Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles∗ Marwan Lazrag
Badis Hammi
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [email protected]
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [email protected]
Lorena Gonzalez-Manzano
Joaquin Garcia-Alfaro
Universidad Carlos III de Madrid Leganes, Spain [email protected]
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [email protected]
arXiv:2607.06484v1 [cs.CR] 7 Jul 2026
Abstract Poisoning attacks against public datasets lead to major concerns, such as (i) misclassification of perceived objects when the poisoned data is used for training and (ii) embedding of backdoors that may eventually be triggered later on, when specific conditions in the system apply over the learned models. Its impact over data augmentation models is unclear. While data augmentation reduces the likelihood of poisoning attack success, some valid questions remain. Is data augmentation affecting the impact of poisoning attacks? can it increase the number of poisoned samples or injected backdoors? We explore in this paper some of these questions. We assess the effects of augmenting poisoned 3D point cloud datasets and validate that poisoning is able to evade the sanitizing nature of augmentation techniques when using the concrete case of Generative Adversarial Network (GAN) techniques to exemplify the case of data augmentation processing. We also validate that poisoning propagates over the augmented datasets and perturbs the decision made by general-purpose classifiers, in the end. All the experimental material (including tools, datasets, and classifiers) is publicly available, to facilitate reproducibility and to foster further research in the topic.
Keywords Connected and Autonomous Vehicle (CAV), 3D Point Cloud, LiDAR, CCAM, Poisoning Attack, Dataset, Data Augmentation, GAN, Data Sanitization.
1
INTRODUCTION
Connected and Autonomous Vehicles (CAVs)1 have progressed rapidly from experimental prototypes to deployed systems, driven ∗ This is the authors’ accepted version of a paper to appear in the Proceedings of
the 23rd International Conference on Security and Cryptography (SECRYPT 2026) Volume 1, ISBN 978-989-758-858-7, ISSN 2184-7711, pages 712-722, Porto, Portugal, July 16 – 18, 2026. The final published version will be available through SCITEPRESS. 1 For the remainder of this paper, the terms “Connected Autonomous Vehicles (CAVs)" and “Autonomous Vehicles (AVs)" are used interchangeably in the context of perceptionlevel processing and LiDAR sensor inputs. Distinctions related to connectivity or higher-level vehicular functions are outside the scope of this work.
by advances in sensing, computation, and connectivity [1] [2]. Central to CAV operation is perception: a safety-critical subsystem that fuses heterogeneous sensor data, mainly cameras, Light Detection and Ranging (LiDAR), and Radar, to build a reliable, real-time model of the surrounding environment for downstream planning and control [3]. The geometric richness and metric fidelity of LiDAR point clouds, in particular, present both an opportunity and a challenge: they enable precise spatial reasoning (e.g., object localization and shape estimation) but require specialized representations and learning methods to handle sparsity, occlusion, and sensor noise [4].
1.1
Motivation
The widespread adoption of 3D point cloud deep learning techniques has significantly advanced the ability of autonomous vehicles to recognize and classify objects on the road, enhancing their navigation and decision-making capabilities [5]. These techniques are fundamental for real-time object recognition, scene understanding, and ultimately, safe autonomous navigation in complex traffic environments. Despite this progress, a critical gap exists: there is currently no comprehensive simulator tailored to holistically evaluate these techniques under diverse conditions. The validation of such systems generally necessitates comprehensive simulation environments [6]. Among the state-of-the-art tools, Waymo Simulation City2 stands out as a highly efficient simulator, but it is proprietary, restricting its accessibility to external researchers. Open-source alternatives such as CARLA3 and Baidu Apollo4 offer notable advantages, including high customizability, modularity, and realistic graphics/physics [7]. These simulators enable researchers to design and test custom scenarios. However, they rely heavily on scenario creation using existing datasets [8], which are often insufficient in size and diversity to simulate prolonged and complex driving scenarios [9]. To address the limitations of dataset size, researchers frequently employ data augmentation techniques (e.g., Generative Adversarial Networks (GAN)) to augment data and generate synthetic point 2 https://waymo.com/blog/2021/07/simulation-city 3 https://github.com/carla-simulator/carla/ 4 https://github.com/ApolloAuto/apollo
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
Marwan Lazrag , Badis Hammi , Lorena Gonzalez-Manzano , and Joaquin Garcia-Alfaro
cloud samples [10]. This approach enables the creation of longer and more comprehensive simulation scenarios, expanding the scope of testing and experimentation [11]. However, these augmented datasets often rely on publicly available datasets contributed by other users. Some studies suggest that data augmentation techniques exhibit a sanitizing effect on data [12][13][14], as they tend to generate synthetic data that reflects the most common features of the original dataset features, which are, by definition benign. In this context, Karra et al.[15] exploit unsupervised data augmentation, a selfsupervised approach, to mitigate backdoor/Trojan attacks, but their evaluation is restricted to a single manipulation type (Trojan triggers) and to relatively modest poisoning rates (generally 10% and a maximum of 20%) [15]. Similarly, Qin et al.[16] show that carefully chosen augmentations can suppress the effect of unlearnable or poisoned examples, although their pipeline relies on a verification step prior to augmentation to filter data used for augmentation. Rebuffi et al.[17] highlight that augmentation, when coupled with weight averaging, may mitigate robust overfitting and increase adversarial robustness, reinforcing the notion that augmentations encourage learning of high-level stable benign features. In medical imaging [13], GAN have been used to augment datasets with synthetic images that capture these shared, representative characteristics.
