Accepted Demos
GazeLock - Physical-World Adversarial Attacks on Camera-Based Driver Monitoring in Autonomous Vehicles
Mboutidem Ekemini Mkpong, Halima Bouzidi, Mohammad Al Faruque, University of California, Irvine;
Driver Monitoring Systems (DMS) are safety-critical components in Level 2–4 autonomous vehicles, responsible for verifying driver attentiveness and triggering takeover requests. These systems rely on camera-based gaze estimation models to infer where the driver is looking. However, the adversarial robustness of these models remains largely unexplored, raising the question of whether an attacker can manipulate gaze estimation to undermine DMS and vehicle safety guarantees. We present GazeLock, a novel physical-world attack framework that uses adversarial eyeglasses to force gaze estimators into outputting a targeted gaze prediction regardless of the driver’s actual gaze direction. We explore two material modalities: traditional RGB-printed patterns and infrared-sensitive material patterns that are invisible to the human eye but effective against NIR DMS cameras. Our live demo allows attendees to wear the adversarial glasses and observe real-time gaze misdirection on a simulated DMS interface, with video demonstrations of the attack under varied conditions.
Is Your ECU Really Yours? Live Hardware Fingerprinting of Embedded Devices via Analog Switching Signals
Abbas Ali and Hafiz Malik, University of Michigan-Dearborn
This demo presents a live hardware fingerprinting system that identifies 8 embedded devices across 4 hardware types by analyzing the analog characteristics of a periodic GPIO switching signal. No firmware modification or protocol access is required. Attendees can connect any of the 8 devices to the measurement setup and observe real-time classification results on screen, achieving 99.5% real-time accuracy including same-model clone pair discrimination.
Certificateless and Non-Interactive Key Establishment for Secure CCS EV Charging
Muhammad Jahanzeb Khan, Hassan Mahmoud, Dylan Canipe, Mahmoud N. Mahmoud, Mizanur Rahman, and Ahmad Alsharif, The University of Alabama
We demonstrate a certificateless, non-interactive key establishment mechanism integrated into the SLAC pairing process for CCS-based EV charging. The proposed integration leverages identity-based cryptography to replace plaintext NMK delivery with a decentralized non-interactive key derivation, eliminating additional message exchanges and certificate overhead. Compared to ECDH-based approaches, our method avoids interactive key exchange and reduces man-in-the-middle exposure at the PLC layer by eliminating plaintext NMK delivery. When combined with policy-controlled fallback, the design also reduces downgrade opportunities during SLAC key establishment. Our integration is implemented and verified on HomePlug Green PHY (HPGP) testbeds using ISO 15118-3 SLAC, preserving compatibility with the standard SLAC procedure and avoiding PKI overhead.
ELDSentry: A Simple DIY J1939 Firewall to Prevent CAN Bus Attacks via ELDs or the Diagnostic Port
Joseph Olatt, Samuel C. Hollifield, Joel Asiamah, and Rima Asmar Awad, Oak Ridge National Laboratory
ELDSentry is a simple do-it-yourself (DIY) microcontroller-based firewall that prevents injection of arbitrary CAN messages onto the CAN bus via devices connected to the SAE J1939 diagnostic port. Additionally, the system logs CAN data to a microSD card. The primary objective was to prevent CAN attacks via the wireless interfaces (WiFi, Bluetooth Low Energy, etc.) found on most ELDs that have been mandated by the Federal Motor Carrier Safety Administration (FMCSA) since 2016 for most commercial motor vehicles (CMV).
The setup uses common off-the-shelf components, like the Teensy microcontroller, CAN Transceivers, DC voltage regulators, etc. The objective is to make the hardware bill of materials, wiring diagram and software code freely accessible, with the vision/hope that CMV operators can procure the hardware portion of this device from any entity that is independent of someone like an ELD vendor, inspect the software that runs it and protect themselves from ELDs (and other similar devices) from being used as a wireless attack surface.
