Drift monitoring tells you that the input distribution has shifted, but without further assumptions it cannot always tell an adversarial attack from benign drift. To separate the two, we recommend an attribution layer on top of your existing per-device drift monitoring. That layer scores each confidence-drop event on how abruptly it started, how concentrated it is in the frame, and whether the other sensors agree, and it reports a probability rather than a verdict, because attributing a single input is only partly reliable.
TechnoLynx builds the eval, regression and drift harness that this attribution layer sits on, through the Production AI Monitoring Harness.
What is the difference between an adversarial attack and sensor drift?
NIST’s 2025 taxonomy of adversarial machine learning defines an evasion attack as one that modifies inputs at deployment time to create adversarial examples. These examples stay close to the original input but change the model’s prediction to one the attacker chooses. Deployed sensors age, degrade or drift outside their intended operating conditions, and the model then receives out-of-distribution inputs to which it may still assign unjustified confidence.
A 2024 survey of out-of-distribution data classes adversarial perturbations as a form of covariate shift, alongside style changes and domain shifts, and says they differ from those only in their malicious intent. The survey also places adversarial examples closest to in-distribution data on its covariate-shift axis, since they add imperceptible perturbations to clean inputs.
Our detector’s confidence just dropped: attack, or a seasonal lighting or terrain shift?
From the drift alert alone, you cannot reliably tell. Shift-detection methods identify that a shift has occurred. In a 2018 empirical study of dataset-shift detection, two-sample tests on representations from pre-trained classifiers performed best, and domain-discriminating approaches helped describe shifts and judge whether they were harmful. Methods such as DISDE (2023) go further and split a performance drop into harder familiar examples, a changed relationship between features and outcomes, and examples rarely or never seen in training. Neither study describes its method as separating engineered shifts from natural ones.
In a feature-shift detection study on real time-series data, the authors found it difficult, and in some cases impossible, to decide whether a shift is benign or adversarial without further assumptions. When their detector accounted for natural time-dependent shifts, its threshold rose so far that adversarial shifts hid among the natural ones and recall collapsed. This is why we hold that attribution needs its own layer. It also needs a contrast class: a model of how benign samples behave, learned from clean data.
If that per-device drift visibility is missing, close that gap first. The groundwork is covered in our pieces on catching distribution drift before the model fails silently and on monitoring model health without ground truth using proxies and segments. Telling a camera or lighting hardware change apart from a genuine new pattern is its own diagnostic problem, covered in telling real model degradation from confounding signals.
Signals that separate spoofing or dazzle from gradual drift
The attribution layer draws on three families of features: onset, spatial concentration and agreement across sensors. A fourth, the confidence trace itself, helps only once the model is well trained and confident.
Onset: persistent change versus a single bad frame
The TERMon runtime monitor sorts anomalies by how long their underlying cause stays active. A persistent anomaly, such as continued sensor degradation, changes the input-generation process across multiple inferences. A transient anomaly affects one inference and leaves nothing behind. A persistent anomaly gives the monitor repeated chances to catch it, so flags can be aggregated over time. A transient one has to be caught from the affected inference alone. TERMon’s prototype raises an alarm when two of the last three inferences are flagged. Its authors calculate that a more conservative four-of-six rule would produce an expected false alarm only once per 9.2 million healthy inferences, while still catching their weakest harmful case within twelve inferences with 93.6% probability. TERMon’s 13.6% per-inference detection on out-of-distribution SVHN inputs, against a 1.03% false-positive rate, supports windowed detection of sustained shift, though its authors claim no reliable per-input detection.
Persistent drift therefore produces repeated flags that windowed rules can aggregate. Video adds a related check. AdvIT (ICCV 2019) uses optical flow from previous frames to build pseudo-frames and flags a frame as adversarial when the model’s output on it disagrees with them. It reports adversarial-frame detection rates above 95% across segmentation, pose estimation, detection and action recognition.
Spatial concentration: where in the frame the anomaly sits
The AdvReal authors note that adversarial attacks and natural detection errors can both cause failed recognition, but the two differ systematically. Patches redirect the detector’s attention onto semantically irrelevant regions. Natural false positives tend to come from ambiguous object boundaries or poor lighting, with no attention convergence. They conclude that attention behaviour, patch localisation and detectability signals analysed together can make the distinction feasible. PatchBlock (2026) finds an information-theoretic version of the same signature: image regions overlapping a patch show abnormally high mutual information across colour channels.
Concentration also matters for benign corruption. In TERMon’s tests, contrast corruption was flagged on 76.2% of inputs at the highest severity, because its effect lands on one statistic (input standard deviation). Fog reached 15.3%, brightness 5.7%, and diffuse corruptions such as noise and blur were not reliably detected. The 2022 edge-consistency detector’s authors say their method may perform poorly when perturbations are only local, and suggest running it on image patches instead.
