Data Spoofing Is Four Attacks, and Your Model Answers None of Them

Correction, 5 September 2026: the version of this article published in February 2021 is completely updated and rewritten.

---

On 3 July 2026 the European Union Aviation Safety Agency issued the fourth revision of its bulletin on Global Navigation Satellite System (GNSS) outages and alterations, SIB 2022-02R4. The FAA’s GNSS Interference Resource Guide, updated in March 2026, lists what a crew sees when the spoofing is good: the moving map jumps, the aircraft’s own navigation systems disagree with each other by miles, terrain warnings fire against nothing. On how many flights, the counts differ by who is counting and when. Benoit Figuet of SkAI Data Services put it at roughly 900 a day in April 2026. Honeywell wrote in November 2025 that jamming and spoofing together affect more than 1,500 flights a day. Different denominators, same direction.

A pilot who suspects the position is false has a procedure: cross-check against the inertial reference system, fall back to ground-based aids, ask air traffic control. Aviation wrote that procedure because the industry accepted a specific fact about GNSS, which is that a signal can be well formed, correctly structured, valid, and manufactured by somebody else.

A machine learning model handed the same kind of input has no procedure and no way to ask where the input came from. Here is the sentence I would send to a CISO: channel authenticity, measurement integrity and model correctness are three separate properties, and no one of them supplies the other two.

Four attacks under one word

NIST’s adversarial machine learning taxonomy, updated to edition 2025 on 24 March 2025, contains no category called data spoofing. It has evasion, poisoning and privacy attacks for predictive systems, plus the generative extensions that edition added. Practitioners keep the term anyway, and what they collect under it is four attacks with four different answers.

Perturbation. The input is genuine and an attacker has modified it. This is the adversarial example literature. In its close relative, model evasion, the attacker tunes the modification to cross a decision boundary.

Fabrication at inference. The input is complete, well formed and valid, and it does not describe the world. Two mechanisms produce it, and conflating them is the mistake that follows conflating everything else. In channel fabrication, an attacker forges the input path, so the data never came from the sensor it claims. In measurement deception, a real sensor faithfully reports something an attacker put in front of it.

Corruption of the store. An attacker changes what the system learned from or what it retrieves. Training-set attacks are data poisoning and its variants, including label flipping.

Impersonation of a participant. Sybil identities, replayed messages, stolen credentials. Classical security problems that AI systems inherit along with every other networked system, and that predate them by thirty years.

Security calls both the second and the fourth spoofing, and both usages are correct. I mean the second here, because it has the thinnest defensive literature and because the other three keep absorbing it.

The model classifies; it does not authenticate

In 2020, Ben Nassi and colleagues at Ben-Gurion University published Phantom of the ADAS at ACM CCS. They projected a human figure onto a road and a speed limit sign onto a tree, and they embedded a 125-millisecond stop sign in an advertisement on a digital billboard. A Tesla Model X on hardware 2.5 and 3 braked for the projected pedestrian and stopped in the road for the billboard sign. A Mobileye 630 PRO read the projected sign. Equipment cost, by the authors’ account, a few hundred dollars, and the attacks ran black-box.

On their project page the team says plainly that phantoms are not bugs. They are not the result of poor code, and they are not the kind of thing a patch closes. They reflect models built to detect objects that were never trained to separate real ones from fake ones.

Tesla had other sensors. The authors read the failure as a better-safe-than-sorry policy, one that treats a visual detection as a real object even though radar and ultrasonics reported nothing there. A fusion architecture that acts on any single channel is running an OR gate over its sensors.

Engineers solved provenance forty years ago with digital signatures, mutual authentication, device attestation, sequence numbers and trusted timestamps. Every one of those controls runs outside the neural network. A classifier can sometimes infer that an input looks wrong. It cannot establish that an input is authentic, and those are two different guarantees.

What the sensor research has demonstrated

Rokuto Nagata and co-authors overwrote LiDAR measurements with malicious laser pulses in SLAMSpoof, presented at ICRA 2025, attacking the scan matching that gives self-driving systems centimetre-level position. A September 2025 preprint, Seeing is Deceiving, reaches a similar result with planar mirrors and no electronics at all, adding phantom obstacles and removing real ones. Those authors validated it outdoors against a commercial LiDAR and an Autoware-equipped vehicle before scaling the tests in CARLA.