1.3
• We present an empirical evaluation study of the sanitization effects of data augmentation on 3D point cloud data for CAVs. • We analyze the impact of poisoned public datasets on downstream classification tasks when these datasets are subjected to augmentation, highlighting potential risks for decisionmaking in CAVs. • We release the complete implementation, including code and datasets, to facilitate reproducibility and future research on poisoning-aware augmentation strategies. The remainder of this paper is organized as follows: Section 2 surveys related work. Section 3 presents our proposal and modeling choices (adversary and impact models). Section 4 evaluates our experimental results. Section 5 concludes the paper.
2 1.2
Research gap and hypothesis
Collectively, these results are encouraging and converge on the claim that augmentation can, under certain conditions, mitigate the influence of data corruption. Nonetheless, such findings are strongly context-dependent and often tested under carefully bounded scenarios, particularly 2D image benchmarks, and thus do not generalize automatically to all data domains. Crucially, they rarely account for the unique challenges posed by 3D point clouds. The 3D point-cloud modality used for automotive perception differs fundamentally from 2D imagery. Mainly, compared to 2D image domains, point cloud data encode geometric, spatial, and structural continuity, making them especially sensitive to subtle perturbations. Augmentation methods designed to replicate or perturb these structures may inadvertently reinforce adversarial manipulations embedded in the dataset, amplifying their prevalence during model training. Therefore, This divergence highlights a critical research gap. We believe that this dependency on public datasets, in the case of 3D point-cloud, creates a critical attack surface. If a malicious actor introduces a poisoned dataset into this ecosystem, the augmentation process can exacerbate the poisoning, resulting in significantly compromised simulation scenarios. As discussed in the threat model, this could lead to catastrophic outcomes: the deployed point cloud classifier might fail to accurately recognize critical 3D objects such as roads, vehicles, or pedestrians. Furthermore, the adversary could embed a backdoor within the dataset, triggering a specific behavior from the vehicle under certain conditions. In autonomous driving scenarios, such failures can result in severe safety and operational consequences.
Contributions of this paper
Given these risks, it is essential to evaluate the sanitizing effect of data augmentation on 3D point-cloud data used in automotive perception. In this paper we present a focused case study on GANbased augmentation and investigate whether common augmentation pipelines amplify or attenuate poisoned examples, and how such effects propagate to downstream decision-making in CAVs. We conduct an operational impact assessment, which consists of estimating the impact of interrupting services and functionalities of a system, e.g., inner functionalities or associated processes, due to an attack. The main contributions are listed below:
RELATED WORK
Data augmentation, commonly used to increase the diversity and size of training datasets, for instance to avoid bias for having lack of representation of a particular group [18], has been applied in many contexts, such as computer vision [19] or natural language processing [20], among others. A widespread data augmentation technique is the use of GAN [21]. In the field of 3D point clouds, many approaches have used GAN for data augmentation purposes. For instance, [22] introduces PUGAN, a GAN-based framework designed to upsample sparse 3D point clouds, enhancing data density and uniformity. Another example is [23], which proposes an image-to-image GAN framework that generates high-resolution RGB-D images from incomplete point cloud projections. Attacks against 3D point clouds is also a well studied area. [26] presents a novel attack method targeting 3D point cloud models. The attack disrupts model availability by embedding class-specific rotations as imperceptible shortcuts into poisoned point clouds. [24] explores methods to create adversarial examples by generating imperceptible perturbations on 3D point cloud data that deceive a deep learning model. Another example is [25], which introduces AdvPC, a method for generating adversarial perturbations on 3D point clouds that are highly transferable across different models. Few proposals address the analysis of poisoning attacks under the use of data augmentation. [27] focuses on label-flipping attacks and the use of GAN-generated electroencephalogram data to compromise model performance in a federated learning environment. However, the environment, attacks, and data differ from those in this paper. Complementary to our work, [28] studies the transferability of 3D adversarial examples by applying different
Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles
Table 1: Related work comparison Ref. [22]
[23] [24] [25]
[26]
[27] [28]
[29] Ours
Operational Impact ✓ point cloud upsamx pling adversarial attacks ✓ indoor 3D scene x synthesis attacks ✓ 3D adversarial point x clouds generation ✓ 3D adversarial x perturbations (transferable) ✓ availability poisonx ing attacks in 3D point clouds ✓ data poisoning with x EEG label-flipping ✓ data augmentation x for 3D adversarial examples ✓ error-minimizing atx tacks ✓ poisoned 3D point ✓ cloud attacks
PROPOSAL
We introduce in this section the threat and impact models assumed in our work. The former formalizes the knowledge and capabilities assumed from a potential adversary who may perpetrate some poisoning attacks over our motivational scenario. The latter formalizes the impact assessment of the adversary attacks, over the same scenario.
3.1
as its true label 𝑌true [30]: 𝑀 (x) = 𝑌true
Poisoning
augmentation techniques, namely drop points, flip, rotation, scale, shear and translation, and analyzing their effects on different models. They conclude that data augmentation has a negative impact on the attack success rate while improving transferability of adversarial examples. In contrast, we analyze whether data augmentation affects the operational impact of poisoning attacks. Also, [29] uses data augmentation against error-minimizing attacks in the context of traffic sign recognition systems in autonomous vehicles. A summary of analysed works is depicted in Table 1, identifying if poisoning is considered and how and if operational impact is somehow addressed. While poisoning has been studied in different ways, its analysis together with operational impact has not been considered so far.
