Cross-checking perception: designing for sensor disagreement

Design physical AI systems so that no single sensor or model decides an important action alone. Compare independent sources, treat disagreement as information, and define what the machine does when sources conflict. Research on sign stickers and on satellite signal spoofing shows why: each one can produce a confident wrong answer.

Two kinds of confident wrong answers

A model fooled by the world. In a 2018 study, stickers on a real stop sign caused targeted misclassification of the sign in 100 percent of lab images and 84.8 percent of video frames from a moving vehicle, against the classifier tested. The model gave an answer without any sign it was wrong.

A receiver fooled by a signal. Reference material describes GNSS spoofing as broadcasting fake signals so the receiver computes a wrong position or time. In a carry-off attack, the fake signals match the real ones, then gradually take over, so the receiver does not lose lock.

In both cases the failure is silent. The system sees no error, so a check inside the same sensor will not catch it.

Principles

1. Independence. Two sensors that share a failure mode are one sensor. A camera and a map can disagree for different reasons, which makes them better partners than two cameras behind the same lens.
2. Plausibility. Reject values that are physically impossible, such as a position jump of kilometers in a second.
3. Persistence. Require a surprising reading to persist, and be confirmed by another source, before acting on it, unless acting is the safe choice.
4. Asymmetry. Make it easy to slow down and hard to speed up on weak evidence.
5. Visibility. Record disagreement. A log of near misses is a free test set.

A decision table

Write one down for each important decision:

• Sources agree and confidence is high: proceed.
• Sources agree and confidence is low: proceed cautiously.
• Sources disagree: choose the safer action, alert, and log.
• A source is missing: use the others, reduce speed, and alert.
• All sources are suspect: stop in a safe state or hand over to a human.

The hard part is not the table. It is deciding what "safe" means for each machine, since stopping is not safe on a highway.

Test for it

Add tests where one source is made wrong on purpose:

1. Replay a recorded satellite position with a gradual offset.
2. Feed the model images with physical perturbations, not only clean ones.
3. Drop a sensor mid-run.
4. Delay a sensor by a fraction of a second.

Record whether the system noticed, how quickly, and what it did.

Limits

This reduces risk. It does not remove it. Other summaries note that real world attacks on perception can be fragile, since small rotations or lighting changes can destroy an adversarial effect, so do not assume an attacker's best case or worst case without testing your own system.

Supply chain angle

The perception stack includes models and libraries. Keep an inventory of each release and watch for advisories. Safeguard's SBOM and dependency scanning cover the library side of software you build.

Quick check

Sources

• Physical-world attacks on deep learning visual classification, Eykholt et al. (arXiv)
• Adversarial machine learning (Wikipedia)
• Spoofing attack, GNSS section (Wikipedia)

Last reviewed: 19 October 2026.