ Θv , D(θ; S) = 1, ∀θ ∈ Θn .

Knowledge: The attacker needs to have 2-phase knowledge. Offline (white-box): The attacker knows the target perception model, defense logic, and decision thresholds. This is realistic because the attacker can join the CP system as a benignlooking participant and directly inspect the perception and defense modules running on their own vehicle. It is also the standard assumption in prior physical adversarial attacks on (collaborative) LiDAR perception [7], [34], [35], [36], [37]. Runtime (environmental): The attacker observes the road layout, approximate CAV positions, and selects a victim and object pose that realize the vulnerable and non-vulnerable viewing angles. All of these are easily obtainable by direct observation. No access to internal model states, V2X messages, or online gradients is required.

That is, the object should disappear from victim angles while remaining visible from non-victim angles under the same perception model. B. Design Challenges and Insights The formulation defines the desired end state but not how a physical object can realize it. We organize the design of TrustFlip around two challenges and their corresponding insights; concrete instantiations are deferred to Section IV-D. Challenge 1: Conflicting view-conditioned objectives. The same 3D object must disappear from victim views and remain detectable from non-victim views, yet both victim and nonvictim often observe overlapping surfaces of the object. As a result, the gradients that suppress detection from Θv and the gradients that preserve detection from Θn act on common vertices in opposite directions. Therefore, applying both losses to a generic mesh tends to cancel out or collapse to a degenerate solution. Figure 2a visualizes this conflict on a closed vehicle prior.

IV. D ESIGN OF T R U S T F L I P A. Problem Formulation We formulate adversarial trust poisoning as a viewconditioned adversarial object optimization problem under CP. The key goal is not only to induce view-specific detection asymmetry, but also to trigger a selective role reversal in the downstream defense: from non-victim ego views, the victim should be judged as malicious while the other collaborators remain normal. Let f (·) denote the LiDAR-based detector used by each agent. Given a point cloud observed from viewing angle θ, the

4

Hidden Detected

Hidden Detected

1.00 1.00 1.00

Init. FromReal

1.00 1.00

1.00 1.00 1.00

1.00

0.30

1.00

1.00

1.00

1.00

1.00 1.00

0.90 0.90 0.90

1.00 1.00 1.00

(a) Real-car prior

Hidden Detected

Init. Hollow

1.00 1.00

1.00 1.00 1.00

0.40

1.00

1.00

1.00

1.00

1.00

1.00 1.00

0.90 0.80 0.90

1.00 1.00 1.00

(b) Hollow prior

1.00 1.00 1.00

Init. Attached

1.00 1.00

1.00 1.00 1.00

1.00 1.00

0.90 0.90 0.90

1.00 1.00 1.00

(c) Attached prior

Fig. 2: Gradient-conflict diagnostics for three shape priors. In each polar plot, the upper semicircle shows the conflict between victim-disappearance and non-victim-retention gradients across viewing angles, while the lower semicircle shows detector confidence over the same angles. The real-car prior exposes strong conflict on shared surfaces; H OLLOW and ATTACHED reduce it by physically biasing one side of the view-conditioned objective.

(a) Hard: non-victim close to victim

(b) Easy: non-victim with distinct view angle

(c) High safety impact: victim’s view is uniquely informative

(d) Low safety impact: nonvictims cover the same regions

Fig. 3: Illustration of Insight 2.3. The attack’s success rate and safety impact are sensitive to the on-road scenarios.

Insight 1.1. Use a shape initialization that physically induces view-conditioned perception discrepancy. A well-chosen initial geometry already satisfies one of the two objectives by construction, reducing the optimizer’s burden to the remaining direction. Two practical priors are (i) a hollow or thin-board structure that lets LiDAR rays pass from the vulnerable angle while presenting an occupied profile from non-vulnerable angles, and (ii) a closed vehicle prior whose rear silhouette can be locally occluded or perturbed without disturbing the side and frontal returns. Figure 2b and 2c shows that these priors largely collapse the gradient conflict by biasing one objective through their initial geometry.

conditioned discrepancy is not sufficient on its own. The attack must also (i) flow through the specific defense’s decision logic so the inconsistency is attributed to the victim, (ii) yield a physically realizable shape that survives fabrication and real LiDAR sampling, and (iii) be deployed in a scenario where excluding the victim actually degrades CP utility. Insight 2.1. Integrate the defense mechanism into the optimization by making it differentiable, so the loss reflects the defense’s actual decision rule. When the defense decision is driven by detection visibility (e.g., the late-fusion boundingbox consistency in MATE [17]), the visibility-constraint formulation in Section IV-A already suffices. When the decision operates on intermediate features or reconstruction statistics (LUCIA [9], MADE [15]), TrustFlip differentiates the relevant suspicion-score branches and optimizes them directly from non-victim ego views. Insight 2.2. Mesh complexity, per-vertex perturbation bounds, and smoothness regularization jointly control physical realizability. The vertex count of the initial mesh sets the spatial frequency of expressible perturbations, per-vertex displacement bounds prevent extreme deformation, and Laplacian smoothing penalizes high-frequency artifacts that arise only in the differentiable surrogate. Together these knobs keep the optimized geometry fabricable and stable under real LiDAR sampling. Insight 2.3. Select scenarios where CP performance is sensitive to the victim’s contribution. Both attack feasibility and safety impact depend on scene geometry. Relative CAV positions and host-vehicle silhouettes determine whether the vulnerable angle Θv is reliably realized. When a non-victim CAV is close to the victim, the two share similar viewing angles and produce more consistent perceptions, making the attack harder; when a non-victim has a distinct view angle, asymmetric LiDAR returns are easier to induce. Separately, the victim’s unique sensing coverage (e.g., regions only it

Insight 1.2. Object optimization is a multi-parameter trade-off among effectiveness, robustness, and stealthiness. The relevant parameters are (1) the size of the vulnerable angle Θv , (2) the size of the non-vulnerable angle Θn , (3) the area of the object that is allowed to be perturbed, and (4) the pervertex perturbation bound. A narrow Θv paired with a wide Θn maximizes perception asymmetry, but Θv cannot be too narrow without losing reliability against victim-pose error, and pushing the angle gap too far amplifies the gradient conflict of Challenge 1 at training time. A larger perturbation area or bound improves attack effectiveness, yet it produces unrealistic shapes that are visibly anomalous to non-victims, and it overfits to the differentiable surrogate, hurting robustness on the deployed perception pipeline. Combining the two insights, TrustFlip couples a physically biased shape initialization with constrained optimization: the initialization resolves one of the conflicting objectives by construction, and the optimizer is restricted (via vertex masks, per-vertex displacement bounds, and conservative angle ranges) to refine the remaining objective without destroying the initialization or producing unrealistic geometry. We empirically study the resulting parameter trade-offs in Section V-C4. Challenge 2: Realistic deployment beyond view discrepancy. An optimized object that creates the desired view-

5

TrustFlip – Offline Shape Optimization

and hit the ground, while rays from Θn strike the side boards and form an occupied car-like profile. Among the three, H OLLOW is the only prior that produces a free-versus-occupied cross-agent conflict, which is required by occupancy-map defenses such as CAD [8]. Closed priors keep the victim’s occupancy map occupied. The three priors also differ in stealthiness. ATTACHED is the most stealthy: the adversarial component is small, largely occluded by the host vehicle from non-victim views, and still plausible from the victim view because objects attached to a trunk or carried behind a vehicle are common in traffic. F ROM R EAL is less stealthy because its own body is perturbed, but non-victims still observe a partial or complete car-shaped object. H OLLOW is the least stealthy: although it creates the strongest free-versus-occupied conflict, its shape is distinctive and easier to notice outside the perception pipeline. Defense-specific adversarial loss: For defenses whose decision is driven by per-agent visibility (the late-fusion detectionconsistency special case in Section IV-A), TrustFlip uses a view-conditioned detector-confidence loss with ℓhide (c) = − log(1 − c) on victim views and ℓshow (c) = − log(c) on non-victim views, combined as

Online Deployment

Shape Priors FromReal

Attached

Synthetic Training Data Optimization

Vertices Updates

Hollow

Ray Casting

Sensor Data

Loss Function & Constraints

Perception & Defense

Scenario Assessment –Easy to succeed? –High safety impact? Adversarial Object Placement

TrustReflect as Attack Mitigation Self-Reflection Victim: I have inconsistent result from others on the suspicious region

Regional Masking Victim: I am not certain about the suspicious region

Other vehicles do not count that region for victim’s trustworthiness

Fig. 4: Overview of TrustFlip and TrustReflect.

can observe) determines how much downstream perception is lost when the victim is excluded. The attacker therefore assesses the scenario, picks road segments and timings where collaboration is most informative, and aligns victim/object geometry to those moments. Figure 3 illustrates both attack difficulty and safety impact.

