Detecting Temporal Misalignment Attacks in Multimodal Fusion for Autonomous Driving
Authors: Md Hasan Shahriar
Md Mohaimin Al Barat
Harshavardhan Sundar
Ning Zhang
Naren Ramakrishnan
Thomas Hou
Wenjing Lou
Venue: ICLR 2026 Poster (2026)
Keywords: Multimodal Fusion
Temporal Misalignment Attack
Attack Detection
Autonomous Driving
Primary area: applications to robotics, autonomy, planning
TL;DR: We propose AION, a plug-in defense for autonomous driving that combines Continuity-Aware Contrastive Learning and DTW-based anomaly scoring to detect subtle temporal misalignments in multimodal sensor data.

Abstract: Multimodal fusion (MMF) is crucial for autonomous driving perception, combining camera and LiDAR streams for reliable scene understanding. However, its reliance on precise temporal synchronization introduces a vulnerability: adversaries can exploit network-induced delays to subtly misalign sensor streams, degrading MMF performance. To address this, we propose AION, a lightweight, plug-in defense tailored for the autonomous driving scenario. AION integrates continuity-aware contrastive learning to learn smooth multimodal representations and a DTW-based detection mechanism to trace temporal alignment paths and generate misalignment scores. 
AION demonstrates strong and consistent robustness against a wide range of temporal misalignment attacks on KITTI and nuScenes, achieving high average AUROC for camera-only (0.9493) and LiDAR-only (0.9495) attacks, while sustaining robust performance under joint cross-modal attacks (0.9195 on most attacks) with low false-positive rates across fusion backbones. Code is available at: https://github.com/shahriar0651/AION.

Published as a conference paper at ICLR 2026
DETECTING TEMPORAL MISALIGNMENT ATTACKS IN MULTIMODAL FUSION FOR AUTONOMOUS DRIVING
Md Hasan Shahriar! Md Mohaimin Al Barat
Harshavardhan Sundar
Naren Ramakrishnan' Ning Zhang
Y. Thomas Hou
Wenjing Loui
Viiginia Tech, Blacksburg, VA, USA
(hshahriar, barat, naren, thou, wilou]evt.ed Amazon.com, Inc., Seattle, WA, USA
hsundar 42 com.
Washington University in St. Louis, St. Louis, MO, USA zhang. wwnggwustt..en. edu
ABSTRACT
Multimodal fusion (MMF) is crucial for autonomous driving perception, combin- ing camera and LiDAR streams for reliable scene understanding. However, its re- liance on precise temporal synchronization introduces vulnerability: adversaries can exploit network-induced delays to subtly misalign sensor streams, degrading MMF performance. To address this, we propose AION, a lightweight, plug-in defense tailored for the autonomous driving scenario. AION integrates continuity- aware contrastive learning to learn smooth multimodal representations and a DTW-based detection mechanism to trace temporal alignment paths and generate misalignment scores. AION demonstrates strong and consistent robustness against a wide range of temporal misalignment attacks on KITTI and nuScenes, achieving high average AUROC for camera-only (0.9493) and LiDAR- (0.9495) attacks, while sustaining robust performance under joint cross-modal attacks (0.9195 on most attacks) with low false-positive rates across fusion backbones. Code is avail- able at: httts:://gitteia http://www..o.eeaaaaaarr01//////
INTRODUCTION
Autonomous vehicles rely multimodal fusion (MMF) of complementary sensors such as cameras and LiDAR to achieve robust perception (Zhang et al. 2023 Feng et al. 2020 Chen et al. 2017). While cameras provide rich semantic texture and LiDAR delivers accurate geometric depth, their integration crucially depends on precise temporal synchronization. Misalignments frames can cause fusion models miss objects generate spurious detections, leading to significant safety hazards in downstream planning and control (Kuhse et al. 2024).
Recent studies, including prior work, have shown that temporal desynchronization not only a benign calibration issue but also a potential attack vector, known as a temporal misalignment (TMA) attack (Shahriar exploited by adversaries to misalign sensor streams in time, thereby degrading the performance of detection and tracking without altering sensor content (Finkenzeller et al. 2025). Specifically, demonstrated that even manll--rraee LiDAR delay can reduce average precision by more than 88% across multiple detection models (Shahriar al. 2026).
2026).. Network-induced delays or timestamp manipulation can be
Existing efforts to handle temporal inconsistency primarily focus on calibration and benign jitter compensation, such as filtering or offline timestamp alignment (Taylor Nieto, 2016)] Zhao et al.) 2021). While effective for clock drift or noise, these methods assume cooperative settings and do not detect deliberate, adversarial misalignments. On the defense side, most work has targeted ad- versarial examples sensor spoofing (Sato et al. 2025 Gao et al.) 2021). rely spatial, semantic, or cross-modal inconsistencies through consistency checks, autoencoders, or hardware safeguards, leaving the temporal dimension of fusion largely unaddressed. Man et al. (2023) enforces track labell consistency but ignores timestamp validity; Li et al. (2020) detects context violations yet fails on time-shifted data; and Xu et al. (024) catches gross spoofing but overlooks subtle desynchroniza-

---

Published as a conference paper at ICLR 2026
tion within tolerance windows. To date, all defense mechanisms assume benign timestamps. leaving them vulnerable to network-level latency manipulation.
To address this gap, we propose AIoN, a lightweight defense patch that augments existing perception models by explicitly monitoring cross-modal temporal consistency. AION learns shared multimodal representations of camera and LiDAR inputs and applies dynamic time warping (DTW) to trace their temporal alignment path (Berndt & Clifford, 1994). In AD, consecutive frames are temporally adjacent and semantically similar, but standard contrastive learning treats pairs strictly as positive or negative. This rigid approach fails to capture subtle temporal misalignments. To address this, we in- troduce continuity-
contrastive learning (CACL), which encourages the model to learn smooth temporal transitions. Specifically, we estimate the "negativity" of two negative sample pairs based on their temporal distance- paannnce---isssssee closer in time are penalized less than distant pairs-allower the model to adaptively respect temporal continuity, enabling fine-grained multimodal representation.
Moreover, DTW is effective analyzing temporal alignment because it does not assume uniform timing-a practical constraint for AD. Hence, instead of comparing sequences strictly index-to- index, DTW allows non-linear warping along the time axis, making it robust to delays, drifts, or jitter in multimodal sensors- pensors--reciiely the distortions exploited by TMA attacks. Deviations in this alignment yield anomaly scores that indicate potential desynchronization or TMA attacks. In the ab- sence of reliable network timestamps, AION leverages such semantic coherence between modalities to detect deviations in the time series input across different modalities.
Our contributions are as follows:
We propose AION, plug-in detection framework that couples multimodal representation learning with DTW-based temporal alignment and consistency monitoring, providing an efficient, downstream task-agnostic defense against TMA attacks.
We introduce continuity- aware contrastive learning, which leverages temporal proximity to assign graded negativity to sample pairs, enabling the model to learn smooth tempo- ral transitions and detect fine-grained misalignments in multimodal sensor data. We also demonstrate a novel use of DTTW to estimate temporal misalignment, enabling real-time detection of subtle temporal manipulations.
We introduce seven temporal misalignment (TMA) attacks covering both benign faults and adversarial patterns, and evaluate AION across multiple datasets and fusion backbones. It achieves high detection and defense performance with AUROC 0.9493 for camera-only, 0.9495 for LiDAR-only, and 0.9195 most cross-modal attacks, while maintaining low false-positive rates, demonstrating robustness and generalizability. The implementation code and trained models are made public to ensure reproducibility.
BACKGROUND AND THREAT MODEL
Dynamic Time Warping (DTW). DTW is a classical technique for measuring similarity between two temporal sequences that may be of phase or evolve at different speeds. Given sequences x = (I1,.... ......... ........... Fnn and Y = (Ji...., .m)). DTW computes a cost matrix D(i,j) = di [z; Mj), where -(.,-) is a local distance (e.g.. Cosine, Euclidean, etc.). An alignment path is defined as P j1)......... jr)), subject to boundary conditions (i1, (1, 1), (r..,r.) (n, mn) monotonicity, and continuity. The quality of a path is measured by its cumulative alignment cost:
C(P)
Σ D(i.)). (JE)
and the optimal path is obtained as P = arg minp C(P). which specifies how elements of X and Y should be aligned in time, while the minimal cost provides a quantitative measure of align- well-aligned sequences and penalizing distortions. This makes DTW natural candidate for checking temporal alignment across multimodal signals that contain redundant information from the same surroundings.
ment
Temporal Synchronizer in AD. We consider multimodal perception pipeline for autonomous driving (AD) that fuses heterogeneous sensor modalities, focusing on camera (Sc) and LiDAR
(St). At each discrete time step sensor S {Sc, Sr.) produces message (
(3) (0) where
2

