Projected phantom-object attacks against driver assistance

1. Summary

The camera-based visual perception and object-detection pipeline of Tesla Model X Autopilot (HW2.5/HW3) and Mobileye 630 PRO treats depthless, flat two-dimensional images — a projected road sign, pedestrian, or lane marking, or a phantom sign shown on a digital billboard — as genuine physical objects. The object-classification DNNs were never trained to distinguish a real object from a flat phantom, and the stacks perform no depth, cross-sensor, or vehicular-communication validation of the camera world model [2][3]. An attacker with brief optical line-of-sight into the camera field of view can therefore coerce the driver-assistance system into dangerous, unwarranted actuation: sudden automatic braking, steering toward oncoming lanes, and false road-sign notifications [2][5]. Delivery can be fully remote via a hijacked internet-facing billboard or local via a drone-mounted portable projector [2][8].

2. Affected products & versions

3. The vulnerability in detail

The flaw lives in the camera-based visual perception and object-detection pipeline of the affected ADAS — specifically the object-classification deep neural network — and in the actuation logic that consumes its output to make braking and steering decisions [1][2]. It is not a memory-safety bug, a code-injection bug, or any conventional software defect. There is no buffer to overflow and no parser to confuse. The defect is architectural and perceptual: the object detectors were trained to answer the question “what class of object is in this region of the image?” and were never trained to answer the prior question “is this a real, physically present object, or a flat depthless image of one?” [2][3]. Because the vehicles perform no cross-validation of the camera-derived world model against independent depth, context, surface, or reflected-light evidence — and because there is no deployed vehicular-communication system that could confirm that a perceived object physically exists in the environment — a two-dimensional visual stimulus is accepted as a genuine three-dimensional obstacle and is allowed to drive actuation [2][3].

The root cause, then, is a trained-in blind spot combined with a missing authenticity check bridging perception and control. The DNN faithfully does what it was trained to do: it recognizes the shape of a stop sign, a pedestrian, or a lane line, whether that shape arrives as reflected light from a real object or as projected light on a road surface, or as pixels on a screen. Nothing downstream questions the provenance of that detection before it becomes a control input [2].

The attack mechanism exploits this directly. The attacker introduces a “phantom” — a depthless image of an object — into the camera’s field of view. Two demonstrated delivery vectors exist. In the projector variant, a drone-mounted portable projector flashes a phantom pedestrian or road sign onto the road or a nearby surface within line-of-sight of a passing vehicle’s camera [2][7]. In the billboard variant, the attacker hijacks an internet-connected digital billboard positioned near a road and embeds phantom road signs inside otherwise-ordinary advertisement frames; a pixel-selection algorithm hides the phantom in “uninteresting” regions of the frame for just a few frames so a human observer is unlikely to notice it [2][6][8]. In both cases the detector classifies the flat phantom as a real object, and with no depth or context check the stack acts on it: Tesla suddenly brakes or swerves (including into oncoming lanes), and Mobileye 630 PRO issues a false notification about a fabricated road sign [2][5].

A critical property is how little exposure the phantom requires. Reliable triggering needed the phantom to persist only about 0.42 seconds against Tesla HW3, and about 0.125 seconds (roughly one-eighth of a second) against Mobileye 630 [5][6][8]. This split-second requirement is what makes the billboard variant so potent: a phantom present for a handful of frames is essentially invisible to drivers and passers-by, yet sufficient to trigger actuation.

The preconditions are minimal. No authentication or pairing with the vehicle is required, and there is no per-vehicle secret to defeat — the flaw affects any vehicle of the tested models identically, with no per-vehicle customization [trigger_preconditions]. The projector variant requires optical line-of-sight positioning near the target (e.g., a drone). The billboard variant requires no physical approach to the scene at all and is therefore remote; the only precondition is that the phantom fall within the camera field of view briefly [2].

The step-by-step exploitation chain is: (1) choose a delivery vector — a projector with line-of-sight, or a compromised internet-facing digital billboard; (2) for the billboard, run the pixel-selection algorithm to hide a phantom sign in uninteresting ad regions; (3) present the depthless phantom into a passing vehicle’s camera view briefly (~0.42 s Tesla, ~0.125 s Mobileye); (4) the detector classifies the flat phantom as a real object with no depth or cross-sensor check; (5) the stack actuates on the false object — Tesla brakes or swerves, Mobileye issues a false notification; (6) remove the phantom, leaving little forensic evidence [exploit_chain][6].

