On Adversarial Attacks In Acoustic Localization
Authors: Tamir Shor
Chaim Baskin
Alex M. Bronstein
Venue: Accepted by TMLR ()

Abstract: Multi-rotor aerial vehicles (drones) are increasingly deployed across diverse domains, where
accurate navigation is critical. The limitations of vision-based methods under poor lighting
and occlusions have driven growing interest in acoustic sensing as an alternative. However,
the security of acoustic-based localization has not been examined. Adversarial attacks pose
a serious threat, potentially leading to mission-critical failures and safety risks. While prior
research has explored adversarial attacks on vision-based systems, no work has addressed
the acoustic setting. In this paper, we present the first comprehensive study of adversarial
robustness in acoustic drone localization. We formulate white-box projected gradient descent (PGD) attacks from an external sound source and show their significant impact on
localization accuracy. Furthermore, we propose a novel defense algorithm based on rotor
phase modulation, capable of effectively recovering clean signals and mitigating adversarial
degradation. Our results highlight both the vulnerability of acoustic localization and the
potential for robust defense strategies.

Published in Transactions on Machine Learning Research (02/2026)
On Adversarial Attacks In Acoustic Localization
Tamir Shor
Shmirr.hor&oaanee hwwah//hhor@ammppps.cciiin...ooo
Department of Computer Science
Technion Israel Institute of Techmology Haifo, Isrell
Chaim Baskin
chaimbaskin
School of Electrical and Computer Engineering Ben- Garion University of the Negev
Be err Sheva, Israel
Alex Bronstein
bron bron@cs. www.weehhhhoncc...o
Technion Israel Institute of Technology Haifa, Israel
Institute of Science and Technology Austria
Reviewed on OpenReview: htips: // openreview. net/ forum? id- Nam5xXoLFb
Abstract
Multi-rolor aerial vehicles (drones) are increasingly deployed across diverse domains, where accurate navigation is critical. The limitations of rision-based methods under poor lighting and occlusions have driven growing interest in acoustic sensing as an alternative. However, the security of croustic-based localization has not been examined. Adversarial attacks pose serious threat, potentially leading mission-critical failures and safety risks. While prior research has explored adversarial attacks vision- based systems, no work has addressed the acoustic setting. In this paper, we present the first comprehensive study of adversarial robustness in acoustic drone localization. We formulate white-box projected gradient de- scent (PGD) attacks from an external sound source and show their significant impact on localization accuracy. Furthermore, we propose novel defense algorithm based on rotor phase modulation, capable of effectively recovering clean signals and mitigating adversarial degradation. Our results highlight both the vulnerability of acoustic localization and the potential for robust defense strategies.
1 Introduction
Multi-rotor autonomous aerial vehicles (drones) have seen rapid adoption across wide range of industries
(Ayamga et al.] 2021 Merkert & Bushell 2020 Moshref-Javadi & Winkenbach 2021). including emergency
medicine (Johnson et al. 2021 Zailani et al. 2020). sustainability (Dutta & Goswamil 2020 Mahroof et al.
2021), and disaster control [Daud et al. 2022 Ishiwatari] 2024h. as well as recreational and commercial
applications (Tan et al.] 2021 Benarbia. Kyamakya] 2021). Their popularity stems from the ability operate challenging or hazardous environments while reducing human risk and cost.
Successful drone deployment relies accurate and efficient navigation. This has driven major advances in localization methods (Kang et al. 2015 Dijkshoorn 2012 Sorbelli et al. 2018), particularly with deep learning (Yousaf ct al. 2022 Bisio et al. 2021 Zhang et al. 2022). Current solutions primarily depend on GPS with inertial systems, visual odometry, or aclive sensors such as LiDAR (Arafat et. al.) 2023 A Aburaya
et al. 2024 Niu et al. 2022 Debeunne & Vivet 2020). While effective many scenarios, these methods often fail under degraded lighting, occlusions, or structural constraints, and may be impractical GPS-denied environments (Arafat al. 2023 Al-Radaideh Sun 2021 Dreissig al. 2023) Meles et al., 2023). To
address these limitations, researchers have explored alternative modalities, notably acoustic localization HHe

---

Published in Transactions on Machine Learning Research (02 (02/2026)
Figure Adversarial Acoustic Localization Setting -. Localization model input (green) is the drone sound response (blue) perturbed with external speaker adversarial interference (red).
et al. 2023 Sun et al. 2023 Serussi et al. 2024). which leverages sound propagation for robust localization even under visual or RF impairments (Famili et al. 2022). With the growing reliance on drones, security
concerns intensify. Adversarial attacks have been shown to manipulate perception systems, leading to severe
outcomes such as navigation failure or collisions (Mynuddin al. 2023 Wisniewski al.) 2024 Guesmi &
Shafique 2024 Fu et. al., 2021) While defenses against such attacks exist (Mynuddin et al. 2024 Wang et al. 2023). they have focused exclusively visual or LiDAR-based sensing. Despite the rapid adoption of acoustic localization, its adversarial robustness remains unexplored.
To address this gap; we present the first formulation and analysis of adversarial attacks targeting acoustic drone localization. We study white-box attacks from a single omni-directional sound source external to the drone. Additionally, we leverage the phase modulation mechanism proposed in (erussi et al. (2024) to design novel defense method that separates the clean signal from adversarial interference under minimal assumptions. We further extend Serussi et al. (2024) to real-world acoustic recordings, beyond simulated settings, enabling realistic evaluation. While experiments focus drone navigation, the proposed approach generalizes to any single-agent acoustic localization system.
Our main contributions are:
1. We formulate and benchmark adversarial attacks on acoustic localization, with fully differentiable attack pipeline.
2. We analyze the computational and performance implications of perturbation source-location opti- mization.
3. We develop acoustic-channel attack test-time defense algorithm, capable of credibly reconstruct- ing the original perturbation waveform sampled by the drone.
We extend Serussi al. (2024) demonstrate self-sound-basee localization using real acoustic data.
2 Related Work
In this work we adopt the acoustic localization algorithu from Serussi al. (2024). This algorithm performs drone localization based solely the self-sound emitted by the drone's propulsion system, sampled by circular array of microphones M located around the drone. The authors propose three-step pipeline. First, forward model is used to model the self-sound emitted by the dronc's propulsion system in froe space, using a fixed, parametrized set of point sound sources optimized to fit. an actual free-space recording. Second, a neural, transformer- based inverse model is used to regress the drone location based on the propulsion sound as sampled by the microphone array. This sound is simulated using both the forward model and RIR by superimposing the direct path from each point sound source each microphone, along with the reflected paths from the walls. These paths are given by the image source model (ISM), replacing source reflections
2