---

Published as a conference paper at ICLR 2026
(7) the observation (image point cloud) and iig is the sensor-reported timestamp. In most J.
AD systems, sensor data are exchanged via middleware based on the Data Distribution Service (DDS). ROS 2, a widely used AD middleware. typically synchronizes cross-modal messages with an upproximate-time synchronizer | each sensor modality keeps finite FIFO buffer 2s {m.g,1...... ms,N] of recent messages (ordered by timestamp). An approximate-tine synchronizer pairs messages across modalities based (6) on timestamp proximity. For a new camera message (or LiDAR message), m the synchronizer selects the LiDAR message (or camera message) with the closest timestamp,
that matches timestamps within a tolerance At. Concretely,
(k) (i) arg min 2tc '
) their reported time difference is within tolerance and that paired and forms a pair (m& ; m data is then processed and fused by the perception model.
Multimodal Fusion-based Perception Each modality has its own encoder Es that extracts feature-level representations: f( Ec(x() and f(z") Ex The features are fused using multimodal operator F(-), where h(0 F F(fo, ( and passed task-specific pre- diction head g(t), yielding the final output y g(h()). Thus, the benign case, temporally aligned sensor data is paired, encoded, fused, and used to generate reliable perception outputs.
2.1 THREAT MODEL
This part discusses the threat model, outlining how an adversary can exploit timestamp manipulation to disrupt sensor synchronization and compromise the perception pipeline (as outlined above).
Attacker Objective. We assume an adversary who does not tamper with raw sensor observations Is or the model parameters. Instead, the attacker manipulates the reported timestamps to force misaligned sensor pairs into the fusion stage. Concretely, for each message the adversary injects perturbation /0 such that the system receives z( t! + o The synchronizer then selects pairs according to manipulated timestamps,
(r(1) arg min 1/8 -1011,
resulting in fused features 7,00) F (FE Fy, Fr ()) Even though the reported misalignment 17 - 2(7) is within tolerance т, the true temporal difference ( =
+(6 may be large, producing semantically inconsistent feature pairs. These corrupted representations (,(0) propagate through the fusion module, ultimately degrading predictions g(() without requiring the attacker to alter raw sensor data or model parameters.
Attacker capability. We focus on the threat model where there is a compromised instance of in- vehicle ECU or the ROS2 middleware situated upstream of the fusion node. From this position, the attacker can read and write messages on the middleware bus and therefore inject messages m/
(a (i) : ((()), while leaving the payload ( untouched. This capability is practically plausible because many ROS2 deployments are not configured with authentication--y--deee
(Deng et al. (022), and legacy software that enlarges the attack surface (Checkoway et al. 2011: Foster et al., 2015 Miller & Valasck 2015) Yeasmin & Haque 2021 Ghosal et al,, 2022 ; single compromised node, therefore, suffices to propagate forged timestamps the fusion process. From an attacker's perspective, the objective is to corrupt the timestamps in a way that forces the approximate-ting synchronizer emit pairs for which true temporal separation | (i.2)
ECUs frequently run third-party
(1) (J) is large enough to break semantic correspondence and degrade downstream perception.
L
are commonly used message fil- tering utilities in ROS2 that align multiple sensor message streams based on their timestamps. While Tí meSynchron zer performs strict timestamp matching, Approximate!! mate"'i wwSeeiimmmmnhhhaaaee zer allows messages with slight temporal differences- specified tolerance window-to he synchronized.
TTimeSynchronize and
3

---

Published as a conference paper at ICLR 2026
Temporal Misalignment
Dowastream Task Head
Altack
Temporal Misalignment
Detection Patch
E
Misalignneent Score
Automative Ethernet
Vehicular Network
Shared Multimodal
DTW
Encader
Eicn
11.
EL
f
Shared Represoniation
Modalit--ppectiic Represeniation
Figure 1: Overview of the proposed defense AION against any TMA attack.
Defense Objectives. A practical defense against temporal misalignment attacks must satisfy three key properties: should accurately detect when sensor streams are out of syne, generalize across different architectures and sensor modalities, and iii) introduce minimal overhead so that real- time perception pipelines remain unaffected. Meeting these requirements essential for ensuring that AD systems remain both robust and deployable in practice.
TEMPORAL MISALIGNMENT DEFENSE: AION
To defend against such temporal misalignment attacks, we propose a countermeasure technique named AION, that detect if any of the sensor data streams misaligned. We design AION as an independent detection patch that can work on top of any MMF-based application, either in parallel or sequentially, agnostic of the downstream task.
3.1 AION OVERVIEW
As shown in Fig. D AION primarily consists of a single shared multimodal representation encoder (MRE) that maps any unimodal feature representation, regardless of its source modality, shared representation space. Furthermore, AION has two phases of implementation: i) development and ii) deployment phase.
Development Phase. In the development phase, AION trains an MRE model using contrastive learn- ing with positive and negative pairs based on their related temporal alignment. MRE learns how to represent temporally aligned (positive) feature pairs from different modalities to similar represen- tations and temporally misaligned (negative) pairs to different representations. Once the MRE trained, AION utilizes that trained MRE in the deployment phase to detect TMA attacks.
Deployment Phase. During the deployment phase, AION utilizes the trained MRE create shared representations of historical inputs from each modality and keeps stack of these representations for a small window. the same time, AION also calculates and keeps track of a 2D similarity matrix with pairwise inter-modality similarity scores between different representation pairs. The diagonal elements in the similarity matrix indicate pairs that are temporally aligned and others that different extents they deviate from the diagonal. On each such
temporally misaligned similarity matrix, AION runs a dynamic time warping (DTW) algorithm to find the optimal path of temporal alignment and the reward of such alignment, which is the summation of all their similarity scores. Under a benign scenario, the optimal path with the highest reward would be the diagonal one, and the reward would be higher. However, under a temporal misalignment attack, the optimal path would deviate from the diagonal and follow the attacker's misaligned pattern. In that case, the optimal reward would be lower, which essentially indicates the existence of an adversary. We elaborate on the details of each component of ATON in the following subsections.
3.2 TECHNICAL. DETAILS OF AION
To learn a unified representation for multimodal inputs, we use shared MRE, Enan that projects modality-specific features fc and fr from different modalities into a common latent space, such that (6)
rc F.mm (1()) and L (f())) The objective is ensure that the shared representations

---

Published as a conference paper at ICLR 2026
of semantically corresponding (e.g.. temporally aligned) inputs are close in the latent space, meaning (f.) r( if j. and dissimilar otherwise. As the majority of MMF- based perception models rc
for AD primarily focus fusing camera and LiDAR data, we center our technical discussion of AION on these two modalities.
The development phase specifically involves the training of the MRE model and running the detec- tion on benign data to set the threshold. To ensure effective learning, we utilize contrastive learning with three types of data pairs for the model training.
3.2.1 DIFFERENT REPRESENTATION PAIRS.
To ensure that MRE effectively learns representations while respecting the subtle semantic changes in temporally adjacent frames, we categorize representation pairs into three types based on their degree of temporal (mis)alignmenn
Definition (Positive Pairs) pair of features (r2,r()) is called a positive pair, denoted (6) (f) Tp, if they originate from the same temporal event, i.e.. i.
(rc .TL
Definition 2 (Near-Negative Pairs) pair (rC ( is called a near-negative pair, denoted
(re (5)) E Tan if they come from different but temporally adjacent events, i.e., i i but i = j. Such pairs share partially overlapping semantic content due to their temporal proximity.
Definition (Far-Negative Pairs) A pair (TC (r) is called far-negative pair, denoted (rC
( jl 0.
Tra if they originate from temporally distant events with no semantic overlap, i.e.,
3.2.2 CONTINUITY-AWARE CONTRASTIVE LEARNING-BASHD TRAINING
The primary goal of the shared encoder Fm is to ensure that the representations of positive pairs are highly similar-i.e., have minimal distance-whai representations of negative pairs remain well separated in the latent space. To achieve this, adopt a contrastive learning objective, based on relaxed contrastive (ReCo) as proposed in (Lin et al. 2023). to train Emm, where each training batch consists of set of discrete sample indices Tbatch (2,,,.,..... n, where the batch size b and each n. corresponds to a unique sample in the batch.
Thus, the representation sequences FC (m1) (12)
(ms) and rr (re re ,....
(n)) (m2)
(r(m)) _L .. (mo)) .L_)) from two different modalities are calculated on the sampled inputs from the training set. These indices are chosen manner that ensures the batch contains both near-negative and far-negative pairs. Based on the ro and rt, we compute similarity matrix E 1R where each entry Siş denotes the cosine similarity between the camera representation
re and the LiDAR representation r//), defined as:
(t)
re
Sig 11 1r
For positive pairs, we define the positive loss as: Lpss = the cosine similarity between the shared representations of temporally aligned inputs to be close as possible to I. Negative pairs consist of temporally misaligned inputs, and ideally, their repre- sentations should exhibit minimal cosine similarity. To enforce this, we define the negative loss Cosg = -', (max(0, (,,))) Aıg. This loss penalizes any similarity between the negative pairs (
(S.- 1S
which loss encourages
at different scales, which is the key enabler of CACL. The penalty is modulated by the weight Aij. which reflects the expected degree of dissimilarity based on temporal distance.
To generalize this weighting scheme, we define Ai as smooth function of temporal distance:
Aij = tanh (i=1l) where, is a temperature-like scaling factor that controls sensitivity to temporal separation. This formulation (as shown in Fig S in Appendix C offers a continuous and differentiable measure of misalignment, encouraging the model to learn nuanced distinctions across the temporal spectrum. The overall objective combines the positive and negative pair losses, Lusal Lps + Laeg- This loss ensures high cosine similarity for aligned (positive) pairs, while
5