3
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
Threat Model
We assume an adversary whose objective is to degrade the victim model’s performance on the clean test distribution, ultimately forcing it to converge toward random guessing after training on a poisoned 3D point cloud dataset. We first assume the baseline condition that the model 𝑀 accurately classifies a clean sample x
(1)
By introducing poisoned data into a data augmentation process, the adversary aims at ensuring that the newly generated dataset contains even more poisoned samples. This poisoning is based on generating a perturbed sample x′ from a clean sample x by injecting a small perturbation 𝜌, such that: x′ = x + 𝜌
(2)
This corrupted data can lead to two major consequences: (i) misclassification of perceived objects when the new dataset is used for training, and (ii) embedding and amplifying a backdoor within the generated dataset, triggering specific behaviors in systems trained on this data. The goal of the attacker is to disrupt the model 𝑀, leading to the misclassification: 𝑀 (x′ ) = 𝑌 ′
| 𝑌 ′ ≠ 𝑌true
(3)
We assume a clean-label adversary with partial control over the training data. Specifically, the adversary can inject poisoned 3D point cloud samples into the training set at an incremental poisoning rate (e.g., 0% to 40%), while preserving the original class labels.5 This scenario may occur when an adversary injects malicious samples to public datasets that are later collected and used to train the victim model. However, the adversary is constrained in several ways. They have access only to the training data and no knowledge of external tools, pre-trained models, or surrogate architectures that could facilitate the generation of effective poison instances. In addition, they lack visibility into the victim’s training process, including model architecture, loss function, and hyperparameter choices. Finally, the adversary cannot prevent the defender from manually inspecting the labels of poisoned samples.
3.2
Impact Model
To assess the impact of the attacks perpetrated by the adversary, we assume the concept of operational impact quantification and the use of business logic modeling introduced in [31]. The first part, on the evaluation of the operational impact quantification, mainly relies on the computation of two functions: • Asset criticality evaluation function: it identifies the criticality of assets within a given system based on how attacks can propagate through and impact those assets. For each asset, this function assigns a criticality value ranging from 0 to 1. A value of 0 indicates that the asset is not impacted by the attack at all, while 1 indicates that the impact of the attack over such an assets is at its maximum. • Impact propagation function: it quantifies how an external event (e.g., a failure or an attack) propagates its effects over the operational functions and the operational processes associated to a given system, in probabilistic terms. The two previous functions assume the existence of a resource dependency graph, representing the dependencies between all the assets in the system, and a mission dependency graph describing the relationships between system-level functions and operational processes associated with each asset. In both cases, nodes represent 5 This clean-label assumption is commonly used in poisoning attack literature [26].
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
Marwan Lazrag , Badis Hammi , Lorena Gonzalez-Manzano , and Joaquin Garcia-Alfaro
Decision Making RADAR Front Right
(e.g., speed up, brake smoothly, ...)
RADAR Back Right
CAMERA Back Right
Traffic Flow Optimization
RADAR Front
CAMERA Front
CAMERA Back
LIDAR Top
Vehicle & Pedestrian Detection RADAR Front Left
Upward
x-axis
Update of AI Models
Object Detection
RADAR Back Left
CAMERA Back Left
Downward
Risk Analysis & Accident Prevention
y-axis
z-axis
Figure 1: CAV scenario inspired from the nuScenes data collection platform [32].
assets, system functions, and operational processes, while edges capture the interdependencies between them. Figure 1 illustrates the system model of a CAV scenario, inspired from the nuScenes dataset6 [32], which details representative assets such as sensors and controllers. Based on this model, we construct the corresponding resource and mission dependency graphs. Figure 2 presents our impact assessment model, combining both types of dependencies into a unified graph7 . To clearly distinguish between the two subgraphs, assets are depicted as circle-shaped nodes (representing the resource dependency graph), while system functions and operational processes are shown as rectangle-shaped nodes (representing the mission dependency graph). The example depicted in Figure 2 also describes the correlation between assets, system functions, and operational processes in a representative CAV scenario from [32]. It contains three assets8 : sensors, training datasets and Electronic Control Unit (ECU); three system functions: Vehicle & Pedestrian Detection, Object Detection, and Update of AI models; and three operational processes: Traffic Flow Optimization, Risk Analysis & Accident Prevention, and Decision Making. The Decision Making process represents the adversary’s ultimate target. By launching a poisoning attack against the asset Training Datasets, the adversary seeks to disrupt the outcomes of this process, for instance, by misleading the autonomous vehicle and causing it to make incorrect decisions. In this propagation model, edges connecting vertices represent interdependency probabilities, specifically Forward and Backward probabilities that quantify how degradation propagates between 6 The nuScenes dataset is a large-scale, multimodal benchmark (camera, LiDAR, radar,
IMU and rich 3D annotations) that is widely used in the literature for perception, tracking and prediction tasks. Its standardized evaluation and provided devkit have made it a de facto reference in autonomous-driving research. 7 The tool used to develop the impact-assessment model and to evaluate the effects of poisoning attacks on vehicle operational functions is derived from existing work [31]. For reproducibility purposes, we release the full implementation and modifications of the original work and tools as a Docker-deployable codebase (source code, Dockerfiles, and detailed implementation and deployment instructions) at https://github.com/ Marwanlz/Assessing_Operational_Impact_Poisoning_3d_PointCloud-CAV. 8 For clarity, all vertices corresponding to non-impacted assets (e.g., Camera) and their directly linked operational functions (e.g., Weather Conditions Analysis, Itinerary Optimization, and so on) have been omitted from the diagram.