Lvis = α Eθ∈Θv ℓhide (cθ ) + β Eθ∈Θn ℓshow (cθ ), C. Attack Overview

where parameters (α, β) depends on the shape prior that will be introduced later in “shape-prior-specific weight setting”. For defenses that aggregate intermediate features or reconstruction statistics (Insight 2.1), the adversarial loss optimizes a defense-specific suspicion margin from non-victim ego views. LUCIA [9]. The post-softmax trust score normalizes away gradient magnitude, so TrustFlip optimizes the raw presoftmax inconsistency on the target-local feature region. Let (θ) (θ) sv and sn denote the inconsistency scores assigned by LUCIA to the victim and to a peer non-victim collaborator under non-victim ego view θ:
1 X (θ) wn s(θ) . ℓLUCIA = n − wv sv |Θn |

Following Section IV-B, the attack proceeds in two stages (Figure 4). The offline stage (Section IV-D) solves a constrained mesh-optimization problem that produces a physical adversarial object whose geometry simultaneously realizes the shape prior of Insight 1.1, the differentiable defense objective of Insight 2.1, and the realizability constraints of Insight 2.2. The online stage (Section IV-E) selects a scenario, a victim, and an object pose that realize the trained vulnerable and nonvulnerable view sets at runtime, following Insight 2.3. The runtime attack is purely physical and requires no digital intrusion. As mitigation, Section IV-F introduces TrustReflect, a lightweight and defense-compatible self-reflection layer that reuses each deployed defense’s own mechanism and adds only a trust-mask field to V2X messages, allowing the same integration pattern to layer on CAD, MATE, LUCIA, and MADE without retraining.

θ∈Θn

MADE [15]. Let ŝk be MADE’s normalized suspicion score for inspected collaborator k (instantiated by its reconstruction score, or the weighted match+reconstruction combination). With V and N denoting the inspection sets in which the victim and a non-victim peer is inspected, respectively: 1 X 1 X ŝk + β ŝk . ℓMADE = − |V| |N |

D. Offline Shape Optimization Shape priors: Following Insight 1.1, we instantiate three shape priors with different physical biases (Figure 4): • F ROM R EAL : a normal car mesh whose deformation is confined to a vertex mask. Non-victim views retain the benign vehicle prior, while the rear surface can be perturbed to suppress victim-view detection. • ATTACHED : a small planar occluder mounted on the trunk of a normal host vehicle. Non-victims still observe the unmodified host vehicle, while the rear silhouette is locally distorted by the occluder. • H OLLOW : a standalone structure of two parallel thin boards with a hollow center. Rays from Θv pass through the gap

k∈V

k∈N

We do not define a separate gradient objective for CAD [8], which reacts to the free-versus-occupied conflict produced by the H OLLOW geometry, or for MATE [17], whose track-level decision is already driven by the visibility loss Lvis . Shape-prior-specific weight setting: The visibility loss above is shared across visibility-driven defenses, but the loss-weight choice (α, β) depends on which side of the conflict the shape prior already resolves (Insight 1.1):

6

Algorithm 1: TrustFlip offline mesh optimization.

Algorithm 2: TrustFlip online deployment.

Input: initial mesh (V0 , F); views Sv , Sn ; task loss Ltask ∈ {Lvis , ℓLUCIA , ℓMADE }; shape constraint C; smoothness weight λ; learning rate η; epochs E. Output: optimized mesh (V, F). 1: V ← V0 2: for epoch = 1, . . . , E do 3: L ← Ltask (V, F, Sv , Sn ) + λ LaplacianSmooth(V, F) 4: V ← V − η ∇V L ▷ gradient descent step 5: V ← ProjC (V) ▷ shape-constraint projection 6: end for 7: return (V, F)

Input: candidate scenarios Σ (road segments + time windows), public HD map, observable CAV poses {xc }, optimized mesh S. Output: chosen scenario σ ∗ , victim v ∗ , object pose p∗ . 1: Scenario assessment:   σ ∗ ← arg maxσ∈Σ ωo O(σ) + ωc |C(σ)| where O(σ) is the occlusion density and |C(σ)| is the CAV count. 2: Object pose: pick towable pose p∗ in σ ∗ aligning the rear cone of S with the dominant traffic heading. 3: Victim selection:   v ∗ ← arg maxc∈C(σ∗ ) ⊮{∠(c, p∗ ) ∈ Θv } · R(c) ′ ∗ ′ ∗ subject to ∃ c ̸= v : ∠(c , p ) ∈ Θn , where R(c) is c’s estimated unique sensing coverage (pixels visible only to c). 4: return (σ ∗ , v ∗ , p∗ )

F ROM R EAL: (α, β) = (1, 0) on a vertex mask. The closed car prior already supports non-victim detection, so only the victim-disappearance loss is active. • ATTACHED : (α, β) = (1, 0). The host vehicle’s body provides the non-victim returns, and the optimizer concentrates on the planar occluder that suppresses the rear silhouette. • H OLLOW : (α, β) = (0, 1). The hollow geometry already eliminates victim-view returns, so the optimizer reinforces non-victim visibility on the side boards. •

Parameter selection: The vulnerable angle Θv is set to a narrow cone (e.g., 5◦ ) directly behind the object, modeling a realistic same-lane towing geometry; Θn is its complement on the surrounding hemisphere. Insight 1.2 captures the operative trade-offs: a narrower Θv paired with a wider Θn improves perception asymmetry but reduces robustness to victim-pose error and amplifies the gradient conflict, while larger displacement bounds increase ASR but hurt non-victim plausibility. We use a single set of defaults for Θv , Θn , the perturbed area, the displacement bound, and λ (Section V-A4). Their sensitivity is studied in Section V-C4.

Constraints and smoothness: Per Insight 2.2, each shape prior carries a constraint set C that confines optimization to a fabricable, sensor-stable region: • F ROM R EAL : optimization is restricted to a vertex mask M, with a global size bound bs on the mesh extent. • ATTACHED : a translation bound bt on the mounted occluder, plus a size bound bs on its mesh extent. • H OLLOW : a per-vertex displacement bound bv on V −V0 , preserving the parallel-board pattern of the initialization. On C we add a Laplacian smoothness penalty Llap = P top of 2 ∥δ ∥ , where δi is the offset from each vertex to its onei 2 i ring centroid, to suppress high-frequency artifacts that exist only in the differentiable surrogate.