Proof-of-concept status: the attack was fully demonstrated on real hardware and peer-reviewed at ACM CCS 2020, with demonstration videos on the authors’ project page. Both projector and billboard variants were reproduced against Tesla Model X HW2.5/HW3 and Mobileye 630 PRO [1][3].

The corresponding weakness class is CWE-1039, “Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations.” The system relies on an automated (machine-learning) recognition mechanism to make safety-relevant decisions, but that mechanism does not adequately detect or handle inputs that have been crafted or manipulated to fool it. Here the “perturbation” is not subtle pixel noise but an entire injected phantom object that the model cannot distinguish from reality, precisely because distinguishing real from fake was never part of its training objective and no compensating validation layer exists [cwe][2][3].

4. Discovery & timeline

The vulnerability was discovered and demonstrated by Ben Nassi (lead author), Yisroel Mirsky, Dudi Nassi, Raz Ben Netanel, Oleg Drokin, and Yuval Elovici of Ben-Gurion University of the Negev [4]. The researchers engaged the vendors through disclosure/bug-bounty channels from early May to October 19, 2019 [3][7]. The work was subsequently presented at ACM CCS in November 2020 [1][8]. Vendor response was dismissive: Mobileye characterized the finding as no exploit, vulnerability, or flaw, and Tesla emphasized that Autopilot is intended for use only with a fully attentive driver and declined to comment on configuration-modification behavior [6][7]. No coordinated firmware patch was issued, consistent with the sources’ position that a single firmware patch cannot remove the physical-world ambiguity [3].

5. Technical reference

• CVE(s): none assigned.
• CWE: CWE-1039 (Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations) [cwe].
• CVSS vector(s): none published. This is not readily scorable under CVSS: the “attacker” gains no privilege and executes no code — they coerce the vehicle’s own legitimate, bounded control output (braking/steering) by manipulating a physical-world sensor input. Standard CVSS confidentiality/integrity/availability metrics map poorly onto a safety-actuation outcome, which is a central reason the CFSE path analysis (Section 6) diverges from CVSS.
• Key timing thresholds (the load-bearing technical metrics here): ~0.42 s phantom persistence to reliably affect Tesla HW3; ~0.125 s for Mobileye 630 [5][6][8]. These define the practical stealth/feasibility of the billboard variant.
• Mitigation performance: GhostBusters detector reports ~0.99 AUC and ~0.994 TPR at zero false positives [2][3][5].
• Code/commit refs: none; the artifacts are the CCS 2020 paper (DOI 10.1145/3372297.3423359), the IACR ePrint 2020/085 preprint, and the authors’ project page [1][2][3].

6. Consequence & CFSE path analysis

Real-world consequence: an attacker can cause a moving, driver-assistance-equipped vehicle on a live public road to suddenly brake, or swerve toward oncoming traffic, in response to an object that does not physically exist — creating a credible risk of collision and injury — and can do so remotely and near-invisibly by hijacking a roadside digital billboard, leaving little forensic evidence [6][8].

Why the CFSE Path Score differs from CVSS: CVSS has no natural way to express “attacker coerces the system’s own safety actuator via a spoofed physical input without gaining any privilege or code execution.” The CFSE path decomposition captures exactly that shape, and the resulting verdict is given below.

Carried CFSE verdict (CRITICAL): The entry decomposes the vulnerability into two co-dominant risk paths, both banded CRITICAL, yielding an overall path_verdict of CRITICAL (direction UNSCORABLE, no CVSS). The DEVICE_CONTROL_SAFETY path captures the demonstrated outcome: a projected or billboard phantom object caused sudden unwarranted automatic braking on a live road (PH:4 dangerous actuation/credible injury), with the attacker coercing the vehicle’s own bounded control output via spoofed input rather than gaining privilege (AT:2). The PERCEPTION_TO_ACTION path captures the mechanism: a depthless phantom corrupts the camera-based world model (DP:4, perception_feeds_action=true) so the automated driving stack acts directly on the false object. Both paths share the same exposure profile — proximity optical line-of-sight positioning (RE:2, EX reachability-bound) with a trivial commodity projector or millisecond billboard frame (EC:4) — and both cross optical/perception/actuation/safety boundaries as a reusable cross-domain bridge (CH:4) affecting every vehicle of the model with no per-vehicle secret (SR:4, SX:3). Recovery is coordinated and imperfect (OR:3) because no single firmware patch removes the physical-world ambiguity; mitigation is via perception-model hardening (GhostBusters), and the condition is reproduced/documented (EV:3) with vendor mitigation recorded (LS:MITIGATED) and no known in-the-wild exploitation.