---

Published as a conference paper at ICLR 2026
pushing apart misaligned (negative) pairs. The extent of separation for negative pairs is controlled by the penalty weight Atj, allowing for flexibility based on temporal misalignment.
3.3
ATTACK DETECTION
The detection of TMA attacks through AION consists of two main tasks.
3.3.1 HISTORICAL REPRESENTATION QUEUE AND SIMILARITY MATRIX
During testing, AION maintains a historical representation queue for each modality over a window of w recent sensor readings. Rather than applying uniform sampling, AION employs exponential sampling strategy. This approach samples densely near the current time and more sparsely further in the past, allowing the model to capture fine-grained recent temporal changes while retaining longer historical context for better generalization. The sampling indices are defined as where y is the sampling base, forming the detection index set Idetect {ni, 722, ......... Rw Across = frc (m)) (ms)
v.
this window size AION tracks the sequential representations
C
(m and
ry = (T( .T. ....,Ti.. (/w)///)) Consistent with the training phase, AION uses these representations to construct the similarity matrix S E Rex= as defined in equation [ Upon the arrival of each new message, AION dynamically updates rc, rz, and S, and proceeds to execute the DTW-based detection process described in the following section.
(ma) (m2)
3.3.2 DYNAMIC TIME WARPING-BASED DETECTION
To quantify the extent of temporal misalignment within the rc and ry, AION employs DTW to compute both the optimal temporal alignment path and the corresponding alignment reward. We implemented DTW to identify the optimal warping path P that maximizes the accumulated simi- larity, which define reward, over similarity matrix. Algorithm [ (in Appendix B), outlines this procedure, which takes S as input and returns the optimal path P and total reward á associ- ated with that path. In an ideal scenario. where all sensors remain temporally aligned, the optimal warping path follows the diagonal: P = {(1, 1), (2, 2). . (w, w)} }, as diagonal elements Sü have the highest similarity scores. Under the optimal alignment path, the optimal accumulated reward, of u Sü x w, since the embedding function Fm is trained to maximize similarity for aligned pairs. Thus, any deviation from that diagonal path p or the optimal reward o² can be
considered anomalous.
Justification on Detection. The fundamental assumption behind this approach that DTW max- imizes cumulative alignment reward by optimally aligning sequences. Given well-trained Emons the cost function S.j satisfies:
Sij iff i=j
In a benign case, where data samples are perfectly aligned, Oben maximized, and Oben is mini- mized, since all elements on the optimal path mostly satisfy i = therefore:
W
Σ
Sij Σ S thus, Aben R 0
Oben
(t.))
1=1
However, in the presence of malicious misalignment, the warping path necessarily includes terms where i * j. leading to Siy << for some (i,j). Since DTW maximizes the total reward, the deviation from p implies a decrease in @mal and an increase in amal, such that:
Omal
Σ
S
S.J
Su thus, amat >> 0
(iJ)
This establishes the fundamental assumption that as misalignment increases, so does anomaly score, reinforcing the validity of DTW in the anomaly detection process. Empirical validation in Sec- tion 5.1 further supports this claim.
EXPERIMENTAL SETTINGS
To evaluate the effectiveness of AION in detecting TMA attacks, conduct detection analysis under various attack scenarios. We synthetically generate different degrees of temporal misalign- ment by perturbing the input sequences in the test data described in Table [ For two different

---

Published as a conference paper at ICLR 2026
Table 1: Seven Temporal Misalignment Attack Strategies
Attack
Type
Delay 8g
Description
Constant
Freeze
6j (within window)
Frame freezing. dropped frames
Random
Replacement
Random from | m, 4
Random replacements, computed frames
Jitter
Stochastic
14 Et, +()
Prohabilistic jitter, network jitter
Reversal
Reordering
6y 2j (within window)
Order reversal, out-of-order packets
Burst
Intermittent
8g (within burst)
Intermittent freezes, bursty congestion
Drift
Cumulative
6 Ir
Gradual desync, clock skew
Scheduler
Algorithm
6, (g, dranx) (round-robin/priority)
CPU scheduler nound-robin/priorityy
models trained on two different datasets, we evaluate AION's ability to distinguish between normal and misaligned sequences under diverse TMA attacks.
4.1 DATASETS
We evaluate AION on two standard multimodal AD datasets:
KITTI Tracking Dataset. The KITTI benchmark (Geiger et al. 2012), collected in Karlsruhe, Germany, covers city, residential, and highway scenes. It provides forward-facing RGB camera and Velodyne LiDAR, with 3D bounding boxes and labels for cars, pedestrians, and cyclists.
NuScenes Dataset. The NuScenes benchmark (Caesar et al., 2020), recorded in Boston and Sin- gapore, captures dense urban traffic. includes six RGB cameras, Velodyne LiDAR, and five radars. NuScenes consists of 1000 20-second sequences with 3D bounding boxes and tracking IDs for different classes, such as vehicles, pedestrians, bicycles, and barriers.
4.2 MODEL ARCHITECTURE
We implemented AION for both the KITTI and nuScenes datasets to evaluate its adaptability across different sensor setups and driving scenarios.
For the KITTI dataset, adopt straightforward approach by testing with two off-the-shelf, pre-trained image and LiDAR feature encoders. The MRE of AION is implemented us- ing a simple convolutional neural network (CNN) architecture, featuring two distinct input branches and a shared output branch. For each KITTI sample, an RGB image of size [3, 375 1242) is en- coded using ResNet-50 (He et al. 2016) produce image features Le R2018x12x'39 while the LiDAR point cloud [ks 3] is processed by PointPillars (Lang et al. 2019) to yield LiDAR features fL R 3x38xx28x22) Our encoder Emm maps both Jc and ft to shared space by applying modality-speciiff convolutional branches, global average pooling, and shared projection head, producing 256-dimensional representations re and rz.
AION on KITTI:
AION on nuScenes: For the nuScenes dataset, we build AION top of BEVFusion (iu et al. 2023) to demonstrate AION'S adaptability to complex MMF architectures. Each input includes six camera images and LiDAR point cloud. We use BEVFusion's encoders to obtain BEV features Jc. IR R 180 for camera and LiDAR, respectively. These are passed to a hybrid encoder Emm. which first applies shared CNN layers to produce [256 x 23 x 23] embeddings. A lightweight transformer then processes spatial tokens with positional encodings and global self-attention, fol- lowed by mean pooling to produce 256-dimensional representations re and r'.
4.3 EVALUATION SETTINGS
Attack Hyperparameters. We generate misaligned samples for both datasets using the TMA attacks defined in Table ! injecting perturbations into test sequences at fixed intervals. All attacks follow periodic structure parameterized by attack interval and duration set to default values t = 25 and n = 10 for consistent evaluation. Attack-specific parameters emulate realistic timing faults: Random uses a history window
10; Jitter applies mean delay μ and jitter range A 3: Burst uses burst size s = 3 and gap = 2; Drift applies drift rate r = 0.5; and Scheduler uses time quantum q 3, maximum delay dmax 5, and round-robin scheduling. For multimodal attacks, we introduce controlled cross-sensod variability to model heterogeneous pipeline behavior, including +-20% variation for Random parameters (1, n, m), +0% variation for Jitter (n, A) and

