# Physics-Aware Spatiotemporal Consistency for Transferable Defense of Autonomous Driving Perception

## TL;DR

This paper introduces a physics-aware defense system for autonomous driving that improves robustness against adversarial attacks by combining visual and physical cues.

## Contribution

A novel physics-aware module that tightly couples visual and kinematic data to detect and correct adversarial inconsistencies in autonomous driving perception.

## Key findings

- The proposed defense improves Correction Accuracy (CA) on nuScenes from 86.5% to 92.1%.
- The defense reduces computational overhead from 42 ms to 19 ms.
- It maintains over 71.0% CA when transferred to unseen detectors and 72.4% CA under adaptive attackers.

## Abstract

Autonomous driving perception systems are vulnerable to physical adversarial attacks. Existing defenses largely adopt loosely coupled architectures where visual and kinematic cues are processed in isolation, thus failing to exploit physical spatiotemporal consistency as a structural prior and often struggling to balance adversarial robustness, transferability, accuracy, and efficiency under realistic attacks. We propose a physics-aware trajectory–appearance consistency defense that detects and corrects spatiotemporal inconsistencies by tightly coupling visual semantics with physical dynamics. The module combines a dual-stream spatiotemporal encoder with endogenous feature orchestration and a frequency-domain kinematic embedding, turning tracking artifacts that are usually discarded as noise into discriminative cues. These inconsistencies are quantified by a Trajectory–Appearance Mutual Exclusion (TAME) energy, which supports a physics-aware switching rule to override flawed visual predictions. Operating on detector backbone features, outputs, and tracking states, the defense can be attached as a plug-in module behind diverse object detectors. Experiments on nuScenes, KITTI, and BDD100K show that the proposed defense substantially improves robustness against diverse categories of attacks: on nuScenes, it improves Correction Accuracy (CA) from 86.5% to 92.1% while reducing the computational overhead from 42 ms to 19 ms. Furthermore, the proposed defense maintains over 71.0% CA when transferred to unseen detectors and sustaining 72.4% CA under adaptive attackers.