We are thrilled to announce that our journal paper entitled “Adversarial Trajectory Attack Targeting Autonomous Driving Planners with Residual-based Defense” has been accepted for publication in IEEE Access. Congratulations Liu-kun!

In this work, we propose AVATAR, an adversarial trajectory attack in which a single surrounding vehicle, controlled by a reinforcement learning agent, generates dynamically feasible, smooth, and broadly rule-compliant trajectories that steer the ego vehicle’s planner toward unsafe decisions. Evaluated in the Waymax closed-loop simulator against four victim planners (rule-based, RL-based, imitation-learning-based, and world-model-based), collision-targeted attacks drop the average safety score from 1.0 to 0.27. We further propose a defense framework that combines a planner-agnostic residual-based anomaly detector with a conservative fallback planner, restoring the average safety score to 0.94 with no collisions observed in benign runs.

Jiadong Liu and Tatsuya Mori, "Adversarial Trajectory Attack Targeting Autonomous Driving Planners with Residual-based Defense." IEEE Access, to appear, 2026.

We are thrilled to announce that our workshop paper entitled “Physiological Linkage Attacks against Visually Obfuscated Videos Using rPPG” has been accepted for publication in The 3rd Workshop on Cybersecurity in Healthcare (HealthSec 2026), co-located with ACSAC 2026. This work is a collaboration with the National Institute of Advanced Industrial Science and Technology (AIST). Congratulations Iijima-kun, Hasegawa-kun, and Kawaoka-kun!

Remote photoplethysmography (rPPG) enables the contactless estimation of pulse waveforms from ordinary videos. Although visual obfuscation techniques such as eye-region masking and facial pixelation are intended to conceal a person’s identity, they may preserve the subtle temporal variations in skin color from which rPPG signals can be extracted. In this work, we investigate physiological linkage attacks against privacy-processed videos in two settings: cross-modal linkage, where an adversary compares an rPPG signal extracted from an identity-labeled video with a sensor-derived PPG signal in a pseudonymous health record, and cross-video linkage, where the adversary compares an rPPG signal from a privacy-processed video with a reference rPPG signal from an unprocessed video. Using Dynamic Time Warping and a CNN-LSTM targeted verification model on the UBFC-Phys dataset, we show that conventional visual privacy processing does not consistently remove individual-specific physiological information: across all evaluated obfuscation settings, the median F1 scores ranged from 0.83 to 0.87, with maximum F1 scores of 0.994 for eye-region masking and 0.987 for facial pixelation. We further propose a proof-of-concept countermeasure that applies randomized frame-level perturbations to the green channel, disrupting rPPG estimation. These results highlight the need to protect latent physiological information contained in video data.

Ryo Iijima, Koki Hasegawa, Ryo Kawaoka, and Tatsuya Mori, "Physiological Linkage Attacks against Visually Obfuscated Videos Using rPPG." In Proc. of The 3rd Workshop on Cybersecurity in Healthcare (HealthSec 2026), co-located with ACSAC 2026, Los Angeles, CA, USA, Dec 2026.