---

Published as a conference paper at ICLR 2026
Drift (r), and #2-frame variation for Burst (s, 9) and Scheduler (q. dmax). along with phase offsets up to 40% of the attack interval to enforce realistic temporal desynchronization between Camera and LiDAR streams.
Anomaly Detection Methodology. To classify whether an input sequence is malicious, we ana- lyze the cross-modal temporal consistency of multimodal pairs within defined observation window w = 3 with sampling base & = 2. In this evaluation, we label window as malicious if at least half of its multimodal pairs contain a misaligned sample. We analyze the anomaly scores using the ROC curve and calculate the area under the ROC curve (AUROC) as the key detection metric.
Software Implementation We implement and evaluate ATON in Python 3.8 using PyTorch, lever- aging open-source frameworks such as OpenPCDet (Team) 2020). Experiments were primarily conducted on a begh-perffrmance server running Ubuntu 20.04.6 LTS, equipped with an Intel Xcon Gold 5520 CPU (16 cores, 2.20 GHz), 128 GB RAM, and three NVIDIA RTX 6000 Ada GPUs. For scalability profiling, we additionally evaluate AION on a more modest Ubuntu machine with an Intel Core 19-9820X CPU (10 cores, 3.30 GHz) and single RTX 2080 Ti GPU, reflecting the constraints of a realistic automotive deployment scenario.
5 DETECTION RESULTS
We evaluate the performance of ATON across both datasets and model architectures. We begin by illustrating the detection process on the nuScenes dataset, including visualizations of similarity and anomaly scores under different attack types. Finally, we present the ROC curves, along with the AUROC scores, for both datasets.
5.1 VISUALIZATION OF SIMILARITY MATRIX
Figure illustrates four different similarity matrices with the Camera and LiDAR representations, re and rL, from time steps 10 to 40 under various TMA attacks (launched from 20 30), including the benign case. The top left-most panel shows the similarity matrix between re and rz under be- nign conditions-i.e. with no delay in either modality. As illustrated, the highest similarity scores lie along the diagonal path from (10, 10) to (40, 40), indicating perfect temporal alignment between both modalities. However, all the following panels depict cases where seven types of temporal mis- alignments are introduced by delaying the camera stream under TMA attacks: all between time steps 20 and 30. In these scenarios, the highest similarity scores often diverge from the diagonal beyond time step 20 and only steadily return to the diagonal again around time step 30. These deviations clearly signify temporal misalignments, which AION leverages to detect such TMA attacks. We provide further figures in Appendix D showing the impact of compromising only LiDAR (Figure and both modalities (Figure 7).
Some plots in Fig. show unique scenarios where both modalities are delayed by the same amount (i.e,, constant delay) under TMA attack. In this case, the similarity scores remain high (and the same) across both diagonal and occasionally, off-diagonal elements, from time steps 20 to 30. Such patterns may emerge under both benign and malicious conditions. For instance, under benign condi- tions, the vehicle may be stationary without any moving objects in the scene, resulting in temporally consistent features over time. In contrast, an attacker could also replicate this same scene with a malicious delay to all modalities by the same constant offset, creating a similar similarity matrix. Hence, these unique, advanced attacks become a challenging task just by analyzing the cross-modal alignment similarities. Although AION, when limited only the modalities used in MMF, cannot reliably detect such an advanced attack case, incorporating additional data sources such as iner- tial measurements (IMU), controller area network (CAN) signals, or other external references- provide complementary evidence and help detect such advanced attacks. However, as we only rely on the multimodal data in this work, we consider this extension as future work for AION.
5.2 DETECTION PERFORMANCE OF AION
We illustrate the detection performance of ATON from two different perspectives.
Visualization of Anomaly Scores. Figure Banleeiillusttt Iillustrates the temporal evolution anomaly scores, provided by AION, across different time steps under various TMA attacks on the camera stream.
8

---

Published as a conference paper at ICLR 2026
Benign Condition (No Delays)
Constant Delay on Camera
Random Delay on Camera
Reversal Delay on Camera
LDRR Tive Stop
0.8
20
0.6
25
30
35
40
0.0
10
Jitter Delay on Camera
Burst Delay on Camera
Drift Delay on Camera
Scheduler Delay on Camera
15
LpO0 time Step
20
06
25
35
94
10
15
20
35
40
10
15
20
25
10
35
10
15
20
25
10
35
40
10
15
20
35
40
Zamena
Timm Step
Camera Time Step
Camera Time Step
Camera Time Step
Figure 2: Similarity scores/matrix between Camera and LiDAR representation embeddings under different TMA attacks on Camera between time steps 20 to 30.
Constant Attack
Random Attack
Reversal Attack
Jitter Attack
Burst Attack
Drift Attack
Scheduler Attack
Aromay Srore
2.0
0.0
1
2.0
20
40
0
20
60
20
40
20 Time Inddes
60
20
40
20
40
Time Indlex
Timme Iriec
Time Indes
Timn Inder
Time Iniles
Time Indec
Figure 3: Anomaly scores generated by AION under various camera-only TMA attacks. The 'red' and "green' shaded regions indicate periods with and without attacks, respectively. Distinetive score patterns across these regions highlight AION's effectiveness against diverse TMA attacks.
Each shaded region indicates whether the system is operating under benign (green) or malicious (red) conditions, based on the temporal alignment. As shown, AION consistently produces higher anomaly scores during periods with temporal misalignment than during benign intervals. This clear contrast in anomaly demonstrates the effectiveness of AION detecting malicious temporal mis- alignment induced by wide range of TMA attacks. Figure in Appendix shows the anomaly scores under LiDeR-bbsedd TMA attack.
ROC Curve with AUROC Scores. Figure illustrates that across both datasets and all single- modality settings, AION exhibits consistently strong detection performance. The ROC curves main tightly concentrated near the top-left corner, and AUROC values range from 0.92-0.98. This robustness holds for all attack variants aariant--including Drift, Jitter, Random, Burst, Scheduler, and even Reversal--demonstraiin that AION reliably captures modality-speciffe temporal deviations with- having dataset-specific dependency. High AUROC under Drift attacks further highlights AION's sensitivity to low-variance and slowly evolving perturbations, underscoring the strength of its DTW- based detection.
AION also maintains competitive performance under both-modality attacks for the majority of per- turbations. Random, Drift, Jitter, Burst, and Scheduler attacks maintain AUROC scores close to their single-modality counterparts, indicating that AION effectively leverages cross-modal temporal correlations even when both sensors are perturbed. The close alignment of trends between KITTI and nuScenes suggests strong generalization across datasets with distinct motion statistics and sen- sor characteristics. Moreover, the consistently high true positive rates and low false positive rates underscore AIoN's reliability in realistic AD environments under TMA attacks.
notable limitation arises under perfectly synchronized, cross-modal perturbations-sucl as Con- stant and Reversal attacks-when applied simultaneously to both camera and lidar. These attacks preserve the highest cross-modal similarity along the diagonal path, effectively suppressing the tem- poral discrepancies that AION relies upon for detection. This exposes important avenue for future work by incorporating additional modalities (c.g.. CAN, IMU, etc.) and developing invariant temporal anomaly features that remain robust under coordinated multi-sensor manipulation.