Training Datasets
Sensors
Poisoning
ECU
Asset
Function Process
Attack
ASR
ASR
Forward probability
Backward probability
Figure 2: Assessing the impact of a poisoning attack against the training datasets of the CAV scenario in Figure 1, using the impact propagation model defined in [31].
system components. The Attack entity is characterized by an Attack Success Rate (ASR), which measures the initial detrimental impact of the poisoning attack on the targeted operational process. This ASR serves as the initial probability that cascades through the interconnected graph structure, influencing both Forward and Backward probabilities of all connected vertices. The combined effect of these probability interactions enables the quantification of the operational impact stemming from the attack against the root operational process. The ASR thus acts as the propagation catalyst, where the initial attack probability diminishes or amplifies as it traverses the dependency network, ultimately determining the extent of system degradation. A practical demonstration of this impact propagation mechanism is illustrated in Section 4.3.2, Figure 6.
4
EXPERIMENTAL METHODOLOGY
In this section, we present our experimental framework and the results obtained.
4.1
Overview
As Figure 3 shows, we designed two experimental scenarios to evaluate the impact of data poisoning under different conditions: (1) The classifier is trained on the original (baseline) dataset. (2) The classifier is trained on an augmented dataset, which includes several new samples generated using the 3D-GAN framework [33]. The rationale behind these two scenarios is to assess the effect of poisoning both with and without the use of augmentation
Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
(3) Training the classifier
(2) Point Cloud
A A
B
(A)ugmented
(B)aseline
Training with
Evaluated on
poisoned data
clean data
Training with
Evaluated on clean data
(5) Compute ASR
(1) ModelNet dataset
poisoning
(4) Testing the classifier
B
clean data
A
B
Figure 3: Methodology to compute the Attack Success Rate (ASR) associated to the motivational scenario depicted in Figure 2. techniques. By doing so, we can achieve an operational impact assessment, which consists of estimating the impact of interrupting services and functionalities of a system, e.g., inner functionalities or associated processes, due to the poisoning attack. In both settings, the training datasets are of equal size to ensure a fair and consistent comparison. The experiments in each scenario are conducted as follows. First, we preprocess the ModelNet dataset9 [34], which contains a variety of 3D object models: we select two classes for binary classification (a primary target class and a secondary, non-target class), split the data into training and test sets, and reserve only the primary-class training samples for manipulation (all secondaryclass and test samples remain unaltered). For training we used 3,000 files (1,500 per class), and for testing we used 600 files (300 per class). The dataset is class-balanced with an 83%/17% train/test split. We report exact counts to ensure experimental reproducibility and to allow fair assessment of sampling variability. Next, in both scenarios, we train our classifier on the clean training data, using original 3D objects for the first scenario (baseline scenario) and synthetic 3D objects generated by the 3D-GAN framework for the second (augmented scenario), and evaluate its performance on the untouched test set to establish baseline metrics. Finally, we simulate an adversary by modifying the 3D shapes of a subset of primary-class samples and injecting these poisoned examples into the training set at incrementally increasing rates (0 % to 40 %). For each Poisoning rate, we retrain the classifier on the modified dataset and evaluate it on the same clean test set. This procedure allows us to assess how varying levels of data poisoning, both with and without augmentation, affect the classification accuracy and attack success. In contrast to saliency-based point-dropping techniques such as proposed by Zheng et al.[35] or point-detach strategies that iteratively remove high-importance points [36], we employed a 9 ModelNet was introduced as a large-scale 3D Computer-Aided Design (CAD) model
dataset and is widely used as a benchmark for 3D shape / point-cloud research. It is frequently employed in studies of adversarial attacks and defenses on 3D point clouds.
simpler poisoning method, typically, we randomly removed 50% of the points from each poisoned file, without applying any ranking or importance criterion. It is worth noting that the experiments conducted in the second scenario are preceded by the creation of an augmented dataset using the 3D-GAN framework. In this setting, the poisoning data is deliberately introduced into the training dataset of the 3D-GAN. The newly generated 3D samples are then used to train the classification model for the primary class, whereas the data for the secondary class remains unaltered. It is worth noting that, the test set used in this scenario is identical to that of Scenario 1, ensuring a consistent evaluation protocol. Figure 4 shows (a) an original 3D object, (b) a synthetic 3D object generated by a GAN trained on the clean dataset, and (c) a synthetic 3D object generated by a GAN trained on a poisoned dataset. This illustration highlights the effects of dataset poisoning on the quality and characteristics of GAN-generated 3D objects.
(a)
(b)
(c)
Figure 4: (a) Original object; (b) GAN output from clean data; (c) GAN output from poisoned data.