E. Online Deployment Algorithm 2 formalizes the three operational steps the attacker runs at deployment time. Each step uses only public map data and externally observable CAV poses. No V2X messages are intercepted. Step 1: Scenario assessment: The attacker scores each candidate by the linear combination ωo O + ωc |C|. High occlusion density makes the victim’s view harder for non-victims to corroborate, so excluding it changes the fused result. High CAV count amplifies trust-system reactivity. Both factors are computable from public sources (HD maps for O, traffic-feed or roadside-observed poses for |C|). Step 2: Victim selection: Among CAVs in σ ∗ , the indicator I{∠(c, p∗ ) ∈ Θv } enforces that the victim sees the object from the predefined vulnerable cone, and R(c) promotes CAVs whose sensing coverage is uniquely informative (so excluding them costs the most CP utility). The non-victim feasibility constraint guarantees corroborating evidence exists. Step 3: Object placement and trajectory control: For F ROM R EAL and H OLLOW, the attacker tows the object behind an attacker-driven vehicle in the victim’s lane, maintaining a longitudinal gap consistent with the predefined Θv cone. For ATTACHED, the structure is mounted on the rear of an attacker-driven vehicle ahead of the victim; the host vehicle itself supplies the benign non-victim returns from adjacent lanes. The attacker adapts speed and lane position frame by frame to keep v ∗ inside Θv and the non-victims inside Θn . A

Differentiable surrogates: LiDAR detectors contain nondifferentiable preprocessing. During training, TrustFlip replaces hard BEV grid or pillar discretizations with smooth point-to-cell assignment and approximates other nondifferentiable components. Surrogates are used only for gradient computation; the final adversarial object is evaluated against the original perception and defense pipelines (Section V-A4). Optimization views: Offline optimization samples representative views Sv ⊂ Θv and Sn ⊂ Θn rather than full traffic scenes. These views isolate the adversarial object with local ground support so that gradients focus on object geometry and view-conditioned discrepancy, while final evaluation is performed in complete CP scenes with the original perception and defense pipelines. Optimization algorithm: Algorithm 1 unifies the offline optimization across shape priors and defense targets. The pipeline differs only in the task loss Ltask and the constraint projection ProjC , both of which are detailed in the preceding paragraphs.

7

frame that momentarily violates the angle conditions does not invalidate the attack, since consistency-based defenses react to repeated cross-view inconsistency. A moderate fraction of valid frames within a temporal trust window (e.g., MATE’s 10-frame window, Section V-C1) suffices to drive the victim’s trust below the threshold.

V. E VALUATION A. Experiment Setup 1) Data Collection: We evaluate TrustFlip using both simulated traffic scenarios and real-world LiDAR captures. Benchmark dataset: We build our benchmark using OPV2V [20], a large-scale collaborative perception dataset containing 430 traffic scenarios, each represented as a 10frame sequence with 2–5 collaborating CAVs and one randomly designated victim selected from these CAVs. To preserve realistic traffic layouts, we replace an existing non-collaborating vehicle with the adversarial object instead of inserting a new car-size object. The object is placed within 40 m of the victim, rear-facing the victim, and visible to both the victim and at least one non-victim CAV. Victims are random and collaborator geometry is constrained only by visibility, so these test cases precede the attacker’s scenario/victim selection (Section IV-E). This full benchmark reflects realistic non-ideal deployment. The attacker can place the object to satisfy the basic geometric requirements, but cannot always obtain the most favorable victim, collaborator layout, occlusion, or unique victim coverage. High ASR under this protocol therefore shows that TrustFlip does not rely on ideal scenario selection; the critical subsets later quantify the additional impact when favorable scenarios are available. Real-world sensor captures: We collect real-world point clouds for the H OLLOW and ATTACHED prototypes using a Velodyne VLP-32C LiDAR mounted on a stationary test vehicle; all vehicles remain static during capture for safety. For each prototype, we capture rear and side views corresponding to Θv and Θn , respectively. The H OLLOW prototype consists of two parallel rigid composite side panels mounted on a long flatbed trailer, while the ATTACHED prototype is a planar rigid-cardboard occluder mounted on the rear of a benign host vehicle (see Section V-E). 2) Evaluated CP Models: We evaluate 4 CP models: latefusion PIXOR [21] and PointPillars [22], and intermediatefusion Attentive Fusion [20] and Where2comm [23], [20] with a PointPillars backbone. 3) Evaluated CP Defenses: We evaluate CAD [8], MATE [17], LUCIA [9], and MADE [15], following their original settings unless noted. MATE uses a 10-frame trust window and default 5-track setting; LUCIA uses compression ratio (CR) =1; MADE is adapted to OPV2V following its semi-supervised protocol. 4) Implementation Detail: To enable end-to-end optimization, we implement a differentiable LiDAR renderer based on Möller–Trumbore ray tracing [39]. Non-differentiable perception components are approximated using prior differentiable relaxations [40], [35], [41]. Optimization runs for 300 epochs using Adam with learning rate 0.01. We set the vulnerable view cone Θv to 5◦ and sample non-vulnerable views with at least 20◦ angular separation. Loss weights are α = 1, β = 1, and λ = 0.001. The H OLLOW mode constrains per-vertex deformation within 0.1 m, while

Robustness: Real-world variations in distance, heading, ground-plane reflectivity, and partial occlusion are absorbed by the offline training distribution. No per-scene mesh retuning is required at runtime. Deployment is a geometric control task. F. Mitigation: TrustReflect The key observation behind TrustReflect is that the cross-view inconsistency TrustFlip creates is also visible from the victim’s own sensor. If the victim runs the same consistency-based defense locally, the defense will flag a malicious-collaborator-like pattern in the very region the adversarial object occupies. TrustReflect adds a single self-reflection edge to the V2X protocol (Figure 4): each benign vehicle re-runs the deployed defense’s scoring rule against its own perception output and, if the local score crosses the malicious-collaborator threshold, treats that region as suspicious and uncertain. The vehicle then (i) localizes the suspicious region using the defense’s own predictionor feature-level output, (ii) attaches a per-frame trust mask declaring that region uncertain to its shared data, and (iii) downstream consumers exclude the masked region from their trust scores or fusion weights. The reflection can leverage the existing defenses without training new models. A malicious vehicle cannot exploit TrustReflect for data fabrication. Although the attacker may mark the attacked region as uncertain to avoid trust-score degradation, the fabricated data from that region is also excluded from fusion and therefore has no effect. Region selection and masking are defense-specific: • CAD [8]: the reflection compares the ego’s occupancy map with a single-vehicle baseline; cells where the ego’s own occupancy disagrees with the baseline form the trust mask, and CAD’s cross-agent occupancy check ignores those cells. • MATE [17]: the reflection compares its ego-view predicted tracks with aggregated tracks; tracks for which the ego’s reported visibility is inconsistent with the aggregator are excluded from the pseudomeasurement update. • LUCIA [9]: the reflection computes the ego’s intermediatefeature consistency against an ego-only feature reconstruction; inconsistent BEV cells form the mask, and LUCIA recomputes its trust score on the unmasked feature region. • MADE [15]: the reflection runs MADE’s reconstruction branch on the ego’s own feature; cells with high ego-side reconstruction error are added to the mask, and the following reconstruction losses are computed on the unmasked subset. In each case, the mask emerges from the same scoring machinery the defense already uses on peers, so TrustReflect layers on top of the existing defenses without retraining.

8

ATTACHED constrains translation and mesh size to preserve stealthiness. LiDAR simulation follows OPV2V specifications (64-channel, 70 m range). For scenario-sensitivity analysis, we construct two 50scenario critical subsets: an ASR-oriented subset favoring stronger cross-view inconsistency, and an AP-oriented subset favoring larger unique victim contribution. All main results still report the full benchmark. More implementation details are in Appendix A. 5) Evaluation Metrics: We report two metric families: attack success rate (ASR), which captures whether TrustFlip successfully causes perception discrepancies or false alarms in CP defenses, and average precision (AP), which captures the eventual downstream perception utility. Each ASR is the fraction of valid frames (or 10-frame trajectories, where indicated) that satisfy the corresponding success condition. We use the names below consistently throughout the paper. Perception ASR: For an ego view, let IoU∗ be the maximum IoU between the target object’s ground-truth box and any predicted box. The attack requires both: ∗ • Victim-view ASR: fraction of frames with IoU = 0 from the victim’s ego view (the victim does not detect the target). ∗ • Non-victim-view ASR: fraction of frames with IoU > 0 from at least one non-victim ego view (the target is still detected by a benign collaborator).