---

Published as a conference paper at ICLR 2026
Attacks on Camera (KITT)
Attacks on Lidar (KITT))
Attackss on Both (KITT)
1.0
True Postive Rate
0.8
Concant 9.12
True Positbee Rate
0.8
Consant: 5 9630
True Positvee Rate.
0.88
Concant
Random: 5212
Random:
0.6
0,9425
0.6
Brit: 0.9356
0.66
0.9331
Jiten 0,9583
Iiter 0.9616
Jiten 0.9169
Reversal: 5346
0.4
Reversal:
Reversal:
Bure: 0,455
Buret
Bure:
0.2
Scneduerr: 9532
0.2
Scheduer 92-M
0.-
Schwduler: 9231
0.0
Random
0.0
Random
0.0
Random
0.2
0.4
0.6
10
0.6
0.8
10
0.2
0.4
0.6
False Positive
Rate
False Positive
Attacks on Camera (nuSceness)
Attacks on Lidar (nuScenes)
(nuScenes)
1.0
1.0
1.0
True Posilive Rate
10.
True Posiove Rates
0.8
True Posittvve Rate
10.0
0.9663
Drfft 0,5457
Iiien
Jizen 0.9289
Iizen
0.4
0.2
Scheduer
0.2
Schesuier: 0.3518
0.2
Schoduler
Randors
0.0
Randors
0.0
0.
0.4
0.6
10
0.5
0.8
10
0.0
0.2
0.4
0.6
10
Falis Positive
Positive
Falise Positive
Figure 4: ROC curves with AUROC scores of AION under TMA attacks across KITTI and nuScenes, evaluated on camera, lidar, and both camera-lidar modalities.
Scalability. To enable efficient multimodal representation learning, AION introduces only a lightweight overhead. Below, we elaborate on the computation overhead of AION the NuScenes dataset, as it is more computationally demanding with 6 cameras compared to the single front cam- in KITTI. Compared to full perception model stacks, AION is highly compact, with only ~1.9 million parameters (~7.99 MB in FP32), whereas typical perception pipelines (such as BEVFusion) exceed 30 million parameters 127 MB in FP32) (Liu et al. 2023). On RTX 2080Ti GPU, our profiling reveals that AION'S ' computational overhead consists of two components: (1) MRE infer- ence requires 1.74 ms per forward pass (574 inf/s) and consumes 42.5 MB of GPU memory, and (2) DTW-based detection adds 1 1.52 ms per inference (659 inf/s) and runs on CPU without GPU mem- ory overhead. The total AION overhead is approximately 3.26 ms per inference with a combined throughput of 307 inf/s (see Table
Given that typical MMF-based AD perception pipelines operate at 10-20 Hz. (corresponding to 50-100 ms per frame), AION's overhead of 3.26 ms represents only 3.3-6.5% of the avail- able frame budget, and can run in parallel to the downstream task. While DTW has (w²²) com- plexity, we empirically find that a short window (w = 3 to 5) is sufficient to detect misalignment attacks in AD while keeping the runtime negligi- ble and suitable for real-time deployment. Larger windows, on the other hand, add cost and may dilute temporal granularity, hurting effectiveness. This demonstrates that AION's robustness gains come at a very negligible computational cost, making it highly feasible for real-time deployment in production AD systems.
Comp
Latency
Throughput
GPU Mem
MRE
1.74 ms
574 inf/s
42.5 MB
DTW
1.52 ms
659 inf/s
Total
3.26 ms
307 inf/s
42.5 MB
Table 2: Computational overhead of AION,
6 CONCLUSION
Temporal misalignment attacks are an emerging threat AD perception, where adversaries manipu- late timestamps -itthu altering sensor data-causing the temporal synchronizer to inadvertently induce cross-modal misalignment. To counter this challenge, we introduced AION, a lightweight defense that integrates multimodal representation learning with dynamic time warping to enforce temporal consistency before fusion. AION consistently exhibits strong robustness on diverse tem- poral misalignment attacks across KITTI and nuScenes, achieving high average AUROC scores for camera-only (0.9493) and LiDAR-only (0.9495) attacks, and maintaining resilient performance under both-modall attacks (0.9195 on most attacks). These results highlight the importance of synchronization awwae perception architectures and establish temporal consistency checking as a critical security property for safety-critical autonomous systems.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENTS
This work was supported in part by the Office of Naval Research under grants -00014-24-1-27300 110014-24-1-2665 the National Science Foundation under Grants 2235232, 2312447, 2247560, 2154929, 2154930. 2238635, 2403758, 2509636. 2312794; the Army Research Office under grant W911NF-24-1-015: and fellowship from the Amazon- -iizonnni Tech Initiative for Efficient and Robust Machine Learning.
REPRODUCIRILLTY STATEMENT
To facilitate reproducibility, we release our full implementation at Shahriar0651 The repository contains code for AION's MRE, CACL DTW-based detector, and baseline methods, along with all configuration files and scripts needed to run the seven attack types and the hyperparameter sweep. We use publicly available KITTI and nuScenes datasets; preprocessing, feature extraction, and evaluation settings are detailed in Sections 5.1-5.2 and Ap- pendices, and reported AUROC and runtime results can be reproduced by running the provided evaluation scripts. We also provide the pretrained weights of MRE and the representation dataset for quick evaluation.
com/
LLM USAGE DISCLOSURE.
LLMs were used for editorial purposes this manuscript, and all outputs were inspected by the authors to ensure accuracy and originality.
REFERENCES
Donald Berndt and James Clifford. Using dynamic time warping find patterns in In Proceedings of the 3rd international conference on knowledge discovery and data mining, pp- 359-370,11 1994.
time series.
Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: multimodal dataset for autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11621-11631 2020.
Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Sav- age, Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno. Comprehensive ex- perimental analyses of automotive attack surfaces. In 20th USENIX security symposium (USENIX Security 11), 2011.
Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multi-view 3d object detection network for autonomous driving. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pp. 1907-1915, 2017.
Gelei Deng, Guowen Xu, Yuan Zhou, Tianwei Zhang, and Yang Liu. On the (in) security of secure ros2. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 739-753, 2022.
Di Feng, Christian -chutz,, Lars Rosenbaum, Heinz Hertlein, Claudius Glaeser, Fabian Timm, Werner Wiesbeck, and Klaus Dietmayer. Deep multi-modal object detection and semantic seg- mentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions on Intelligent Transportation Systems, 22(3):13414 1311::131 2020.
Andreas Finkenzeller, Andrew Roberts, Mauro Bellone, Olaf Maennel, Mohammad Hamad, and Sebastian Steinhorst. Sensor fusion desynchronization attacks. In 37th Euromicro Conference on Real-Time Systems (ECRTS 2025), pp. 6-1. Schloss Dagstuhl-LeebnizzZZerr 2025.
für Informatik,
Ian Foster, Andrew Prudhomme, Karl Koscher, and Stefan Savage. Fast and vulnerable: A story of telematic failures. In 9th USENIX Workshop Offensive Technologies (WOOT 15), 2015.
11

---

Published as a conference paper at ICLR 2026
Cong Gao, Geng Wang, Weisong Shi, Zhongmin Wang, and Yanping Chen. Autonomous driving security: State of the art and challenges. IEEE Internet of Things Journal, 9110)77522-555, 2021.
Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are we ready for autonomous driving? the kitti vision benchmark suite. In 2012 IEEE conference on computer vision and pattern recognition, pp. 3354-3361. IEEE, 2012.
Amrita Ghosal, Subir Halder, and Mauro Conti. Secure over-the-air software update for connected vehicles. Computer Networks, 218:109394, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Daniel Kuhse, Nils Holscher, Mario Gunzel, Harun Teper, Georg Von Der Bruggen, Jian-Jia Chen, and Ching-Chi Lin. Sync sink? the robustness of sensor fusion against temporal misalignment. In IEEE Real-Time and Embedded Technology and Applications Symposium, pp. 122-134, 2024.
Alex H Lang, Sourabh Vora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom. Point- pillars: Fast encoders for object detection from point clouds. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 12697-12705, 2019.
Shasha Li, Shitong Zhu, Sudipta Paul, Amit Roy-Chowdhury, Chengyu Song, Srikanth Krishna- murthy, Ananthram Swami, and Kevin S Chan. Connecting the dots: Detecting adversarial pertur- bations using context inconsistency. In European Conference on Computer Vision, pp. 396-413. Springer, 2020.
Zudi Lin, Erhan Bas, Kunwar Yashraj Singh, Gurumurthy Swaminathan, and Rahul Bhotika. Re- laxing contrastiveness multimodal representation learning. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pp. 2227-2236, 2023.
Zhijian Liu, Haotian Tang, Alexander Amini, Xinyu Yang, Huizi Mao, Daniela L. Rus, and Song Han. Bevfusion: Multi-task multi-sensor fusion with unified bird's-eye view representation. In 2023 IEEE international conference on robotics and automation (ICRA), pp. 2774-2781. IEEE, 2023.
Yanmao Man, Raymond Muller, Ming Li, Z Berkay Celik, and Ryan Gerdes. That person moves like a car: Misclassification attack detection for autonomous systems using spatiotemporal con- sistency. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 6929-6949 2023.
Charlic Miller and Chris Valasek. Remote exploitation of an unaltered passenger vehicle. Black Hat USA, 2015(S 91):1-91, 2015.
Takami Sato, Ryo Suzuki, Yuki Hayakawa, Kazuma Ikeda, Ozora Sako, Rokuto Nagata, Ryo Yoshida, Qi Alfred Chen, and Kentaro Yoshioka. On the realism of lidar spoofing attacks against autonomous driving vehicle high speed and long distance. In Proceedings of the Network and Distributed System Security Symposium (NDSS), 2025.
Md Hasan Shahriar, Md Mohaimin Al Barat, Harshavardhan Sundar, Naren Ramakrishnan, Y Thomas Hou, and Wenjing Lou. Temporal misalignment attacks against multimodal perception in autonomous driving. In 2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2026.
Zachary Taylor and Juan Nieto. Motion-based calibration of multimodal sensor extrinsics and timing offset estimation. IEEE Transactions on Robotics, 32(5):1215-1229) 2016.
OpenPCDet Development Team. Openpedet: An open- toolbox for 3d object detection from point clouds. https:
wtt. heppm/ope--oee mm ab/ abmmma//CDppppt.t.t.... 2020.
Yuan Xu, Gelei Deng, Xingshuo Han, Guanlin Li, Han Qiu, and Tianwei Zhang. Physcout: Detect- ing sensor spoofing attacks via spatio-temporal consistency. In Proceedings of the 2024 on ACM SIGSAC Conference Computer and Communications Security, pp. 1879-1893, 2024.
12

