{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T15:01:26Z","timestamp":1780498886983,"version":"3.54.1"},"reference-count":49,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T00:00:00Z","timestamp":1769472000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Key Research and Development Program of Hubei Province, China","award":["2024BAA011"],"award-info":[{"award-number":["2024BAA011"]}]},{"name":"Technological Innovation Program of Hubei Province, China","award":["2025BEA006"],"award-info":[{"award-number":["2025BEA006"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Autonomous driving perception systems are vulnerable to physical adversarial attacks. Existing defenses largely adopt loosely coupled architectures where visual and kinematic cues are processed in isolation, thus failing to exploit physical spatiotemporal consistency as a structural prior and often struggling to balance adversarial robustness, transferability, accuracy, and efficiency under realistic attacks. We propose a physics-aware trajectory\u2013appearance consistency defense that detects and corrects spatiotemporal inconsistencies by tightly coupling visual semantics with physical dynamics. The module combines a dual-stream spatiotemporal encoder with endogenous feature orchestration and a frequency-domain kinematic embedding, turning tracking artifacts that are usually discarded as noise into discriminative cues. These inconsistencies are quantified by a Trajectory\u2013Appearance Mutual Exclusion (TAME) energy, which supports a physics-aware switching rule to override flawed visual predictions. Operating on detector backbone features, outputs, and tracking states, the defense can be attached as a plug-in module behind diverse object detectors. Experiments on nuScenes, KITTI, and BDD100K show that the proposed defense substantially improves robustness against diverse categories of attacks: on nuScenes, it improves Correction Accuracy (CA) from 86.5% to 92.1% while reducing the computational overhead from 42 ms to 19 ms. Furthermore, the proposed defense maintains over 71.0% CA when transferred to unseen detectors and sustaining 72.4% CA under adaptive attackers.<\/jats:p>","DOI":"10.3390\/s26030835","type":"journal-article","created":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T11:35:42Z","timestamp":1769513742000},"page":"835","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Physics-Aware Spatiotemporal Consistency for Transferable Defense of Autonomous Driving Perception"],"prefix":"10.3390","volume":"26","author":[{"given":"Yang","family":"Liu","sequence":"first","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zishan","family":"Nie","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tong","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Northeast Electric Power University, Jilin 132000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-2024-2799","authenticated-orcid":false,"given":"Minghui","family":"Chen","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiheng","family":"Yao","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jieke","family":"Lu","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"},{"name":"Electric Power Research Institute of Guangxi Power Grid Co., Ltd., Nanning 530000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Linya","family":"Peng","sequence":"additional","affiliation":[{"name":"Faculty of Artificial Intelligence in Education, Central China Normal University, Wuhan 430079, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fuming","family":"Fan","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Internet of Intelligence, School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"122836","DOI":"10.1016\/j.eswa.2023.122836","article-title":"Autonomous driving system: A comprehensive survey","volume":"242","author":"Zhao","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Zhu, Z., Liang, D., Zhang, S., Huang, X., Li, B., and Hu, S. (2016, January 27\u201330). Traffic-Sign Detection and Classification in the Wild. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.232"},{"key":"ref_3","unstructured":"Zhang, Q., Jin, S., Zhu, R., Sun, J., Zhang, X., Chen, Q.A., and Mao, Z.M. (2024, January 14\u201316). On data fabrication in collaborative vehicular perception: Attacks and countermeasures. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"10950","DOI":"10.1109\/TCE.2025.3622367","article-title":"Collaborative Truck-UAV Delivery Routing Optimization under Dynamic Weather Conditions and Customer Demands","volume":"71","author":"Yuan","year":"2025","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"103955","DOI":"10.1016\/j.imavis.2020.103955","article-title":"CrossFusion net: Deep 3D object detection based on RGB images and point clouds in autonomous driving","volume":"100","author":"Hong","year":"2020","journal-title":"Image Vis. Comput."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27\u201330). DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201324). Towards Evaluating the Robustness of Neural Networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_8","unstructured":"Song, D., Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Tramer, F., Prakash, A., and Kohno, T. (2018, January 13\u201314). Physical adversarial examples for object detectors. Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT 18), Baltimore, MD, USA."},{"key":"ref_9","first-page":"15498","article-title":"Adversarially robust 3D point cloud recognition using self-supervisions","volume":"34","author":"Sun","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_10","unstructured":"Chiang, P.Y., Ni, R., Abdelkader, A., Zhu, C., Studer, C., and Goldstein, T. (2020, January 26\u201330). Certified Defenses for Adversarial Patches. Proceedings of the International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia."},{"key":"ref_11","unstructured":"Xiang, C., Bhagoji, A.N., Sehwag, V., and Mittal, P. (2021, January 11\u201313). PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Vedaldi, A., Bischof, H., Brox, T., and Frahm, J.M. (2020). Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency. Computer Vision\u2014ECCV 2020, Springer.","DOI":"10.1007\/978-3-030-58542-6"},{"key":"ref_13","unstructured":"Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. (2022). Diffusion models for adversarial purification. arXiv."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Chen, Z., Dash, P., and Pattabiraman, K. (2023, January 10\u201314). Jujutsu: A two-stage defense against adversarial patch attacks on deep neural networks. Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, Melbourne, VIC, Australia.","DOI":"10.1145\/3579856.3582816"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Garg, S., Chattopadhyay, N., and Chattopadhyay, A. (2022, January 9\u201311). Robust Perception for Autonomous Vehicles using Dimensionality Reduction. Proceedings of the 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Wuhan, China.","DOI":"10.1109\/TrustCom56396.2022.00216"},{"key":"ref_16","unstructured":"Man, Y., Muller, R., Li, M., Celik, Z.B., and Gerdes, R. (2023, January 9\u201311). That person moves like a car: Misclassification attack detection for autonomous systems using spatiotemporal consistency. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Yu, Z., Li, A., Wen, R., Chen, Y., and Zhang, N. (2024, January 14\u201318). Physense: Defending physically realizable attacks for autonomous systems via consistency reasoning. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, Salt Lake City, UT, USA.","DOI":"10.1145\/3658644.3690236"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Xiao, C., Deng, R., Li, B., Lee, T., Edwards, B., Yi, J., Song, D., Liu, M., and Molloy, I. (November, January 27). Advit: Adversarial frames identifier based on temporal consistency in videos. Proceedings of the 2019 IEEE\/CVF International Conference on Computer Vision, Seoul, Republic of Korea.","DOI":"10.1109\/ICCV.2019.00407"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Ding, L., Wang, Y., Yuan, K., Jiang, M., Wang, P., Huang, H., and Wang, Z.J. (2021, January 2\u20139). Towards universal physical attacks on single object tracking. Proceedings of the Proceedings of the 35th AAAI Conference on Artificial Intelligence, Virtual.","DOI":"10.1609\/aaai.v35i2.16211"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"366","DOI":"10.1109\/TCAD.2023.3305932","article-title":"Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attacks","volume":"43","author":"Han","year":"2024","journal-title":"IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"17218","DOI":"10.1109\/TITS.2024.3421339","article-title":"Deep learning-based robust multi-object tracking via fusion of mmWave radar and camera sensors","volume":"25","author":"Cheng","year":"2024","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Guo, Z., Wu, J., Tian, Y., Tang, H., and Guo, X. (2022). Real-time vehicle detection based on improved yolo v5. Sustainability, 14.","DOI":"10.3390\/su141912274"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Varghese, R., and M., S. (2024, January 18\u201319). YOLOv8: A Novel Object Detection Algorithm with Enhanced Performance and Robustness. Proceedings of the 2024 International Conference on Advances in Data Engineering and Intelligent Computing Systems (ADICS), Hennai, India.","DOI":"10.1109\/ADICS58448.2024.10533619"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"23747","DOI":"10.1109\/JIOT.2025.3554008","article-title":"Lightweight Hybrid Device Identification for IoT Applications","volume":"12","author":"Liu","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_25","unstructured":"Wang, C., Muller, R., Song, R., Monteuuis, J.P., Petit, J., Man, Y., Gerdes, R., Celik, Z.B., and Li, M. (2025, January 13\u201315). From Threat to Trust: Exploiting Attention Mechanisms for Attacks and Defenses in Cooperative Perception. Proceedings of the 34th USENIX Security Symposium (USENIX Security 25), Seattle, WA, USA."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Chatziioannou, I., Tsigdinos, S., Tzouras, P.G., Nikitas, A., and Bakogiannis, E. (2024). Connected and Autonomous Vehicles and Infrastructure Needs: Exploring Road Network Changes and Policy Interventions. Deception in Autonomous Transport Systems: Threats, Impacts and Mitigation Policies, Springer.","DOI":"10.1007\/978-3-031-55044-7_5"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Tu, J., Wang, T., Wang, J., Manivasagam, S., Ren, M., and Urtasun, R. (2021, January 11\u201317). Adversarial attacks on multi-agent communication. Proceedings of the 2021 IEEE\/CVF International Conference on Computer Vision, Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.00767"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Yang, C., Kortylewski, A., Xie, C., Cao, Y., and Yuille, A. (2020). Patchattack: A black-box texture-based attack with reinforcement learning. European Conference on Computer Vision, Springer.","DOI":"10.1007\/978-3-030-58574-7_41"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Chen, S.T., Cornelius, C., Martin, J., and Chau, D.H. (2018). Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. Joint European Conference on Machine Learning and Knowledge Discovery in Databases, Springer.","DOI":"10.1007\/978-3-030-10925-7_4"},{"key":"ref_30","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1751","DOI":"10.1109\/TPWRS.2024.3435789","article-title":"A projected gradient descent-based distributed optimal control method of medium-voltage DC distribution system considering line loss","volume":"40","author":"Lu","year":"2024","journal-title":"IEEE Trans. Power Syst."