(a) F ROM R EAL adv.

(b) ATTACHED adv.

(c) H OLLOW adv.

Fig. 5: Visualization of adversarial objects optimized on PointPillars late fusion: F ROM R EAL, ATTACHED, and H OLLOW. The top row shows the back view; the bottom row shows the oblique top-side view. ”adv.” denotes adversarial.

We optimize the adversarial objects from three shape priors and adapt to different CP defenses. The visualization of some optimized shapes are shown in Figure 5. View-conditioned asymmetry survives fusion across all CP models. Table I reports victim-view and non-victim-view ASR on the target object across the four backbones, both before fusion and after the relevant fusion stage. For all three shape priors, victim-view ASR rises sharply above the benign baseline, while non-victim-view ASR stays close to it. The object is therefore not merely harder to detect globally; it is optimized so that different CAVs reach incompatible conclusions about the same physical target. After fusion, the late-fusion victim error remains visible at the box level, and for intermediate fusion, the comparison of w/ victim versus w/o victim shows that including the victim feature actively reduces non-victim fused ASR, while removing it restores non-victim detection. The corrupted victim feature does not just remove evidence; through benign collaboration, it injects misleading evidence into the fused representation of other CAVs, the role reversal at the heart of TrustFlip. The weaker ATTACHED result on PointPillars reflects detector-specific shape tolerance rather than a failure of the attack design: on PIXOR, ATTACHED achieves strong victimview disappearance while preserving non-victim detectability. A plain cuboid is more often treated as vehicle-like by PointPillars than by PIXOR, yielding lower victim-disappearance ASR and higher non-victim-detection ASR (63.56%/41.07% vs. PIXOR’s 81.88%/21.96%). Since ATTACHED only introduces a small rear-mounted occluder while leaving the host vehicle largely intact, PointPillars more readily preserves the vehicle hypothesis from the victim view. Shape initialization is critical for view-conditioned asymmetry. We use cuboids as controlled diagnostics to test whether vertex-level loss scoping alone can induce view-conditioned behavior. The jointly optimized cuboid achieves victim/nonvictim ASRs of 73.19%/37.10%, showing that loss scoping can partially separate the two views. However, its non-victim detectability remains limited, so optimization alone is insufficient. Practical attacks need shape priors that preserve vehiclelike evidence for benign views while suppressing detection

Defense-aware ASR: Each defense exposes a different decision variable, so the success condition is defense-specific: • CAD ASR: a frame succeeds when CAD reports a conflicted occupancy region that spatially matches the adversarial object’s ground-truth region. • MATE ASR: a 10-frame trajectory succeeds when the victim’s final agent trust falls below the track-count-specific threshold after the temporal trust update. • LUCIA ASR: a frame succeeds when, from a non-victim ego view, the victim’s trust score is below 0.1 (the victim contributes less than 10% to fusion). • MADE ASR: a frame succeeds when a non-victim ego marks the victim as the malicious collaborator. Average Precision (AP): AP is computed at the IoU threshold at 0.5 after the corresponding fusion pipeline. Without defenses, AP follows the regular fusion procedure. CAD, LUCIA, and MADE are applied per-frame: CAD and MADE exclude the marked collaborator from the current fusion step, while LUCIA uses the current trust score as the fusion weight. MATE is temporal: its Bayesian agent-trust update accumulates evidence over the 10-frame window, and the resulting trust is used as the fusion weight during that period. No evaluated defense permanently removes a CAV from future collaboration. B. Attack Effectiveness We first evaluate the full benchmark, where victim and collaborator geometries are not optimized for the attacker, and then use critical subsets to quantify the additional impact of favorable scenario selection.

9

TABLE I: IoU-based perception results. For late fusion, Single is the ego-view perception result; Fused is the late-fused perception result. For intermediate fusion, w/o victim removes the victim feature from fusion. Values are in %. Late Fusion PIXOR

Intermediate Fusion

PointPillars

AttFusion

Where2Comm

Mesh

View

Single

Fused

Single

Fused

w/ Victim

w/o Victim

w/ Victim

w/o Victim

Benign

Victim Non-Victim

20.03 71.88

4.00 86.46

9.16 74.55

3.19 87.15

7.53 88.00

– 86.16

19.78 79.84

– 81.40

Adv. F ROM R EAL

Victim Non-Victim

88.50 51.47

30.33 66.98

90.81 61.38

24.44 73.12

34.72 68.88

– 75.67

63.56 51.44

– 59.98

Adv. ATTACHED

Victim Non-Victim

89.59 51.57

31.56 67.02

27.67 67.18

9.47 83.19

12.82 82.48

– 81.98

34.62 66.17

– 71.54

Adv. H OLLOW

Victim Non-Victim

84.68 54.89

22.74 73.01

60.56 63.98

13.09 80.61

23.73 74.73

– 79.55

41.52 67.30

– 73.59

from the victim view. TrustFlip most effectively poisons defenses that react to localized inconsistency. The w/o TrustReflect rows in Table II show two defense regimes. F ROM R EAL is most effective for MATE and MADE, while H OLLOW is most effective for CAD and for LUCIA’s strongest case. MATE, CAD, and MADE expose actionable trust-poisoning surfaces because their decisions react to the localized inconsistency that TrustFlip creates, so the victim can be downweighted or excluded even though it sends no malicious message. LUCIA is different: it has a high benign low-trust baseline and only modest mesh-specific separation for most attacks, except H OLLOW on Where2Comm. We therefore interpret the LUCIA results as limited sensitivity to localized point-cloudstage discrepancies rather than as a strong trust-poisoning surface; Section V-C2 explains this mismatch. Being flagged as an outlier by a defense does not always imply proportional AP loss. We conduct some ideal objectremoval experiments as baselines to calibrate the strongest single-target discrepancy each defense can observe. For MATE, late removal of only the victim’s target prediction yields 98.31% ASR but [email protected] remains 84.45%, showing that MATE ASR measures victim misattribution rather than proportional scene-level utility loss. For MADE, object point cloud removal attack yields 67.43% ASR and 80.44% [email protected], where binary attacker exclusion makes ASR more directly tied to AP. The LUCIA counterpart is discussed in Figure 8b, where object early removal reaches only 41.71% ASR. Scenario selection amplifies both false alarm rise and AP loss. Figure 6 validates Insight 2.3. The full-dataset protocol is intentionally conservative: the victim is random, and nonvictim geometry is constrained mainly by visibility. When cases are selected for larger victim–non-victim view discrepancy and stronger victim contribution to CP utility, the defense-aware ASR rise and AP drop become larger for most model–defense combinations. This shows that TrustFlip is not only a mesh-level effect; its deployment geometry can substantially amplify both false victim attribution and downstream utility loss. The AP drop is bounded by two extreme situations. Table III