---

Published as a conference paper at ICLR 2026
Sadia Yeasmin and Anwar Haque. A multi-factor authenticated blockchain- based ota update frame- work for connected autonomous vehicles. In 2021 IEEE 94th Vehicular Technology Conference (VTC2021-Fall), pp. 1-6. IEEE, 2021.
Xinyu Zhang, Yan Gong, Jianli Lu, Jiayi Wu, Zhiwei Li, Dafeng Jin, and Jun Li. Multi-modal fusion technology based on vehicle information: A survey. IEEE Transactions on Intelligent Vehicles, 8 (6):3605-3619, 2023.
Ganning Zhao, Jiesi Hu, Suya You, and C-C Jay Kuo. Calibdnn: multimodal sensor calibration for perception using deep neural networks. In Signal Processing, Sensor/Informatiinn Fusion, and Target Recognition XXX, volume 1756, pp. 324-335. SPIE, 2021.
A CONSIDERED ATTACKS
We evaluate our defense against seven distinct temporal misalignment attack strategies that model various real-world failure modes and adversarial scenarios autonomous driving systems. Each attack operates on the temporal dimension of sensor data streams, introducing misalignment camera and LiDAR modalities through different delay and manipulation patterns.
betteeeeeetbbtweennn between
Introduces complete frame freezing by replacing consecutive frames with single frozen frame at periodic intervals. This attack simulates dropped frames sensor failures, where frames within the attack window are replaced with the frame at the start of the window. The delay 6, j for position j within the attack window, as each subsequent frame uses data from j frames earlier, creating temporal plateaus that break cross-modal temporal alignment.
Constant A Attack:
Random Attack: Applies random frame replacements by selecting frames uniformly at random from history window This attack models corrupted frames packet loss with random retrans- mission, introducing temporal discontinuities that disrupt the expected temporal ordering. Unlike delay-based attacks, this attack replaces frames with random historical frames rather than applying a deterministic delay distribution.
Jitter Attack: Applies stochastic timing delays following 5, # Et, where Es Uniform( A, +A) and ó, represents the delay amount in frames. Each frame within the attack window is shifted backward by frames, modeling realistic network jitter and timing noise from scheduler fluctuations or multi-threading effects.
Reversal Attack: Reverses the temporal order of frames within periodic attack windows, where the delay 5; = 2j for position j within the attack window. This attack simulates out-of-order packet delivery scenarios, where frames arrive in reverse temporal sequence, violating the expected monotonic temporal progression.
Introduces intermittent freezes with gaps between bursts, where frames within each burst are frozen by replacing them with earlier frames. This attack models bursty network conges- tion, where multiple short bursts of frozen frames are separated by gaps of normal operation. Within each burst, the delay increases 85 j for position j within the burst, creating a more subtle misalignment pattern than continuous freezing.
Burst Attack:
Applies gradually accumulating delays following 6, = [rxi]] where is the drift rate and 6, represents the delay amount in frames. This attack simulates clock skew and buffer buildup scenarios. where delays accumulate lincarly time, either within periodic attack windows or continuously across all frames, creating a cumulative desynchronization effect.
Drift Attack:
Mimics CPU scheduler behavior by applying delays following deterministic patterns 5, = (quantum, dmax). where ò, represents the delay amount frames and f implements round-robin or priority-based based scheduling algorithms. This attack models system-level delays from task preemption and priority-but based processing, where delays cycle through values or increase based on priority aging mechanisms.
Scheduler Attack:
13

---

Published as a conference paper at ICLR 2026
B DTW ALGORITHM FOR AION IN MISALIGNMENT DETECTION
Algorithm [ summarizes how we apply DTW to measure temporal misalignment in AION and to quantify anomaly score on window of multimodal representations.
Algorithm 1: OPTIMAL WARPING PATH AND REWARD COMPUTATION
Input Cost matrix S E R =
Output: Optimal path P and reward d"
/* Initia iaatialin alizatiion
Initialize accumulated score matrix R. E I=x";
1(1,1) S(,, 1);
< 2 w do
R(n, 1) t S(n, 1) + R(n - 1,1);
end
for 2 do R(1, m) S(1, m) R(1, m 1);
end
* Dynamic programming ng recursion
for < 2 to do
for
do R(a, m² < m), + max( 1,m 1), R(n 1,m), B(n, m 1)};
end
end
/+ Backtracking
p + [(w, w)], (n,m) m) + (w, w);
while (n, m) * (1, do
if then
m
else then n t n-n-1
else
(n, arg arg max (N(n 1,m 1), R(n R(n, 1)}:
end
Prepend (n,m) to P
end
Final reward
o R(w, w); return P", ;";
C PLOT OF À FUNCTION
In Fig. we plot the À function to show how it assigns penalty weights based on the temporal misalignment j - jl between sequence elements, highlighting the effect of the sensitivity factor in controlling the transition from near-negative to far-negative pairs
D ADDITIONAL FIGURES ON COSINE SIMILARITY
We provide additional visualizations of the cosine similarity matrices under TMA attacks applied to both LiDAR-only (Figure 6 and both-modalities (Figure 7). These figures complement the main-text analysis by illustrating how TMA systematically perturbs the temporal similarity structure across different sensor configurations.
E ADDITIONAL VISUALIZATION OF ANOMALY SCORES
Figure g presents the anomaly score trajectories for LiDAR- TMA attacks, complementing the camera-based results shown Fig. 3 As with the camera stream, AION exhibits a clear separation between benign (green) and malicious (red) intervals, consistently producing elevated
14

---

Published as a conference paper at ICLR 2026
1.00
0.75
T=1
T=2
0.50
T=3
0.25
T=4
T=5
0.00
10
[n - njl
Figure 5: Visualization of the function Ay for different misalignment level (i- ([i-j) and sensitivity factor (r). The x x-axis represents the absolute difference i jl. indicating the transition from near- negative to far-negative pairs, and the y-axis shows the corresponding penalty weights Asj. Different lines indicate how the function saturates more quickly for smaller т, indicating the role of in setting the boundary between the near and far negative.
Benign Condition (No Delays)
Constant Delay on Lidar
Random Delay on Lidar
Reversal Delay on
1.0
UDMA time Step
0.8
20
go
30
0.2
60
0.0
Jitter Delay Lidar
Burst Delay on Lidar
Drift Delay on Lidar
Scheduler Dalay on Lidar
10
1.0
LOWA Time Step
15
0.8
20
0.6
0.4
23
0.2
0.0
10
15
20
25
30
35
60
10
15
20
25
30
35
40
100
15
20
25
50
40
10
15
20
30
35
40
Camera
Time Stop
Camera Time Stop
Camera Time Stop
Camera Time Step
Figure 6: Similarity scores/matrix between Camera and LiDAR representation emheddings under different TMA attacks LiDAR between time steps 20 to 30.
anomaly scores whenever temporal misalignment is introduced. This reinforces that AION detects serllignmmet-iinuueue anomalies reliably across sensing modalities, including LiDAR.
F HARDWARE-IN-THE-LOOE TESTBED
To assess AION'S compatibility with real-world deployment constraints, we develop a hardware-in- the-loop automotive Ethernet (AE) testbed that emulates production in-vehicle sensing and fusion setup. As shown in Fig. 9 multiple Raspberry Pis, preloaded with the KITTI dataset, operate as camera and LiDAR sensor nodes, with an additional Pi and server CPU together serving as the fusion node. All these nodes communicate over AE using media converters and AE switch. The full pipeline runs on ROS over a data distribution service (DDS) for message distribution, enabling realistic sensor message timing and fusion workloads.
The camera and LiDAR nodes publish ROS 2 messages (images and point clouds) at a fixed rate (default & 10 Hz). Each message carries (i) the sensor payload and (ii) header times- tamp set from the node's wall clock at publish time. All nodes run in single PTP domain and synchronized with each other. The fusion node subscribes to both topics and runs ROS 2's Approximan eataeeeemmee Syneerynchhrrr onizer: it maintains bounded per-topic queues and emits camera-LiiAA tuple when the header timestamps of the messages fall within configurable
15

