## 3 Materials and Methods
### Attack Implementation  
We implemented and evaluated seven distinct cyberattacks targeting the sensor inputs of autonomous vehicles, with attack parameters carefully selected based on existing cyber-security literature and real-world attack feasibility studies. Each attack represents a realistic threat vector that could be executed by adversaries with moderate technical capabilities:  
* **RGB Camera Attacks, Salt-and-Pepper Noise (80% intensity)**: We implemented a high-density salt-and-pepper noise attack where random pixels were replaced with either black (0) or white (255) values with equal probability [37,54]. The 80% intensity parameter represents an extreme noise level commonly used in image denoising research to test algorithm robustness under severe corruption conditions. This attack simulates severe sensor interference from electromagnetic attacks or physical sensor tampering [15,27]. * **Dynamic Vision Sensor Attacks, Event Flooding (60% spurious events)**: We implemented an event flooding attack that injected spurious events with random positions and polarities into the DVS output stream [30,33]. The 60% flooding rate was selected to represent a significant degradation scenario that would challenge event-based processing algorithms while remaining within realistic attack capabilities [28,29,34]. This attack exploits the asynchronous nature of DVS devices and could be implemented through electromagnetic interference or direct sensor manipulation [35]. * **Depth Camera Attacks, Depth Map Tampering (5 patches, 50 x 50 pixels)**: We implemented a patch-based depth tampering attack that modified depth values in random regions of the depth map following established adversarial patch methodologies [38,55]. The attack parameters (5 patches of 50 x 50 pixels with depth offsets of 5-15 units) were selected to balance attack effectiveness with practical implementation constraints [22,56]. This creates false distance measurements that could cause collision avoidance systems to malfunction [9]. * **LiDAR Attacks, Phantom Object Injection (5 clusters, 100-500 points each)**: We implemented a phantom object injection attack that added false point clusters to the LiDAR point cloud at positions 5-15 m ahead of the vehicle [9,22]. The attack parameters (5 clusters with 100-500 points each) were designed to create detectable objects while remaining within the spoofing capabilities demonstrated in recent LiDAR security research [23,27,57]. This attack could be implemented using laser devices or reflective materials [15,22]. * **GPS Spoofing Attacks, Position Manipulation (\(\pm\)50 m deviation)**: We implemented a GPS spoofing attack that created discrepancies between actual and perceived vehicle positions [24,25]. The \(\pm\)50 m deviation threshold represents a significant but realistic spoofing scenario that would noticeably impact navigation while remaining within documented GPS attack capabilities [9,58,59]. The attack maintains separate records of actual and spoofed positions to enable quantitative analysis of navigation impact. * **Denial of Service (DoS) Attacks, Sensor Rate Limiting (50% packet loss)**: We implemented a DoS attack that restricted sensor update frequency to simulate network-based attacks on sensor communication channels [11]. The 50% packet loss rate represents severe network conditions that significantly impact autonomous vehicle performance, as demonstrated in recent automotive cybersecurity research [16]. This attack simulates jamming or network flooding scenarios [17,18]. * **Steering Bias Attacks, Control Manipulation (\(\pm\)15\({}^{\circ}\) systematic offset)**: We implemented a steering bias attack that introduced systematic errors into steering commands [11; 16]. The \(\pm 15^{\circ}\) bias parameter was selected to represent a significant control deviation that would be detectable by monitoring systems while demonstrating clear attack impact [17]. This attack simulates compromised control systems or actuator manipulation [18].