Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks

arXiv:2610.21034 · cs.CR · Submitted 2026-10-15 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks".

Elias: The gist: This survey systematizes thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale, co-tenancy, deployability, and AV relevance <ref:2610.21034#pg6>.

Nadia: First, who's behind it and why it matters.

Title and authors: Nadia: So we're looking at this paper called "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks." It's written by Harsh Aaryan and Ce Zhou from Missouri University of Science and Technology.

Elias: Yeah, the title itself is pretty direct, suggesting that autonomous vehicles might have some thermal problems. It sounds like they're looking at how the heat generated by these complex systems can be used to compromise safety features.

Nadia: Exactly. They are focusing on how that heat interacts with things like perception and compute hardware. The main idea is that these two things, safety-critical perception and the compute hardware it runs on, are coupled thermally.

Elias: Right. And they're pointing out that the interfaces built for reliability or night driving often aren't actually designed to be confidentiality boundaries, which means they leave a vulnerability open.

Priya: So what this paper is doing is comparing different ways this can happen based on who has access—like privilege levels—and how long it takes for the attack to work. That sounds like a big organizational task.

Nadia: That's right, Priya. They're systematizing thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction by comparing them across five axes: privilege, timescale, co-tenancy, deployability, and AV relevance (Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks #pg1).

Elias: The survey is organizing the literature into three attack families: physical thermal infrared attacks, unprivileged silicon telemetry leakage using thermal or dynamic voltage and frequency scaling telemetry, and energy-based model extraction.

Priya: That categorization helps us see the different ways we might need to defend the system. It moves beyond just looking at one type of threat.

Nadia: Exactly. And they look at how these paths—the physical spoofing versus the unprivileged telemetry leakage—differ in mechanism and privilege, noting that both exploit interfaces that AV stacks can't easily turn off without risking Safety of the Intended Functionality, or SOTIF #pg2.

Elias: That SOTIF part is key; it means we can't just shut down thermal management because it might cause the vehicle to overheat and fail in a dangerous way.

The paper's summary: Nadia: So, what’s the core finding of this survey? It basically summarizes how these different thermal attack paths overlap and where the real risks are in autonomous driving systems.

Elias: They are mapping out the whole landscape by comparing these thirteen works along those five axes we talked about: privilege, timescale, co-tenancy, deployability, and AV relevance #pg1.

Priya: I wonder what that comparison actually reveals about the severity of these threats. Does it show that one type of attack is way more dangerous than another?

Nadia: It shows how they are complementary failures—one path deals with integrity and the other with confidentiality—and that AV platforms have to keep both interfaces operational for things like night perception and package thermal safety #pg1.

Elias: They look at defenses too, mapping them against residual risk while keeping thermal management still working. And they found something pretty important about how different controls interact with each other regarding SOTIF constraints #pg2.

Priya: So, if you're trying to defend against one path, like spoofing the IR sensor, does that leave the other path—the telemetry leakage—completely untouched?

Nadia: That's a major finding. Key Observation four states that no single defense layer closes both access paths without leaving some residual risk #pg2.

Elias: And they also looked at software-path telemetry accessibility on commodity hardware, which gives them a baseline mechanism for the software co-tenant class, showing that residual leakage is often a telemetry class rather than just one locked interface #pg3.

The paper's improvements: Nadia: Now, the authors suggest some ways to make things better based on their survey findings. They propose improvements across different areas of defense and design.

Elias: They suggest enhancements in a few specific areas like threat-aware IR DSP, which would help reduce opportunistic spoofs that rely on camera internal equalization amplifying small heat sources #pg3.

Priya: That sounds like trying to make the sensor itself smarter about what it sees, instead of just trusting the raw thermal input. It moves the defense up the stack.

Nadia: Precisely. And they suggest capability-based telemetry policy instead of just locking things down; this would mean that while ASIL governors still keep full-resolution thermal state, quality management and unprivileged readers only get coarse or delayed views #pg3.

Elias: That makes sense for the software side—giving different software classes different levels of data access based on their need, not just a simple on or off switch.

Priya: And then there's DVFS domain isolation, which they suggest to reduce observable coupling by explicitly capping the frequency or interrupts that govern that dissipation #pg3.

Nadia: So, it’s about isolating those functions so the heat doesn't leak its information through the power management side.

Elias: And they also point toward fusion trust under IR spoofing, suggesting planner-level policies that weight RGB and LiDAR corroboration based on sensor reliability to assess thermal evidence using cross-modal disagreement #pg3.

Conclusion: Nadia: So wrapping up this paper, the main implication is that we can't treat thermal and perception attacks in isolation. They are two sides of the same coin when dealing with autonomous vehicles.

Elias: The survey on "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks" shows these paths are complementary integrity and confidentiality failures that AV platforms must keep operational for both night driving perception and package thermal safety #pg1.