reports the two reference points for each fusion model. B E NIGN follows the regular fusion procedure with no collaborator excluded. P ERFECTATTACK removes the victim from collaboration in every frame (i.e., 100% TrustFlip ASR). The AP gap between B ENIGN and P ERFECTATTACK is the upper bound of impact TrustFlip can achieve. C. Defense Analysis and Impacting Factors We isolate how each attack/defense’s internal parameters affect attack effectiveness, and surface the recurring sensitivityversus-attackability trade-off. 1) MATE Effectiveness: We study how MATE’s number of tracks shapes its susceptibility to TrustFlip. MATE [17] is a late-fusion defense that estimates agent trust through Bayesian updates over trust pseudomeasurements (PSMs): matched track pairs between ego agent and aggregator supply positive evidence, while aggregator tracks that should be visible to an agent but are missing from its report supply negative evidence. Track count toggles MATE between absorbing noise and accumulating evidence. We report MATE ASR over observed 1, 3, 5, and 10 tracks. Because MATE’s trust scale grows with the number of matched tracks, the corresponding agent-trust thresholds are set to 0.15, 0.35, 0.40, and 0.45. With more tracks, MATE has more positive PSMs that becomes more robust to negative evidence, but it also has more negative PSMs against a victim disagreeing with non-victims. Figure 7 reveals two competing effects. More tracks supply more positive PSMs from benign matches, raising agent trust and absorbing isolated errors. They also create more visibilityversus-report checks: when TrustFlip repeatedly makes the victim disagree with non-victims on the adversarial object, the victim accumulates negative PSMs and fails to rebuild trust at the same rate as benign agents. The mesh-dependent gap reflects the strength of the physical inconsistency: F ROM R EAL produces the strongest MATE ASR curve, H OLLOW stays above the benign baseline, and ATTACHED is weaker but visible. TrustFlip therefore exploits MATE by turning one localized physical discrepancy into repeated negative trust evidence.

10

TABLE II: Attack results on various CP defenses, w/ and w/o the TrustReflect. Late Fusion PIXOR MATE Mesh

TrustReflect?

ASR

Benign

No Yes

Adv. R EAL

CAD

AP

Intermediate Fusion PointPillars

MATE

AttFusion CAD

AP

LUCIA AP

Where2Comm MADE

ASR

LUCIA

AP

ASR

MADE

ASR

AP

ASR

ASR

AP

ASR

AP

ASR

19.73% 76.98% 14.29% 77.53%

– –

– –

12.93% 87.14% 9.52% 87.00%

– –

– –

31.74% 80.84% 9.89% 87.43% 36.56% 78.64% 9.86% 83.37% 9.42% 82.95% 6.81% 87.51% 10.93% 80.38% 6.34% 83.48%

AP

No Yes

42.86% 73.33% 22.45% 73.57%

– –

– –

87.76% 82.96% 28.57% 83.90%

– –

– –

32.90% 74.82% 52.14% 81.61% 37.03% 76.49% 45.99% 78.11% 9.64% 80.68% 9.17% 83.26% 11.63% 78.15% 11.04% 79.42%

No Adv. ATTACH Yes

42.86% 74.85% 24.49% 74.65%

– –

– –

66.67% 84.81% 15.99% 84.72%

– –

– –

27.11% 79.70% 21.60% 85.34% 34.67% 77.71% 16.78% 81.51% 7.94% 81.74% 11.52% 85.67% 9.83% 79.48% 6.01% 81.88%

No Adv. H OLLOW Yes

42.86% 76.65% 47.65% 64.45% 34.01% 85.12% 50.84% 82.29% 39.09% 79.22% 16.33% 86.72% 57.48% 78.71% 20.88% 81.99% 21.77% 76.90% 0.47% 66.59% 22.45% 84.01% 0.51% 85.46% 8.30% 81.78% 10.46% 86.91% 10.27% 79.54% 8.90% 82.32%

100

ASR Rise (%)

Full cases

Selected cases

80 60 40 20 0 15.0

AP Drop (%)

12.5 10.0 7.5 5.0 2.5 0.0 PIXOR CAD Hollow

PP CAD Hollow

PIXOR MATE Real

PIXOR MATE Hollow

PIXOR MATE Attach

PP MATE Real

PP MATE Hollow

PP MATE Attach

Att. MADE Real

Att. MADE Hollow

Att. MADE Attach

W2C MADE Real

W2C MADE Hollow

W2C MADE Attach

Att. LUCIA Real

Att. LUCIA Hollow

Att. LUCIA Attach

W2C LUCIA Real

W2C LUCIA Hollow

W2C LUCIA Attach

Fig. 6: Effect of scenario selection on outcomes of attack on CP defenses (w/o TrustReflect). Bars compare full-case deltas with selected critical-case deltas, measured as attack–benign ASR (top) and benign–attack AP (bottom). PP, Att., W2C, and Attach denote PointPillars, AttFusion, Where2Comm, and ATTACHED, respectively. TABLE III: Reference AP baselines. B ENIGN uses normal fusion, while P ERFECTATTACK removes the victim from collaboration in all frames. Values are in %. B ENIGN

P ERFECTATTACK

Drop

PIXOR-Late PointPillars-Late PointPillars-Attentive PointPillars-Where2Comm

66.56 85.83 88.60 84.74

61.73 75.44 77.99 75.21

4.83 10.39 10.61 9.53

Victim identification rate

Model

Benign Adv. Real

Adv. Hollow Adv. Attached

1.0 0.8 0.6 0.4 0.2 0.0 1

3

5

10

Number of tracks

Fig. 7: Impact of the number of tracks on MATE.

2) LUCIA Effectiveness: We dissect LUCIA’s compression ratio (CR) and its feature-distance metric to explain its limited response to TrustFlip. LUCIA [9] estimates collaborator trust from intermediatefeature consistency: each agent’s BEV feature AP is averagepooled, normalized, and pairwise L1 inconsistency scores across agents are converted into trust scores. Larger CR dilutes localized inconsistency. The CR sets the spatial granularity at which LUCIA observes feature disagreement: a small CR preserves the object-scale signal, while a large CR averages it with surrounding features,

making LUCIA less sensitive to localized physical attacks like TrustFlip. Figure 8a shows that LUCIA ASR drops as CR grows. TrustFlip perturbs LiDAR evidence only in the local region of the physical object, so larger pooling windows average that signal with nearby unaffected features. Larger CRs therefore improve LUCIA’s robustness to localized physical discrepancies, but only by smoothing away the finegrained inconsistency evidence the defense was designed to

11

Victim lowest Trust < 0.1

Trust < 0.2 Trust < 0.3

encoding, pooling, and normalization. The higher LUCIA ASR on Where2Comm than on AttFusion follows from how spatial compression changes LUCIA’s averaging. Where2Comm communicates features through a confidence-guided spatial mask, so many low-information background cells are suppressed, and the target-object cells occupy a larger fraction of the feature region compared by LUCIA. When the victim misses the object but non-victims retain it, this selection makes the victim/non-victim mismatch less diluted by surrounding road features. AttFusion performs dense attention over the BEV map, so the same object-local discrepancy is averaged with more unaffected context before LUCIA computes its feature distance. 3) Defense Sensitivity Dilemma: We distill the recurring trade-off between defense sensitivity and attackability that emerges from the MATE and LUCIA studies above. Defenses are either insensitive to single-point errors or attackable by TrustFlip. This dilemma appears in both MATE and LUCIA. For MATE, more tracks provide more benign matches that compensate for a single inconsistent track, making the defense less sensitive to localized physical errors and therefore less attackable. However, this also means MATE is less responsive to real single-object physical discrepancies. When the localized inconsistency becomes influential enough, the same trust-update mechanism can misidentify the victim as malicious (Figure 7). For LUCIA, increasing the CR averages features over coarser regions and dilutes the local attack signal; lower compression preserves object-scale inconsistency, but also exposes a stronger trust signal that TrustFlip can poison (Figure 8a). Therefore, failure of TrustFlip against a defense does not necessarily imply strong security. It may indicate that the defense is insensitive to the single-point errors it is expected to detect. Conversely, if a defense is sensitive enough to detect such errors, TrustFlip can exploit that sensitivity unless the defense also performs correct attribution. 4) Vertex Mask Tradeoff: We analyze how the vertex mask, during adversarial object optimization, mediates the gradient conflict between victim and non-victim losses for F ROM R EAL, as mentioned in Section IV. Larger angular separation between the victim and nonvictim view angles reduces gradient conflict of detected and hidden losses. For F ROM R EAL, the vertex mask M determines how much geometry can be changed to hide the object from the victim, but also how much benign geometry may be perturbed from non-victim views. To quantify this tradeoff, we count the vertices in M whose victim-loss and non-victim-loss gradients oppose each other at a non-victim angle θ:  Nconf (θ) = i ∈ M : cos(gvi , gni (θ)) < 0 ,

