Experiment Note
The SUMO scenario used a straight two-lane road, five CAVs, a 0.05 s simulation step, a 120 s horizon, vehicle length 4.8 m, maximum speed 33.33 m/s, maximum acceleration 2.5 m/s2, and maximum deceleration 4.5 m/s2.
Four controllers were tested: raw CACC, sensor-only ACC, trust CACC, and shielded trust CACC. Five communication conditions were tested: clean, FDI-position, FDI-velocity, delay, and packet loss. Five seeds were used per attack-method pair, producing 100 integrated runs.
Under clean, delay, and packet-loss conditions, the methods remained free of unsafe-gap samples in the reported SUMO configuration. The most revealing results were under false-data injection.
For FDI-position:
- Raw CACC: RMS 7.966 ± 2.966, minimum gap -1.476 ± 4.791 m, 3702.4 ± 4696.2 unsafe samples.
- Trust CACC: RMS 68.291 ± 129.903, minimum gap 4.770 ± 6.903 m, 224.8 ± 136.0 unsafe samples.
- Shielded Trust CACC: RMS 1.613, minimum gap 6.162 m, zero unsafe samples.
- Sensor-only ACC: RMS 1.615, minimum gap 6.059 m, zero unsafe samples.
For FDI-velocity:
- Raw CACC: RMS 12.477 ± 4.168, minimum gap -10.270 ± 8.115 m, 7112.4 ± 3831.2 unsafe samples.
- Trust CACC: RMS 4.106 ± 3.700, minimum gap 3.471 ± 3.931 m, 171.4 ± 263.5 unsafe samples.
- Shielded Trust CACC: RMS 1.613, minimum gap 6.162 m, zero unsafe samples.
- Sensor-only ACC: RMS 1.615, minimum gap 6.059 m, zero unsafe samples.
The shield activated 9426 times in each reported FDI configuration. This high count indicated sustained fallback behavior during severe corruption. It was interpreted as a diagnostic rather than presented as a desirable independent outcome.
Technical Essay
The SUMO results confirmed the prevention pattern but also exposed a subtle issue: under FDI-position, trust-weighted CACC without shielding produced extremely high variance and could be worse than raw CACC in RMS error. Low trust does not automatically create a good fallback controller. If corrupted cooperative information is suppressed without a stable transition to sensor-only behavior, tracking can become poor. The shielded controller effectively behaved close to the conservative sensor-only baseline during severe attacks.
The correct conclusion was therefore not that the learned component dominated every baseline on every metric. The conclusion was that the architecture preserved clean cooperative behavior and provided an attack-aware path to conservative safe behavior when communication became dangerous.