4.2
Experimental setup and metrics
The experimental setup is designed to evaluate the classification performance against data poisoning attacks10 . The experiments are 10 The experiments (including source code, original datasets, augmented datasets,
poisoned dataset, data augmentation code, and data classification code) are publicly
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
Marwan Lazrag , Badis Hammi , Lorena Gonzalez-Manzano , and Joaquin Garcia-Alfaro
conducted on a machine equipped with an Intel i7-11850H CPU processor and an NVIDIA RTX A4000 GPU. Data augmentation via 3D-GAN is conducted using PyTorch11 . Training of the binary classifier is conducted using TensorFlow12 . The classifier is built using an existing InceptionNet architecture, which was adapted by us for binary classification. The classifier is trained with the Adam optimizer [37], using binary cross-entropy as the loss and a sigmoid activation on the output to produce probabilistic predictions. The Adam optimizer provides adaptive learning-rate updates that speed and stabilize convergence. Binary cross-entropy is the canonical log-loss for twoclass problems. And the sigmoid yields well-interpretable posterior scores for thresholding or calibration. These settings are standard and widely adopted for binary classification in deep-learning work [38][39][40]. The training of the classifier is conducted over 20 epochs with a batch size of 32, which provides a good trade-off between convergence speed and performance consistency on the validation dataset. The model performance is monitored at each epoch, using validation accuracy to ensure stable learning. To align with the literature, we evaluate the classifier’s robustness using the F1 score. However, We also use the Matthews correlation coefficient (MCC) metric. F1 is a harmonic mean of precision and recall, it compactly measures a detector’s ability to find true positives while limiting false alarms, making it well suited for tasks that prioritise the positive class. Whereas MCC is a correlation coefficient that uses all four confusion-matrix entries and ranges from −1 (total disagreement) to +1 (perfect prediction) (with 0 means random prediction). Because it accounts for true negatives as well as positives, MCC provides a balanced, prevalence-insensitive assessment of overall classifier quality. Reporting both metrics is essential, F1 reflects the precision–recall trade-off for the target class, while MCC reveals overall performance and exposes pathological behaviour on imbalanced data (e.g., models that attain high F1 by exploiting a tiny positive class but fail on negatives). Together they prevent over-claiming detector performance and make hidden failure modes visible. We also report a third metric to quantify poisoning effectiveness on classifier outputs: the Attack Success Rate (ASR), Formally: ASR =
FNafter attack − FNbefore attack · 100 Total number of samples
where 𝑁 is the total number of tested samples, and 𝐹 𝑁 before attack 𝐹 𝑁 after attack are the counts of false negatives before and after the poisoning, respectively. This ASR measures the increase in missed detections attributable to the attack, normalized by the evaluation set size. We focus on false negatives because poisoning in our threat model aims to increase wrongful non-detections (samples that should be flagged but are not). In other words, we consider only false negatives (not false positives) because the evaluation targets the primary class exclusively. In this setting, true positives are primary-class samples correctly identified; false negatives are primary-class samples incorrectly classified due to the poisoning; and false positives are non-primary samples incorrectly labeled as available at https://github.com/Marwanlz/Assessing_Operational_Impact_Poisoning_ 3d_PointCloud-CAV 11 https://pytorch.org 12 https://tensorflow.org
primary. This focus ensures that reported metrics capture degradations in recognition of the targeted class. All experiments were repeated five times. The reported values are the mean across runs. Standard deviations were consistently small, demonstrating the stability of the results. For clarity, in the next section, we omit the standard deviations from the main figures and tables.
4.3
Experimental results
In the following, the analysis of the poisoning attack is presented (Section 4.3.1), together with the impact quantification study (Section 4.3.2). 4.3.1 Poisoning analysis. The classification metrics results are summarised in Figure 5 for both the Baseline scenario and the Augmented scenario (see Section 4.1), using the metrics defined in Section 4.2. In both scenarios, only the training set of the primary class was manipulated by injecting poisoned samples at rates ranging from 0% (without poisoning) to 40%. The secondary class and the entire test set were left unchanged to isolate the effect of poisoning on model performance. In each figure, the x-axis displays the reported classification metric (MCC, F1, ASR) and the y-axis indicates the poisoning rate (in %). Across both evaluation scenarios (Baseline and Augmented), the classifier’s performance degrades monotonically with increasing poisoning: MCC and F1 decline while Attack Success Rate (ASR) rises, and the performance gap between scenarios widens as the poisoning load grows. At low poisoning levels the two setups differ only marginally (≈ 0.1 point in MCC and a similar delta in F1), indicating comparable initial robustness. By 20% poisoning the Baseline still yields strong detection (MCC ≈ 0.90, F1 ≈ 0.95) with a small ASR (2.8%). At the highest injection rates the divergence becomes pronounced: the Baseline records MCC = 0.88, F1 = 0.93, ASR = 5.8%, whereas the Augmented setup drops to MCC = 0.70, F1 = 0.79, ASR = 17.6%. These results indicate that, under our threat model and augmentation pipeline, the augmentation amplifies the impact of poisoned samples: rather than diluting adversarial artefacts, the augmentation process appears to reinforce distributional modes that the attacker exploits, increasing misclassification rates and overall attack effectiveness. This behavior is consistent with a mechanism where augmentation shifts model emphasis toward features present in both clean and poisoned examples, thus enlarging the adversary’s effective feature space. We recall that all reported values are averages over repeated runs. 4.3.2 Impact Quantification. We use the ASR as a concrete, operational indicator of poisoning effectiveness and feed it into the impact-propagation model from Section 3.2 to quantify downstream effects on the Decision Making operational function. Concretely, ASR values measured for each poisoning rate are treated as probabilistic inputs to the propagation function, which maps classifier degradation to the likelihood of impaired decision outcomes in the motivational scenarios. Figure 6 illustrates the impact assessment model across three use cases. For clarity, the assets: Electronic Control Unit (ECU), sensors, and training datasets are replaced by Asset 1, Asset 2, and Asset 3; the
Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles
1.00
1.00
Baseline scenario Augmented scenario
0.95
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
30.0%
Baseline scenario Augmented scenario
0.95
25.0%
0.90
20.0%
0.85
15.0%
Baseline scenario Augmented scenario
0.85 0.80 0.75
ASR
F1 score (Average)
MCC (Average)
0.90
0.80
10.0%
0.75
5.0%
0.70 0.65 0.60
0%
10%
20%
40%
Poisoning rate (%)
0.70
0%
(a)
10%
20%
40%
Poisoning rate (%)
0.0%
0%
(b)
10%
20%
40%
Poisoning rate (%)
(c)
Figure 5: Dependencies between metrics and poisoning rate: (a) Dependency between MCC and Poisoning rate; (b) Dependency between F1 score and Poisoning rate; (c) Dependency between ASR and Poisoning rate. 0.13 Decision Making
0.04 Decision Making
Decision Making 0.64
Impact Low
High
0.70
0.03 Traffic Flow Optimization
Risk Analysis & Accident Prevention
Traffic Flow Optimization
0.83
0.92
0.14 Risk Analysis & Accident Prevention
0.75
Update of AI Models
Object Detection
Vehicle & Pedestrian Detection
0.11 Traffic Flow Optimization
0.05 Risk Analysis & Accident Prevention
0.04 Vehicle & Pedestrian Detection
0.05 Object Detection
0.02 Update of AI Models
0.12 Vehicle & Pedestrian Detection
0.15 Object Detection
0.06 Update of AI Models
0.85 0.67
0.89
0.87
0.41
Training Datasets
Sensors
ASR=0.0
Training Datasets
Sensors
ASR= 0.058
Training Datasets
Sensors
ASR= 0.176
0.50
0.79
ECU
Poisoning
ECU
(a)
(b)
Poisoning
ECU
Poisoning
(c)
Figure 6: Impact assessment model: (a) Nominal system state; (b) Baseline scenario with a 40% poisoning rate; (c) Augmented scenario with a 40% poisoning rate. Table 2: Assessment of the impact on the operational function Decision Making based on ASR values Scenario
Poisoning Rate
ASR
Operational Impact
Baseline
10% 20% 40%
1.2 % 2.8 % 5.8 %
1% 2% 4%
Augmented
10% 20% 40%
6.4 % 12 % 17.6 %
5% 9% 13 %
system functions: Vehicle & Pedestrian Detection, Object Detection, and Update of AI models by Function 1, Function 2, and Function 3; and the operational processes: Traffic Flow Optimization, Risk Analysis & Accident Prevention, and Decision Making by process 1, process 2, and process 3. Figure 6.a depicts the nominal (pre-attack)
system state where edges encode interdependencies between assets. While the model supports bidirectional impacts, this particular scenario exhibits only downstream propagation, meaning all backward impact probabilities are set to zero. For visual clarity, only the forward impact probabilities (shown in dark blue) are displayed, as the reverse probabilities would contribute no meaningful information to the analysis. In Figure 6.a, the edge values between operational functions and processes (represented as rectangular nodes) were manually assigned based on domain expertise, as modeling these relationships requires in-depth knowledge of vehicle activities [31]. For interdependencies between assets (represented as circular nodes), edge values were derived from the nuScenes dataset [32]. Figure 6.b depicts the Baseline scenario with a 40% poisoning rate, while Figure 6.c illustrates the Augmented scenario under the same poisoning rate. These figures demonstrate how an attack propagates its impact across the graph, with interdependencies recalculated accordingly. The degradation level of each asset or
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
Marwan Lazrag , Badis Hammi , Lorena Gonzalez-Manzano , and Joaquin Garcia-Alfaro
operational function (represented as rectangles) is indicated by a red numerical value above each vertex. A color gradient from white (no impact) to yellow (low impact) to dark red (severe impact) visually encodes the extent of degradation on these vertices. This value quantifies the perturbation in the execution and performance of vehicular functions. It ranges from 0 (no impact) to 1 (very high impact), corresponding to 0% and 100%, respectively. For example, in the baseline scenario, the operational impact of the poisoning attack on the Traffic Flow Optimization function is 0.03 (3%), as shown in Figure 6.b. In the augmented scenario, the operational impact on the Traffic Flow Optimization function reaches 0.11 (11%), as shown in Figure 6.c. Table 2 summarizes the impact probability of the poisoning attack on operational functions for both scenarios. The resulting assessment exhibits two robust patterns. First, impact probability grows monotonically with ASR, denoted . That is, higher attackinduced misclassification directly increases the chance that decisionmaking functions receive corrupted inputs and produce incorrect outcomes. Second, the Augmented scenario consistently yields substantially larger operational impacts than the Baseline for the same poisoning rate. For instance, at 40% poisoning the assessed probability that Decision Making is affected rises from 4% (Baseline) to 13% (Augmented), hence, an over threefold increase in impact under our modeling assumptions. Hence, the analysis demonstrates a clear and actionable insight: augmentation, amplifies attack effectiveness and materially increases the probability of operational disruption in decision-making functions. Finally, while this evaluation focuses on a specific poisoning attack and a GAN-based augmentation technique, the observed increase in misclassification and operational impact is not limited to this setting. Comparable effects may also arise with other attacks, potentially leading to similar performance degradation and increased operational impact under our assessment model. Similarly, augmentation techniques other than GANs that expand the training dataset may influence the propagation of poisoned samples, resulting in comparable amplification effects.