0.7 0.6

0.4

0.60

0.3

0.45

Rate

Rate

Trust < 0.1

Victim lowest

0.75

0.5

0.2

0.30

0.1 0.15

0.0 1

2

4

8

0.00

Compression ratio

(a) Compression ratio V--N

Benign

Hollow

Adv. Real

Cuboid

Ideal

(b) Idealized visibility discrepancy

N--N

Victim view

Non-victim view

Raw L1 distance

20

Raw L1

15

10

5

16 12 8 4 0

n ig en

0

Ground

Benign

Hollow

Adv. Real

Cuboid

(c) Same object across different views

Gr

-B nd

ou

al

w

llo

o -H

nd

ou

Gr

Fr d-

un

o Gr

id bo

Re

om

Gr

u -C

nd

ou

l ea

ow

oll

H n-

nig

Be

R om

Fr

n-

nig Be

id bo

Cu

n-

nig Be

(d) Different objects under the same view

Fig. 8: Impacting factors and diagnostics for LUCIA.

use. LUCIA is less sensitive to point-cloud-stage object removal. We hypothesize that TrustFlip is limited on LUCIA because LUCIA is less sensitive to localized point-cloudlevel discrepancies than to broad feature-level perturbations. To validate this hypothesis, we replace the victim’s LiDAR points inside the target-object region with ground returns while keeping the object intact for non-victims. This is the strongest physical-disappearance case in our threat model. Figure 8b shows the resulting LUCIA ASR is only moderately above benign and is comparable to H OLLOW and cuboid, while adversarial F ROM R EAL is no more suspicious than the benign car. LUCIA’s trust score is therefore not monotonic in the semantic severity of object disappearance: even perfect victimview removal is attenuated by feature encoding, pooling, and normalization. Raw L1 distance only partially tracks physical visibility. We further investigate the internal mechanism of LUCIA by measuring L1 distance over normalized local feature descriptors in two settings: the same object across victim and nonvictim views, and different objects under the same view. These diagnostics test whether physical visibility changes become feature-space outliers before softmax normalization, which would localize LUCIA’s failure to the post-softmax stage. Figures 8c and 8d show a mismatch between physical visibility and LUCIA’s feature metric. H OLLOW makes the victim observe mostly ground, but it does not produce the largest victim–non-victim feature distance; ordinary viewpoint changes for benign cars or cuboids can be comparable. The ray-level asymmetry is not amplified into a uniquely large cross-agent L1 score, which explains LUCIA’s limited response: the defense was designed for digital feature-level attacks where the collaborator perturbs broad BEV regions [9], whereas TrustFlip perturbs sparse LiDAR returns before feature extraction, and that object-scale effect is diluted by

where gvi and gni (θ) are the gradients on vertex i induced by the victim and non-victim losses. Figure 9 shows that conflict is highest when the nonvictim observes the object from a view close to the victim’s view. Around 20◦ , the count drops sharply as the non-victim leaves the vulnerable cone and shares fewer victim-visible

12

Number of conflicted vertices

50

LiDAR

40 HOLLOW

30 20 10

(a) H OLLOW physical prototype.

0 0

30

60

90

120

150

LiDAR

180

Non-victim view angle from rear (degree)

Fig. 9: Gradient-conflict trend for F ROM R EAL. The y-axis counts mask vertices whose victim and non-victim loss gradients point in opposing directions.

Adversarial Object

(b) ATTACHED physical prototype.

Fig. 10: Deployment details of H OLLOW and ATTACHED.

vertices. Beyond side-view angles, the curve stays low and fluctuates around a small nonzero value because the remaining overlap is mainly on the rooftop surface. This supports the F ROM R EAL design choice in Section IV-D: optimizing a set of localized vertices gives it enough perturbable geometry for disappearance from the victim while limiting conflict with normal detection from other non-victim vehicles. D. Mitigation Effectiveness We evaluate how TrustReflect reduces TrustFlip’s defense-aware ASR and restores AP. TrustReflect reduces victim misattribution and restores AP under defenses which completely exclude the attacker from the collaboration. Table II compares the w/o TrustReflect defense-aware results discussed in Section V-B with the results after w/ TrustReflect applied on each evaluated defense. The ASR and AP differences show that self-reflection suppresses false victim attribution across all evaluated defenses. For CAD and MADE, the effect is direct: both exclude the attacker from collaboration, so preventing the victim from being falsely marked restores its useful contribution and improves AP. For LUCIA, TrustReflect reduces the ASR to a near-benign self-reflection level and improves AP, showing that masking locally inconsistent regions can stabilize featureconsistency weighting even when the original LUCIA signal is not strongly effective. MATE remains the main exception in AP behavior for the same reason discussed in Section V-B: trust is a continuous fusion weight, so AP is not determined solely by whether the victim crosses the ASR threshold.

(a) H OLLOW, rear

(b) H OLLOW, side

(c) ATTACHED, rear

(d) ATTACHED, side

Fig. 11: Real-world LiDAR point clouds of the physical prototypes. Rear views correspond to the vulnerable viewing angle Θv , where the object is designed to suppress detection. Side views correspond to non-vulnerable angles Θn , where the object remains visible as an occupied vehicle-like region.

geometric concepts already manipulate real LiDAR returns as intended, before any gradient-based refinement. The H OLLOW prototype is stabilized by thin support rods whose cross-section is below the angular resolution of typical automotive LiDAR and therefore invisible to the sensor. The ATTACHED prototype is affixed to the rear of a benign host vehicle via an adjustable mounting strut (e.g., an action-camera mount). We process the statically captured frames with a pretrained PointPillars late-fusion model. Figure 11 shows the corresponding real LiDAR returns. The rear views instantiate the vulnerable angle Θv , while the side views instantiate non-vulnerable angles Θn . • H OLLOW : from the victim view, the parallel panels return almost no points, so the car-sized object is effectively invisible in the point cloud and PointPillars detects nothing; from the non-victim view, the side profile reflects a dense

E. Physical Experiment We test prototypes of H OLLOW and ATTACHED on a real LiDAR sensor to validate the physical mechanics of the attack. The deployment is illustrated in Figure 10. Initial prototypes already induce the targeted viewconditioned LiDAR asymmetry. High-fidelity fabrication of the optimized meshes requires industrial-grade manufacturing, so for this study we fabricate only the initial geometries of H OLLOW and ATTACHED and test whether the baseline

13

cluster that PointPillars detects as a vehicle. ATTACHED: from the victim view, the occluder hides the host’s rear geometric features, the resulting point cloud no longer resembles a vehicle, and PointPillars misses the host entirely; from the non-victim view, the occluder’s thin profile is invisible and the host is detected normally. These prototypes do not reproduce the optimized mesh geometry, but they provide sensor-level evidence for the condition required by TrustFlip: the same physical object can produce victim-view disappearance while remaining visible from non-victim views. This supports the feasibility of the free-versus-occupied and visibility inconsistencies evaluated in simulation.

modify, or transmit real V2X communication. No humansubject data or personally identifiable information is collected or analyzed. The physical experiments are limited to sensor-level validation of LiDAR behavior using physically constructed prototypes. These experiments were performed under controlled conditions on a closed and unoccupied road segment. All vehicles remained stationary during data collection, no human participant operated a vehicle during the experiments, and no attack was evaluated in live traffic or against public infrastructure. To reduce misuse risk, we evaluate only research collaborative-perception pipelines and published defenses rather than targeting vendor-specific deployed systems. We additionally present TrustReflect as a mitigation and release artifacts to support reproducible evaluation and future defensive research. We believe that responsible publication is justified because the work identifies a previously underexplored blind spot in consistency-based defenses and highlights the need for more robust trust mechanisms in collaborative perception systems.

