The Ghost Navigator: Revisiting the Hidden Vulnerability of Localization in Autonomous Driving
(USENIX Security 2025)
The Ghost Navigator: Revisiting the Hidden Vulnerability of Localization in Autonomous Driving
(USENIX Security 2025)
The source code of MSAF is released at :
Illustration of two attack scenarios with three motion states: high-speed cruising on straight paths (S1.1->S1.2), accelerating from a standstill on straight paths (S2.1->S2.2), and transitioning from deceleration to acceleration in turns (S3.1->S3.2).
Localization is crucial for Autonomous Driving (AD), which serves as a key foundation that impacts downstream modules such as perception, planning, and control. With the advent of Multi- Sensor Fusion (MSF) techniques enhancing accuracy and reliability, the security of such fusion-based localization methods has become a major concern. Existing research has examined various security aspects, but the impact of vehicle dynamics on the effectiveness of GPS spoofing attacks has been largely overlooked.
To bridge this gap, we introduce the Motion Sensitive Analysis Framework (MSAF), focusing on the analysis of previously underestimated vehicle dynamics. MSAF highlights that vehicles are more susceptible to successful GPS spoofing attacks during acceleration from a standstill and high-speed cruising.Evaluating these dynamics on real-world systems Apollo_MSF and Shenlan_MSF shows that MSAF significantly improves attack efficiency, requiring less time to complete successful attacks.
Observability Variance Across Motion States
Kalman Gain Variance Across Motion States
The Impact on Constant Spoofing Attacks
1.1 Identifying Potential Attack Scenarios. We start by analyzing key vehicle dynamics — acceleration, linear velocity, and angular velocity — which substantially determine the state of vehicle dynamics. By simplifying the model and omitting the effects of slope on pitch and the vehicle's lateral dynamics on roll, we theoretically analyze 2^3=8 possible combinations of these variables. Upon eliminating physically untenable combinations, such as those involving nonzero acceleration alongside zero velocity, we refine our focus to four practical scenarios detailed in Table 1.
1.2 Assessing Impact through Observability Analysis. We then assess the impact of these motion scenarios on the MSF system using stability and observability analysis. A high condition number in the system matrix indicates greater vulnerability to numerical instability, while singular value analysis identifies weakly observable states that are more susceptible to manipulation. These analyses help identify which motion states are most prone to GPS spoofing.
1.3 Analyzing the Impact of Motion States on Kalman Gain. Further, we evaluate the impact of various motion states on the Kalman gain within the MSF framework. We find that the Kalman gain coefficients for GPS positioning are diminished when the vehicle is either stationary or decelerating, suggesting these scenarios are less conducive for successful attacks. Conversely, while higher speeds yield increased Kalman gain, the practical challenges and performance issues of GPS signal spoofing at these velocities lead us to discount these scenarios as well. After a thorough evaluation, we propose two conservative attack strategies.
The Apollo_MSF (black box), Shenlan_MSF (white box), and our MSAF (white box) models exhibit fundamental differences in their strategies for designing the prediction and observation equations. The prediction equation propels the system's state forward in time based on its current dynamics, while the observation (or correction) equation utilizes new sensor data to adjust and refine these state predictions.
2.1 Differences in Prediction Equation Design. The prediction equation plays a crucial role in estimating the vehicle's position and orientation. Apollo_MSF and MSAF incorporate a comprehensive Earth model that accounts for both the Earth's rotational angular velocity and the angular velocity induced by the vehicle's motion relative to the Earth's surface. This approach enhances the accuracy of the estimated states, particularly in high-latitude regions and under dynamic conditions. In contrast, Shenlan_MSF does not explicitly consider the Earth model during the prediction phase, potentially compromising its global navigation performance.
2.2 Differences in Correction Equation Design. The correction equation, also known as the observation equation, integrates sensor measurements to refine the predicted states. While Shenlan_MSF relies solely on positional and pose data from GPS and LiDAR, Apollo_MSF and MSAF extend their observational model to incorporate GPS velocity. This divergence in sensor fusion strategies highlights the distinct approaches employed by these models to optimize the correction process.