Black-box attackers cause traffic delays by faking vehicle reports
A Minimally Informed Black-Box Fake-Report Attack on DRL Traffic-Signal Control
Cryptography and Security
Summary
Traffic lights controlled by AI learn from car reports to manage flow, but these reports can be faked. The authors show a simple attacker who can only inflate their own car counts, without knowing the AI’s details, can still make other drivers wait longer. Surprisingly, even just always reporting the maximum number of cars works as well as more complex tricks. This reveals a weak spot in the car-to-traffic-light communication that could be exploited to create delays.
What this means in practice
- •For traffic management teams: Detect and mitigate vehicle count falsification to improve urban traffic flow reliability.
- •For cybersecurity teams in smart city infrastructure: Design defenses against black-box attacks exploiting vehicle-to-infrastructure communication vulnerabilities.
Authors
Amro Saleh, Loukas Lazos, Mohammad J. Abdel-Rahman
Abstract
Deep reinforcement learning (DRL) traffic-signal controllers may use vehicle-to-infrastructure (V2I) reports, exposing their perception layer to false-data injection. Existing demonstrations typically assume either white-box access to the controller's weights or full observability of the traffic state. We study the impact of a weaker and more realistic adversary who has no access to the RL model and whose traffic observations are limited to her own approach. This black-box, minimally informed attacker trains an imitation surrogate of the controller. She then crafts bounded fake reports, restricted to inflating vehicle counts on her own approach, that transfer to the real controller. We demonstrate that despite the loss of accuracy relative to an attacker who can observe the entire state and action space, this limited attacker can significantly increase the average waiting time for other approaches while barely changing the waiting time on her own approach, i.e. externalizing the added delay onto the other approaches. Because the only realizable move is to inflate one's own reported queue, we find that a zero-knowledge attacker that simply reports the maximum feasible queue is as damaging as the surrogate-based one, while an unstructured random inflation is not: the surrogate is not required to reproduce the degradation, and the exposed vulnerability is the V2I sensing channel itself. The surrogate's role is directional control, selecting a disruptive or a selfish objective at the same budget. The attack persists under +/-20% uniform demand variation. Finally, on a common per-lane budget we place the attacker on a knowledge ladder against white-box adversaries, and find the black-box surrogate matches a realizable white-box attacker that uses the victim's own gradients; only abandoning realizability raises the damage further.