Stereo vision plays a critical role in enabling depth perception for drones, supporting navigation and obstacle avoidance in complex environments. However, the robustness and security of stereo vision systems remain largely underexplored. In this paper, we propose Rolling in the Deep (RiD), a novel physical attack that exploits the rolling shutter effect (RSE) to inject imperceptible, structured perturbations into stereo image pairs. We analyze RSE formation in binocular camera setups and show how RSE-based perturbations can degrade deep learning-based stereo matching by exploiting model vulnerabilities and sensor misalignments, resulting in incorrect depth estimation. Preliminary results show the feasibility of RiD under realistic stereo configurations, revealing a new class of threats to drone perception systems.

Adversarial attacks with real objects or lasers on car-borne LiDAR-based object detection are concerning. The existing defense approaches are often designed to address specific attacks and short of considering adaptive attackers who may adapt based on all available information about the deployed defense to maximize attack effect. This paper proposes Hyper3Def, a new defense for the function of detecting vehicle objects, which uses a Hypernet to generate an ensemble of multiple new detection models when needed at run time. The detection results of these models are fused to give the final result. As a dynamic defense, Hyper3Def revokes an important basis of the adaptive attack, i.e., the object detection model is needed to plan effective adversarial perturbations. Evaluation based on open data and real-world experiments with embedded system implementation show that, when confronting adaptive attacks, Hyper3Def outperforms various baseline defenses including the adversarial training, which is often cited as the state of the art.

Camera-based object detection excels but remains vulnerable to adversarial attacks that suppress target detection (object-hiding attacks). Here, we propose PaSED, a Parameterized Stochastic Ensemble Defense, which leverages HyperNetworks to enable rapid and diverse updates for detection models in the ensemble. At its core, we introduce functional diversity to enhance the defense robustness. It adapts each generation process to the input image preprocessing parameterized by HyperNetworks' random noise input. In our preliminary evaluations against physically deployed attacks, PaSED outperforms five baseline defenses without requiring attack knowledge. It recovers attacked objects in 92% and 98% of frames in the indoor and outdoor testbeds, respectively.

Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.

Camera-based computer vision is crucial for autonomous vehicle perception. We demonstrate GhostStripe [5], an attack system that uses light-emitting diodes and exploits the camera's rolling shutter effect to generate adversarial stripes that are invisible to humans while misleading traffic sign recognition. To maintain stable attack effectiveness, GhostStripe controls the timing of the modulated light emission, adapting to both the camera's framing operation and the movement of the victim vehicle. Evaluated on real testbeds, GhostStripe can stably spoof traffic sign recognition results for up to 97% of frames to a wrong class when the victim vehicle passes the road section.

Smartphone indoor location awareness is increasingly demanded by a variety of mobile applications. The existing solutions for accurate smartphone indoor localization rely on additional devices or pre-installed infrastructure (e.g., dense WiFi access points, Bluetooth beacons). In this demo, we present EchoLoc, an infrastructure-free smartphone indoor localization system using room acoustic response to a chirp emitted by the phone. EchoLoc consists of a mobile client for echo data collection and a cloud server hosting a deep neural network for location inference. EchoLoc achieves 95% accuracy in recognizing 101 locations in a large public indoor space and a median localization error of 0.5 m in a typical lab area. Demo video is available at https://youtu.be/5si0Cq6LzT4.