Autonomous vehicles (AVs) increasingly rely on multi-sensor perception pipelines that combine data from cameras, lidar, radar, and other modalities to interpret the environment. This SoK systematizes 48 peer-reviewed studies on perception-layer attacks against AVs, tracking the field's evolution from single-sensor exploits to complex cross-modal threats that compromise multi-sensor fusion (MSF). We develop a unified taxonomy of 20 attack vectors organized by sensor type, attack stage, medium, and perception module, revealing patterns that expose underexplored vulnerabilities in fusion logic and cross-sensor dependencies. Our analysis identifies key research gaps, including limited real-world testing, short-term evaluation bias, and the absence of defenses that account for inter-sensor consistency. To illustrate one such gap, we validate a fusion-level vulnerability through a proof-of-concept simulation combining infrared and lidar spoofing. The findings highlight a fundamental shift in AV security: as systems fuse more sensors for robustness, attackers exploit the very redundancy meant to ensure safety. We conclude with directions for fusion-aware defense design and a research agenda for trustworthy perception in autonomous systems.

翻译：自动驾驶汽车越来越依赖多传感器感知管道，这些管道结合来自摄像头、激光雷达、雷达及其他模态的数据来理解环境。本SoK系统梳理了48篇关于自动驾驶感知层攻击的同行评审研究，追踪了该领域从单传感器攻击到威胁多传感器融合（MSF）的复杂跨模态攻击的演化过程。我们开发了一个统一的分类法，涵盖20种攻击向量，按传感器类型、攻击阶段、媒介和感知模块进行组织，揭示了融合逻辑和跨传感器依赖中尚未充分探索的漏洞模式。分析识别出关键研究空白，包括有限的实际场景测试、短周期评估偏倚以及缺乏考虑传感器间一致性的防御措施。为说明其中一个空白，我们通过一个结合红外和激光雷达欺骗的概念验证模拟，验证了融合级漏洞。研究结果凸显了自动驾驶安全的一个根本性转变：当系统为了鲁棒性融合更多传感器时，攻击者恰恰利用了本应为安全提供保障的冗余结构。最后，我们提出了融合感知防御设计的指导方向，并规划了面向自动驾驶系统可信感知的研究议程。