---

Published in Transactions on Machine Learning Research (02/2026)
walls with imaginary point sound sources (termed images Allen & Berkley present the optimization of the time-dependent angular offiets of the rotors, termed phase modulation, in order to improve localization accuracy. We further elaborate on the concept of phase modulation in Section 3.4 in the sequel. Our reason for using the approach from Serussi et al. (2024) is the fact that it presents an accurale, purely acoustic-based localization model for us to evaluate under acoustic adversarial perturbations, and mainly since the proposed phase modulation mechanism will serve us establishing our proposed defense method in Section 3.4
1979 Lastly, the authors
One shortcoming of Serussi et al. (0024) is the choice to compute input to the location regressor (a.k.a inverse model), i.c. the sound sampled at cach sensor using a simulation superimposing a set of point sources given by the ISM, with equation | being applied over each point sound source separately. While this method is relatively accurate in sufficient point source sample density (Scheibler et al. 2018), the computational costs entailed in computing the ISM render this method prohibitively expensive for larger and more complex acoustic environments. Our specific uso-case of adversarial attack optimization calls for the optimization of sound emitted by the attacker (Section 3.3 obligating rapid inference of the forward model (i.e., through sound generation). This makes the original ISM-based approach of sound computation inapplicable for our purposes. In this work we therefore opt develop a modified version of the ISM-reliant algorithm from Scrussi et al. 2024 making use of neural-acoustic fields (NAFs) (Luo et al. 2022), as further elaborated on Section 3.2
3 Method
In the following section, we outline our approach to developing adversarial attacks and defenses for the task of acoustic drone localization. Section 3.1 lays the loundations of acoustic sensing-guided localization, and Section 3.2 presents the "clean' (non-perturbed) localization setting studied in this paper. Section 3.3
formulates our threat model and the proposed acoustic adversarial attack, and Section 3.4 proposes a defense method relying on active rotor phase modulation.
3.1 Acoustic Localization Background
Acoustic localization is the task of identifying the location x, R of sound source emitting sound signal (t) E RR in known enviromment, based the response of that signal st(()= E R² measured at given sensor (microphone) location X,, E R Here, the temporal signals are assumed to be sampled at T discrete time points, and n denotes the number of location degrees of freedom. While, in the most general case, n = (for location and orientation in 3D space), in this work, we focus on 2D localization with known orientation (n = 2). State-of-the-art acoustic localization solutions (Baron et al. 2019: Serussi et al., 2024 typically employ various neural architectures Ft)m(t) optimized to regress X
Sm (t) is dependent on the decay and scatter sx(t) undergoes when propagated through the room to Xm- This propagation is modeled by the room impulse response (RIR) [Borish 1984) r(4; Xa, Xm: C) temporal function also dependent on the source and sensor locations, as well the room geometry and physical properties, collectively denoted as Ç. This function essentially describes the response in time of an impulse at x, as perceived at Xm after propagating in the environment Ç. The sampled sound sm can finally be attained by convolving the RIR with the input sound,
sm (t) = r(;; Xm, () # st(,,,
(1)
where the convolution is performed over time t.
3.2 Clean localization
To circumvent the reliance on computationally complex ISMs used in Serussi et al. (2024) for RIR computa- tion (as detailed Scction D we replace usage of ISMs with neural acoustic fields (NAFs, Luo al. (2022) ). NAFs offer a reliable neural representation of the RIR, and are trained over actual RIR sampled from actual room acoustics. Unlike the original forward model from Serussi et al. 2024 NAFs produce RIRs already
3

---

Published in Transactions on Machine Learning Research (02/2026)
encompassing higher-order reflection sources. Therefore, for every point sound source, modeling the drone sound 8x, and the entire sound waveform sampled at given microphone, 8m, can be directly derived from equation T in a single forward pass, with the RIR component attained by a single query of the NAF model.
Optimized-
*
Adrone
Frozen
NAP
Kgrone-F Ry.
Ap
XAF
*
ac( aL( Xdrams
Xyource
Bat
Figure 2: Adversarial Pipeline Overview - sound from both drone sound and adversarial source is convolved with NAF-induced RIRs and superimposed at the sensor, prior to being fed into the localization model. Localization loss gradients guide the optimization of source-emitted waveforms.
In our altered formulation for Scrussi et al. (2024) for every microphone μe E M, the response of cach point sound-source s,Vi S perceived at μr, is computed using equation I (with NAF-produced RIRs). The total Si. These inputs are fed into the inverse model (transformer-
sampled sound at sensor fu is given by 8/ encoder architecture from Serussi et al. (024 to train our 'clean" regressor, to be later evaluated under the presence of adversarial acoustic perturbations. We report clean localization performance in Section 4.2 These iodificatiios fall outside the main intended contributions of this paper and serve as a stepping stone toward a fast, differentiable model for the computation of sm.
3.3 Acoustic Adversarial Attacks
In their most general form, adversarial attacks aim to add a perturbation to the input of a given, usmally trained model M(x) receiving an input x, so as to manipulate the performance the model over the perturbed imput x in order to maximize the model's error according some quality measure L, thus harming the model's performance and reliability. This is usually done by solving the constrained optimization problem formulated in equation 2
max L(M(x + p)) s.l. C,(p) < B
2
P
where Eg is some constraint over the optimized perturbation, ensuring its feasibility under domain-specift requirements.
In our setting, M is the localization model from Scction 3.2 and is sound sampled the dronc's microphone array. Our acoustic adversarial attack must establish both the perturbation p, and the a set of constraints (collectively measured by Eg) appropriate for our domain of acoustic localization.
3.3.1 Perturbation Formulation
In our setting we wish develop adversarial attacks originated from stationary, omni-directional sound source located at arbitrary location in the environment, controlled by the attacker. The motivation for this choice is that unlike common adversarial perturbations known from the field of Computer- Vision, such as 2D perturbations added to the input of image classificrs, in our setting the attacker cannot directly control the perturbation added to the model's input signal. This is because, unlike spatial signals (e.g. 2D images), acoustic signals are not stationary the presence an acoustic perturbation at one location in the environment inevitably affects the sampled sound another location. For this reason, we also focus our discussion in this paper on universal adversarial attacks, rather than optimizing a distinct perturbation for every drone location and orientation.
4

---

Published in Transactions on Machine Learning Research (02/2026)
We choose to model the sound emitted by the perturbation sound source (namely, the attacker) sp R using a basis B = [fA JEE of sine waves from a chosen frequency set K. J&Vk E K is sine wave of frequency
k sampled at I" timesteps The corresponding perturbation is given by spanning this basis with a set of [
learnable amplitudes [ae]
8p = Σ aak.f fk
(3)
REK
The rationale for this formulation is 3-fold: Firstly, it implies inherent periodicity, as we wish to optimize for periodic perturbations to avoid having to optimize the attack for an indefinite temporal duration. Especially under the assumption that the clean signal is in itself periodic (as is the case in the sound generated by the drone). Secondly, this formulation allows to reduce the number of learnable parameters from T (when optimizing for the sound in signal domain) to [K], allowing more efficient optimization. Lastly, it allows simple control over the amplitude and frequency components of the perturbation in order to impose various constraints elaborated in Section 3.3.2
3.3.2 Attack Constraints
Our goal in this section is to develop set of constraints that would allow the attack to elficiently harm localization performance while still not be easily detectable by the localizing agent. Contrary to the computer- vision domain and similar countcrpart adversarial scttings, where appropriate constraints are well-studiod and well-established (see Croce al. (2020)) (mostly Lox, L2 and Ln norms, among others), the relatively uxder-explored domain of acoustic attacks does not currently hold a set of widely accepted attack constraints. We deem the acoustic setting more challenging in this aspect as, unlike vision where many scenarios may the conditions where acoustic perturbation can
bound together under relation with be deemed feasible or non-trivial for detection vastly change under different factors (e.g. sensors, 'clean" sound properties and task). For this reason, we propose our own constraints for the optimized adversarial perturbation. The effect of different constraint value choices over performance is studied in Section 4.2
Frequency constraints. Our first observation in this context that the sound emitted by the drone's propulsion system is periodic. If the period of perturbative sound substantially differs from that of the drone, the adversarial attack could be trivially detected by the agent. Therefore, we filter our sine basis B to include only frequencies integerly intertwined in the drone's cycle. The bandwidth of perturbation source-emitted frequencies is also subjected to frequency constraints given by the sound-source itsclf. We, therefore, also clamp the bandwidth of B according to some plausible minimal and maximal values (set to a minimun of 50 Hz and a maximum of 2 KHz in all of our experiments). All ttequency-relater constraints are imposed by the construction of the perturbation as detailed in Section 3.3.1
Signal constraints. We constrain both the amplitude and power of the emitted signal. The amplitude is constrained to avoid trivial perturbations that dominate the clean signal and can subsequently be easily disentangled from it. The power is more closely related to human perception (namely the loudness of perceived signal), however constraining it also helps diminish irregular local signal energy patterns that may potentially be utilized in attack detection.
Signal constraints are imposed via soft constraints regularizing the optimization process (equation 4 Note that while the perturbation is sampled at the microphones, all constraints are imposed over the sound at the source. This choice is motivated by the fact that the sound sampled at the microphones could potentially greatly vary with drone spatial translation, reducing attacker control over perturbation fcasibility.
Location constraints. Upon optimizing for the perturbative source location Xp: we must ensure the source remains within environment boundaries. This is done using a signed-distances fintaaccceffniioonn (SDF) LSDF linearly penalizing distance when the source is optimized to be away from environment boundarics.
3.3.3 Perturbation Propagation
Much like the 'clcan" sound emitted by the drone, our adversarial perturbation must also be propagated to the drone's sensor array to be sampled by it. Our goal is to formulate a universal attack optimization scheme shaping the emitted signal at the source 8p so that the sampled response at the sensor μa, denoted op, would
5

