Georgia Tech researchers identified a new vulnerability they call VillainNet in AI “super networks” used by autonomous driving systems. Super networks work by swapping small subnetworks to handle tasks such as rain, heavy traffic or lane changes. David Oygenblik, a PhD student and lead researcher, helped lead the project.
The team found an attacker can hide a backdoor inside one subnetwork. The backdoor remains dormant until that specific subnetwork is selected; when triggered, it activates and can take control of the vehicle. The researchers describe a possible trigger: a self-driving taxi responding to rainfall and changing road conditions. Once in control, attackers could threaten passengers or force the car to crash.
In experiments the attack was almost certain to succeed when activated, with a 99% success rate. The researchers say detecting such a backdoor would need far more computing power and time than current methods allow. They warn the threat can be inserted at any development stage and call for stronger defenses. The work was presented at the ACM CCS conference in October 2025.
Difficult words
- vulnerability — a weakness that attackers can use
- super network — a large AI model made of many partsSuper networks
- subnetwork — a smaller part of a larger networksubnetworks
- backdoor — a secret access point for attackers
- dormant — inactive and not working now
- trigger — an event that makes something starttriggered
- attacker — a person who tries to harm the systemattackers
- detect — to find or notice a problem or faultdetecting
Tip: hover, focus or tap highlighted words in the article to see quick definitions while you read or listen.
Discussion questions
- What steps could developers take to make autonomous cars safer against this kind of threat?
- Would you feel safe riding in a self-driving taxi after reading this? Why or why not?
- The researchers say detecting the backdoor needs more computing power and time. How might that affect testing and development of self-driving systems?
Related articles
Light tool measures activity inside living brain cells
Researchers developed a bioluminescent calcium sensor called CaBLAM to record activity inside living brain cells without external light. The tool works in mice and zebrafish and enables long recordings that avoid damage from bright light.
