PHANTOM: PHysical ANamorphic Threats Obstructing Connected Vehicle Mobility

TL;DR

PHANTOM introduces a perspective-dependent physical adversarial attack using anamorphic road art to deceive camera-based perception in connected autonomous vehicles. The authors develop a geometry-driven pipeline with $L_g = rac{d h}{H - h}$, $w_{far} = rac{w H}{H - h}$, and $ heta = ext{arctan}ig(rac{w}{2d}ig)$, and optimize anamorphic patterns under black-box settings to achieve high transferability across detectors. Validated in CARLA and SUMO–OMNeT++, PHANTOM achieves attack success rates exceeding 90% under optimal conditions and induces up to an 89% increase in Peak Age of Information (PAoI) in network-level simulations, revealing vulnerabilities in both perception and V2X communications. The work highlights the need for geometry-aware defenses and cooperative perception to mitigate cascading disruptions in cooperative driving systems.

Abstract

Connected autonomous vehicles (CAVs) rely on vision-based deep neural networks (DNNs) and low-latency (Vehicle-to-Everything) V2X communication to navigate safely and efficiently. Despite their advances, these systems remain vulnerable to physical adversarial attacks. In this paper, we introduce PHANTOM (PHysical ANamorphic Threats Obstructing connected vehicle Mobility), a novel framework for crafting and deploying perspective-dependent adversarial examples using \textit{anamorphic art}. PHANTOM exploits geometric distortions that appear natural to humans but are misclassified with high confidence by state-of-the-art object detectors. Unlike conventional attacks, PHANTOM operates in black-box settings without model access and demonstrates strong transferability across four diverse detector architectures (YOLOv5, SSD, Faster R-CNN, and RetinaNet). Comprehensive evaluation in CARLA across varying speeds, weather conditions, and lighting scenarios shows that PHANTOM achieves over 90\% attack success rate under optimal conditions and maintains 60-80\% effectiveness even in degraded environments. The attack activates within 6-10 meters of the target, providing insufficient time for safe maneuvering. Beyond individual vehicle deception, PHANTOM triggers network-wide disruption in CAV systems: SUMO-OMNeT++ co-simulation demonstrates that false emergency messages propagate through V2X links, increasing Peak Age of Information by 68-89\% and degrading safety-critical communication. These findings expose critical vulnerabilities in both perception and communication layers of CAV ecosystems.

Figures (8)

• Figure 1: Illustration of PHANTOM physical adversarial attack on CAVs.
• Figure 2: Anamorphic art illustration scheme using the grid method.
• Figure 3: CARLA simulation environment illustrating the PHANTOM attack setup. The top view shows the road with the anamorphic adversarial example (AE) placed as a decal, while the ego-view captures how the illusion appears to the vehicle’s front camera. This configuration enables evaluation of attack activation distance and perception response under realistic driving scenarios.
• Figure 4: Attack success rate vs. distance under different conditions: (a) varying ego vehicle speed, (b) weather, (c) lighting, and (d) detection model.
• Figure 5: Grad-CAM visualization of YOLOv5 under PHANTOM attack.