Embedded Files
The Heat is On:
Accepted to NDSS '26
Thermal cameras are increasingly considered a viable solution in autonomous systems to ensure perception in low-visibility conditions, such as during nighttime, fog, or heavy rain. Thermal image processing typically requires specialized calibration and equalization operations to handle thermal drift and high dynamic range, unlike RGB image processing.
Our research exposes and mitigates three vulnerabilities in these specialized thermal image processing, specifically within equalization, calibration, and lensing mechanisms inherent to thermal cameras.
Exploiting Linearity in Thermal Equalization
Real-world scenarios involve dynamic variations in thermal maps, which can trigger a linear response in plateau algorithms used in thermal imaging equalization. Our analysis shows that adversaries can exploit this naturally occurring condition to reduce the heat signature of target obstacles, causing misdetection of genuine obstacles.
Experimental Setup: We test and evaluate the vulnerability using three thermal cameras: InfiRay T2S, FLIR Boson, and FPV XK-C130 in outdoor static and dynamic conditions.
Pedestrian detected without the heat lamp Pedestrian misdetected with the heat lamp
equalization_dynamic.mp4Misdetection is caused due to the linear properties of the equalization, exploited by strategically placing a heat lamp. The video illustrates a scenario with a vehicle driving towards a pedestrian on the road
Pedestrian detected without the heat lamp Pedestrian misdetected with the heat lamp
equalization_static.mp4Misdetection is caused due to the linear properties of the equalization, exploited by strategically placing a heat lamp. The video illustrates a scenario with a pedestrian crossing the road in front of the vehicle.
Exploiting Thermal Calibration
Thermal cameras need an automatic heat intensity correction algorithm in their calibration processes, which exposes a new attack surface, enabling attackers to cause heat map distortion. Attackers can exploit this vulnerability to induce delayed artifacts with just 10 seconds of exposure. These artifacts may appear between 30 seconds and 2 minutes after the attack ends and can trigger continuous detection of non-existent obstacles.
Experimental Setup: We test and evaluate the vulnerability using three thermal cameras: InfiRay T2S, FLIR Boson, and FPV XK-C130 in outdoor static and dynamic conditions.
Prolonged creation of artifact as pedestrian obstacle after the attack in static scenario
Artifact detected as pedestrian for YOLOv5 model
dynamic_crop_yolo_expose.mp4Artifact detected as pedestrian for FasterRCNN model
dynamic_crop_rcnn_expose.mp4Prolonged creation of artifact as pedestrian obstacle after the attack in dynamic scenario
Artifact detected as pedestrian for YOLOv5 model
dynamic_crop_yolo.mp4Artifact detected as pedestrian for FasterRCNN model
dynamic_crop_rcnn.mp4Exploiting Image Acquisition Weaknesses
We demonstrate a vulnerability in the shutter assembly and lens design of thermal cameras, which, unlike visible cameras, preserves the structure of heat signals. This allows adversaries to generate controllable flare patterns (e.g., ghost artifacts) that can appear in thermal images, triggering false object detection.
Experimental Setup: We test and evaluate the vulnerability using a FLIR Boson camera under outdoor conditions, varying the distance of the heat lamp from the camera. Images are collected using the FLIR GUI 3.0.
Ghost artifact detected as a pedestrian from 1 m distance from the camera
Ghost artifact detected as a pedestrian from 1.5 m distance from the camera
Ghost artifact detected as a pedestrian from 2 m distance from the camera
Acknowledgements
We thank the anonymous shepherd, reviewers, and AE evaluators for their valuable comments. This research was supported in part by the NSF CNS-2145493, CNS-2413877, USDOT under Grant 69A3552348327 for the CARMEN+ University Transportation Center, JSPS KAKENHI Grant Number 24K14943, JST CREST JPMJCR23M4, SoCal Hub grant, and unrestricted research funds from Toyota InfoTech Labs. We also would like to thank Srajana Chandrashekhar and Vladimir A. Alekseev for their assistance with the outdoor experiments.
Page updated
Google Sites
Report abuse