5
CONCLUSION
We addressed in this paper the issue of poisoning attacks against public datasets. More precisely, the case of poisoning attacks over augmented 3D point cloud public datasets for Connected and Autonomous Vehicles (CAV) scenarios. Poisoning attacks are known to lead to misclassification of perceived objects. Even worse, they can assist adversaries to embed backdoors that may eventually be triggered later on, when specific conditions in the system apply over the learned models. We assessed the operational impact of this attacks over data augmentation models. While data augmentation reduces the likelihood of poisoning attack success, we addressed whether data augmentation keeps affecting the impact of poisoning attacks over general purpose classifiers. We experimentally validate that data augmentation can even increase the number of poisoned samples, hence augmenting as well the effects of augmenting poisoned 3D point cloud datasets. We validated that poisoning is able to evade the sanitizing nature of augmentation techniques under the concrete case of GAN techniques. Our results validate as well that poisoning propagates over the augmented datasets and perturbs
the decision made by general-purpose classifiers. Extending this evaluation to other 3D point cloud datasets remains challenging, given the limited availability of such datasets for CAV scenarios.
ACKNOWLEDGEMENTS The work presented in this paper was conducted within the framework of the Horizon Europe AI4CCAM project (grant agreement 101076911), addressing trustworthiness of artificial intelligence in the context of Connected, Collaborative and Automated Mobility. Lorena González and Joaquin Garcia-Alfaro are being partially supported by Project PID2023-150310OB-I00 (MORE4AIO) funded by MCIU/ AEI / 10.13039/501100011033 / FEDER, UE. We thank the anonymous reviewers for their valuable comments and helpful suggestions.
References [1] K. Sghaier, B. Hammi, G. Gharbi, P. Merdrignac, P. Parrend, and D. Verna, “Advancing security in software-defined vehicles: A comprehensive survey and taxonomy,” arXiv preprint arXiv:2510.09675, 2025. [2] D. Parekh, N. Poddar, A. Rajpurkar, M. Chahal, N. Kumar, G. P. Joshi, and W. Cho, “A review on autonomous vehicles: Progress, methods and challenges,” Electronics, vol. 11, no. 14, p. 2162, 2022. [3] S. A. Salguero-Luna, K. A. Ramirez-Gutierrez, and A. Martinez-Cruz, “A stateof-the-art review on attacks and defense mechanisms for lidar on autonomous vehicles,” IEEE Transactions on Intelligent Transportation Systems, 2024. [4] A. Eskandarian, C. Wu, and C. Sun, “Research advances and challenges of autonomous and connected ground vehicles,” IEEE Transactions on Intelligent Transportation Systems, vol. 22, no. 2, pp. 683–711, 2019. [5] Q. Chen, S. Tang, Q. Yang, and S. Fu, “Cooper: Cooperative perception for connected autonomous vehicles based on 3d point clouds,” in 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS). IEEE, 2019, pp. 514–524. [6] M. Kautz, B. Hammi, and J. Garcia-Alfaro, “Platelet: Pioneering security and privacy compliant simulation for intelligent transportation systems and v2x,” in 2024 22nd International Symposium on Network Computing and Applications (NCA). IEEE, 2024, pp. 61–67. [7] G. Yang, Y. Xue, L. Meng, P. Wang, Y. Shi, Q. Yang, and Q. Dong, “Survey on autonomous vehicle simulation platforms,” in 2021 8th International Conference on Dependable Systems and Their Applications (DSA). IEEE, 2021, pp. 692–699. [8] P. Kaur, S. Taghavi, Z. Tian, and W. Shi, “A survey on simulators for testing self-driving cars,” in 2021 Fourth International Conference on Connected and Autonomous Driving (MetroCAD). IEEE, 2021, pp. 62–70. [9] Y. Li, W. Yuan, S. Zhang, W. Yan, Q. Shen, C. Wang, and M. Yang, “Choose your simulator wisely: A review on open-source simulators for autonomous driving,” IEEE Transactions on Intelligent Vehicles, 2024. [10] M. Sarmad, H. J. Lee, and Y. M. Kim, “Rl-gan-net: A reinforcement learning agent controlled gan network for real-time point cloud shape completion,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 5898–5907. [11] M. Cheng, G. Li, Y. Chen, J. Chen, C. Wang, and J. Li, “Dense point cloud completion based on generative adversarial network,” IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–10, 2021. [12] E. Strelcenia and S. Prakoonwit, “A survey on gan techniques for data augmentation to address the imbalanced data issues in credit card fraud detection,” Machine Learning and Knowledge Extraction, vol. 5, no. 1, pp. 304–329, 2023. [13] A. Bissoto, E. Valle, and S. Avila, “Gan-based data augmentation and anonymization for skin-lesion analysis: A critical review,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 1847–1856. [14] Z. He, L. Xie, X. Chen, Y. Zhang, Y. Wang, and Q. Tian, “Data augmentation revisited: Rethinking the distribution gap between clean and augmented data,” arXiv preprint arXiv:1909.09148, 2019. [15] K. Karra, C. Ashcraft, and C. Costello, “Sanitais: Unsupervised data augmentation to sanitize trojaned neural networks,” in 2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech). IEEE, 2022, pp. 1–6. [16] T. Qin, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu, “Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks,” arXiv preprint arXiv:2303.15127, 2023. [17] S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. A. Mann, “Data augmentation can improve robustness,” Advances in neural information processing
Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles systems, vol. 34, pp. 29 935–29 948, 2021. [18] S. Sharma, Y. Zhang, J. M. Ríos Aliaga, D. Bouneffouf, V. Muthusamy, and K. R. Varshney, “Data augmentation for discrimination prevention and bias disambiguation,” in Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 2020, pp. 358–364. [19] S. Yang, W. Xiao, M. Zhang, S. Guo, J. Zhao, and F. Shen, “Image data augmentation for deep learning: A survey,” arXiv preprint arXiv:2204.08610, 2022. [20] C. Shorten, T. M. Khoshgoftaar, and B. Furht, “Text data augmentation for deep learning,” Journal of big Data, vol. 8, no. 1, p. 101, 2021. [21] A. Bissoto, E. Valle, and S. Avila, “Gan-based data augmentation and anonymization for skin-lesion analysis: A critical review,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 1847–1856. [22] R. Li, X. Li, C.-W. Fu, D. Cohen-Or, and P.-A. Heng, “Pu-gan: a point cloud upsampling adversarial network,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 7203–7212. [23] J. Y. Koh, H. Agrawal, D. Batra, R. Tucker, A. Waters, H. Lee, Y. Yang, J. Baldridge, and P. Anderson, “Simple and effective synthesis of indoor 3d scenes,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 1, 2023, pp. 1169–1178. [24] C. Xiang, C. R. Qi, and B. Li, “Generating 3D adversarial point clouds,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 9136–9144. [25] A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem, “Advpc: Transferable adversarial perturbations on 3d point clouds,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XII 16. Springer, 2020, pp. 241–257. [26] X. Wang, M. Li, P. Xu, W. Liu, L. Y. Zhang, S. Hu, and Y. Zhang, “PointAPA: Towards availability poisoning attacks in 3D point clouds,” in European Symposium on Research in Computer Security. Springer, 2024, pp. 125–145. [27] M. Alsereidi, A. Awadallah, A. Alkaabi, S. Yoon, and C. Y. Yeun, “Data poisoning against federated learning: Comparative analysis under label-flipping attacks and gan-generated eeg data,” in 2024 2nd International Conference on Cyber Resilience (ICCR). IEEE, 2024, pp. 1–5.
SECRYPT 2026, 16–18 July, 2026, Porto, Portugal
[28] F. Qian, Y. Zou, M. Xu, X. Zhang, C. Zhang, C. Xu, and H. Chen, “A comprehensive understanding of the impact of data augmentation on the transferability of 3d adversarial examples,” ACM Transactions on Knowledge Discovery from Data, 2024. [29] T. Hapuarachchi, L. Dang, and K. Xiong, “Securing traffic sign recognition systems in autonomous vehicles,” arXiv preprint arXiv:2506.06563, 2025. [30] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security. Chapman and Hall/CRC, 2018, pp. 99–112. [31] M. Lazrag, C. Kiennert, and J. Garcia-Alfaro, Quantifying the Impact Propagation of Cyber Attacks Using Business Logic Modeling. Cham: Springer Nature Switzerland, 2025, pp. 49–71. [32] H. Caesar, V. Bankiti, A. H. Lang, S. Vora, V. E. Liong, Q. Xu, A. Krishnan, Y. Pan, G. Baldan, and O. Beijbom, “nuscenes: A multimodal dataset for autonomous driving,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 621–11 631. [33] J. Wu, C. Zhang, T. Xue, B. Freeman, and J. Tenenbaum, “Learning a probabilistic latent space of object shapes via 3D generative-adversarial modeling,” Advances in neural information processing systems, vol. 29, 2016. [34] Z. Wu, S. Song, A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao, “3D ShapeNets: A Deep Representation for Volumetric Shapes,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2015, pp. 1912–1920. [35] T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren, “Pointcloud saliency maps,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 1598–1606. [36] J. Yang, Q. Zhang, R. Fang, B. Ni, J. Liu, and Q. Tian, “Adversarial attack and defense on point sets,” arXiv preprint arXiv:1902.10899, 2019. [37] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014. [38] U. Ruby, V. Yendapalli et al., “Binary cross entropy with deep learning technique for image classification,” Int. J. Adv. Trends Comput. Sci. Eng, vol. 9, no. 10, 2020. [39] F. Chollet and F. Chollet, Deep learning with Python. Simon and Schuster, 2021. [40] A. Schaad and D. Binder, “Deep-learning-based vulnerability detection in binary executables,” in International Symposium on Foundations and Practice of Security. Springer, 2022, pp. 453–460.