{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T16:37:36Z","timestamp":1757608656648,"version":"3.44.0"},"reference-count":57,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T00:00:00Z","timestamp":1747612800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T00:00:00Z","timestamp":1747612800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,5,19]]},"DOI":"10.1109\/icra55743.2025.11127598","type":"proceedings-article","created":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T17:28:56Z","timestamp":1756834136000},"page":"1-8","source":"Crossref","is-referenced-by-count":0,"title":["Detecting Perception-Based Attacks using Visual Odometry: Inconsistency Modeling and Checking on Robotic States"],"prefix":"10.1109","author":[{"given":"Yuan","family":"Xu","sequence":"first","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gelei","family":"Deng","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00067"},{"key":"ref2","article-title":"Rocking drones with intentional sound noise on gyroscopic sensors","volume-title":"USENIX Security Symposium","author":"Son","year":"2015"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.42"},{"article-title":"Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors","volume-title":"USENIX Security Symposium","author":"Tu","key":"ref4"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354259"},{"key":"ref6","article-title":"Fooling detection alone is not enough: Adversarial attack against multiple object tracking","volume-title":"International Conference on Learning Representations","author":"Jia","year":"2020"},{"key":"ref7","article-title":"Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations","volume-title":"USENIX Security Symposium","author":"Jing","year":"2021"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00076"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670290"},{"key":"ref10","article-title":"Sonic gun to smart devices","author":"Wang","year":"2017","journal-title":"Black Hat USA"},{"key":"ref11","article-title":"Sensor confusion: Defeating kalman filter in signal injection attack","author":"Nashimoto","year":"2018","journal-title":"ACM AsiaCCS"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/VLSID.2018.97"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2019.1800156"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2018.1800065"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179458"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485377"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19839-7_30"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00080"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref21","article-title":"Ghostimage: Remote perception attacks against camera-based image classification systems","volume-title":"International Symposium on Recent Advances in Intrusion Detection","author":"Man","year":"2020"},{"key":"ref22","article-title":"Slap: Improving physical adversarial examples with short-lived adversarial perturbations","volume-title":"USENIX Security Symposium","author":"Lovisotto","year":"2021"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref24","article-title":"Physical adversarial examples for object detectors","author":"Song","year":"2018","journal-title":"Workshop on Offensive Technologies"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"ref27","article-title":"Rolling colors: Adversarial laser exploits against traffic light recognition","author":"Yan","year":"2022","journal-title":"CoRR"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423359"},{"key":"ref29","article-title":"Phantom of the adas: Phantom attacks on driver-assistance systems","author":"Nassi","year":"2020","journal-title":"IACR Cryptology ePrint Archive"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01580"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484766"},{"key":"ref32","article-title":"Certified robustness against physically-realizable patch attack via randomized cropping","author":"Lin","year":"2021","journal-title":"ICLR Open Review"},{"key":"ref33","article-title":"Certified defenses for adversarial patches","author":"Chiang","year":"2020","journal-title":"ICLR"},{"journal-title":"NeurIPS 2020","article-title":"(de)randomized smoothing for certifiable defense against patch attacks","author":"Levine","key":"ref34"},{"key":"ref35","article-title":"Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking","volume-title":"USENIX Security Symposium","author":"Xiang","year":"2021"},{"key":"ref36","article-title":"Patchguard++: Efficient provable attack detection against adversarial patches","author":"Xiang","year":"2021","journal-title":"CoRR abs\/2104.12609"},{"key":"ref37","article-title":"Efficient certified defenses against patch attacks on image classifiers","author":"Metzen","year":"2021","journal-title":"ICLR"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484757"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_24"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00776"},{"key":"ref41","article-title":"Knowledge enhanced machine learning pipeline against diverse adversarial attacks","author":"Gurel","year":"2021","journal-title":"ICML"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00407"},{"article-title":"That person moves like a car: Misclassification attack detection for autonomous systems using spatiotemporal consistency","volume-title":"USENIX Security Symposium","author":"Man","key":"ref43"},{"article-title":"Exorcising wraith: Protecting lidar-based object detector in automated driving system from appearing attacks","volume-title":"USENIX Security Symposium","author":"Xiao","key":"ref44"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3011690"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2004.1315094"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/MRA.2011.943233"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TRO.2015.2463671"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10605-2_54"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/11744023_34"},{"key":"ref54","article-title":"G2o: A general framework for graph optimization","author":"Kummerle","year":"2011","journal-title":"IEEE ICRA"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.00098"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01656"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2023.3264658"}],"event":{"name":"2025 IEEE International Conference on Robotics and Automation (ICRA)","start":{"date-parts":[[2025,5,19]]},"location":"Atlanta, GA, USA","end":{"date-parts":[[2025,5,23]]}},"container-title":["2025 IEEE International Conference on Robotics and Automation (ICRA)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11127273\/11127223\/11127598.pdf?arnumber=11127598","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,3]],"date-time":"2025-09-03T06:05:12Z","timestamp":1756879512000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11127598\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,19]]},"references-count":57,"URL":"https:\/\/doi.org\/10.1109\/icra55743.2025.11127598","relation":{},"subject":[],"published":{"date-parts":[[2025,5,19]]}}}