Research map / Multi-agent systems and games / Human-AI and goal-conditioned
CP-Guard: Malicious Agent Detection and Defense in Collaborative Bird’s Eye View Perception
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CP-Guard, a defense that lets each connected vehicle detect and exclude malicious collaborators in BEV segmentation via probability-agnostic group sampling (PASAC) and a collaborative consistency loss (CCLoss) consensus check.
Problem
Malicious connected vehicles can send adversarial intermediate feature maps that corrupt the ego vehicle's fused perception in collaborative perception, and existing defenses either need prior attack probabilities, check collaborators one by one, or rely on costly adversarial training.
Approach
Recursively split collaborators into groups and accept groups whose fused BEV prediction agrees with the ego-only prediction under a class-weighted overlap loss (CCLoss), removing the need for prior malicious probabilities.
Key results
- Under PGD attack, CP-Guard (threshold 0.08) reaches 39.34 mIoU versus 14.34 with no defense and 40.45 upper bound.
- PASAC averages 6.74 verification count versus 7.06 for ROBOSAC, with max 8 versus 46, across attack ratios on V2X-Sim.
- CCLoss threshold 0.02 fails to flag the attacker (mIoU 25.97), while 0.08 is optimal.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add CP-Guard defense | Collaborative BEV segmentation with U-Net and V2VNet · V2X-Sim, FGSM attack | mIoU: 21.57 -> 39.30 | Helped |
| Add CP-Guard defense | Collaborative BEV segmentation with U-Net and V2VNet · V2X-Sim, C&W attack | mIoU: 29.80 -> 37.95 | Helped |
| Add CP-Guard defense | Collaborative BEV segmentation with U-Net and V2VNet · V2X-Sim, PGD attack | mIoU: 14.34 -> 39.34 | Helped |
| Use PASAC instead of ROBOSAC | Collaborator verification · Attack ratio 0.6 | Average verification count: 8.29 -> 7.59 | Helped |
| Use PASAC instead of ROBOSAC | Collaborator verification · Attack ratio 0.4 | Average verification count: 10.36 -> 6.60 | Helped |
| Set CCLoss threshold ε to 0.02 instead of 0.08 (ablation) | CP-Guard · V2X-Sim, PGD attack | mIoU: 39.34 -> 25.97 | Hurt |
| Set CCLoss threshold ε to 0.05 instead of 0.08 (ablation) | CP-Guard · V2X-Sim, PGD attack | mIoU: 39.34 -> 37.79 | Hurt |
| Set CCLoss threshold ε to 0.10 instead of 0.08 (ablation) | CP-Guard · V2X-Sim, PGD attack | mIoU: 39.34 -> 39.17 | Hurt |
| Set CCLoss threshold ε to 0.12 instead of 0.08 (ablation) | CP-Guard · V2X-Sim, PGD attack | mIoU: 39.34 -> 37.99 | Hurt |
| Set CCLoss threshold ε to 0.15 instead of 0.08 (ablation) | CP-Guard · V2X-Sim, PGD attack | mIoU: 39.34 -> 37.52 | Hurt |
Surprising findings
- Under C&W attack, CP-Guard's mIoU (37.95) is noticeably below its FGSM and PGD results, which the authors attribute to fine-grained C&W perturbations.
- PASAC's average verification count (6.74) is only slightly lower than ROBOSAC's (7.06) overall, with the main gain being in the maximum count and stability.
Limitations
- Robustness to C&W attacks is noticeably weaker than to FGSM and PGD.
- Detection relies on a manually tuned CCLoss threshold, where too small or too large values hurt performance.
- Evaluated only on the V2X-Sim synthetic dataset with LiDAR BEV segmentation and a single fusion method.
Experimental setup
Datasets: V2X-Sim
Benchmarks: V2X-Sim
Metrics: mIoU verification count
Baselines: ROBOSAC Upper-bound (no attack, all collaborators) Lower-bound (ego only) No Defense
Builds on: ROBOSAC V2VNet U-Net
Closest papers by meaning
- STAMP: Scalable Task- And Model-agnostic Collaborative Perception (ICLR 2025 · similarity 0.90)
- CoSDH: Communication-Efficient Collaborative Perception via Supply-Demand Awareness and Intermediate-Late Hybridization (CVPR 2025 · similarity 0.87)
- Privacy-Preserving V2X Collaborative Perception Integrating Unknown Collaborators (AAAI 2025 · similarity 0.86)
- One is Plenty: A Polymorphic Feature Interpreter for Immutable Heterogeneous Collaborative Perception (CVPR 2025 · similarity 0.85)
- RCP-Bench: Benchmarking Robustness for Collaborative Perception Under Diverse Corruptions (CVPR 2025 · similarity 0.85)
- An Extensible Framework for Open Heterogeneous Collaborative Perception (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.