Abstract
Autonomous vehicle perception models are continuously updated through retraining and fine-tuning, making post-update integrity verification essential for safe deployment. Conventional validation relies on predictive metrics such as accuracy, precision, recall, and F1-score, but these metrics cannot determine whether an updated model preserves the behavioural characteristics of the trusted model it replaces. Consequently, stealthy attacks, including label poisoning, clean-label-style poisoning, and model tampering, may maintain acceptable predictive performance while altering internal model behaviour.
This paper formulates perception-model integrity as a behavioural identity verification problem and proposes Behavioural Feature Fingerprinting (BFF), a framework that verifies whether an updated perception model remains behaviourally consistent with a trusted baseline. BFF constructs behavioural fingerprints from complementary representation-, geometric-, decision-, and patch-response signals extracted from hidden-layer activations and prediction outputs, compares them against a trusted baseline using benign behavioural calibration, and aggregates behavioural deviations into a Behavioural Identity Score (BIS) that quantifies model integrity independently of conventional performance metrics. The framework is evaluated on the German Traffic Sign Recognition Benchmark (GTSRB) using benign updates, label-poisoned models, clean-label-style poisoned models, and directly tampered models. Starting from a trusted baseline achieving 94.47% classification accuracy, BFF identifies the compromised candidates in this controlled case study even when their predictive performance remains comparable to the benign update. The results show that behavioural identity verification provides complementary evidence beyond accuracy-based validation while motivating broader comparative evaluation.