SoK: The Next Frontier in AV Security: Systematizing Perception Attacks and the Emerging Threat of Multi-Sensor Fusion

TL;DR

This paper systematically reviews perception-layer attacks on autonomous vehicles, highlighting vulnerabilities in multi-sensor fusion and proposing a research agenda for more robust, trustworthy perception systems.

Contribution

It provides a comprehensive taxonomy of 20 attack vectors, identifies key research gaps, and demonstrates a fusion-level vulnerability through simulation.

Findings

Identified underexplored vulnerabilities in sensor fusion logic.

Validated a fusion-level attack combining infrared and lidar spoofing.

Highlighted the need for defenses considering inter-sensor consistency.

Abstract

Autonomous vehicles (AVs) increasingly rely on multi-sensor perception pipelines that combine data from cameras, lidar, radar, and other modalities to interpret the environment. This SoK systematizes 48 peer-reviewed studies on perception-layer attacks against AVs, tracking the field's evolution from single-sensor exploits to complex cross-modal threats that compromise multi-sensor fusion (MSF). We develop a unified taxonomy of 20 attack vectors organized by sensor type, attack stage, medium, and perception module, revealing patterns that expose underexplored vulnerabilities in fusion logic and cross-sensor dependencies. Our analysis identifies key research gaps, including limited real-world testing, short-term evaluation bias, and the absence of defenses that account for inter-sensor consistency. To illustrate one such gap, we validate a fusion-level vulnerability through a proof-of-concept simulation combining infrared and lidar spoofing. The findings highlight a fundamental shift in AV security: as systems fuse more sensors for robustness, attackers exploit the very redundancy meant to ensure safety. We conclude with directions for fusion-aware defense design and a research agenda for trustworthy perception in autonomous systems.