Module 10 / Computer Vision / AV Mission: Impossible – Dead Reckoning (2023)

If the model only sees sensors, whoever can write the sensors can write the model. This is not a sentient virus. It is a perception channel you do not own.

Domain: Computer Vision / Autonomous Vehicles Focus: Adversarial Input & Sensor Evasion

● SOURCE: Mission: Impossible – Dead Reckoning Part One (Paramount, 2023) REAL-WORLD CASE: Tesla Autopilot phantom braking (NHTSA); physical adversarial patches (Eykholt et al., 2018) RCA REF: NHTSA PE21-020 / EA22002; Eykholt et al., CVPR 2018

Section 01

The Script — Cinematic Anchor

Dialogue Extract

The Entity is not interesting here as a god on the network. It is interesting where it feeds false acoustic and telemetry into ships that still believe their sensors. Stealth profiles, targeting, the map of the sea — all of it is a model of a signal. — paraphrased from the naval / sensor-compromise beats, not a verbatim line

The beat used here is spoofed perception — not "AGI hacks the world's computers." If the scene cannot be told as an input-channel failure, it is the wrong scene for this module. Comic strip below is an original educational parody of those beats — not frames from the film.

Scene Visual — Comic Strip

Four-panel comic of spoofed ship sensors creating a phantom contact — COMIC · Sensor → spoof → two worlds → actuator (original educational strip)

Dramatis Personae → Stack Mapping

The Entity (sensor beats only)→An adversary who can write the input channel — not a plot-level superintelligence
Naval acoustic / stealth telemetry→Layer D — the only world the classifier sees
The crew watching the board→HITL who may be as fooled as the model if they trust the same feed

Diegetic Failure Mode

A perception model treats its input as the world. An adversary who can perturb that input — acoustically, with a projector, with a sticker — selects the class without touching the weights.

Section 02

AI System Stack

D — Data & sensors Cameras, radar, ultrasonics, microphones. Physical adversarial examples live here. Digital FGSM lives in a file. Same idea, different budget.

M — Model A classifier / detector trained on a clean distribution. Small, structured perturbations can move it across a decision boundary.

O — Objective Minimize classification loss on the train set. Adversarial robustness is a different objective and was often not in the loss.

X — Orchestration Fusion: if camera says "obstacle" and the rest of the stack trusts camera, you get phantom braking even when radar is quiet — or the reverse, depending on the fusion bug.

H — Human loop A driver who is not actually in the loop at highway speed. Takeover time is part of MEASURE 2.6, not a footnote.

Section 03

The Incident — Empirical Grounding

Field Visual — Comic Strip

Four-panel comic of phantom braking and a sticker-perturbed traffic sign — COMIC · The Field — phantom braking + physical adversarial examples (original educational strip)

Real-World Incident Precedent

Two documents, one mechanism, honestly labeled. Primary field case: NHTSA's Tesla Autopilot investigation (PE21-020, then EA22002) includes large numbers of "phantom braking" complaints — sudden deceleration without an apparent obstacle, i.e. the perception stack asserting a world that the road did not contain. Mechanism paper: Eykholt et al., "Robust Physical-World Attacks on Deep Learning Visual Classification," CVPR 2018, demonstrated that small physical perturbations (stickers on a stop sign) can flip a classifier in the physical world. Projector and patch attacks on traffic-sign and camera stacks have been shown on multiple vendors, including Mobileye-class systems in researcher demos. This module does not claim NHTSA found stickers on every Tesla. It claims the input channel is writable, and that ISO/IEC 24029 exists because neural nets are not robust by default.

Cinematic vs. Reality Matrix

Dimension	Media Depiction (The Script)	Field Reality (The Incident)
Failure Vector	A named superintelligence infiltrates naval sensors and the world's networks.	Camera/radar stacks misclassify; researchers can force misclassification with patches and projectors. Teach the writable input, not the omniscient Entity.
Time to Impact	Set-piece minutes.	Phantom braking: a second of deceleration at highway speed. Patch attacks: as long as the sticker stays.
Operator Visibility	The crew may see spoofed tracks on a board.	Drivers feel the brake. They often cannot see what the camera thought it saw unless the vendor shows them the frame.
Failsafe Behavior	Impossible Mission Force as the patch.	Sensor fusion disagreement as a trip, robust-training / 24029 evals, and a driver who is actually a driver — which the operational design may have already given up.

Root-Cause Analysis (RCA)

Classification: Data / Sensor integrity + Model (lack of robustness)

Primary root cause is a perception policy that treats camera (or acoustic) class labels as the world, without a robustness requirement or a fusion trip when sensors disagree. A contributing cause is training and evaluating on clean data only.

Section 04

Engineering Runbook & Countermeasures

Eval / Telemetry Envelope

Parameter	Normal / Baseline	Trip Threshold	Condition at Failure
Phantom actuation rate	Emergency brake / evasive yaw with no confirming second sensor ≈ 0	Unconfirmed camera-only obstacle at speed	NHTSA complaint cluster: deceleration, empty road
Physical-world attack eval	Documented 24029-style tests (patches, weather, projectors)	Stop-sign / speed-limit class flips under published perturbations	Eykholt-class stickers; researcher projector demos
Fusion disagreement	Camera vs. radar vs. map must agree to act at severity S	Single-sensor actuate on S	Camera-dominant brake
Takeover budget	Driver can resume in the documented time	Hands-off design that assumes the model is the world	Human loop too slow for the error the camera just made

Mitigation / Recovery Protocol

Do not actuate a high-severity maneuver on one unconfirmed camera class. Fusion disagreement is a trip, not a tie the vision net always wins.
Put physical adversarial tests in the gate — patches, rain, projectors — not only clean-set mAP.
Log the frame the model believed. Without that, phantom braking is a ghost story and you cannot RCA.
Robust training is a requirement, not a paper. ISO/IEC 24029 is how you say what you measured.
Keep a real human loop at speeds where a misclass is a crash — or do not claim the driver is the control.

Standards Reference

ISO/IEC 24029-1 — assessment of the robustness of neural networks. The clause family for this module; "the model got 99% on the clean set" is not a 24029 argument.

NIST AI RMF MEASURE 2.7 — AI system security and resilience are evaluated and documented — including evasion of the classifier via the input channel.

NIST AI RMF MEASURE 2.6 — safety risks, residual risk vs. tolerance, fail-safe beyond knowledge limits, and response times for failures. Phantom braking is a knowledge-limit failure at speed.