---

Published in Transactions on Machine Learning Research (02/2026)
optimally reduce localization accuracy. In experiments, consider both optimization of the emitted perturbation for a sound source located in the center of the room, as well as optimization of the emitted sound jointly with the perturbation speaker's location Xp E R². For our localization quality measure, we choose Mcan-Squarod-EFror (MSE), following the critcrion from Scrussi et al. (2024). Our universal attack optimization, in its most general form, therefore formulated according to equation
max [or Xx
|[ x,) 8p()) xxalé + Lop88p
(4)
for definition of the constraint loss Lgg as:
Cg(sp, Ip) = Xamp max {0, 11sp1l0000 - 3}
(1) { ) Apooer max 0, M
+ AsDFLsDr(x))
Sp is the perturbation source-sound attained from equation 3 x(t; x.) is the RIR between sound-source location Xp and microphone location Xu. given by the pre-trained NAF, F is the pre-trained localization model with a set of microphones M, where each microphone is located in location X Xa represents actual location of the center of the drone, and B,7 are the respective amplitude and power bounds from Section 3.3.2 for losses weighted by Aump and Apower. Location SDF is weighted by ASDF. While equation is tormulated for non-targeted attacks, in Section and in Appendix B.1 we adapt our formulation explore targeted attacks.
3.3.4 Source Location Optimization
One potential difficulty in our formulation from equation 4 is that there are cases where optimization of the perturbation source location Xp within the scene may be difficult or altogether impossible. The reason is that optimizing Xp necessitates differentiation through the acoustic model of the environment (namely, in our case, the NAF). To address cases where such a differentiable model not available or where the added computational costs incurred by querying and backpropagating through such, usually large, models are too heavy (see Appendix D for time and memory footprint in our experiments), in experiments, analyze universal attacks with fixed perturbation source location in the center of the room. In this case we only optimize the perturbative sound. The alleviation in computational costs stems from the fact that the perturbation impulse response for every microphone location is constant, circunventing repeated forward and backward evaluation the NAF model. As Section 4.2 shows, we observe only a marginal decrease in allack prowess when waiving source-location optimization. Our adversarial pipeline rated Figure
also
3.4 Phase Modulation Perturbation Delineation
In this section, we propose Phase Modulation Perturbation Delineation a novel method for the utilization of phase modulation (Serussi el al.) 2024) for the recovery of the "clean," non-perturbed signal from the entire (presumably adversarially perturbed) acoustic sample as perceived by any the drone's sensors. Section 3.4.1 overviews the concept of phase modulation, originally used by Serussi et al.) (2024) for improving localization accuracy. In Section 3.4.2 we show how this mechanism can be further extended for perturbation and clean-signal separation.
3.4.1
Phase Modulation
In our acoustic localization setting, similar to that studied in Serussi et al. (2024), the drone's propulsion system consists a set of R rotors that rotate at constant and equal angular velocities. The resulting angular locations of cach rotor through the duration of a single cycle spanning over seconds (namely, the azimuthal rotor shaft positions w.r.t some chosen starting point) can thus be described as function (t) [7] - [0, 2T]] converting moments in time from each cycle to the corresponding angular location of

---

Published in Transactions on Machine Learning Research (02/2026)
rotor i.
The phase modulation mechanism from Serussi et al. (0224) proposes to actively optimize per-rotor fune- tion of temporal offsets from po(t), termed a modulation function pi(t): [2'] + [0, 2T], for every rotor i. Every combination of such modulation functions alters the sound emitted by the propulsion system through time, and thus the ratilnale is to optimize the set of R such per-rotor modulation functions to generate imput waveforms more useful for localization (under imposition of certain constraints over these modulation functions, ensuring kinematic feasibility and the drone's stable flight)..
3.4.2 Perturbation Delineation
We extend the concept of phase modulation (Section 3.4.1 to delincate the adversarial perturbation from the entire sampled input 8n at given microphone μ.. Let us denote the perturbation response of sp at microphone j by op. Upon sampling a perturbed waveform Sμ = &drone + Tp. the goal is to solve for op. Upon doing so, we can input the original non-perturbed signal Sdrone to the localization model, essentially mullifying the effect of the attack over localization performance.
Our approach is applying gradual temporal delays over Sdrone using the phase modulation mechanism, utilizing the fact the perturbation sound remains constant under these modulations. Denote by T the maximum of the period times of the dronc and perturbation source. Since the drone cycle Tarone must be an integer multiple of the perturbation source period pert (Section 3.3.2). both Sdvome and Sp complete a periodic cycle (of one or more periods) within a duration of T seconds.
For every moment in time j E [T], we can apply constant phase modulation of j timesteps across all rotors jointly for the entire seconds period. Denote the sound sampled some arbitrary microphone I with constant modulation j across rotors as (t: This sound is the sum of the j-modulated drone- emitted sound, denoted (t: and the original sampled perturbation sound op(t) (unaffected by phase modulation). Our key observation is that for every non-zero value of j, at moment of the current period (where each rotor is modulated at timesteps), the sound component originated from the drone's propulsion system is the same as that sampled at the j = 0) constant modulation at timestep 0, and hence by simple subtraction: St (t= [)))) - st = 0; = op(t j) -p((t = -).
By performing this process for every value of j E [T], we can essentially recover op(t) - op(t = 0) for every value of t, giving us the perturbating waveform at the location of the microphone μ. One degree of uncertainty which our algorithm does not allow solving for, is the value of Op at moment t = 0. While we believe this value can be retrieved, for example by imposing correlation among several perturbation waveforms at different locations, we defer the study of this possibility to future work. For the scope of this work, as validated in Section 4.3] simple setting of a, = 0) to be everywhere in the environment roduces localization degradation almost completely. We stress that while our proposed algorithm demonstrated on phase modulation of drone rotors, applicable for acoustic perturbation delineation of any agent capable of actively shaping the 'clean" sound, thus separating it from the constant perturbation. This formulation is summarized in algorithm Figure 3 visually depicts our algorithm single drone period is illustrated
stops modulation
T2 steps modulation
1
A
C +
pert value
pert value at
Figure Summary of Perturbation Delineation Method rotor self-sound (blue) under different phase modulations (black arrows depict rotor angular location at f = 0)- In red is the perturbation sound. The two are superimposed to the microphone-samples signal (green).
under 3 different phase modulations - 0 (A), æ (B, corresponding to 7, timestops), and 2 (C, corresponding to 72 timesteps). In each room the same perturbation sound (red) is observed, while for cach modulation the same drone-emitted sound is observed up to certain shift (blue). The superimposed sound sampled by
7