Bluetooth Impersonation from Pairing Keys Recovered in Used Vehicle Infotainment Systems
Bhargab Acharya, Christos Papadopoulos, and Spiros Thanasoulas, University of Memphis
Used vehicle infotainment head units, routinely sold on secondary markets, retain Bluetooth pairing keys from prior owners alongside personally identifiable information (PII). We demonstrate that an attacker who recovers a BR/EDR link key from such a unit can impersonate the original head unit to a previously paired phone and exercise the Bluetooth profiles the phone had granted to the vehicle—most notably HFP, PBAP, and MAP—to exfiltrate contacts and call logs, intercept calls and SMS-based one-time passwords, and in some configurations invoke the phone’s voice assistant, in several cases against a locked phone. Co-recovered PII (home address, prior-owner names, GPS traces, paired-device names) makes targeting practical rather than opportunistic. We demonstrate the full chain live on a salvaged 2016 Honda Pilot head unit against an attacker-controlled test phone.
Open CAN Bus Interfaces for BeamNG.tech: Enabling Affordable HIL and Software-in-the-Loop Automotive Security Research
Bhargab Acharya, Christos Papadopoulos, and Spiros Thanasoulas, University of Memphis
BeamNG.tech is a high-fidelity vehicle simulator widely used in automotive research. We present three open BeamNG transport extensions: CANBusSerial.lua (slcan USB-CAN adapters), CANBusUDP.lua (UDP bridge between machines), and CANBusVirtual.lua (direct SocketCAN binding); plus an input consumer CANBusInput.lua, that expose BeamNG’s vehicle CAN traffic to vcan, SocketCAN tools, real ECUs, or a physical instrument cluster, at a fraction of the hardware cost (roughly 25 for a CANable adapter versus 300 for a PEAK PCAN-USB, or zero with vcan). As a demonstration we drive a BeamNG vehicle with Comma.ai’s Openpilot through this CAN layer, and will show a hardware-in-the-loop demo with a physical instrument cluster at the conference. The Lua modules will be released on GitHub and as a BeamNG mod.
Leveraging BeamNG Simulation Environment for Automotive Security Research
Samuel C. Hollifield, Kevin D. Spakes, and Nathan Sutherland, Oak Ridge National Laboratory
Cybersecurity research on vehicle systems is constrained by the cost of physical test vehicles and the proprietary nature of OEM signal definitions. We present a middleware that bridges the BeamNG.Tech vehicle simulation platform and a physical CAN network, translating in-game vehicle sensor state into standards-compliant J1939 CAN messages in real time. The middleware currently extracts 22 signals aligned with the ORNL Driver Identification Dataset and emits them onto a live CAN bus via commodity hardware, enabling controlled replication of real-world driving studies without physical vehi cle access. We describe the system architecture, J1939 signal mapping methodology, and a planned validation study against the original dataset. Future work will integrate CAN injection to support safe, repeatable cyberattack simulation. All source code will be released publicly.
SPHERE-CAN: Enabling Reproducible Automotive Network Security Experimentation
Chandrima Ghatak, Colorado State University; Christopher Tran, USC Information Sciences Institute; Rik Chatterjee, Colorado State University; David Balenson and Jelena Mirkovic, USC Information Sciences Institute; Jeremy Daily, Colorado State University
We present SPHERE-CAN, a platform that exposes a physical automotive network testbed through the SPHERE research infrastructure. The system connects hardware at Colorado State University with the USC Information Sciences Institute SPHERE research infrastructure, allowing users to configure experiments, interact with embedded controllers, and observe network traffic. This demo shows monitoring, message injection, and attack execution on live systems, along with logging of resulting behavior. By enabling interaction with real automotive networks, SPHERE-CAN supports reproducible experimentation and evaluation of automotive cybersecurity.
