SIPA: Stealthy Intent Planning Attacks on V2X End-to-End Autonomous Driving

In vehicle-to-everything (V2X) end-to-end driving, the ego vehicle fuses bird’s- eye-view (BEV) features shared by collaborators and uses the fused represen- tation for both cooperative perception and planning. Existing V2X attacks and defenses, however, largely focus on the perception side. In particular, perception- level defenses can flag collaborators whose transmitted features visibly corrupt detection, motivating a subtler threat: can a malicious collaborator disrupt down- stream planning while keeping cooperative perception close to its clean behavior? We study this perception-stealthy planning attack and propose SIPA (Stealthy Intent Planning Attack). A key challenge is that the attacker cannot access or query the victim planner and does not observe its private route intent. Our key observation is that this intent is not entirely hidden. Planning-aware V2X proto- cols broadcast a request map generated from provisional waypoints, whose spatial structure retains a coarse proxy of the ego vehicle’s route intent. SIPA exploits this protocol-visible side channel to condition an independently trained surrogate plan- ner, infer a counter-intent steering direction, and localize a sparse request-guided perturbation region. Rather than maximizing generic waypoint displacement, SIPA optimizes a control-aware planning objective over trajectory-derived quan- tities used by the downstream controller, while suppressing perception drift. In closed-loop CARLA evaluation, SIPA reduces the Driving Score by 19.91 points while keeping cooperative perception close to the same-frame clean counterfac- tual (∆[email protected] = −0.002). As a result, a perception-level defense (CP-Guard) flags the SIPA collaborator on 18.4% of frames, at or below its 19.2% false-alarm rate on an honest one. These results reveal that perception-level consistency alone does not guarantee downstream planning safety.