All three attacks are measurement deception, not channel fabrication. The sensors work. The measurements are honest reports of an environment an attacker has arranged.

Vehicle engineers have answered this with sensor fusion. Check the LiDAR reading with the camera, bring radar in as a third opinion, and the surviving channels catch an attacker who compromises one. An April 2026 preprint, Cross-Modal Phantom, reports 85.5% success against a PointPillars fusion model across 400 KITTI scenes by placing a camera phantom and a matching LiDAR return at the same 3D location.

Those authors did not build the infrared projector or the LiDAR injector. They simulated the sensor-level output such hardware would produce, inserting perspective-aware image patches and synthetic point clusters into the data. So 85.5% is a simulation result under the paper’s own model of what the hardware would emit, on one dataset against one detector, and nobody has road-tested the coordinated attack.

Fusion protects you in proportion to how independently its inputs fail. Two sensors that both answer directed light from an attacker’s position are less independent than the block diagram suggests. Inertial navigation and GNSS fail for different reasons, which is why the aviation cross-check works. Ask the same question of any system reading several input modalities at once: which single attacker position compromises two channels together? Where the output steers a vehicle or a robot arm the cost of a wrong answer changes, which I have written about separately in the context of autonomous robots.

Injection attacks against identity verification

Attackers stopped using the camera once presentation-attack detection improved. Holding a deepfake up to a phone now works less often than it did, so they bypass the capture path instead: a virtual camera driver, a hooked application or a compromised device feeds synthetic video into the verification pipeline as though a sensor had produced it. The face matcher then does its job correctly. The liveness model does its job correctly. Both are reasoning about frames that no camera ever captured.

iProov’s Threat Intelligence Report 2026 puts injection attacks up 741% year on year, with attacks against iOS devices up 1,151% in the second half of 2025, ending the assumption that Apple hardware was structurally safer. Entrust’s 2026 Identity Fraud Report, published 18 November 2025 from more than a billion verifications across 195 countries, finds deepfakes in one of every five biometric fraud attempts, deepfaked selfies up 58%, and injection attacks up 40%.

Every one of those numbers comes from a company that sells detection of the attack it is counting. Independent vendor networks agree on the direction of travel, which is the part I rely on. The rates are computed over a denominator each vendor defines and nobody outside can audit, so I read the trend as evidence and the percentages as marketing.

Annex III of the EU AI Act makes remote biometric identification a high-risk use, then excludes systems whose sole purpose is confirming that a person is who they claim to be. A KYC selfie check performs one-to-one verification, so the exclusion covers it, and Recital 17 extends the carve-out to authentication and to access to a service. Article 15, which covers accuracy, robustness and cybersecurity and requires resistance to attempts at altering a system’s use or outputs, binds high-risk systems. An identity verification product reaches it only by qualifying as high-risk on some other ground.

Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, appeared in the Official Journal on 24 July and entered into force on 27 July. It moved Annex III high-risk duties to 2 December 2027 and Annex I to 2 August 2028, and left Article 50 transparency on its original date of 2 August 2026. Checked 5 September 2026. So 2 December 2027 applies to remote biometric identification providers. One-to-one verification, where the injection attacks are actually happening, is outside the regime that would have required anyone to defend the input channel.

Fabricated facts in agent pipelines

Prompt injection is untrusted content becoming instruction. What I am describing is untrusted content becoming fact. The two need different controls, because an instruction filter looks for imperatives and role changes, and a fabricated fact contains neither.

Wei Zou and colleagues drew that same line in PoisonedRAG, at USENIX Security 2025, describing their attack as relying on malicious knowledge instead of instructions. Injecting five crafted texts per target question into a knowledge database of 2,681,468 clean texts, they induced attacker-chosen answers on Natural Questions 97% of the time against PaLM 2 in the black-box setting. Every one of the eight models they tested stayed above 88%. Four defences were tried. Paraphrasing cut the rate to 87%, perplexity filtering could not separate the malicious texts from clean ones, duplicate filtering changed nothing, and retrieving fifty documents instead of five still left the attack working on roughly two questions in five.

The attack requires one thing: somebody has to get five documents into the corpus. Those authors name the routes plainly, including editing Wikipedia articles and an insider writing into a private enterprise database. In an enterprise retrieval system fed by a wiki, a ticket queue, a shared drive and a crawler, corpus write access belongs to hundreds of people and several automated processes, and almost nowhere is it governed like database administration.