Priya: So what does this mean for the people who build these systems right now, seeing this map of risks? It means they can't just focus on hardening one area without worrying about the other #pg1.

Nadia: Right. And the paper provides a residual-risk frame that links sensor, OS, silicon, and standards concerns together in a way that prior surveys haven't done before #pg1.

Elias: The work points toward needing ontarget co-tenant evaluation and standards-ready TARA artifacts to really move forward in mitigating these risks #pg3.

Priya: It sounds like the immediate research needs to be about building trust between different sensor modalities, especially when thermal data might be manipulated #pg3.

Nadia: That's the direction we need to head. We'll be looking at how those specific improvements they suggested actually play out in real-world hardware testing next time.

Harsh Aaryan, Ce Zhou

Missouri University of Science and Technology · MIT

cs.CR

Submitted: 2026-10-15

Updated: 2026-10-15

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 92/100

The gist: The gist: This survey systematizes thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale,

Key concepts

Thermal Perception Integrity
This refers to the security of how an AV perceives its environment using thermal data. Attacks here involve physical adversaries tricking the vehicle's thermal sensors, potentially leading to incorrect driving decisions or perception failures during night operations.
Telemetry Leakage
This involves unprivileged software co-tenants observing sensitive operational data from the hardware, such as dynamic voltage and frequency scaling (DVFS) and thermal event interrupts (TEI). This leakage allows attackers to fingerprint perception workloads, revealing details about the vehicle's internal processing.
SOTIF Compromise
Safety of the Intended Functionality (SOTIF) is compromised when security attacks force a system to operate outside its intended safe operational envelope. The paper shows that exploiting interfaces for covert data extraction or spoofing can violate these safety constraints, even if thermal management remains functional.

Summary

The gist: This survey systematizes thirteen representative works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale, co-tenancy, deployability, and AV relevance <ref:2610.21034#pg6>.

How it works

The paper addresses the vulnerability of autonomous vehicles (AVs) which couple safety-critical perception to thermally constrained compute <ref:2610.21034#pg9>. Physical adversaries can spoof thermal infrared (IR) sensors used for night driving, while unprivileged software co-tenants can fingerprint perception workloads from thermal, dynamic voltage and frequency scaling (DVFS), and thermal event interrupt (TEI) telemetry required for package safety <ref:2610.21034#pg10>. These paths differ in mechanism and privilege; both exploit interfaces that AV stacks cannot disable without compromising Safety of the Intended Functionality (SOTIF) <ref:2610.21034#pg10>. The survey distinguishes between attack family from adversary class and maps defenses to residual risk while thermal management remains operational <ref:2610.21034#pg10>.

Taxonomy and Structured Comparison of Thermal Attack Paths

The survey compares thermal IR spoofing, unprivileged thermal/DVFS/TEI telemetry, and energy-based DNN extraction along privilege, timescale, co-tenancy, deployability, and relevance-confidence axes <ref:2610.21034#pg10>. The taxonomy organizes works into physical thermal IR attacks, unprivileged silicon telemetry leakage, and energy-based model extraction <ref:2610.21034#pg10>. The survey compares the works by privilege, timescale, co-tenancy, deployability, and AV relevance <ref:2610.21034#pg10>.

Defense Residual-Risk Synthesis Across Both Access Paths

The survey maps sensor, OS-telemetry, DVFS, packaging, and model controls to residual risk when thermal management must remain functional <ref:2610.21034#pg10>. For each control, the synthesis reveals what remains open on the other path and which mitigations conflict with SOTIF thermal constraints <ref:2610.21034#pg10>. Key Observation 4 states that no single defense layer closes both access paths without residual risk <ref:2610.21034#pg10>.

Software-Path Proxy Characterization on Commodity Hardware

The survey measures software-path telemetry accessibility, workload fingerprinting, channel redundancy, observer sensitivity, and co-tenant stress on commodity hardware under an unprivileged policy <ref:2610.21034#pg10>. This mechanism baseline does not validate the physical IR branch or production AV stacks; it supplies a mechanism baseline for the software co-tenant class and shows that residual leakage is a telemetry class rather than a single locked interface <ref:2610.21034#pg10>. The results show that fused temperature, frequency, and GPU features dominate workload fingerprinting macro-F1 on the commodity proxy <ref:2610.21034#pg10>.

Key Observations

The survey identifies five key observations that synthesize the literature and software-path proxy <ref:2610.21034#pg10>. These include that Heat was instrumented for reliability or night perception, not confidentiality <ref:2610.21034#pg10>, that naive thermal-only fusion under RGB collapse can allow an IR spoof to dominate fused decisions <ref:2610.21034#pg10>, and that restricting a single energy interface leaves residual frequency and accelerator telemetry informative <ref:2610.21034#pg10>.