Sensor-Based Jailbreak Attacks Against Safety Policies in Physical AI Systems
Shri Abijith Mohanraj, Jianshu Wang, and Jinwen Wang, University of Texas at Dallas
Physical AI systems powered by vision-language-action (VLA) models employ safety policies to prevent unsafe actions. However, jailbreak attacks pose a significant threat to generative AI models, including VLAs. This threat is further exacerbated by the rich sensor inputs in physical AI systems, as attackers can manipulate sensor observations with human-imperceptible perturbations to bypass safety policies and induce unsafe actions. In this demo, we show that sensor-based jailbreak attacks against safety policies can achieve a 97% success rate on the NVIDIA GR00T-N1.6 physical AI model.
Real-World Reconstruction of LiDAR Perception under Jamming Attacks
Ryo Yoshida, Takami Sato, Wenlun Zhang, Yuki Hayakawa, Shota Nagai, and Kentaro Yoshioka, Keio University
LiDAR sensors are critical for autonomous driving perception, yet remain vulnerable to spoofing attacks. Jamming attacks inject high-frequency laser pulses that blind LiDAR sensors by overwhelming authentic returns with malicious signals. We discover that while point clouds become randomized, the underlying full-waveform data retains distinguishable signatures between attack and legitimate signals. In this work, we propose PULSAR-Net, capable of reconstructing authentic point clouds under jamming attacks by leveraging previously underutilized intermediate full-waveform representations and simultaneous laser sensing in modern LiDAR systems. PULSAR-Net adopts a novel U-Net architecture specifically designed to identify attack-induced signals from legitimate returns in the full-waveform representation. To address the lack of full-waveform representations in existing LiDAR datasets under jamming attacks, we introduce a physics-aware dataset generation pipeline that synthesizes realistic attacked waveforms. Despite being trained exclusively on synthetic data, PULSAR-Net achieves substantial reconstruction in real-world static and driving scenarios.
Controlling Depth Estimation in Stereo Cameras with Projected Patterns
Tetsu Ishizue, The University of Electro-Communications; Nicholas U. Costagliola, University of Florida; Sri Hrushikesh Varma Bhupathiraju, University of Florida; Ozora Sako and Kentaro Yoshioka, Keio University; Takeshi Sugawara, University of Electro-Communications; Sara Rampazzi, University of Florida
Stereo cameras are integrated into autonomous systems such as self-driving cars and drones to provide precise depth estimation more cost-effectively than LiDAR. In this demo, we reveal an intrinsic vulnerability in stereo cameras’ image-pixel sampling that influences the outcomes of stereo matching algorithms. Attackers can exploit this vulnerability by using simple repeated patterns to achieve fine-grained control over the estimated depth of genuine obstacles. We determine the cause of the vulnerability and demonstrate precise manipulation of the estimated depth on the RealSense D435, a popular commercial stereo camera with a proprietary depth-matching algorithm. Our work highlights intrinsic vulnerabilities in stereo-based depth estimation algorithms and addresses critical limitations in autonomous system deployments.
A Benchmark for Security Evaluation of Adversarial Manoeuvre Attacks in Autonomous Driving
Adibeh Emamy, Marcello Maugeri, and PingChen Lin, CybPass Limited; Aryan Pasikhani, The University of Sheffield
Adversarial manoeuvre attacks examine how an Autonomous Driving policy responds when another road user performs physically valid but adversarial vehicle manoeuvres. Studying these attacks requires changing road geometry, traffic density, attacker behaviour, victim policy, and evaluation metrics under controlled conditions. The demonstration presents an open-source MetaDrive-based benchmarking platform for configuring these conditions, training driving policies, training adversarial attackers, and evaluating attack outcomes through replays, logs, and metrics. The live demonstration uses a highway road geometry and reinforcement-learning policies trained with PPO, showing the complete workflow from victim training to attacker training and final evaluation.
