The problem
Delivery drones increasingly rely on cameras and learned perception for the final, most delicate part of the mission: finding a safe spot to land or lower a package, and following or tracking objects on the ground. Unlike GPS, a camera sees the world directly. That also means anyone who can change what the camera sees can influence the aircraft.
Our approach
GWU, UC Irvine, and TSU work this use case together in a bi-weekly subteam, combining attack discovery with defenses and shared data.
- Understanding the vulnerabilities. UC Irvine performed the first security analyses of camera-based autonomous target tracking (FlyTrap) and of fiducial-marker pose estimation used for precision landing (MirageMarker), showing that small, physically realizable changes in the scene can steer a drone’s behavior while evading standard filtering.
- Trustworthy perception for delivery. GWU benchmarked real-time detectors for safe landing with calibrated uncertainty, used vision-language models to identify and explain safe landing zones, and is developing a calibrated forecast of how long a drop zone will stay clear during tethered delivery.
- Shared data at scale. TSU’s IRIS D³ dataset simulates clean, degraded, occluded, and compromised drop zones in RGB and LiDAR, supporting cross-institution benchmarking of landing models.
- Securing AI reasoning onboard. UC Irvine has begun work on defending vision-language models used in drone autonomy against visual prompt injection.
Looking ahead
Year 3 brings these pieces into joint demonstrations of vision-based delivery that can recognize, and recover from, a manipulated scene.
