Adversarial Attack on Autonomous Ships Navigation Using K-Means Clustering and CAM

Abstract

As Maritime Autonomous Surface Ships (MASSs) increasingly become part of global maritime operations, the reliability and security of their object detection systems have become a major concern. These systems, which play a crucial role in identifying small yet critical maritime objects such as buoys, vessels, and kayaks, are particularly susceptible to adversarial attacks, especially clean-label poisoning attacks. These attacks introduce subtle manipulations into training data without altering their true labels, thereby inducing misclassification during model inference and threatening navigational safety. The objective of this study is to evaluate the vulnerability of maritime object detection models to such attacks and to propose an integrated adversarial framework to expose and analyze these weaknesses. A novel attack method is developed using K-means clustering to segment similar object regions and Class Activation Mapping (CAM) to identify high-importance zones in image data. Adversarial perturbations are then applied within these zones to craft poisoned inputs that target the YOLOv5 object detection model. Experimental validation is performed using the Singapore Marine Dataset (SMD and SMD-Plus), and performance is measured under different perturbation intensities. The results reveal a considerable decline in detection accuracy—especially for small and mid-sized vessels—demonstrating the effectiveness of the attack and its capacity to remain imperceptible to human observers. This research highlights a critical gap in the security posture of AI-based navigation systems and emphasizes the urgent need to develop maritime-specific adversarial defense strategies for ensuring robust and resilient MASS deployment.