•

VI. D ISCUSSION Scope of evaluation: Our study focuses on standard LiDARbased CP backbones on the OPV2V simulated benchmark, complemented by real-world LiDAR captures of fabricated prototypes. Two extensions are deferred to future work: (i) advanced CP architectures spanning different modalities, including camera-LiDAR fusion and other multimodal designs, and (ii) larger-scale real-world experiments with industrially fabricated optimized meshes. Mitigation and limitation: TrustReflect adds a reflection layer that mitigates trust degradation when the inspected data provider is itself benign. However, TrustReflect does not by itself separate benign from malicious scenarios or objects, so the mitigation addresses the symptom rather than the cause. Certified separation between adversarial trust poisoning and benign cross-view inconsistencies remains an open problem.

R EFERENCES [1] U. D. of Transportation, “Connected and Automated Vehicles - Transportation Planning Capacity Building Program — planning.dot.gov,” https://www.planning.dot.gov/planning/topic CVAV.aspx. [2] Y. Han, H. Zhang, H. Li, Y. Jin, C. Lang, and Y. Li, “Collaborative perception in autonomous driving: Methods, datasets, and challenges,” IEEE Intelligent Transportation Systems Magazine, vol. 15, no. 6, pp. 131–151, 2023. [3] T.-H. Wang, S. Manivasagam, M. Liang, B. Yang, W. Zeng, and R. Urtasun, “V2vnet: Vehicle-to-vehicle communication for joint perception and prediction,” in European conference on computer vision. Springer, 2020, pp. 605–621. [4] Y.-C. Liu, J. Tian, N. Glaser, and Z. Kira, “When2com: Multi-agent perception via communication graph grouping,” in Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition, 2020, pp. 4106–4115. [5] R. Xu, H. Xiang, Z. Tu, X. Xia, M.-H. Yang, and J. Ma, “V2x-vit: Vehicle-to-everything cooperative perception with vision transformer,” in European conference on computer vision. Springer, 2022, pp. 107– 124. [6] Q. Zhang, X. Zhang, R. Zhu, F. Bai, M. Naserian, and Z. M. Mao, “Robust real-time multi-vehicle collaboration on asynchronous sensors,” in Proceedings of the 29th Annual International Conference on Mobile Computing and Networking, 2023, pp. 1–15. [7] J. Tu, T. Wang, J. Wang, S. Manivasagam, M. Ren, and R. Urtasun, “Adversarial attacks on multi-agent communication,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7768–7777. [8] Q. Zhang, S. Jin, R. Zhu, J. Sun, X. Zhang, Q. A. Chen, and Z. M. Mao, “On data fabrication in collaborative vehicular perception: Attacks and countermeasures,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 6309–6326. [9] C. Wang, R. Muller, R. Song, J.-P. Monteuuis, J. Petit, Y. Man, R. Gerdes, Z. B. Celik, and M. Li, “From threat to trust: Exploiting attention mechanisms for attacks and defenses in cooperative perception,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 7387–7406. [10] C. Wang, R. Song, R. Muller, J.-P. Monteuuis, Z. B. Celik, J. Petit, R. Gerdes, and M. Li, “CP-FREEZER: Latency attacks against vehicular cooperative perception,” in AAAI Conference on Artificial Intelligence, 2026. [11] Q. Zhang and Z. M. Mao, “Stealthy data fabrication in collaborative vehicular perception,” in Proceedings of the Sixth Workshop on CPS&IoT Security and Privacy, 2024, pp. 142–149.

VII. C ONCLUSION We presented a novel adversarial trust poisoning attack against collaborative perception defenses. By introducing a single physical adversarial object, the attack induces crossview inconsistencies that defenses misattribute to a benign participant, causing the victim to be downweighted or excluded from collaboration without compromising V2X communication or onboard systems. We developed physically grounded attack designs, defense-aware optimization, and runtime attack strategies, and evaluated the attack across collaborative perception models and defenses. We further proposed a selfreflection mitigation that reduces the attack surface. E THICS C ONSIDERATIONS This work studies security risks in collaborative perception and is inherently dual-use, since physical adversarial objects that induce trust-poisoning failures could be misused if deployed in real traffic. We therefore designed the study to minimize risk and focus exclusively on defensive security analysis. Our evaluation is conducted primarily in digital simulation using the OPV2V research platform and open-source collaborative-perception models and defenses. The work does not interact with deployed V2X infrastructure, production vehicles, or public transportation systems, and does not intercept,

14

trade-offs,” in 2019 16th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON). IEEE, 2019, pp. 1–9. [33] S. Shi, J. Cui, Z. Jiang, Z. Yan, G. Xing, J. Niu, and Z. Ouyang, “Vips: Real-time perception fusion for infrastructure-assisted autonomous driving,” in Proceedings of the 28th annual international conference on mobile computing and networking, 2022, pp. 133–146. [34] Y. Cao, C. Xiao, D. Yang, J. Fang, R. Yang, M. Liu, and B. Li, “Adversarial objects against lidar-based autonomous driving systems,” arXiv preprint arXiv:1907.05418, 2019. [35] Y. Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li, “Invisible for both camera and lidar: Security of multisensor fusion based perception in autonomous driving under physicalworld attacks,” in 2021 IEEE symposium on security and privacy (SP). IEEE, 2021, pp. 176–194. [36] J. Tu, M. Ren, S. Manivasagam, M. Liang, B. Yang, R. Du, F. Cheng, and R. Urtasun, “Physically realizable adversarial examples for lidar object detection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 13 716–13 725. [37] S. Zhu, Y. Zhao, K. Chen, B. Wang, H. Ma, and C. Wei, “{AEMorpher}: Improve physical robustness of adversarial objects against {LiDAR-based} detectors via object reconstruction,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 7339–7356. [38] Y. Zhu, C. Miao, T. Zheng, F. Hajiaghajani, L. Su, and C. Qiao, “Can we use arbitrary objects to attack lidar perception in autonomous driving?” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1945–1960. [39] T. Möller and B. Trumbore, “Fast, minimum storage ray/triangle intersection,” in ACM SIGGRAPH 2005 Courses, 2005, pp. 7–es. [40] H. Liu, Y. Wu, Z. Yu, Y. Vorobeychik, and N. Zhang, “Slowlidar: Increasing the latency of lidar-based detection using adversarial examples,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 5146–5155. [41] E. Jang, S. Gu, and B. Poole, “Categorical reparameterization with gumbel-softmax,” arXiv preprint arXiv:1611.01144, 2016.