---

Scheduler Delay Both Published as a conference paper at ICLR 2026
Benign Condition (No Delays)
Constant Delay on Both
Random Delay on Both
Reversal Delay on Both
UDAR Time Seop
0.0
0.6
22
0.4
35
0.2
40
0.0
Both
Delay on Botth
Drift Both
10
1.0
LIDMA Time Stop
15
0.8
20
0.6
25
30
0.4
35
30
20
Step
Step
Step
Step
Figure 7: Similarity scores/matrix between Camera and LiDAR representation embeddings under different TMA attacks on Both Camera and LiDAR between time steps to 30.
Constant Attack
Random Attack
Reversal Attack
jitter Attack
Burst
Drift Attack
Schoduler Attack
Anommaly Score
1.
0.0
20
20
40
20
20
40
20
40
20
Time
Time Index
Index
Time
Time Index
Index
Time Index
Figure& 8: Anomaly scores generated by AION under various LiDAR-only TMA attacks. The 'red' and "green" shaded regions indicate periods with and without attacks, respectively. Distinetive score patterns across these regions highlight AIoN's effectiveness against diverse TMA attacks.
tolerance (the slop r = 0.10 The fusion node then runs MMF-based perception on each emitted pair.
AION is integrated as parallel callback to the perception stack that also triggered whenever a new aligned sensor pair is selected for fusion. While the data pair passes through the perception module, AION also updates its representation queue, computes a cross-modal similarity matrix, and performs DTW to evaluate the anomaly score. If the anomaly score falls within an acceptable threshold, the perceived result is released for further downstream tasks, such as planning and control. With this, the AION ensures that MMF-based autonomous driving is secure against TMA attacks.
We implement the temporal misalignment attack proposed in Shahriar et al. 2026), in which the adversary injects clock offsets by exploiting vulnerabilities in the PTP profile. Figure illustrates how AION detects this attack. Under benign operation, the anomaly score remains consistently low, as shown the figure. Once the attacker initiates the temporal offset injection, the anomaly score increases proportionally to the induced misalignment. After the attack ceases and synchronization stabilizes, the anomaly score gradually returns to its nominal low level. Thcoretically, the anomaly score should remain close to O, which can be obtained in the testbed with a proper calibration and configuration.
G SENSITIVITY ANALYSIS OF WINDOW SIZE
Figure 12 presents sensitivity analysis evaluating the impact of the window size parameter w E {3, 5, 7, 10} on detection performance (AUROC) across various attack types for the KITTI and NuScenes datasets. The results demonstrate that moderate window sizes, specifically w = 3 and = 5, consistently yield the highest detection accuracy across both datasets. As the window size increases to w 2 7, we observe diminishing returns characterized by general decline AUROC, a trend that is particularly pronounced across all attacks in the NuScenes dataset and for the Scheduler
16

---

Published as a conference paper at ICLR 2026
Perception Visualization
Fusion Node
Media Converter
AE Cable
Camera Node
AE Switch
LIDAR Node
Figure 9: Hardware-in-the-loop (HIL) automotive Ethernet testbed
Preloaded Images
200001..pmm
50000o.pm
Preloaded
D03000 bin
000001 bin
Pointcloud
Camera Node
LiDAR Node
Automotive Ethernet
Raspberry
Malicious Node
AION Enabled
TSN HAT
Media Converter
Switch
Fusion Node
Figure 10: Schematic Diagram of HIL Testbed with AION enabled Fusion Node
attack in the KITTI dataset. Nevertheless, the extended evaluation highlights that the model's overall performance remains highly robust to the choice of w, maintaining strong detection capabilities provided the temporal window is not excessively long.
H THRESHOLD CALIBRATION AND TPR EVALUATION
To facilitate real-world deployment, we adopt robust, single percentile-based global threshold calibrated exclusively on benign data. While Dynamic Time Warping (DTW) calculates the optimal alignment path reward, raw maximum similarity scores inherently fluctuate below in practice due scene- and context-specific variations. To mitigate this variance and ensure cross-context generalizability. we scale each similarity matrix to [0, 1] range. This normalization isolates the temporal alignment path from scene-specific limitations.
Under benign conditions, even if natural discrepancies exist between modalities due to external fac- tors, the diagonal elements the similarity matrix still reach their maximum values (S,, x 1), while off- off-diagonal elements remain significantly lower. Conversely, under Temporal Misalignment At- tack (TMA), specific off- aff-diagonal elements artificially spike, forcing the DTW algorithm to deviate from the diagonal and penalizing the overall alignment reward. By evaluating benign segments,
17

---

Published as a conference paper at ICLR 2026
Anomaly Detection Results HIL Testbed
niment, Anomaly)
1.0
0.6
0.4
0.2
Temporal Misalignment AION Anomaly Score
0.0
20
25
30
35
40
Time (s)
+1.772421969
Figure 11: Anomaly detection by AION in benign scenario and attack (shaded area) scenario
AUROC by Attack and Window Size (kitti)
AUROC
0.6
Window Size
AUROC by Attack and Window Size (nuscenes)
0.6
Window Size
0.2
0.0
Burat
Constant
Drift
Random
Reversal
Scheduler
Type
Figure 12: Sensitivity analysis of the impact of window size w on detection performance (AUROC) across various attack types for the KITTI and NuScenes datasets.
establish global threshold at stringent high percentile (c.g., the 99 percentile), effectively tar- geting a worst-case False Positive Rate (FPR) < 0.01. This approach enables consistent, reliable deployment across diverse sequences and fleets without requiring continuous recalibration.
KITTI
NuScenes
Attack Type
Both
Camera
LiDAR
Both
Camera
LiDAR
Burst
0.2742
0.0333
0.2333
0.3307
0.3444
0.3333
Constant
0.0600
0.5400
0.5800
0.0033
0.4908
0.4942
Drift
0.6441
0.5500
0.5500
0.4221
0.3708
0.3656
Jitter
0.3036
0,4167
0.3125
0.2942
0.2486
0.2913
Random
0.3385
0,4000
0.6000
0.3688
0.3704
0.3488
Reversal
1.0000
0,4000
0.5200
0.0092
0.3538
0.3458
Scheduler
0.2963
0.7143
0.6000
0.3580
0.3643
0.3732
Table 3: True Positive Rate (TPR) at False Positive Rate (FPR) of < 0.01 across various attack types and sensor modalities.
18

---

Published as a conference paper at ICLR 2026
Table presents the preliminary window-level True Positive Rate (TPR) at this target FPR. These metrics reflect window-level detection performance across the targeted modalities. Because some windows within single extended attack event may exhibit only subtle misalignments, the per- window TPR is naturally constrained; however, the generalized thresholding strategy maintains high precision and strict false positive control.
BASELINE COMPARISON
To compare the performance of AION, implement two temporal misalignment detection base- lines: one based on timestamps and another on semantic content from the fused message pairs.
Timestamp-sanity (interval variance). This baseline operates purely on the sequence of times- tamps and detects irregular timing patterns. Given a stream of timestamps {li), we compute inter- arrival times At,
f and measure their normalized variance var(At)/(ee normal operation, messages arrive with nearly constant spacing, so the variance of At is small. Manipulating timestamps or introducing abnormal jitter makes the gaps more irregular, increasing this variance. We use the resulting value as scalar anomaly score and select threshold based on benign data.
+E). Under
Sliding-windon correlation baseline. This baseline quantifies the similarity between camera and LiDAR features at each time and interprets low similarity as evidence misalignment. Let "C, E Rd denote camera and LiDAR feature vectors at time step n4. for window of w. For each time step, we compute the Pearson correlation Pn. = corr(re: rz'' between the two feature vectors and then average these over time, p = + Ei Pi. Well-synchronized streams yield feature pairs that highly correlated (large p), whereas temporal misalignment decorrelates the streams and decreases p. We finally map this to an anomaly score via a simple linear transform, (1 p2/2, and flag windows whose score exceeds threshold calibrated benign sequences.
1.1 DETECTION PERFORMANCE
In Fig. 13 we compare AION to the two baseline detectors, Timestamp and Correlation, in terms of AUROC across all seven attack types on KITTI and nuScenes. On both datasets, AION con- sistently attains the highest or near-highest AUROC, typically in the 0.85-0.97 range, while the timestamp-sanity baseline lags behind (often below 0.8 on KITTI and 0.7 on nuScenes) and the cor- relation baseline sits in between. The gap especially pronounced for the NuScenes dataset, where AION retains high AUROC, whereas the purely timestamp- or correlation-bas substantially. Overall, these results indicate that AION provides significantly more reliable de- tector of temporal misalignment than either simple timestamp modeling or sliding-windov feature correlation, and that its advantage is stable across datasets and attack families.
methods degrade
19

---

Published as a conference paper at ICLR 2026
Baseline Comparison on kitti
1.0
0.8
AUROC
0.6
0.4
Detector
Timestamp
0.2
Correlation
AION
0.0
Burst
Constant
Drift
Random
Reversal
Scheduler
Attack Type
Baseline Comparison on nuscenes
1.0
0.8
AUROC
0.6
Detector
Timestamp
0.2
Correlation
AION
0.0
Constant
Jitter
Random
Reversal
Scheduler
Attack Type
Figure 13: Baseline comparison of AUROC for the Timestamp and Correlation-basee detectors across seven TMA attacks on KITTI (top) and nuScenes (bottom). AION consistently achieves higher AUROC than both baselines for most attack types, especially on complex datasets such as NuScenes, demonstrating its stronger robustness to diverse timing perturbations.
20