Cross-sensor consistency: does the LiDAR agree with the camera?
The same sensor-network study shows that dependencies across sensors can expose attacks built to avoid detection. An adversary can match the marginal distribution of one compromised sensor, for example by looping yesterday’s values, but may not be able to match that sensor’s distribution conditioned on the sensors they do not control. How well this works depends on the mutual information between compromised and uncompromised sensors. If they are independent, there is little hope of detecting an attacker who mimics the marginals. If they are tightly correlated, one disagreeing sensor stands out. Localising which sensor was compromised is harder than detecting that something happened, with precision and recall usually below 0.75 in their experiments. A sophisticated adversary who compromises several correlated sensors together can defeat the test.
Sensor fusion likewise depends on uncompromised sensors. The authors of a 2019 LiDAR spoofing study propose fusion as a defence but note that it requires most sensors to be working correctly, and that it raises the attacker’s effort without being a perfect defence. A 2021 study of LiDAR-camera fusion found that adding image inputs improved robustness to LiDAR-only attacks but made models more vulnerable to attacks across both inputs, driven mainly by brittle image features. Treat cross-sensor agreement as strong evidence when it fails and weak evidence when it holds.
The confidence trace itself
Volatility in Certainty is a label-free metric built from the gap between the top two predicted probabilities. On its test models, log(VC) correlated strongly and negatively with accuracy, and clean and perturbed sets differed significantly at only 5% contamination. It became reliable only once models were well trained and confident, and the correlation was weak early in training. Use it as an input feature, not as a decision.
Quick reference: attack pattern versus drift pattern
| Signal | Benign drift tends to look like | Attack tends to look like | Known limit |
|---|---|---|---|
| Onset | Persistent over many inferences; caught by windowed rules | In video, frames inconsistent with optical-flow pseudo-frames | Per-input adversarial detection at strict false-positive rates is weak |
| Spatial | Diffuse; ambiguous boundaries, poor illumination | Attention converging on an irrelevant region; locally abnormal texture statistics | Whole-image detectors miss local patches |
| Cross-sensor | Correlated sensors move together | One sensor breaks its conditional relationship to the others | Correlated multi-sensor attacks defeat the test |
| Confidence trace | Volatility tracks gradual accuracy loss | Irregular confidence profile under contamination | Reliable only when the model is confident |
Benign sensor noise is the main source of false attack alerts
Ordinary noise blurs the boundary between normal and abnormal inputs. A 2026 study of collaborative edge inference lists wireless channels, thermal fluctuation and hardware degradation as noise sources. It notes that noisy samples distort the boundary between normal and abnormal behaviour, which raises false positives on noisy but legitimate data. Its authors argue that a robust detector should not treat every deviation from the clean latent manifold as an attack. It should model how noise affects benign samples, using noise-tolerant anomaly scores. They also found that denoising before detection is not a simple fix, because the denoiser changes the structure of the latent space. Their noise-aware framework exceeded 80-90% AUROC across multiple cut-point layer configurations, but detection degraded at deeper cut-points and approached random as noise intensity grew.
The practical lesson is to model the noise floor for each device class as part of the benign baseline, rather than leaving the attack layer to rediscover it alert by alert.
Inference-time checks that fit on an edge detector
Several checks can run at inference time beside the model, each built on a different signal:
- Output divergence under preprocessing. Run inference on the raw input and on a preprocessed copy, and flag the input when the L1 distance between the softmax outputs exceeds a threshold calibrated on clean validation data. A 2026 study of depthwise-separable edge models reports this needs no retraining and adds 0.15-0.74 ms per preprocessing pass. On EfficientNetB0, preprocessing moved clean outputs by an average of 24.1 percentage points while leaving adversarial outputs almost unchanged, which is the signal being detected.
- Instability under benign augmentation. AEGIS (2026) measures how often labels flip, how much predictions disagree, how layer features shift and how entropy behaves across augmented views. It then rejects inputs whose evidential uncertainty exceeds a threshold and falls back to safe behaviour, illustrated with an autonomous shuttle facing stickered signs.
- Patch localisation on the CPU. PatchBlock runs as a sensor-level preprocessing module on the CPU in parallel with GPU inference, using an isolation forest to find anomalous regions.
- Cross-task edge consistency. For multi-task perception, a 2022 method flags perturbation when edges from the input, the depth output and the segmentation output disagree, using a two-of-three vote. At a 5% false-positive rate it detected up to 100% of perturbed images, depending on attack strength.
Can existing drift and anomaly monitoring be extended, or does it need a new layer?