[12] H. Lin, D. Pan, Q. Xia, H. Wu, C. Wang, S. Shen, and C. Wen, “Pretend benign: A stealthy adversarial attack by exploiting vulnerabilities in cooperative perception,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 19 947–19 956. [13] Q. Zhang, R. Zhang, and Z. M. Mao, “From stealthy data fabrication to unsafe driving: Realistic scenario attacks on collaborative perception,” arXiv preprint arXiv:2605.01301, 2026. [14] Y. Li, Q. Fang, J. Bai, S. Chen, F. Juefei-Xu, and C. Feng, “Among us: Adversarially robust collaborative perception by consensus,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 186–195. [15] Y. Zhao, Z. Xiang, S. Yin, X. Pang, Y. Wang, and S. Chen, “Made: Malicious agent detection for robust multi-agent collaborative perception,” in 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2024, pp. 13 817–13 823. [16] S. Hu, Y. Tao, Z. Fang, G. Xu, Y. Deng, S. Kwong, and Y. Fang, “Cpguard+: A new paradigm for malicious agent detection and defense in collaborative perception,” arXiv preprint arXiv:2502.07807, 2025. [17] R. S. Hallyburton and M. Pajic, “Security-aware sensor fusion with mate: the multi-agent trust estimator,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 2009–2023. [18] Z. Jin, X. Ji, Y. Cheng, B. Yang, C. Yan, and W. Xu, “Pla-lidar: Physical laser attacks against lidar-based 3d object detection in autonomous vehicle,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 1822–1839. [19] J. Petit and S. E. Shladover, “Potential cyberattacks on automated vehicles,” IEEE Transactions on Intelligent transportation systems, vol. 16, no. 2, pp. 546–556, 2014. [20] R. Xu, H. Xiang, X. Xia, X. Han, J. Li, and J. Ma, “Opv2v: An open benchmark dataset and fusion pipeline for perception with vehicle-tovehicle communication,” in 2022 International Conference on Robotics and Automation (ICRA). IEEE, 2022, pp. 2583–2589. [21] B. Yang, W. Luo, and R. Urtasun, “Pixor: Real-time 3d object detection from point clouds,” in Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, 2018, pp. 7652–7660. [22] A. H. Lang, S. Vora, H. Caesar, L. Zhou, J. Yang, and O. Beijbom, “Pointpillars: Fast encoders for object detection from point clouds,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 12 697–12 705. [23] Y. Hu, S. Fang, Z. Lei, Y. Zhong, and S. Chen, “Where2comm: Communication-efficient collaborative perception via spatial confidence maps,” Advances in neural information processing systems, vol. 35, pp. 4874–4886, 2022. [24] Q. Chen, S. Tang, Q. Yang, and S. Fu, “Cooper: Cooperative perception for connected autonomous vehicles based on 3d point clouds,” in 2019 IEEE 39th International Conference on distributed computing systems (ICDCS). IEEE, 2019, pp. 514–524. [25] X. Zhang, A. Zhang, J. Sun, X. Zhu, Y. E. Guo, F. Qian, and Z. M. Mao, “Emp: Edge-assisted multi-vehicle perception,” in Proceedings of the 27th Annual International Conference on Mobile Computing and Networking, 2021, pp. 545–558. [26] H. Chen, B. Liu, X. Zhang, F. Qian, Z. M. Mao, and Y. Feng, “A cooperative perception environment for traffic operations and control,” arXiv preprint arXiv:2208.02792, 2022. [27] Q. Chen, X. Ma, S. Tang, J. Guo, Q. Yang, and S. Fu, “F-cooper: Feature based cooperative perception for autonomous vehicle edge computing system using 3d point clouds,” in Proceedings of the 4th ACM/IEEE Symposium on Edge Computing, 2019, pp. 88–100. [28] J. Cui, H. Qiu, D. Chen, P. Stone, and Y. Zhu, “Coopernaut: End-toend driving with cooperative perception for networked vehicles,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 17 252–17 262. [29] Y. Yuan, H. Cheng, and M. Sester, “Keypoints-based deep feature fusion for cooperative vehicle detection of autonomous driving,” IEEE Robotics and Automation Letters, vol. 7, no. 2, pp. 3054–3061, 2022. [30] Y. Lu, Q. Li, B. Liu, M. Dianati, C. Feng, S. Chen, and Y. Wang, “Robust collaborative 3d object detection in presence of pose errors,” arXiv preprint arXiv:2211.07214, 2022. [31] C. Wang, Z. Li, M. F. Li, and W. Wen, “Jigsawcomm: Joint semantic feature encoding and transmission for communication-efficient cooperative perception,” arXiv preprint arXiv:2511.17843, 2025. [32] H. Liu, P. Ren, S. Jain, M. Murad, M. Gruteser, and F. Bai, “Fusioneye: Perception sharing for connected vehicles and its bandwidth-accuracy

A PPENDIX A I MPLEMENTATION D ETAILS We evaluate our attack against SOTA collaborative perception models spanning both late and intermediate fusion paradigms. For late fusion systems, we target PIXOR [21] and PointPillars [22]. For intermediate fusion architectures, we evaluate Attentive Fusion [20] and Where2comm [23], [20], both configured with a PointPillars backbone. To enable end-to-end optimization against these models, we implement a differentiable LiDAR renderer using Möller– Trumbore ray tracing [39] for mesh intersection. We specifically address the non-differentiable components of the target perception models as follows. For PIXOR [21], the nondifferentiable BEV preprocessor is replaced with a differentiable approximation inspired by SlowLiDAR [40]. For PointPillars [22], the non-differentiable Voxelization and Scatter operations are substituted with trilinear and tanh approximations [35], and we utilize Gumbel-Softmax [41] as a differentiable surrogate for its non-differentiable max pooling step. In this way, the entire optimization pipeline is rendered differentiable. We evaluate four collaborative perception defenses: CAD [8], MATE [17], LUCIA [9], and MADE [15]. For CAD, we follow the original implementation and evaluate the CAD-specific H OLLOW mode described in Section IV-D. For MATE, we follow the original trust-estimation procedure and set the temporal trust period to 10 frames. Unless otherwise stated, we report the 5-track setting as the default MATE result,

15

since the original MATE evaluation uses scenarios with 5– 10 vehicles. We further analyze the impact of track count in Section V-C. For LUCIA, we follow the original featureconsistency scoring mechanism and set the compression ratio to 1, which gives LUCIA the finest spatial granularity and avoids weakening it through feature averaging. We study the effect of larger compression ratios in Section V-C. For MADE, we adapt the original method to OPV2V by training the autoencoder using benign CP cases and collecting matchbranch calibration scores from benign cases, on both PointPillar AttFusion [20] and Where2Comm [23], following its semi-supervised anomaly detection protocol. For TrustReflect, we implement the self-reflection step as a lightweight add-on without retraining the base perception or defense models. In our 10-frame evaluation sequences, when the victim observes a local inconsistency with the majority for two consecutive frames, it activates a trust mask on that local inconsistent region from the next frame through the last frame. Downstream defense computation ignores the masked region when computing inconsistency scores, trust updates, or anomaly decisions. For temporal MATE, the mask is applied before the pseudomeasurement update in each masked frame. For the scenario-sensitivity analysis in Figure 6, we additionally form two 50-scenario critical subsets from the 430scenario benchmark. The ASR-oriented subset favors cases with larger victim–non-victim pose separation, suitable nonvictim view angles, stronger occlusion, and more CAVs, which make cross-view inconsistency easier to attribute to the victim. The AP-oriented subset favors cases where the victim has a larger unique contribution to collaborative perception, so downweighting or excluding it causes greater utility loss. These subsets operationalize the scenario assessment in Section IV-E; all main tables still report the full benchmark. Optimization runs for 300 epochs using Adam with a learning rate of 0.01. We set the vulnerable view cone Θv to 5◦ behind the object and sample non-vulnerable views Θn with at least 20◦ angular separation from Θv . The loss weights are set to α = 1, β = 1, and λ = 0.001 for Laplacian regularization. The H OLLOW mode applies per-vertex tanh projection to bound deformation (0.1 m), while ATTACHED constrains maximum translation and overall mesh size to preserve stealthiness. The global translation is constrained to a range within 0.3 m of the rear bumper. The size of the initial H OLLOW mesh is similar to a normal car, measuring 4.4 m × 1.6 m × 1.6 m. LiDAR simulation in the synthetic data generation matches OPV2V specifications (64-channel, 70 m range). The feature number of PointPillars is set to 128 to allow for larger and more effective perturbations.

16