7. Remediation & mitigations

There is no vendor firmware fix, and the sources are explicit that no single firmware patch fully eliminates the underlying physical-world ambiguity, because the ambiguity is intrinsic to camera-only perception [3].

The primary proposed remediation is GhostBusters, an add-on defense proposed by the researchers: a committee of four lightweight CNNs that each assess an already-detected object along one dimension — reflected light, context, surface, and depth — and combine their judgments to flag depthless phantoms. It is reported at approximately 0.99 AUC and 0.994 TPR with zero false positives [2][3][5]. Because it operates as a post-detection authenticity filter, it directly targets the missing “is this real?” check that is the root cause.

More broadly, the durable direction indicated by the sources is architectural rather than a point patch: introduce cross-sensor and depth validation of the camera world model, and add vehicular-communication confirmation that a perceived object physically exists before acting on it, since a camera-only pipeline cannot inherently distinguish a real object from a phantom [2][3]. For the billboard variant specifically, the delivery channel is a compromised internet-facing digital billboard, so securing and monitoring those billboards’ content-management systems reduces the remote, high-reach attack surface even though it does not address the perceptual defect itself [6][8].

Operationally, the only vendor-stated “mitigation” at disclosure time was Tesla’s reminder that Autopilot requires a fully attentive driver ready to intervene [6] — a usage caveat, not a fix for the defect.

8. Sources

[1] Phantom of the ADAS: Securing Advanced Driver-Assistance Systems from Split-Second Phantom Attacks (ACM CCS 2020) — ACM SIGSAC CCS ’20 — https://dl.acm.org/doi/10.1145/3372297.3423359 — Canonical peer-reviewed publication; definitive for methodology, timing thresholds, attack variants, and the GhostBusters countermeasure. Credibility: researcher-primary.

[2] Phantom of the ADAS: Phantom Attacks on Driver-Assistance Systems (IACR ePrint 2020/085) — IACR Cryptology ePrint Archive — https://eprint.iacr.org/2020/085 — Open-access full-text; complete technical detail, tested-hardware setup (Tesla HW2.5/HW3, Mobileye 630 PRO), root-cause framing, and 0.99 AUC detection result. Credibility: researcher-primary.

[3] Phantom of the ADAS — official project page — Ben Nassi (lead author) — https://www.nassiben.com/phantoms — Demonstration videos, “fundamental flaw” framing, tested-systems list, disclosure window, and GhostBusters description (four CNNs; TPR 0.994; zero false positives). Credibility: researcher-primary.

[4] dblp record: Phantom of the ADAS (Nassi, Mirsky, Nassi, Ben Netanel, Drokin, Elovici) — dblp — https://dblp.org/rec/conf/ccs/NassiMNBDE20.html — Authoritative bibliographic metadata confirming full author roster and CCS 2020 venue. Credibility: primary-advisory.

[5] Split-Second Phantom Images Fool Autopilots — Schneier on Security (Bruce Schneier) — https://www.schneier.com/blog/archives/2020/10/split-second-phantom-images-fool-autopilots.html — Independent expert corroboration of threat model, timing (Tesla 0.42 s / Mobileye ~0.125 s), actuation outcomes, and GhostBusters TPR. Credibility: reputable-press.

[6] Split-Second ‘Phantom’ Images Can Fool Tesla’s Autopilot — Ben-Gurion University Cyber Security Research Center — https://cyber.bgu.ac.il/split-second-phantom-images-can-fool-teslas-autopilot/ — Home-institution writeup describing the pixel-selection hiding algorithm, the 0.42 s reliable-braking figure, the low-forensic-evidence billboard scenario, and Tesla’s “attentive driver” response. Credibility: researcher-primary.

[7] Tesla Autopilot Duped By ‘Phantom’ Images — Threatpost — https://threatpost.com/tesla-autopilot-duped-by-phantom-images/152491/ — Trade-press coverage of the projector-phase phantoms (braking, false notifications), disclosure timeline, and Mobileye’s dismissal. Credibility: reputable-press.

[8] Researchers show how hacked billboards could force Tesla’s autopilot into a collision — TechSpot — https://www.techspot.com/news/87126-researchers-show-how-hacked-billboards-force-tesla.html — Press coverage focused on the remote digital-billboard variant, the collision/traffic-disruption consequence, timing thresholds, and CCS 2020 presentation date. Credibility: reputable-press.