We hold that it should be extended, since attribution depends on the drift stack’s event stream and benign baseline. What it does not supply is the split between attack and drift. Open-source tooling already combines drift and adversarial detection. Alibi Detect, for example, provides online and offline detectors for outliers, adversarial inputs and drift, with TensorFlow and PyTorch backends for drift detection.
The attribution logic on top takes one of two forms:
| Choose | When | Calibration and data needs | Main risk |
|---|---|---|---|
| Rule-based layer (thresholds, voting, windowed aggregation) | Attack and drift signatures are well characterised; interpretability and fast deployment matter | Thresholds set on clean data representative of deployment, at a fixed false-positive rate | Goes stale as attack techniques evolve; needs periodic re-threat-modelling |
| Learned classifier over the feature vector | Signatures are subtle or the fleet is heterogeneous | Labelled examples of attack categories as well as clean data; AEGIS trains its discriminator on six categories | Weaker on attacks outside training: AEGIS fell to 86.5% AUROC on held-out hybrid attacks |
Whichever you pick, fix the false-positive budget before committing to features. TERMon’s authors evaluate at a strict 1% operating point and note that many reported results assume rates well above what a safety-critical edge deployment can tolerate. They also found that more features do not automatically help: their reference detector caught 66.4% of heavy weight faults with eight chosen features, but only 1.3% with 128 per-channel means. Treating attribution as alert-quality work, with defined false-positive economics and missed-event handling, is what we mean by production AI reliability.
Retraining on operational data opens a poisoning route. NIST notes that detectors retrained on operational data to follow drift give an attacker a chance to imitate corrupted-sensor signals at training time, so that real attacks later go undetected. A retraining trigger that fires on confirmed drift should therefore check the attribution history of the data it is about to learn from. Evaluating across scenario buckets, covered in catching domain shift before it hurts, is a reasonable gate before such a model is promoted.
Physical attacks that can be mistaken for scene change
Physical attacks have been demonstrated against signs, pedestrians and LiDAR:
- Stickers on signs and markers. Eykholt et al. (2017) used black and white stickers on a real stop sign to cause targeted misclassification in 100% of lab images and 84.8% of video frames captured from a moving vehicle. From the drift monitor’s point of view, that is one sign that looks unusual.
- Patches on clothing. AdvReal (2025) optimises patches for non-rigid clothing so they stay effective across viewing angles, which matters for cameras moving relative to pedestrians. One-stage detectors such as YOLOv2 and YOLOv3 were especially sensitive to such localised perturbations.
- LiDAR spoofing. A study that reliably injected around 60 spoofed points reached roughly 75% success with an improved optimisation method. The resulting stop decision cut the vehicle’s speed from 43 km/h to 0 within one second. Because spoofing uses the sensor’s own physical channel, it yields readings that look legitimate.
- Crude edits. In a case NIST cites, a commercial phishing detector found 100 adversarial examples among 4,600 inputs marked uncertain. Manual analysis showed the attackers used cropping, masking and blurring rather than optimisation. Simple edits like these are exactly what a scene-change explanation absorbs.
What an attribution layer cannot promise
Adaptive attackers have bypassed many proposed detectors. A 2017 study surveyed ten detection methods and defeated all of them by constructing new loss functions, concluding that adversarial examples are much harder to detect than had been assumed. NIST’s 2025 report warns that the field has a history of defences evaluated against weak adversaries and later broken, and that mitigations need testing against strong adaptive attacks. Several of the methods above state their own version of this limit:
- The divergence check can be evaded by an adversary who minimises the divergence.
- The edge-consistency detector can be targeted by an attacker who also optimises for edge consistency.
- TERMon assumes no attack is crafted to keep its features in range, and its authors claim no adversarial robustness.
The edge-consistency authors report resisting the O-PGD attack, and the AdvIT authors a strong expectation-over-transformation attack; those results cover only the attacks tested.
Report attribution as a calibrated probability with its evidence attached, never as a binary verdict. An operator who sees “attack likelihood elevated: abrupt onset, localised, LiDAR-camera disagreement” can act. An operator told “drift” when the truth was a sticker has been misled by the very tool meant to help. Novel attack types outside the threat model will slip past a fixed feature set, so the threat model and its features need revisiting on a schedule, not only after an incident.
Who can build an attack-versus-drift attribution layer on our detector fleet?
TechnoLynx builds the eval, regression and drift harness that such an attribution layer sits on, through the Production AI Monitoring Harness. When choosing a partner, ask how they would calibrate thresholds on your own clean data and how they would test against an adaptive attacker.
Some limits on scope apply. This is engineering of monitoring and alert quality.
FAQ
How can adversarial AI attacks be defended against?
NIST names adversarial training, certified techniques such as randomized smoothing, and formal verification as the most promising mitigations for evasion attacks. Each has costs: adversarial training and randomized smoothing reduce accuracy, and formal verification is computationally expensive.