---

Published in Transactions on Machine Learning Research (02/2026)
the microphone (green) is shifted accordingly (w.rtt the O-modulation room A) in each room. In the bottom part, we illustrate how the (-modulation waveform is subtracted from each 7-slep modulated waveform to receive the original perturbation (red waveform) at timestep T, utilizing the fact the perturbation is agnostic to phase modulation.
Algorithm Perturbation Recovery Algorithm for Sound Waveform Separation
Require: Perturbed waveform Suz period time Ensure: Recovered sampled perturbation waveform Sr
1: Initialize 8, =[]
Recovered waveform
2: for j to T do
3: sample Sy (t;j)
Modulate by j timesteps
4: update (t =) = sp(t;]) s)(t:
Perturbation at timestep j
end for return 8r
4 Results
4.1
Experimental Setup
Following the experimental setting in Luo et al. (2022). we pick representative subset of acoustic envi- ronments from the Matterport3D (Chang et al. 2017] and Replica (Straub et al.) 2019) datasets used in training of RIRs from Neural Acoustic Fields (NAFs). In this section, we primarily present results from the uparlment 2 fri enviroument (denoted apl, in this section). We also provide partial results for the office_4 and room_ scenes in Figure 5 with the full set of results available in the supplementary material (Appendix B For cach environment we train the clean localization model from (Serusii et al. (2024) using the environment-fitted pre-trained NAF. In order to explore our developed approaches disjointly from any external, case-specific affects, in most experiments we assume zero interference from any acoustic signals, excluding the drone and the attacker. Nonetheless, in Section 4.4 we also model the effect of white noise over adversarial success. Furthermore, in our experiments we focus on the localization model from Scrussi et al. (2024) since the only one completely reliant on the self-sound emitted by the drone's propulsion system. Other methods (e.g. [Sun et al. (2023); He al. (2023)) rely mostly on external speakers, and thus require the development of adversarial attacks accounting for both the speaker sound and propulsion sound simultaneously. We refer this direction of research to future work. Nonetheless, our developed attack and defense methods are applicable to any combination of drone configuration and acoustic localization algorithm. Localization training details are stated in Appendix C
emphasize that
To evaluate our attacks, for every combination of constraints (B,7) E [0.01, 0.1, 0.3, 1 x [0.1, 0.25, 0.5, 1,2] we perform 100 iterations of universal PGD attack over each environment and combination, with early-stop not
of itcrations without localization loss increase. Our set of attack constraints is upper-bounded surpass 50% of the average clean signal amplitude and power, and lower-bounded to allow minimal deviation from clean localization. We set all regularization weights from our training objective (equation to 1 in all experiments. We report our results in scaled RMS (i.c. RMS between predicted and ground-truth locations after being scaled to the [0, 1] range) for the sake of interpretability and comparability across scenes.
4.2 Attack Results
Optimized attack RMS error results across different bounds are reported in Figure 4 Our proposed attack increases the mean localization error from slightly below 5% in the clean model, to 37.4% for highest am- plitude and power bounds. Results also demonstrate saturation of attack efficacy with growth in the B, bounds, where in both figures the largest and second-largest. amplitude bounds B = 0.5, B = 1 intersect almost completely. This also true for the power bounds, as all figures remain almost constant in transition from 7 = to y = This bounds the maximum efficacy of our PGD attack bound of around 0.5 for the amplitude and y for power. Lastly, corresponding to Section 3.3.4 we observe that results for location optimization (left) and fixed-source location experiments (right) are nearly identical. We deem the apparent
8

---

Published in Transactions on Machine Learning Research (02/2026)
agnostic nature of sound-source perturbation optimization to source location notable conclusion for future related studies, especially given the increased computational costs (see Appendix D
Optimized Source Location
Stationary Source
0.5
B-0.01
P-0.01
8-0.1
8-0.1
Mean RMS
0.4
0.0.5
P-0.5
B-1
B-1
0.3
0.2
0.1
0.0
0.0
0.5
1.0
1.5
2.0
0.0
0.5
1.0
1.5
2.0
Y
Y
Figure 4: Mean RMS error with and without source location optimization across varying ampli- tude (8) and power (사) bounds. Optimizing the perturbation source location yields negligible improvement over fixed source in the room center.
A39
138
(30
030
EM
A25
175
Alethol
A25
Slaccool
029
029
Secourd Stoee
Pacownd Stame
Racbeared Store
Decouere: Score
Faczvered Score
3.5
106
B== room B 2,0ffice
p= 1,y a,
0.5.y 0.5, apt
B 0.1.y 0.25, apt
Figure 5: Spatial error distribution (Mean RMS) for Clean (top), Attacked (middle), and Re- covered (bottom) scenarios across three environments (apt., room, and office). The "Attacked" remonstrates that the universal perturbation degrades localization performance uniformly across the entire environment (indicated by high RMS values), rather than exploiting specific positional weaknesses. The "Recovered" row shows that our phase-modulation defense suc- cessfully delineates the perturbation, restoring localization accuracy to near-clean levels. Blue markers indicate optimized source locations.
Figure illustrates sal RMS error distributions across varying scenes and 3,7 bounds for optimized source location perturbation optimization. We supply similar results for fixed-source location in appendix B "Clean Scene' denotes non-perturbed localization, "Attacked Scene" depicts localization subjected to the attack from Section 3.3 and "Recovered Scene" shows localization with the perturbation delincation defense methods developed Section 3.4 Results visually demonstrate the effect of our proposed attack over localization performance, spread across the majority of the environment in all test scenes. The smooth spatial distribution of error across each map implies that universal adversarial attack method manages to markedly diminish the underlying localization capability throughout the scene. This consistency in error across diverse spatial coordinates implics that the attack successfully generalizes to attack the localization task as whole, rather than exploiting isolated positional weaknesses. To address any concern of the similarity between fixed and optimized source Figure stemming from the perturbation source not changing in optimization, we stress that location-optimization experiments do demonstrate some change source location under optimization.
The restricted extent this change from the center can be explained by the reduced affect of room geometry perceived perturbation at the sensors the source closer to the sensor. This pushes the perturbation

---

Published in Transactions on Machine Learning Research (02/2026)
source to remain close to the center during optimization, also insinuating that the conclusion from Figure regarding the effect of source location optimization may change in highly non-convex rooms. We defer exploration of this possibility to future work.
In our setting the exploration targeted adversarial attacks is also of great importance, as such attacks would allow a potential allacker to direct the drone a specific location within the enviroument. Our main analysis of the performance of our method in applying targeted attacks brought the supplementary (Appendix B.Ij, however in Figure we present initial results of developed attack's potential in successful targeted attack. This potential is evident from the presented error heatmap in the attacked scene, depicting RMS error between prediction and adversarial target. For our largest-considrred attack bounds, this error is almost zero all along the map. We refer the reader to the supplementary (Appendix B for further related results, including cases where our targeted atlack has proven inefficient.
4.3 Defense Results
In this section we analyze the effectiveness of our proposed acoustic perturbation delincation algorithm from Section 3.4 Figure qualitative support for our method's capability in drastically reducing adversarial performance decay, producing recovered scenes almost indistinguishable from the corresponding clean scenes for the most lenient attack constraints, our algorithm reduces localization error from 37% (Figure below 6%, only marginally higher than the error of 4.87% reported for clean localization. In Appendix also report the recovered RMS error statistics, similarly to Figure 4
Clean Scene
Attacked Scene
Recovered Scene
0.3
RMS
-2
0.2
0.1
2
0
2
4
6
8
2
0
2 4
6
8
2
0
2
4
6
8
Figure 6: Targeted attack spatial distribution of RMS error relative the adversarial target (indicatod by the blue dot) under a targeted attack with maximal bounds. The uniformly low error (black regions) indicates highly successful attack, where the drone is consistently deceived into localizing itself at the adversary's chosen coordinates regardless of its actual position in the room.
We attribute the efficacy of our method to the fact that it is capable of retrieving the sensed perturbation with a only single scalar degree-of-freedonn moment f = 0. To further validate our method, in the appendix we provide thorough empirical analysis of this uncertainty, and conclude that this degree of uncertainty has marginal affect over post-reconstruction localization performance.
that is the uncertainty in the sampled perturbation value at
4.4 Noise Modeling
Since we are the first work to address adversarial attacks over acoustic drone localization, in our experiments wish to assess the impact of acoustic adversarial attacks over drone localization with minimal assumptions over the attacker and the environment. Therefore, in all previous experiments assume the only sound sources are the dronc and the adversarial perturbation. This assumption maximizes the attacker's ficxibility and isolates external interference. Nonetheless, in order lo provide an initial assessment of our findings in real-world conditions, in this section we test the potential our developed attacked under the presence of white noise. Table shows final attack accuracy after perturbation optimization. Selected values of o are chosen as std values below of up 50% of the standard-deviation of the original signal. Notably, the presence of noise does not affect the potential of the attack, in comparison to the clean-setting case.
10