Open Problems

The survey identifies several open problems requiring concrete research directions <ref:2610.21034#pg10>. These include on-target co-tenant evaluation, fusion trust under IR spoofing, chiplet and 3D thermal coupling, capability-based telemetry and SOTIF budgets, and standards-ready TARA artifacts <ref:2610.21034#pg10>.

Conclusion

The survey systematized thermal IR perception attacks and unprivileged thermal/DVFS/TEI telemetry across physical and software co-tenant classes <ref:2610.21034#pg10>. Comparing thirteen works by privilege, timescale, co-tenancy, deployability, and relevance confidence, we showed that the paths are complementary integrity and confidentiality failures of interfaces AV platforms must keep operational for night perception and package thermal safety <ref:2610.21034#pg10>. Progress requires ontarget co-tenant evaluation, fusion trust under IR spoofing, chiplet thermal coupling, capability-based telemetry under SOTIF budgets, and standards-ready TARA artifacts <ref:2610.21034#pg10>. The broader impact is a residual-risk frame linking sensor, OS, silicon, and standards concerns that prior surveys leave fragmented <ref:2610.21034#pg10>.

--- Page 1 ---

Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks Harsh Aaryan1 and Ce Zhou1⋆ Missouri University of Science and Technology, Rolla, MO 65409, USA

--- Page 2 ---

H. Aaryan and C. Zhou

--- Page 3 ---

A Survey of Thermal Side-Channel and Perception Attacks 3

--- Page 4 ---

H. Aaryan and C. Zhou

--- Page 5 ---

A Survey of Thermal Side-Channel and Perception Attacks 5

--- Page 6 ---

H. Aaryan and C. Zhou

--- Page 7 ---

A Survey of Thermal Side-Channel and Perception Attacks 7

--- Page 8 ---

H. Aaryan and C. Zhou

--- Page 9 ---

A Survey of Thermal Side-Channel and Perception Attacks 9

--- Page 10 ---

H. Aaryan and C. Zhou

--- Page 11 ---

A Survey of Thermal Side-Channel and Perception Attacks 11

--- Page 12 ---

H. Aaryan and C. Zhou

--- Page 13 ---

A Survey of Thermal Side-Channel and Perception Attacks 3

--- Page 14 ---

H. Aaryan and C. Zhou

--- Page 15 ---

A Survey of Thermal Side-Channel and Perception Attacks 5

--- Page 16 ---

H. Aaryan and C. Zhou

--- Page 17 ---

A Survey of Thermal Side-Channel and Perception Attacks 7

--- Page 18 ---

H. Aaryan and C. Zhou

--- Page 19 ---

A Survey of Thermal Side-Channel and Perception Attacks 9

--- Page 20 ---

H. Aaryan and C. Zhou

--- Page 21 ---

A Survey of Thermal Side-Channel and Perception Attacks 13

--- Page 22 ---

H. Aaryan and C. Zhou

--- Page 23 ---

A Survey of Thermal Side-Channel and Perception Attacks 15

--- Page 24 ---

NVIDIA: NVIDIA DRIVE AGX Orin developer documentation. Tech. rep., NVIDIA (2022)

--- Page 25 ---

Taneja, H., Kim, J., Xu, J.J., van Schaik, S., Genkin, D., Yarom, Y.: Hot pixels: Frequency, power, and temperature attacks on GPUs and Arm SoCs. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 6275–6292 <ref:2610.21034#pg10>

--- Page 24 ---

NVIDIA: NVIDIA DRIVE AGX Orin developer documentation. Tech. rep.

Improvements for AI systems

  1. Bold header: Sensor Defense Enhancement

By implementing Threat-aware IR DSP, AV systems can reduce opportunistic spoofs that rely on camera-internal equalization amplifying small heat sources and improve robustness against physical attacks by using cross-modal consistency checks (thermal versus RGB/LiDAR).

  1. Bold header: Capability-Based Telemetry Policy

Instead of simple locking, implement a Capability-based telemetry policy to ensure that while ASIL governors retain full-resolution thermal state, Quality Management (QM) and unprivileged readers are restricted to coarsened or delayed views.

  1. Bold header: DVFS Domain Isolation

Design the system with explicit DVFS domain isolation or caps for perception to reduce observable coupling, mitigating the risk where governors couple that dissipation to observable frequency or interrupts.

  1. Bold header: Fusion Trust Under IR Spoofing

Develop planner-level policies that weight RGB/LiDAR corroboration by sensor reliability, enabling the system to assess thermal-only evidence using reliable cross-modal disagreement, temporal consistency, and detection uncertainty.

  1. Bold header: Telemetry Inventory for FFI Analysis

Maintain a per-SoC channel inventory that records which entity—principal (governor, ASIL partition, QM partition, unprivileged process)—is permitted access to each interface to verify freedom-from-interference (FFI) analysis.

Related papers