Multi-Robot Coordination with Adversarial Perception

TL;DR

This work addresses the resilience of perception-based, multi-robot coordination in the presence of adversarial perception. It introduces a system-theoretic framework that fuses Visual-Inertial Odometry with a learned perception module, modeling adversarial effects as intermittent and spurious measurements and integrating them via a Kalman-filter based estimator coupled with gating for data association. The authors demonstrate how misclassification and mislocalization degrade observability and stability and quantify these effects using an observability-oriented metric, validating the approach with real-time experiments on a small quadrotor team. The results highlight the framework's capacity to sustain robust relative localization and coordinated behavior despite adversarial perception, with future work focusing on uncertainty quantification and theoretical guarantees.

Abstract

This paper investigates the resilience of perception-based multi-robot coordination with wireless communication to online adversarial perception. A systematic study of this problem is essential for many safety-critical robotic applications that rely on the measurements from learned perception modules. We consider a (small) team of quadrotor robots that rely only on an Inertial Measurement Unit (IMU) and the visual data measurements obtained from a learned multi-task perception module (e.g., object detection) for downstream tasks, including relative localization and coordination. We focus on a class of adversarial perception attacks that cause misclassification, mislocalization, and latency. We propose that the effects of adversarial misclassification and mislocalization can be modeled as sporadic (intermittent) and spurious measurement data for the downstream tasks. To address this, we present a framework for resilience analysis of multi-robot coordination with adversarial measurements. The framework integrates data from Visual-Inertial Odometry (VIO) and the learned perception model for robust relative localization and state estimation in the presence of adversarially sporadic and spurious measurements. The framework allows for quantifying the degradation in system observability and stability in relation to the success rate of adversarial perception. Finally, experimental results on a multi-robot platform demonstrate the real-world applicability of our methodology for resource-constrained robotic platforms.

Figures (5)

• Figure 1: Experimental setup for perception-based multi-robot coordination subject to adversarial image attacks. (a) Two Tello-EDU quadrotors (robots) independently run the framework in Fig. \ref{['fig:perception_based_coord']}. Only Robot 2 is subject to adversarial perception. The jackal-UGV is the object of interest located at $\boldsymbol{p}_r \! \in \! \mathbb{R}^{3}$ in an object-centric map. Each quadrotor uses a custom-trained YOLOv7 object detection model to detect the jackal-UGV and then calculates its relative position w.r.t the detected jackal-UGV as described in Sec. \ref{['sec:tracking_localization']}. The quadrotors coordinate their estimated relative positions through the distributed control protocol \ref{['eq:ctrl_pr']} over a wireless communication network. (b) Multi-robot communication architecture for TelloSwarm+. The network is built on the server-client model over Wi-Fi 802.11 using the UDP protocol for multi-threaded, low-latency communication. A motion capture system provides the ground-truth robots' poses.
• Figure 2: Overview of perception-based multi-robot coordination. Our approach models adversarial misclassification and mislocalization in the perception module as sporadic and spurious measurements in a state estimation pipeline. The contribution of this paper is highlighted in the gray box, which encompasses the perception module, shown in the green box, subject to adversarial image attacks. The perception module integrates (Visual-Inertial Odometry) VIO data and object detection data, subject to adversarial attacks, to provide state estimation for the ego-robot, along with capabilities for perception-based relative localization and object tracking. In this setup, the VIO pipeline provides rotation (roll, pitch, yaw) and velocity data in each robot's local frame, and the perception data, subject to adversarial image attacks, provide complementary localization data, which allows for localization of all robots with respect to an object of interest in a global frame. The problem of interest is to evaluate the degree to which adversarial image attacks on the learned perception module cause performance degradation, locally, in robot localization, and globally, in multi-robot coordination. The blue box shows the consensus-based coordination algorithm and the adversary detection algorithm developed in our prior work bahrami2024distributed, bahrami2022detection. These two modules enable resilient coordination in the presence of adversarial attacks on images or transmitted information over the communication network.
• Figure 3: Illustration of reference frames and the perspective camera projection model. $\{{\mathcal{W}}\}$ is the common inertial (world) frame, and $\{{\mathcal{B}}_i\}$ is the body-fixed frame of the $i$-th robot on which a forward-pointing centered camera is attached with the coordinate frame $\{{\mathcal{C}}\}$. We let ${\rm R}_{{ \mathcal{W} \mathcal{B}}} =: {\rm R}$ and ${\rm R}_{{ \mathcal{B} \mathcal{C}}} =: \bar{\rm R}$ which yields ${\rm R}_{{ \mathcal{C} \mathcal{W}}} = {\rm R}_{ \mathcal{C} \mathcal{B}} {\rm R}_{{ \mathcal{B}\mathcal{W}}} = \bar{\rm R}^{\top} {\rm R}^{\top}$. Finally, without loss of generality, we assume that the body frame $\{{\mathcal{B}}_i\}$ and the camera frame $\{{\mathcal{C}}\}$ have no offset and differ only in orientation.
• Figure 4: Timestamped adversarial perception (Sec. \ref{['sec:perception']}) and relative localization (Sec. \ref{['sec:tracking_localization']}) of Robot 2 in the two-robot coordination experiments described in Fig. \ref{['fig:exp_tello_vision']}. The 2D detection boxes with labels on top are the outputs of the custom-trained YOLOv7 model, while the green boxes with labels underneath are calculated by projecting the 3D relative position estimations from the Kalman filter \ref{['eq:kalman_filter']} into the image space under Assumption \ref{['assum:orthographic_proj']} for the objects of known size (i.e. Jackal-UGV as the landmark). (a) The case of adversarial mislocalization that causes spurious 3D measurements and overload. b) The case of adversarial mislocalization and misclassification that cause spurious and sporadic 3D measurements. The image frames in (a)-(b) are cropped for better visualization.
• Figure 5: Results from a two-robot perception-based coordination experiment using the framework shown in Fig. \ref{['fig:perception_based_coord']}, subject to both adversarial misclassification and mislocalization as detailed in Tables \ref{['tab:DoS_False_neg_data']}-\ref{['tab:mix_adv']}. (a) The evolution of the induced $2$-norm of state estimation covariance matrix $\mathbf{ P }_k$, as a stability metric wu2017kalman of Kalman filter \ref{['eq:kalman_filter']}, for the three levels of adversarial perception listed as Exp. 1, 3, and 8 in Table \ref{['tab:DoS_False_neg_data']}. The peaks reflect the degenerative effect of adversarial misclassification-induced missed measurements of \ref{['eq:unc_localization']}. (b) Observability degradation as defined in \ref{['eq:obs_quality']} for Kalman filter \ref{['eq:kalman_filter']} under missed measurements of \ref{['eq:unc_localization']} that were caused at the three levels of adversarial perception listed as Exp. 1, 3, and 8 in Table \ref{['tab:DoS_False_neg_data']}. The red shades indicate time intervals with missed measurements associated with Exp. 8. (c) The degenerative effect of an overload of adversarially spurious perception data on latency, relative position localization, and multi-robot coordination (cf. (d)). (d) Demonstration of the proposed framework's capability for robust relative localization and multi-robot coordination under adversarial misclassification and mislocalization at the levels specified in Exp. 16 in Table \ref{['tab:mix_adv']}.

Theorems & Definitions (3)

• Remark 1
• Remark 2
• Remark 3