Accepted Posters
Mitigating Persistent Personal Data Exposure in Vehicle Infotainment Systems
Bhargab Acharya, University of Memphis; Sam Lauzon, Bishop Fox; Spiros Thanasoulas, University of Memphis; David Balenson, USC Information Sciences Institute; Christos Papadopoulos, University of Memphis
Personally Identifiable Information (PII) routinely persists on vehicle infotainment systems after ownership changes, and retrieving it has been shown to be easy with off-the-shelf forensic tools. Such data can be abused by malicious actors. The cryptographic and storage elements needed to address this already exist and are widely deployed in phones and laptops but not vehicles. The challenge is not a gap in technology, but adapting existing mechanisms to vehicle-specific realities: shared use, physical keys instead of passwords, messy identity, and limited OTA updates. We analyze these constraints, identify deployable fixes that require no new cryptographic or hardware primitives, and outline what is needed to implement them in practice. Our goal is to provide actionable guidance for OEMs, regulators, and consumers.
Mind the Structural Gap - Evaluating Automotive CAN Datasets as Interchangeable Benchmarks for Intrusion Detection
Isha Pali, UQ-IITD Research Academy; Shubham Thakur and Vikas Maurya, Indian Institute of Technology Delhi; Naipeng Dong, The University of Queensland, Australia; Vireshwar Kumar, Indian Institute of Technology Delhi; Dan Dongseong Kim, The University of Queensland, Australia
Network intrusion detection systems (NIDS) proposed for the automotive CAN are routinely evaluated on public datasets under the implicit assumption that these datasets represent comparable notions of benign traffic. We challenge this assumption through a measurement study of six public CAN datasets: CH, OTIDS, CAN-MIRGU, ROAD, SynCAN, and X-CANIDS. Characterizing each along four structural dimensions ID space size, transition density, payload entropy, and inter-ID correlation, we find variation of up to 10× in ID space and 2× in transition density, and different structurally isolated clusters in terms of payload entropy and transition density. These findings show that public CAN datasets are not interchangeable benchmarks, and that evaluation results are strongly conditioned on dataset structure.
Cloaking Signals with Signs: Traffic-Sign-Camouflaged Adversarial Patches against Traffic Light Detection
Kyo Suetsugu and Go Tsuruoka, Waseda University; Yuna Tanaka and Kazuki Nomoto, Deloitte Tohmatsu Cyber LLC; Hiroto Onoda, Waseda University; Tatsuya Mori, Waseda University/RIKEN AIP/NICT
Adversarial attacks against traffic light recognition pose security risks to autonomous driving systems, but visually conspicuous patches are difficult to deploy stealthily in real-world environments. This poster presents a traffic-sign-camouflaged adversarial patch attack that hides traffic lights from a detector while making the patch resemble a real traffic sign. Motivated by scenarios where traffic signs appear near traffic lights, our method optimizes the patch using detection suppression loss, traffic-sign-based camouflage loss, EoT, and TV loss. We evaluate the attack in both digital experiments and physical-world experiments with a traffic light mock-up. The best patch achieved 85% ASR in digital experiments, and several physical-world conditions reached 100% ASR, demonstrating the feasibility of stealthy traffic light hiding attacks.
Policy-Guided Enforcement in Unmanned Aerial Vehicles
Sonali Rout and Vireshwar Kumar, Khosla School of Information Technology, Indian Institute of Technology Delhi
Unmanned Aerial Vehicles (UAVs) operating in civilian airspace are increasingly vulnerable to remote software attacks that can manipulate flight paths and violate restricted no fly zones. Existing geofencing mechanisms that assume trustworthiness of the onboard software, fail under attacks such as command injection, memory corruption, or compromise of the complete software stack, including the operating system. We propose a novel framework consisting of a multi layered attestation and policy enforcement mechanism for the UAV equipped with a trusted execution environment. Our framework establishes trust in the navigation system by ensuring that a given flight plan is strictly followed and protected against unauthorized modifications, thereby guaranteeing mission integrity, albeit with acceptable computational overhead.