# Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing (Extended Version) arXiv: https://arxiv.org/abs/2006.10318 ยท HTML: https://mlsanity.com/paper/2006.10318/ ## Key facts - Cited by 25 papers in the map (data through 14 Oct 2026). - First posted on arXiv 18 Jun 2020. ## Built on by (most cited first, 25 of 25) - [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021) - [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022) - [Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks](https://mlsanity.com/paper/2502.13175/) (2025) - [Fooling LiDAR Perception via Adversarial Trajectory Perturbation](https://mlsanity.com/paper/2103.15326/) (2021) - [SoK: On the Semantic AI Security in Autonomous Driving](https://mlsanity.com/paper/2203.05314/) (2022) - [A Survey on Scenario-Based Testing for Automated Driving Systems in High-Fidelity Simulation](https://mlsanity.com/paper/2112.00964/) (2021) - [Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles](https://mlsanity.com/paper/2109.06126/) (2021) - [On Data Fabrication in Collaborative Vehicular Perception: Attacks and Countermeasures](https://mlsanity.com/paper/2309.12955/) (2023) - [DoubleStar: Long-Range Attack Towards Depth Estimation based Obstacle Avoidance in Autonomous Systems](https://mlsanity.com/paper/2110.03154/) (2021) - [APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation](https://mlsanity.com/paper/2303.01351/) (2023) - [Security Considerations in AI-Robotics: A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2310.08565/) (2023) - [Detecting Multi-Sensor Fusion Errors in Advanced Driver-Assistance Systems](https://mlsanity.com/paper/2109.06404/) (2021) - [Enhancing LLM-based Autonomous Driving Agents to Mitigate Perception Attacks](https://mlsanity.com/paper/2409.14488/) (2024) - [MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models](https://mlsanity.com/paper/2403.19080/) (2024) - [Self-Localized Collaborative Perception](https://mlsanity.com/paper/2406.12712/) (2024) - [AutoML for Multi-Class Anomaly Compensation of Sensor Drift](https://mlsanity.com/paper/2502.19180/) (2025) - [Learning-Based Vulnerability Analysis of Cyber-Physical Systems](https://mlsanity.com/paper/2103.06271/) (2021) - [A Certifiable Security Patch for Object Tracking in Self-Driving Systems via Historical Deviation Modeling](https://mlsanity.com/paper/2207.08556/) (2022) - [Trustworthy Sensor Fusion against Inaudible Command Attacks in Advanced Driver-Assistance System](https://mlsanity.com/paper/2306.05358/) (2023) - [Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systems](https://mlsanity.com/paper/2307.08939/) (2023) - [PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lighting](https://mlsanity.com/paper/2505.05183/) (2025) - [Development of Vision-Language Model-based GNSS Spoofing Detection for Autonomous Vehicle Navigation](https://mlsanity.com/paper/2607.23962/) (2026) - [High-Order Liquid Evidence Encoding for Gradual GNSS Spoofing Detection in Autonomous Driving](https://mlsanity.com/paper/2608.11790/) (2026) - [Adversarial Calibration Attack on Autonomous Vehicles](https://mlsanity.com/paper/2608.28778/) (2026) - [High-Order Liquid Evidence Modeling for Continuous and Subtle GNSS Spoofing Detection in Autonomous Driving](https://mlsanity.com/paper/2609.26231/) (2026) ## Abstract (arXiv) For high-level Autonomous Vehicles (AV), localization is highly security and safety critical. One direct threat to it is GPS spoofing, but fortunately, AV systems today predominantly use Multi-Sensor Fusion (MSF) algorithms that are generally believed to have the potential to practically defeat GPS spoofing. However, no prior work has studied whether today's MSF algorithms are indeed sufficiently secure under GPS spoofing, especially in AV settings. In this work, we perform the first study to fill this critical gap. As the first study, we focus on a production-grade MSF with both design and implementation level representativeness, and identify two AV-specific attack goals, off-road and wrong-way attacks. To systematically understand the security property, we first analyze the upper-bound attack effectiveness, and discover a take-over effect that can fundamentally defeat the MSF design principle. We perform a cause analysis and find that such vulnerability only appears dynamically and non-deterministically. Leveraging this insight, we design FusionRipper, a novel and general attack that opportunistically captures and exploits take-over vulnerabilities. We evaluate it on 6 real-world sensor traces, and find that FusionRipper can achieve at least 97% and 91.3% success rates in all traces for off-road and wrong-way attacks respectively. We also find that it is highly robust to practical factors such as spoofing inaccuracies. To improve the practicality, we further design an offline method that can effectively identify attack parameters with over 80% average success rates for both attack goals, with the cost of at most half a day. We also discuss promising defense directions.