Reviews:
[{"review_id": "Rprl5NnGZS", "reviewer": "Reviewer_A4m8", "summary": "This paper looks at a very concrete hole in current multimodal AD pipelines: if an attacker only tampers with timestamps (not pixels/points) to force the ROS2/DDS synchronizer to pair camera frame t with LiDAR frame t−k, fusion degrades badly, but most existing defenses don’t look at the temporal axis. The authors propose AION, a plug-in module that (1) learns a shared camera–LiDAR representation with a continuity-aware contrastive loss so temporally close pairs stay close and far pairs stay apart, and then (2) at run time builds a cross-modal similarity matrix over a short window and runs DTW to see whether the optimal path still follows the diagonal. On KITTI and nuScenes, under synthetic constant / random delays, AION gets AUROC around 0.92–0.98 while keeping the module lightweight.", "questions": "a) In deployment, is the threshold global (one value for all scenes / weather / motion) or per-sequence? How sensitive was AUROC to the threshold estimated on “benign” data?\n﻿\nb) For nuScenes where you aggregate 6 cameras -> BEV -> shared space, do you observe different DTW patterns than in KITTI (single front camera)? In other words, is AION implicitly assuming similar FoV on both modalities?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "a) Fits AD architecture. The threat model (attacker sits on ROS2 / in-vehicle network and rewrites timestamps) matches how actual AD stacks glue sensors together.\n\nb) Problem is real. Recent works have shown that temporal desync alone can tank fusion AP, but most defenses assume honest timestamps and focus on spoofing / spatial inconsistency / context violations. AION directly targets the temporal gap, which is a good angle. \n\nc) CACL is a reasonable tweak. Using relaxed/graded negatives based on temporal distance is a sensible extension of ReCo-style contrastive learning to sequential sensor data, not just random pairs.", "weaknesses": "a) Attack model is fairly simple. All attacks are synthetic constant/random delays with a fixed window and fixed injection interval. Real attackers could do pattern-shaped delays, scene-aware delays, or imitate low-speed / stationary AD scenarios the paper itself says are hard to detect; for these, DTW over a short window may not separate benign vs. attack that cleanly. \n\nb) Stationary / low-dynamics scenes remain hard. The paper admits that if both modalities are delayed by the same amount or the scene stays visually/geometrically similar, the similarity map still looks diagonal, so AION can’t tell benign from malicious. This is exactly the case an attacker in city driving would want to exploit. This limitation should be foregrounded more.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WQbzUFGZge", "reviewer": "Reviewer_hrs4", "summary": "AION is a lightweight, plug-in defense that detects temporal misalignment attacks (TMA) in camera–LiDAR fusion by (i) learning continuity-aware multimodal embeddings (CACL) and (ii) using Dynamic Time Warping (DTW) on a rolling similarity matrix to spot off-diagonal alignment paths indicative of delays/drift/jitter. On KITTI and nuScenes, it reports AUROC 0.92–0.98 across constant and random delay scenarios with low FP rates, using a ~1.97M-param module and small DTW window (w=5) for real-time viability.", "questions": "See in the weakness section.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "Clear threat model & practical attack surface: focuses on timestamp manipulation in ROS2/DDS synchronizers within tolerance windows—no need to alter sensor payloads.\n\nContinuity-aware contrastive learning: grades negatives by temporal distance to capture subtle misalignments, improving sensitivity over rigid positive/negative setups.\n\nGeneral plug-in design: shared multimodal encoder + DTW operates task/backbone-agnostically; demonstrated on KITTI encoders and BEVFusion for nuScenes.", "weaknesses": "Hard case acknowledged: equal constant delay on both modalities (or stationary scenes) can mimic benign diagonals; detecting this requires extra sensors (IMU/CAN) beyond the current scope.\n\nSynthetic attack generation: evaluations inject delays at fixed intervals and windows; robustness to real network behaviors (bursts, variable τ, dropped frames) isn’t deeply profiled here.\n\nThresholding & ops details light: deployment describes reward-based anomaly scoring but gives limited guidance on threshold calibration and sensitivity to window size w beyond w=5 choice. \n\nThe authors also needs to consider robustness to adaptive attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6wzFPoCSFb", "reviewer": "Reviewer_hBGi", "summary": "The paper proposes a method called AION to detect temporal misalignment attacks in multimodal fusion for autonomous driving. The main idea is to use continuity-aware contrastive learning to learn smooth multimodal representations and a Dynamic Time Warping (DTW)-based detection mechanism to trace temporal alignment paths and generate misalignment scores. The proposed method is evaluated on the KITTI and nuScenes datasets, achieving high AUROC values with low false-positive rates across fusion backbones. However, the realism of the threat model for tampering reported time stamps is questionable, and the actual handling of timestamp inconsistencies in real-world scenarios is not addressed. Additionally, the practicality of the proposed method is limited due to the lack of experiments on real vehicles.", "questions": "Please refer to the weakness.", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 1, "strengths": "1. The problem statement is clear.\n2. The write-up is easy to follow.", "weaknesses": "1. The realism of the threat model for tampering with reported time stamps is questionable. If the attacker has the right access to the captured data, why is it a challenge for him to further tamper with the raw sensor data?\n\n2. The actual handling of timestamp inconsistencies in real-world scenarios is not addressed, and it is unclear how the proposed method would perform in such situations.\n\n3. The practicality of the proposed method is limited due to the lack of experiments on real vehicles, which could reveal potential issues or limitations in real-world deployment.\n\n4. The experimental evidence is not enough; more evaluation (including the computation costs are needed).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fC0djHeiTb", "reviewer": "Reviewer_ApBr", "summary": "The paper targets temporal misalignment attacks (TMA) in multimodal fusion for autonomous driving, where an attacker perturbs timestamps to make camera/LiDAR frames desync without touching sensor content. It proposes AION, a lightweight, plug-in “detection patch” that:\n(1) learns a shared multimodal representation via continuity-aware contrastive learning (CACL) that down-weights negatives that are temporally near using a tanh(|i−j|/τ) weighting, and\n(2) runs Dynamic Time Warping (DTW) over a rolling window of cross-modal similarity matrices to score alignment; deviations from a diagonal path lower the DTW “reward,” signaling misalignment. Architecture overview in Fig. 1 (p.4); attack types in Table 1 (p.6); similarity matrices and anomaly curves in Figs. 2–3 (p.8); ROC curves in Fig. 4 (p.9); DTW algorithm in Algorithm 1 (p.12). Reported AUROC on KITTI and nuScenes is 0.92–0.98 across several delay scenarios with small model overhead (~1.97M params, window w=5).", "questions": "1. Can you include discussion of difference of the work to \"Fusion is not enough: Single modal attacks on fusion models for 3D object detection\" ICLR.\n\n2. Why not compare to (i) timestamp-sanity models with probabilistic jitter, (ii) cross-modal tracking consistency checks (adapted to timing), (iii) simple sliding-window correlation or CUSUM-style detectors?\n\n3. Can a single MRE trained on one dataset/backbone generalize to another without retraining? Any train-on-KITTI, test-on-nuScenes results?\n\n4. What FPR/TPR do you get at thresholds suitable for deployment (e.g., FPR ≤ 0.5%)? How are thresholds set (per-scene, per-vehicle, global)?", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "It offers a few contributions:\n1. Timestamp-level, network-induced TMA is realistic and distinct from content spoofing; the threat model is clearly articulated (Sec. 2). \n\n2. AION is architecturally simple (shared encoder + DTW) and plausibly deployable as a non-intrusive patch; runtime cost is argued to be low (Sec. 5, “Scalability”). \n\n3. CACL’s graded negative weighting (λij=tanh(|i−j|/τ)) is intuitive for video-like sequences and is nicely visualized in Fig. 5 (p.12).", "weaknesses": "I would like to hear from the authors to address the following issues:\n1. Attacks are synthetic (constant/random delays) and limited; no drift, burst, schedule-dependent, or closed-loop attacks; no real middleware latency manipulation or ROS2-in-the-loop study. (Table 1 + Sec. 4.3.)\n\n2. Results are ROC/AUROC-only; no calibration/threshold selection, no reporting at practical FPRs (e.g., 0.1%–1%), and no end-to-end latency or throughput measurements in a real AD stack. (Sec. 5 focuses on AUROC.)\n\n3. Sec. 3.3.2 informally treats Sij≈1 iff i=j to justify reward drops; in practice, cross-modal similarity is noisy and scene-dependent, so this theoretical justification is fragile without empirical sensitivity checks to motion, density, lighting, etc.\n\n4. It’s unclear if the MRE is trained per dataset/backbone and how it transfers (train on KITTI, test on nuScenes?) or across different fusion designs; “task-agnostic plug-in” claim would be stronger with cross-architecture/domain transfer results. (Sec. 4.2 describes per-dataset setups.)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)