Attack on shared AI sensing breaks 2 defenses with near 100% success

Researchers show a new attack on cooperative perception. In this setup, AI systems share sensor data with partners to see more than the sensors of the system can see. The attack, RT-TrPB, gets through the 2 defenses ROBOSAC and FLD, with success near 100%. It makes each incorrect message in less than 56 milliseconds and works without access to the victim model.

How it works

The first attack makes the receiver think that bad changes are help, in areas that it cannot check with its sensors. That attack had to have the structure and the adjustments of the victim model. The new attack uses different stand-in models and a set of changes that it can use again. It works on models that it has not seen.

The numbers

• Success near 100% against the 2 defenses on benchmarks that many teams use.
• Less than 56 milliseconds to make each change.
• STTrust finds more than 90% of such attacks and gives performance near the level without attack.

STTrust checks if messages agree in space and in time, and it uses trust in the sender.

What is not known

The source gives no test on systems in use and no test by other teams. The numbers come from the authors.

Insight: Attacks that copy help get through content checks

In October 2026, researchers showed an attack with only correct text from a seller. A different attack, Log-To-Leak, kept the task result almost the same. RT-TrPB also copies help. This reads as a test of trust: attackers copy usual input, and defenders must check the source and the consistency, as STTrust does. For leaders: make vendors show how they check input that they cannot make sure of.