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Purnekar, N., Tondi, B., and Barni, M. (2024, January 3\u20136). Physical Domain Adversarial Attacks Against Source Printer Image Attribution. Proceedings of the 2024 Asia Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), Macau, Macao.","DOI":"10.1109\/APSIPAASC63619.2025.10848809"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Yusuf, B., and Huang, H.H. (2025, January 10\u201314). Robust Handwritten Text Recognition via Multi-Source Adversarial Domain Adaptation for Low-Resource Scripts. Proceedings of the 34th ACM International Conference on Information and Knowledge Management, Seoul, Republic of Korea.","DOI":"10.1145\/3746252.3760865"},{"key":"ref_34","unstructured":"Zhang, S., Cheng, Y., Zhu, W., Ji, X., and Xu, W. (2023, January 9\u201311). CAPatch: Physical Adversarial Patch against Image Captioning Systems. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA."},{"key":"ref_35","unstructured":"Lovisotto, G., Turner, H., Sluganovic, I., Strohmeier, M., and Martinovic, I. (2021, January 11\u201313). SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual."},{"key":"ref_36","unstructured":"Xiang, C., and Mittal, P. (2021). Patchguard++: Efficient provable attack detection against adversarial patches. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Han, X., Wang, H., Zhao, K., Deng, G., Xu, Y., Liu, H., Qiu, H., and Zhang, T. (2024, January 14\u201318). VisionGuard: Secure and Robust Visual Perception of Autonomous Vehicles in Practice. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, Salt Lake City, UT, USA.","DOI":"10.1145\/3658644.3670296"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"7865","DOI":"10.1109\/TIV.2024.3403667","article-title":"Securing autonomous vehicles visual perception: Adversarial patch attack and defense schemes with experimental validations","volume":"9","author":"Liang","year":"2024","journal-title":"IEEE Trans. Intell. Veh."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"2709","DOI":"10.1038\/s41467-025-57845-z","article-title":"Predicting driving comfort in autonomous vehicles using road information and multi-head attention models","volume":"16","author":"Chen","year":"2025","journal-title":"Nat. Commun."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Zhou, T., Ye, Q., Luo, W., Zhang, K., Shi, Z., and Chen, J. (2023, January 2\u20133). F&F Attack: Adversarial Attack against Multiple Object Trackers by Inducing False Negatives and False Positives. Proceedings of the 2023 IEEE\/CVF International Conference on Computer Vision (ICCV), Paris, France.","DOI":"10.1109\/ICCV51070.2023.00422"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"104171","DOI":"10.1016\/j.cag.2025.104171","article-title":"FreqSpace-NeRF: A fourier-enhanced Neural Radiance Fields method via dual-domain contrastive learning for novel view synthesis","volume":"127","author":"Yu","year":"2025","journal-title":"Comput. Graph."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Geiger, A., Lenz, P., and Urtasun, R. (2012, January 16\u201321). Are we ready for autonomous driving? The kitti vision benchmark suite. Proceedings of the 2012 IEEE Conference on Computer Vision and Pattern Recognition, Providence, RI, USA.","DOI":"10.1109\/CVPR.2012.6248074"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Caesar, H., Bankiti, V., Lang, A.H., Vora, S., Liong, V.E., Xu, Q., Krishnan, A., Pan, Y., Baldan, G., and Beijbom, O. (2020, January 13\u201319). nuScenes: A multimodal dataset for autonomous driving. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Yu, F., Chen, H., Wang, X., Xian, W., Chen, Y., Liu, F., Madhavan, V., and Darrell, T. (2020, January 13\u201319). BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00271"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Cao, J., Pang, J., Weng, X., Khirodkar, R., and Kitani, K. (2023, January 17\u201324). Observation-centric sort: Rethinking sort for robust multi-object tracking. Proceedings of the 2023 IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00934"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Xiang, C., and Mittal, P. (2021, January 15\u201319). Detectorguard: Provably securing object detectors against localized patch hiding attacks. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual.","DOI":"10.1145\/3460120.3484757"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"62","DOI":"10.23919\/JSC.2023.0006","article-title":"Automatic Real-Time Detection of Infant Drowning Using YOLOv5 and Faster R-CNN Models Based on Video Surveillance","volume":"4","author":"He","year":"2023","journal-title":"J. Soc. Comput."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Wang, W., Xi, L., Cui, H., Yin, D., and Jingbo, L. (2024, January 8\u201311). 3D Vehicle Detection From Roadside Monocular View Based on Improved CenterNet. Proceedings of the 2024 IEEE International Conference on Cybernetics and Intelligent Systems (CIS) and IEEE International Conference on Robotics, Automation and Mechatronics (RAM), Hangzhou, China.","DOI":"10.1109\/CIS-RAM61939.2024.10672833"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Zhou, Z., Li, B., Song, Y., Yu, Z., Hu, S., Wan, W., Zhang, L.Y., Yao, D., and Jin, H. (March, January 25). Numbod: A spatial-frequency fusion attack against object detectors. Proceedings of the 2025 AAAI Conference on Artificial Intelligence, Philadelphia, PA, USA.","DOI":"10.1609\/aaai.v39i1.32108"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/3\/835\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T11:36:25Z","timestamp":1769513785000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/3\/835"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,27]]},"references-count":49,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["s26030835"],"URL":"https:\/\/doi.org\/10.3390\/s26030835","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,27]]}}}