Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks".

Elias: The gist: This survey systematizes thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale, co-tenancy, deployability, and AV relevance <ref:2610.21034#pg6>.

Nadia: First, who's behind it and why it matters.

Title and authors: Nadia: So we're looking at this paper called "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks." It's written by Harsh Aaryan and Ce Zhou from Missouri University of Science and Technology.

Elias: Yeah, the title itself is pretty direct, suggesting that autonomous vehicles might have some thermal problems. It sounds like they're looking at how the heat generated by these complex systems can be used to compromise safety features.

Nadia: Exactly. They are focusing on how that heat interacts with things like perception and compute hardware. The main idea is that these two things, safety-critical perception and the compute hardware it runs on, are coupled thermally.

Elias: Right. And they're pointing out that the interfaces built for reliability or night driving often aren't actually designed to be confidentiality boundaries, which means they leave a vulnerability open.

Priya: So what this paper is doing is comparing different ways this can happen based on who has access—like privilege levels—and how long it takes for the attack to work. That sounds like a big organizational task.

Nadia: That's right, Priya. They're systematizing thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction by comparing them across five axes: privilege, timescale, co-tenancy, deployability, and AV relevance (Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks #pg1).

Elias: The survey is organizing the literature into three attack families: physical thermal infrared attacks, unprivileged silicon telemetry leakage using thermal or dynamic voltage and frequency scaling telemetry, and energy-based model extraction.

Priya: That categorization helps us see the different ways we might need to defend the system. It moves beyond just looking at one type of threat.

Nadia: Exactly. And they look at how these paths—the physical spoofing versus the unprivileged telemetry leakage—differ in mechanism and privilege, noting that both exploit interfaces that AV stacks can't easily turn off without risking Safety of the Intended Functionality, or SOTIF #pg2.

Elias: That SOTIF part is key; it means we can't just shut down thermal management because it might cause the vehicle to overheat and fail in a dangerous way.

The paper's summary: Nadia: So, what’s the core finding of this survey? It basically summarizes how these different thermal attack paths overlap and where the real risks are in autonomous driving systems.

Elias: They are mapping out the whole landscape by comparing these thirteen works along those five axes we talked about: privilege, timescale, co-tenancy, deployability, and AV relevance #pg1.

Priya: I wonder what that comparison actually reveals about the severity of these threats. Does it show that one type of attack is way more dangerous than another?

Nadia: It shows how they are complementary failures—one path deals with integrity and the other with confidentiality—and that AV platforms have to keep both interfaces operational for things like night perception and package thermal safety #pg1.

Elias: They look at defenses too, mapping them against residual risk while keeping thermal management still working. And they found something pretty important about how different controls interact with each other regarding SOTIF constraints #pg2.

Priya: So, if you're trying to defend against one path, like spoofing the IR sensor, does that leave the other path—the telemetry leakage—completely untouched?

Nadia: That's a major finding. Key Observation four states that no single defense layer closes both access paths without leaving some residual risk #pg2.

Elias: And they also looked at software-path telemetry accessibility on commodity hardware, which gives them a baseline mechanism for the software co-tenant class, showing that residual leakage is often a telemetry class rather than just one locked interface #pg3.

The paper's improvements: Nadia: Now, the authors suggest some ways to make things better based on their survey findings. They propose improvements across different areas of defense and design.

Elias: They suggest enhancements in a few specific areas like threat-aware IR DSP, which would help reduce opportunistic spoofs that rely on camera internal equalization amplifying small heat sources #pg3.

Priya: That sounds like trying to make the sensor itself smarter about what it sees, instead of just trusting the raw thermal input. It moves the defense up the stack.

Nadia: Precisely. And they suggest capability-based telemetry policy instead of just locking things down; this would mean that while ASIL governors still keep full-resolution thermal state, quality management and unprivileged readers only get coarse or delayed views #pg3.

Elias: That makes sense for the software side—giving different software classes different levels of data access based on their need, not just a simple on or off switch.

Priya: And then there's DVFS domain isolation, which they suggest to reduce observable coupling by explicitly capping the frequency or interrupts that govern that dissipation #pg3.

Nadia: So, it’s about isolating those functions so the heat doesn't leak its information through the power management side.

Elias: And they also point toward fusion trust under IR spoofing, suggesting planner-level policies that weight RGB and LiDAR corroboration based on sensor reliability to assess thermal evidence using cross-modal disagreement #pg3.

Conclusion: Nadia: So wrapping up this paper, the main implication is that we can't treat thermal and perception attacks in isolation. They are two sides of the same coin when dealing with autonomous vehicles.

Elias: The survey on "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks" shows these paths are complementary integrity and confidentiality failures that AV platforms must keep operational for both night driving perception and package thermal safety #pg1.

Priya: So what does this mean for the people who build these systems right now, seeing this map of risks? It means they can't just focus on hardening one area without worrying about the other #pg1.

Nadia: Right. And the paper provides a residual-risk frame that links sensor, OS, silicon, and standards concerns together in a way that prior surveys haven't done before #pg1.

Elias: The work points toward needing ontarget co-tenant evaluation and standards-ready TARA artifacts to really move forward in mitigating these risks #pg3.

Priya: It sounds like the immediate research needs to be about building trust between different sensor modalities, especially when thermal data might be manipulated #pg3.

Nadia: That's the direction we need to head. We'll be looking at how those specific improvements they suggested actually play out in real-world hardware testing next time.