This is corpus corruption. It belongs beside data poisoning in the taxonomy without being the same attack, because a retrieval corpus can be rewritten this afternoon and a training set cannot.

The same team ran the attack against a ReAct agent and reached 72%, 58% and 52% success across their three datasets, lower than the chatbot numbers and still high enough to matter for anything acting on retrieved evidence.

OWASP has the agentic version catalogued. The Top 10 for Agentic Applications 2026, published on 9 December 2025, lists spoofed inter-agent messages under ASI07, Insecure Inter-Agent Communication, and false signals propagating through automated pipelines under ASI08, Cascading Failures. The supply-chain entry, ASI04, covers a different mechanism that has already happened in the wild: the npm package postmark-mcp impersonated a legitimate email integration through fifteen clean releases before version 1.0.16 added a line copying every message an agent sent to an attacker’s address. Koi Security disclosed it on 25 September 2025, after 1,643 downloads. That case involves a backdoored tool and not a fabricated fact; the two belong in different rows.

Much of the current agent-security discussion covers instruction and goal hijacking. An agent that believes a fabricated fact has not been hijacked. Its planner works. Its guardrails pass. Every tool call it makes is legitimate. It then acts competently on a false premise, and the monitoring built to catch a compromised agent never fires.

Why adversarial training does not answer this

Adversarial training raises the cost of finding a perturbation that crosses a decision boundary. It is a reasonable defence against the first of the four categories above and, tuned well, a measurable one.

A model can also be trained to recognise a particular spoof. The Phantom of the ADAS team built exactly that: GhostBusters, four small convolutional networks scoring an object’s light, context, surface and depth, reaching a 0.994 true positive rate at a zero false positive rate on their own phantoms. What GhostBusters learned is the artefact signature of one attack, and a signature is a detection asset with a shelf life. It establishes nothing about where an input came from.

Adversarial training is narrower still, because a spoofed input reaches the model unperturbed. A synthetic face frame, a fabricated GNSS fix, a phantom LiDAR return and a forged retrieval document are all in-distribution, ordinary, unremarkable examples of what the model was trained to process. Hardening the boundary changes nothing, because the input already arrives on the right side of it.

Combining models helps where the members fail for different reasons. Members reading one compromised input channel fail together, so an ensemble adds nothing here.

Vendors propose tamper-evident ledgers for this regularly. A ledger can make a recorded value and its claimed origin tamper-evident, given identity and ingest you already trust. It says nothing about whether the sensor that produced the value was reporting the world.

What holds

Five controls, in the order I would build them. The first two answer channel fabrication, the third answers measurement deception, and the last two limit the damage where neither is available.

Sign at the source. Authenticate where the data is produced rather than where it is consumed: signed telemetry from attested hardware, camera modules that sign frames, content credentials for media under C2PA. This settles origin and history, which is all it claims to settle. A signed frame of a projected pedestrian is still a signed frame. The provenance work in synthetic media is the same problem approached from the publishing side.

Attest the channel. Prove the input arrived by the path it claims. Injection-attack detection in identity verification serves this objective, though what vendors ship under the name mixes device integrity checks, capture-path signals and media forensics more than formal attestation. Cheaper than signing at the source, weaker, available now.

Cross-check against independent sources. Add channels that fail for different reasons, the way inertial navigation and GNSS do, and set the fusion policy to require agreement instead of accepting any single detection. This is the only control on the list that addresses a genuine sensor faithfully reporting a manufactured scene.

Govern write access to retrieval corpora as privileged access. Five crafted texts per question were enough against a corpus of millions in the PoisonedRAG experiments. Anyone who can add a document to a production corpus can pick the answer users get for a given question. Review that permission the way you review production database credentials.

Contain the output where neither origin nor measurement can be established. Limit the damage a confident wrong answer causes: no irreversible action on a single unverified input, second approval for anything that moves money or writes to production, no autonomous credential use on evidence the system cannot trace.

The Monday version of all of this is one question, asked of every model already in production. If this input were fabricated by somebody who understood its format, what in the system would notice? For most models no component in the pipeline checks the origin of the input, and for most of them that is acceptable. The list where it is not acceptable is short. Working through that list is the practical follow-on to the taxonomy in AI Security 101, and it is a different exercise from hardening the models on it.