---

Published in Transactions on Machine Learning Research (02/2026)
Table 1: Attack performance under different noise standard-devvation ø. Rows represent different attack configurations (B,7).
3.7
0.01
0.025
0.05
0.075
0.1
Clean model (under noise)
0.0
0.062
0.081
0.116
0,147
3 0.1.7 0.25
0.22
0.226
0.23
0.26
0.261
== 0.5, 0.5
0.345
0.339
0.327
0.346
0.342
B 0=1,702 =2
0.372
0.371
0.369
0.358
0.35
5 Discussion
In this work, we presented first study of adversarial attacks on acoustic localization. We formulated a framework for generating universal acoustic perturbations and analyzed their impact on localization accu- racy under various conditions. We also introduced a novel algorithm for recovering the adversarial signal. Our attacks increased localization RMS error by up to 37%. Our approach also demonstrated that adversar- ial optimization of source location has minimal impact on attack effectiveness, enabling efficient attacks with lower computational cost. As by-product, we trained and evaluated self-sound-relann drone localization model on real acoustic data, expanding prior work that focused solely on simulations.
While our work provides foundational framework for adversarial attacks and defenses in acoustic localiza- tion, several limitations remain. First, in this study we focus on 2D acoustic localization. Many real-world localization scenarios incorporate a 6-DoF regression problem, calling for an extension of our contributions higher-dimension localization. Second, order to isolate the marginal impact of the adversarial attack, our work assumes a simplistic noise model, that does not grasp the chaotic acoustic nature found in some scenes. Furthermore, while efficient, our perturbation delineation algorithm must be applied for an entire drone cycle for every moment in time [0, T), which requires several seconds to delineate a single perturbative waveform.
Another promising avenue for future research would be the exploration of more-complex adversarial settings, that are not discussed in this work. While our experimental evaluation is focused on a single stationary perturbation source, the proposed defense theoretically extensible to more-general scenarios. Since acous- tic signals in lincar medium superimpose, a multi-source attack effectively manifests as single complex waveform the sensor array. Because defense relies the independence of external sound sources from the drone's 's internal phase modulation mechanism, it is potentially capable of extending to any number of stationary, non-adaptive sources without modification. Another viable ad adversarial setting for future explo- ration would be active real-time adversarial adaptation done by the attacker. In the case of our proposed defense, it is constrained by causality. The propagation delay of sound and the processing time required to estimate the drone's phase prevent the attacker from reacting instantaneously to the defense mechanism. We hope our findings help pave the way for the development robust and secure acoustic perception in future autonomous systems.
References
for drone navigation. International Journal of Intelligent Robotics and Applications, pp. 1-19, 2024. Anas Aburaya, Hazlina Selamat, and Mohd Tauliq Muslim. Review of vision-based reinforcement learning
Amer Al-Radaideh and Liang Sun. Self-localization of tethered drones without a cable force sensor in deside environments. Drones, 5(4):135, 2021.
Jont B Allen and David A Berkley. Image method for efficiently simulating small-room acoustics. The Journal of the Acoustical Society of America, 65(4):943-955 1979.
Muhammad Yeasir Arafat, Muhammad Morshed Alam, and Sangman Moh. Vision-based navigation tech- niques for unmanned acrial vehicles: Review and challenges. Drones, 7(2):89, 2023.
Matthew Ayamga, Selorm Akaba, and Albert Apotele Nyaaba. Multifaceted applicability of drones: A review. Technological Forecasting and Social Change, 167:120677, 2021.
11

---

Published in Transactions on Machine Learning Research (02/2026)
Valentin Baron, Simon Bouley, Matthieu Muschinowski, Jérôme Mars, and Barbara Nicolas. Drone local- ination and identification using an acoustic array and supervised learning. In Artificial Intelligence and Machine Learning in Defense Applications, volume 11169, pp. 129 137. SPIE, 2019.
Taha Benarbia and Kyandoghere Kyamakya. A literature review of drone-based package delivery logistics systems and their implementation feasibility. Sustainability, 14(1):360) 2021.
Igor Bisio, Chiara Garibotto, Halar Haleem, Fabio Lavagetto, and Andrea Sciarrone. On the localization of wireless targets: A drone surveillance perspective. IEEE Network, 35(5):249 2021.
Jeffrey Borish. Extension of the image model to arbitrary polyhedra. The Journal of the Acoustionl Society of America, 75(6):1827 1836, 1984.
Angel Chang, Angela Dai, Thomas Funkhouser, Maciej Halber, Matthias Niessner, Manolis Savva, Shuran Song, Andy Zeng, and Yinda Zhang. Matterport3d: Learning from rgb-d data in indoor environments. arXiv preprinl Xiv:: 11777099066588 2017.
Francesco Croce, Maksym Andriushchenko, Vikash Schwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. arXiv preprint or Xix:2001 0.09670, 2020.
Sharifah Mastura Syed Mohd Daud, Mohd Yusmiaidil Putera Mohd Yusof, Chong Chin Heo, Lay See Khoo, Mansharan Kaur Chainchel Singh, Mohd Shah Mahmood, and Hapizah Nawawi. Applications of drone in disaster management: A scoping review. Science & Justice, 62(1):30-42, 2022.
César Debeunne and Damien Vivet. A review of visual-lidar fusion based simultaneous localization and mapping. Sensors, 20(7):2068, 2020.
Nick Dijkshoorn. Simultaneous localization and mapping with the ar. drone. PhD diss., Masters thesis, Universiteit van Amsterdam, 2012.
Mariella Dreissig, Dominik Scheuble, Florian Piewak, and Joschka Boedecker. Survey lidar perception in adverse weather conditions. In 2023 IEEE Intelligent Vehicles Symposium (IV), pp. 1-8. IEEE, 2023.
Gopal Dutta and Purba Goswami. Application of drone in agriculture: A review. International Journal of Chemical Studies, 8(5):181-177, 2020.
Alireza Famili, Angelos Stavrou, Haining Wang, and Jung-Min Jerry Park. Rail: Robust acoustic indoor localization for drones. In 2022 IEEE 95th Vehicular Technology Conferene:<VTCC0022--5ppp pp. 1 6.
IEEE, 2022.
Zhangjic Fu, Yucyan Zhi, Shouling Ji, and Xingming Sun. Remote attacks on drones vision sensors: An empirical study. IEFE Transactions on Dependable and Secure Compuling, 19(5):3125 3135, 2021.
Amira Guesmi and Muhammad Shafique. Navigating threats: A survey of physical adversarial attacks on lidar perception systems in autonomous vehicles. arXiv preprint arXiv:2409.20/ 2024.
Yuan He, Weiguo Wang, Luca Mottola, Shuai Li, Yimiao Sun, Jinming Li, Hua Jing, Ting Wang, and Yulei Wang. Acoustic localization system for precise drone landing. IEEE Transactions on Mobile Computing, 2355):4126-4144, 2023.
Mikio Ishiwatari. Leveraging drones for effective disaster management: A comprehensive analysis of the 2024 noto peninsula earthquake case in japan. Progress in Disoster Science, pp. 100348, 2024.
Anna M Johnson, Christopher J Cunningham, Evan Arnold, Wayne D Rosamond, and Jessica K Zègre- Hemscy. Impact of using drones in emergency medicine: What does the future hold? Open Access Emergency Medicine, pp. 487 498, 2021.
Jin-Hyeok Kang, Kyung-Joon Park, and Hwangnam Kim. Analysis of localization for drone-flect. In 2015 International Conference on Information and Communication Technology Convergence (ICTC), pp. 533- 538. IEFE, 2015.
12

