The Latent Guardian: Defending Collaborative Perception via Feature-Level Consistency Verification

Collaborative perception (CP) significantly extends the sensing range of connected and autonomous vehicles (CAVs). However, its reliance on data fusion among multiple CAVs makes it inherently vulnerable to adversarial attacks from malicious participants. Existing defenses primarily rely on output-level consensus, assuming that malicious messages manifest as statistical outliers, while suffering from poor adaptability to environmental noise. This makes them vulnerable to stealthy adversarial attacks and prone to high false positive rates. To address this challenge, we shift the defense paradigm from superficial output-level consensus to deeper consistency within the internal feature space. Guided by this principle, we propose \texttt{Cerberus}, a novel defense framework against adversarial attacks in CP systems by leveraging multi-dimensional consistency in the feature space. By quantifying conflicts in topological structure, semantic direction, and energy distribution within feature maps, \texttt{Cerberus} effectively detects adversarial perturbations and provides dynamic protection against adversarial attacks. Experimental results demonstrate that \texttt{Cerberus} significantly outperforms state-of-the-art methods, effectively limiting the attack success rate to as low as 0.05\% while restoring the mAP to 0.88.