Black-box fake V2I reports delay DRL traffic signals
Original title: A Minimally Informed Black-Box Fake-Report Attack on DRL Traffic-Signal Control
Simply reporting the maximum feasible queue was as damaging as a trained surrogate; random inflation was not.
The paper studies a minimally informed attacker against deep-reinforcement-learning traffic-signal controllers that trust vehicle-to-infrastructure counts. The attacker cannot see the model and observes only her own approach. She trains an imitation surrogate and sends bounded fake reports that inflate vehicle counts on that approach, shifting extra waiting time onto other approaches. The authors find a zero-knowledge maximum-queue report matches the surrogate's damage, so the exposed weakness is the V2I sensing channel. The effect held under plus or minus 20 percent uniform demand variation, and the black-box surrogate matched a realizable white-box attacker using the victim's gradients.
Unconfirmed: Results are from the authors' simulations, not reported field incidents.
- Fake reports are limited to inflating counts on the attacker's own approach.
- Waiting time on the attacker's approach barely changes while other approaches wait longer.
- Unstructured random inflation did not reproduce the degradation.
- On a common per-lane budget, only dropping realizability increased damage further.
Impact: Fake queue reports shift delay onto other traffic approaches
| Product | Affected |
|---|---|
| DRL traffic-signal controllers using V2I reports | — |
From the original article
1 min read at arxiv.orgDeep reinforcement learning (DRL) traffic-signal controllers may use vehicle-to-infrastructure (V2I) reports, exposing their perception layer to false-data injection. Existing demonstrations typically assume either white-box access to the controller's weights or full observability of the traffic state.
By Amro Saleh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.