---

Published in Transactions on Machine Learning Research (02/2026)
Andrew Luo, Yilun Du, Michael Tarr, Josh Tenenbaum, Antonio Torralba, and Chuang Gan. Learning neural acoustic fields. Advances in Neural Information Processing Systems, 35:3165-31 3177, 2022.
Kamran Mahroof, Amizan Omar, Nripendra P Rana, Uthayasankar Sivarajah, and Vishanth Weerakkody. Drone as a service (daas) in promoting cleaner agricultural production and circular economy for ethical sustainable supply chain development. Journal of Cleaner Production, 287: 287:125522, 2021.
Mehari Meles, Akash Rajasekaran, Lauri Mela, Reza Ghazalian, Kalle Ruttik, and Riku Jäntti. Performance evaluation of measurement based gps denied 3d drone localization and tracking. In 2023 IEEE Wireless Communications and Networking Conference (WCNC), pp. 1-6. IEEE, 2023.
Rico Merkert and James Bushell. Managing the drone revolution: A systematic literature review into the current use of airborne drones and future strategic directions for their effective control. Journal of air transport management, 89:101929, 2020.
Mohammad Moshref-Javadi and Matthias Winkenbach. Applications and research avenues for drone based models in logistics: A classification and review. Expert Systems with Applications, 177:114854, 2021.
Mohammed Mynuddin, Sultan Uddin Khan, Mahmoud Nabil Mahmoud, and Ahmad Alsharif. Adversarial allacks on deep learning-based uav navigation systems. In 2023 IEEE Conference on Communiications and Network Security (CNS), pp. 1-6. IEFE, 2023.
Mohammed Mynuddin, Sultan Uddin Khan, Reza Ahmari, Luis Landivar, Mahmoud Nabil Mahmoud, and Abdollah Homaifar. Trojan attack and defense for deep learning based navigation systems of unmanned aerial vehicles. IEEE Access, 2024.
Xiaoji Niu, Hailiang Tang, Tisheng Zhang, Jing Fan, and Jingnan Liu. Ie-gvins: A robust, real-time, ins- centric guss-visual-inertial navigation system. IEEE robotics and automation letters, 8(1):216 223, 2022.
Robin Scheibler, Eric Bezzam, and Ivan Dokmanić. Pyroomacoustics: A python package for audio room simulation and array processing algorithms. In 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP), pp. 351-355. IEEE, 2018
Gabriele Serussi, Tamir Shor, Tom Hirshberg, Chaim Baskin, and Alex M Bronstein. Active propulsion noise shaping for multi-rotor aircraft localization. In 2024 IEFE/RS. /RSJ International Conference on Intelligent Robots and Systems (IROS), pp. 472-479. IEEE, 2024.
Francesco Betti Sorbelli, Sajal K Das, Cristina M Pinotti, and Simone Silvestri. Range based algorithms for precise localization of terrestrial objects using a drone. Pervasive and Mobile Compuling, 48:20 42, 2018.
Julian Straub, Thomas Whelan, Lingni Ma, Yufan Chen, Erik Wijmans, Simon Green, Jakob J Engel, Raul Mur-Artal, Carl Ren, Shobhit Verma, et al. The replica dataset: A digital replica of indoor spaces. arXiv preprint ar Xic::1900.0555 05797, 2019.
Yimiao Sun, Weiguo Wang, Luca Mottola, Jia Zhang, Ruijin Wang, and Yuan He. Indoor drone localization and tracking based on acoustic inertial measurement. IEFE Transactions on Mobile Compuling, 2023.
Lynn Kai Lin Tan, Beng Chong Lim, Guihyun Park, Kin Huat Low, and Vietor Chuan Seng Yeo. Public acceptance of drone applications in highly urbanized environment. Technology in Society, 64:101462, 2021.
Zhaoxuan Wang, Yang Li, Shihao Wu, Yuan Zhou, Libin Yang, Yuan Xu, Tianwei Zhang, and Quan Pan. A survey on cybersecurity attacks and defenses for unmanned aerial systems. Journal of Systems Architecture, 138:102870, 2023.
Mariusz Wisniewski, Inigo Galan Ona, Paris Chatzithanos, Weisi Guo, and Antonios Tsourdos Autonomous navigation in dynamic maze environments under adversarial sensor attack. In 2024 International Confer- ence on Unmonned Aireraft. Systems (ICUAS), pp. IEFE, 2024.
13

---

Published in Transactions on Machine Learning Research (02/2026)
Jawad Yousaf, Huma Zia, Marah Alhalabi, Maha Yaghi, Tasnim Basmaji, Eiman Al Shehhi, Abdalla Gad, Mohammad Alkhedher, and Mohammed Ghazal. Drone and controller detection and localization: Trends and challenges. Applied Sciences, 12(24):12612, 2022.
Mohamed Añiq Hidayat Zailani, Raja Zahratul Azma Raja Sabudin, Rahana Abdul Rahman, Ismail Mohd Saiboon, Aniza Ismail, and Zaleha Abdullah Mahdy. Drone for medical products transportation in ma- ternal healthcare: A systematic review and framework for future research. Medicine, (9(33))e21967, 2020.
Peihan Zhang, Gang Chen, Yuzhu Li, and Wei Dong. Agile formation control of drone flocking enhanced with active vision-based relative localization. IEEE Robotics and Automation Letters, 7(3):6359 636666666,,6 2022.
A Supplementary Layout
In the following sections we report additional details complementing the main paper, ordered as follows 1) Section [ includes supplementary results for the three main types of experiments conducted in the paper Targeted Attacks Section B.1 extends figure 6 from the paper, reporting localization performance attained under targeted adversarial attacks, considering wider range of acoustic scenes and attack bounds, well as an ablation for adversarial sound source location optimization.
Source Location Optimization - Section B.2 provides further comparison between localization capabili-
ties with and without adversarial source location optimization, similar to section 4.2.
Uncertainty Section B.3 claborates values of location gradients w.r.t sensor-sampled sound (as shown in figure 5) to quantifty the error expected for our perturbation delineation algorithm under the uncertainty in value of the recovered waveform at moment 0.
we note that our scatter-plot heatmap figures for the room and office environments may depict enviromment shapes slightly different than those known from Chang et al.] (2017); Straub et al. (2019) environments. The reason is we do not evaluate localization in locations where the drone cannot be present, due to its simulated physical dimensions from Serussi et al. (2024).
2) Section provides in-depth implementation, optimization and training-regime details. 3) In Section D we discuss the added computational resources required in adversarial source location optimization, to further stress the importance of our findings from section 4.2, where we claim sourco-location optimization could prove cost-ineffective in some cases.
4) Section further provide added details for our proposed perturbation delineation algorithm.
B Additional Results
B.1 Targeted Attacks
A central motivation for the study of adversarial attacks in drone localization is the possibility of a potential attacker directing the drone to a specific location, where could potentially pose harm to the original user or third-party individuals. We therefore also analyze the effect of targeted adversarial attacks, brought forth in Figure 7 In this figure we show spatial error distributions for targeted attacks in different locations (marked in green the heatmap, and textually on each sub-figure caption). Note that unlike heatmaps for non-targeted attacks, here the error reported the heatmap is RMS from adversarially desired target (so all-black heatmap means perfectly successful attack).
We observe that the success of targeted attacks depends on target location. Subfigures a-c present very target is predicted almost everywhere
successful adversarial targeted attack, where the adversarially-destn in the map. Figures g-i present the complementary scenario, where the clean and attacked error maps are nearly identical for all bounds. We speculate this difference stems from the fact that the attack targeted [-2, -4.5] (namely, the "successful" attack) is focused on a more-likely low-certainty area (given the room
14

---

Published in Transactions on Machine Learning Research (02/2026)
shape in the area of [-2,0], that is non-representative of the common shape other scene regions), contrary to the attack at [8, -4.5] (an area where the attack allegedly failed).
Clean Scone
Clean Scene
Clean Scene
0.25
0.35
0.25
0.30
0.30
0.30
Scene
Scaree
Allac Scene
0.25
0.25
0.25
0.00
0.25 10
0.00
035
015
Recovered Scene
Recovered Scone
Recevered Scone
(a)
3
1,7 = 2, largel
(b) 8 = 0.5. = 0.5, largel
= (c) 3 = 0.1,7 = 0.25, largel
-455
-4.5]
[-2. -4.5
Clean Scene
Clean Scene
Attacked
Attackidd
Allacked Scene
83
03
02
Recovered Scone
Recovered Scene
0:
Recovered
8 2- 0]
0.5, y
0.5, target B B [2
0.1, 0.25, torget
(d) 8 1, = 2, targett = 2-
Clean Scone
044
Attacked Scene
Altacked Scene
63
Recovered Scene
81
0:
(h)
0.5, 7 0.5, target
(i) B 0.1, 0.25, target
(g) 8 = 1, = 2, target = |8, -4.5
[8, -455
-4.5)
Figure/ 7: Clean, perturbed and delineation-recovereed spatial error distribution for selected targeted attack bounds for selected map targets (in green).
B.2 Fixed-perturbation source RMS distribution
Figure g presents results similar to Figure along with fixed-source location attack optimization. Results support our findings from Section 4.2 stating that location optimization holds limited contribution for attack
15

---

Published in Transactions on Machine Learning Research (02/2026)
success in our tested setting. Similar conclusions can be drawn from results over the office (Figure D and room (Figure 10 environments, also complementing the partial results for location optimization in the two latter environments, as shown in Figure 5
In Figure Figure 12 we present localization RMS mean and standard deviation, similar to the plot from Section 4.2 in the paper. While our conclusion regarding marginal advantage in source location optimization is supported those plots, we do denote that for these environments, for smaller attack bounds we observe larger growth in attack efficieney when performing source-location optimization.
Clean Scone
Clean Scene
Cican Scone
0.35
033
Attacked
0.30
Attacked
Attackeed Srone
030
421
0
0.0
Recovered Scene
a1
Recevered Scone
Recovered Scone
212
05
cas
(a) 3
(b) 0.5, 7
0.5
(c) 0.1, 7 0.25
clean Score
Clean Scene
Cletn Scone
648
0.95
018
Recevered Scere
Receveed Scent
Recevered Scete
(d) 1, = 2, fixed source
(e) 8 = 0.5, = 0.5, fixed source
(f) 8 0.1, 7 = 0.25, fixed source
Figure Clean, perturbed and delineation-recooeera spatial error distribution for selected attack bounds for both fixed and optimized source location.
B.3 Perturbation Delineation Uncertainty
Our perturbation recovery algorithm recovers the exact perturbation waveform to uncortainty in the sampled perturbation value at moment t 0, in this section we further evaluate our method by assessing the effect of this deviation over model performance. Namely, for a clean input signal (t)ome(!), our recovered signal Section 3.4 is (Sarone + (t) for some unknown scalar offset E R (that equals the perturbation response the microphone at moment t 0). Our primary approach for evaluating the reporcussion of uncertainty in 8 is by estimation of the spatial distribution of location- wist perturbation values at (denoted (t, = 0; μ)) and location gradient infinity norms across different sensor locations μ Loo (x(rrne
DEdrons
The product (t = (:) Loo Braromee
upper-bounds the location-wise rate of location prediction change
as response of change in 5 exactly equal to our perturbation recovery error s = 0; P:p.). Results are brought in Figure demonstrating that characteristic values of & (t= 14) across the map hold negligible response
16

---

Published in Transactions on Machine Learning Research (02/2026)
Clean Scene
Clean Scene
Clean Scene
Clean Scene
Clean Scene
Clean Scene
0.35
0.30
0.25
Attacked
Attacked Scene
Attacked Scene
Attacked Scene
Attacked
0.20
0.15
Recovered Scene
Recovered Scene
Recovered Scene
Recovered Scene
Recovered Scene
Recovered Scene
0.10
0.05
-2
-2
-2
-2
0.0
2.5 B= ==1y= =2 fixed source
0.0
0.0
2.5
B y.y opt. source
y 0.5, opt. source
== y 0.5, fixed source
# = 0.1,,y = 0.25, source
#= 0. 1.y 0.25, fixed source
Figure 9: Office environment spatial error distribution for selected attack bounds Office envi- ronment.
Clean Scene
Clean Scene
Clean Scene
Clean Scene
Clean Scene
Attacked Scene
Attacked Scene
Attacked
Attaciced
Attacked Scene
Attacked Scene
0.20
0.15
Recovered Recovered
Recovered
Recovered
Recovered Scene
Recovered Scone
0.10
A 1, opt. source
f= 1yy = fixed source
0 = 0. 0.5, opt.
== 0.5. 0.5, fixed
# 0.1.y 0.25, opt.
$ 0. 0. 0.25,
fixed
Figure 10: Office environment spatial error distribution for selected attack bounds Room envi- ronment.
over location prediction, corroborating the reliability our delineation method. To further support our conclusions, we show similar results on the training objective loss gradients, rather than on the location directly. These results depicted in Figure 14
C Training Details
C.1
Clean Model Training
For training our 'clean" localization model (to later be attacked) train both the forward model and the transformer-encoder inverse model from Serussi et al. 2024
17

---

Published in Transactions on Machine Learning Research (02/2026)
Optimized Source Location
Stationary Source
0.5
P-1
p-1
Mean RMS (Room)
8-0.5
8-0.5
0.4
B-0.1
B-0.1
B-0.01
B-0.01
0.3
0.2
0.1
0.0
2
Y
Y
Figure 11: Mean RMS with and without source location optimization RRom Environment.
Optimized Source Location
Stationary Source
B-1
B-1
Mean RMS (Office)
0.4
B-0.5
8-0.5
B-0.1
B-0.1
0.3
R-0.01
B-0.01
0.2
0.0
2
5
2
Y
Y
Figure 12: Mean RMS with and without source location optimization Office Environment.
0.009
0.008
0.020
Maximum Location Grad
t=0 Perturbation Values
Max Error Response
0.007
0.015
2.0
max
-2
0.006
Gmer
11.5
-4
-4
0.010
0.005
1.0
-2
2
0
8
0.004
0.005
0.5
0.003
Figure 13: Spatial distribution of maximum location prediction response to change in demon- strating responses typically several magnitudes of order lower compared to absolute locations
18

---

Published in Transactions on Machine Learning Research (02/2020)
0.009
0.175
0.008
0.0008
0.150
Maximum Loss Gradients
Perturbation Values
Max Error Response
0.007
0.125
0.0006
6max
E. (CCont
0.100
0.006
6max
MM
-4
0.0004
0.075
0.005
2
2
6
0.050
0
2
4
8
-2
2
6
0.004
0.0002
0.025
0.003
Figure 14: Spatial distribution of maximum loss response to change in perturbation starting conditions uncertainty 5.
C.1.1 Forward Model
We parameterize the self-sound of each rotor with 16 point sound-sources, and optimize using L-BFGS for 50 iterations. The self-sound is then used along with the scene-specifie pre-trained RIRs published in Luo et al. 2022) for each test environment.
C.1.2 Localization Model
We train the localization model with dataset generated by sampling each enviromment with x cm density. For each such drone location we computed the sound sampled by the microphone array in 32 azimuthal orientations uniformly spaced within the [0,2 range. With this dataset of sounds sampled by the microphones at different drone locations and orientations ( 125000 samples for the apartment, 65000 for office and 42000 for room) we train the localization model, using the transformer-encodde architecture from Serussi et al. (2024). We subsample each waveform from a temporal dimension of 12000 timesteps to 1200 using a learned linear operator. This subsampled input is then fed into a 3-layered transformer-encodle model with hidden dimension 1024. This model is trained on batches of 128 for 80 epochs on an NVIDIA RTX-2080 GPU, with phase modulation optimization of 10 sine basis components. Model parameters are optimized with an Adam optimizer, using a learn-rate of 0.00001 for the localization model and learn rate of 0.05 for the phase modulation parameters.
C.2 Perturbation Optimization
We train each universal perturbation for 100 PGD iterations, with carly-stop of consecutive epochs without loss increase. Each PGD iterations is performed across the entire set. Minimum frequency set 50 H2),, maximum to 2000[Hz]] Aamp, andeer optimization run all experiments locations we train on an RTX-2080 with batch-size of 128. Source initial position is set to the center of the environment for all experiments.
all set to 1 for all experiments. For location NVIDIA A6000 GPU with batch-size of 3. For fixed attack source
D Resource Analysis
In this section we supply resource consumption details for a single NVIDIA A6000 GPU during a single PGD iteration of perturbation optimization across the entire datasel of 12575 samples, consisting our test set for the spartment_frl_ acoustic setting (the largest of the 3 environments we consider). Each table compares itcration time with and without source location optimization. Results show growth in GPU memory consumption by factor of over 3, and in optimization time growth by a factor of around when applying source location optimization, compared to the fixed-source location counterpart. We further stress
19

---

Published in Transactions on Machine Learning Research (02/2026)
Table 2: RMS Mean Standard Deviation per amplitude (3) and power (7) constraints after perturbation
recovery
NY
clean
0.1
0.25
2
0.01
0.0487 + 0.0331
0.0568 + 0.0331
0.0568 = 0.0332
0.0568
0.0333
0.0568 + 0.0332
0.0568 + 0.0332
0.1
0.0487 + 0.0331
0.0568 + 0.0315
0.0569 = 0.0330
0.0570 + 0.0334
0.0572 + 0.0334
0.0569 + 0.0331
0.5
0.0487
0.0331
0.0568 +: 0.0316
0.0569 + 0.0330
0.0570
0.0334
0.0568 0.0331
0.0570 + 0.0331
1
0.0487 1 0.0331
0.0568 + 0.0316
0.0570 - 0.0331
0.0571 0.0333
0.0572 1 0.0332
0.0573 + 0.0333
that while, for the sake of comparability, we only analyze for low batch-sizes of up to 3 (for which we are able to fit optimization in memory using a single GPU in both cases), fixed-location optimization can be expedited by increasing the batch-size.
Table 3: Single PGD iteration memory consumption across batch sizes
Batch Size
Optimized Location (GB)
Fixed Location (GB)
15.850
5.562
2
29.746
9.184
3
43.542
12.078
Table 4: Single PGD iteration runtime across batch sizes
Batch Size
Optimized Location (seconds)
Fixed Location (seconds)
7592
3979
6615
3491
6322
3201
we note that the batch-size of 128 mentioned in Section C used by internally batching RIR computations to batches of 2, and only inserting the batch-size of 128 onto the localization model.
E Phase Modulation Perturbation Delineation
In this section we provide further evidence for the prowess of our adversarial perturbation recovery algorithm from Section 3.4 added to figures 13
In table 2 we report RMS error mean and standard-deviatee for all amplitude and power bounds evaluated in
Section 4.3 similarly to results shown in Section 4.2 We observe marginal performance differences bet ween
clean and recovered perturbation performance.
20


Reviews:
[{"review_id": "vkmiTdhTWl", "reviewer": "Reviewer_m4Tc", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents the first systematic study of adversarial attacks and defenses for acoustic-based drone localization relying on self-generated propulsion noise. The authors formulate a physically realistic threat model where external sound sources disrupt localization, utilizing Neural Acoustic Fields for gradient-based attack optimization. Experiments demonstrate that universal acoustic perturbations significantly degrade accuracy, increasing RMS error from under 5% to over 30%.", "claims_and_evidence_yn": "Yes", "claims_explanation": "1. This paper addresses the adversarial robustness of acoustic-based drone localization, a topic that has received little attention compared to vision- or LiDAR-based perception systems.\n2. The integration of Neural Acoustic Fields enables a fully differentiable forward model, allowing gradient-based optimization of adversarial waveforms and source locations.\n3. The proposed defense based on rotor phase modulation is conceptually elegant.", "audience_yn": "Yes", "audience_explanation": "Studying adversarial attack in acoustic localization is an important topic for machine learning application.", "requested_changes": "1. In most experiments, the setup assumes zero interference from other acoustic signals aside from the drone and the attacker. While a noise analysis is provided in Section 4.4, the primary evaluation environment is somewhat idealized compared to chaotic real-world acoustic environments with multiple unrelated noise sources.\n2. The threat model focuses on a stationary, omni-directional sound source. While this is a necessary starting point, it does not account for mobile attackers or directional interference, which might present different challenges for the proposed phase-modulation defense。\n3. Please replace with high-resolution figures.", "broader_impact_concerns": "N.A.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "SpUYpqcc9v", "reviewer": "Reviewer_TQsR", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work aims to analyze possible adversarial perturbations that can interfere with acoustic localization in drones. It also proposes phase modulation as an effective defence against such adversarial attacks. \n\n**Strengths**:\n\n- Using NAFs instead of compute-heavy ISMs for RIR computation would be a strong contribution to the literature on acoustic localization since it brings down the cost of training the localization model. \n\n- The attack is universal and does not rely on exploiting positional weaknesses of certain locations. It affects localization uniformly across the space.\n\n- The attack is affected minimally with source location optimisation demonstrating robustness in attack efficacy with a fixed perturbation source.\n\n**Weaknesses**:\n\n1. Author(s) modify Serussi et al.(2025)'s approach to acoustic localization replacing ISMs with NAFs, but do not provide any details about how the new formulation varies in efficiency compared to the baseline (Serussi et al. (2025)). While they do say these modifications fall outside the main contributions of the paper, a comparison of the 2 approaches would ensure that this new formulation does not necessarily cause performance degradation.\n\n2. In Section 4.1, the author(s) mention using pretrained NAFs for their experiments. Following that, it says that the environments attacked in the paper are a subset of the NAF's pertaining data. Can the author(s) comment on whether the results will be affected if the pretraining and attack environments differ in distribution?\n\n3. In Section 4.1, the author(s) state, \"Nonetheless, we emphasise that our developed attack and defence methods apply to any combination of drone configuration and acoustic localization algorithm.\" This claim is not accompanied by any supportive evidence. \n\n4. (Minor) The attack is white-box, and as such, it relies on certain assumptions about the adversary's access to the localization model. The author(s) will benefit by detailing these assumptions in the paper.\n\n5. (Minor) In Section 3.3.4, it says, \"perturbation source location $x_{\\mu}$\". Should it not be $x_{p}$, the perturbation source location?", "claims_and_evidence_yn": "No", "claims_explanation": "Weaknesses #1, 2 and 3 undermine the paper's acceptance. If the author(s) could address them, I am amenable to revising my stance.", "audience_yn": "Yes", "audience_explanation": "Acoustic localization is proposed as a computationally efficient alternative to vision-based localization. Studying possible interference in localisation by adversarial perturbations is relevant to the research towards robust acoustic localisation algorithms.", "requested_changes": "It would greatly strengthen the paper if the author(s) could address the list of weaknesses/ modify the submission accordingly.\n\nAdditionally, the presentation of the paper would benefit from,\n- Using capitalised references to figures and sections, i.e., using \"Figure 6\" instead of \"figure 6\" to refer to them in the text. This can be done by using \"\\Cref\" in place of \"\\cref\" from the cleveref package.\n- In places where the results are present in the supplementary materials, specify references to the sections in the Appendix about them instead of directing readers to go on a search in the supplementary section.\n- Captions in figures are supposed to be a standalone description of the message authors are trying to convey. The bare minimum description expects the reader(s) to jump back and forth between the text and the figure to get an idea of what the intended message is. Complement the text by captions detailing the experimental setting + primary observation from the figure.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "8D97yJhaYQ", "reviewer": "Reviewer_Nwh5", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Contributions:\n\n1. Problem Formulation: Provide the first systematic study of adversarial attacks on acoustic-based drone localization relying on self-generated propulsion noise.\n\n2. Attack Framework: Formulate a fully differentiable, white-box universal acoustic attack from an external stationary sound source under realistic frequency and amplitude constraints.\n\n3. Defense Method: Propose a novel test-time defense based on active rotor phase modulation that enables separation and removal of adversarial perturbations without explicit attack detection.\n\nKey Strengths:\n\n1. The paper addresses a novel and previously unexplored security vulnerability in acoustic localization.\n\n2. The proposed defense is physically grounded, elegant, and does not rely on heuristic detection thresholds.\n\nWeaknesses:\n\n1. The attacker model (in Eq. (4) ) focuses on a single stationary, non-adaptive sound source; further discussion on how the proposed defense may extend to more adaptive or multi-source adversaries would strengthen the scope of the work.\n\n2. While the evaluation uses realistic acoustic modeling, all experiments are conducted in simulation; additional discussion of the practical feasibility of rotor phase modulation on real drone platforms would improve clarity regarding real-world deployment.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper provides clear empirical evidence that acoustic localization models are vulnerable to adversarial sound perturbations. Consistent degradation is observed across multiple environments and attack settings. The proposed defense is evaluated under the same conditions and recovers localization performance close to clean baselines, supporting the main claims of the paper.", "audience_yn": "Yes", "audience_explanation": "Acoustic sensing and robust perception are relevant to many robotics and autonomous systems, particularly in GPS-denied or visually degraded environments. The paper introduces an adversarial threat model and a principled defense mechanism that are likely to be of interest to researchers working on robustness, sensor security, and embodied AI within the TMLR community.", "requested_changes": "1. Clarify the scope of the attacker model and discuss how the proposed defense may extend to more adaptive or multi-source adversaries. More specifically, the attacker model considered in Eq. (4) focuses on a single stationary, non-adaptive perturbation source. Additional discussion clarifying this scope, as well as potential extensions of the proposed defense to more adaptive or multi-source adversarial settings, would improve the clarity and generality of the contribution.\n\n2. Further discuss the practical feasibility of phase modulation in real-world drone platforms.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)