Battling Prompt Injection Attacks on LLM-Enabled Autonomous Vehicles

Abstract

The integration of Large Language Models (LLMs) as semantic co-pilots in Autonomous Driving Systems (ADS) represents a significant paradigm shift for analyzing vehicles and perceiving what reasonably lies ahead. Preliminary works already demonstrate that incorporating LLM-based context-awareness into Vehicle-to-Everything (V2X) planning can benefit the actions and derived consequences. However, this creates a significant and underexplored security vulnerability. In LLM enabled V2X communication, we validate message origin and physical plausibility through a layered architecture that fuses cryptographic authentication with kinematic misbehavior detection. These layers indicate who sent a message and its physical possibility, but neither looks at what a message means semantically. This architectural design creates a gap by eliminating the need for content validation of V2X payloads, which are introduced directly into LLM prompts without checks or censors. In this paper, we empirically simulate prompt-injection attacks from V2X message free-text fields for LLMs used in autonomous vehicles. We develop a taxonomy of three attack classes Override Injection, Suppression Injection, and Phantom-Obstacle Injection, all carrying spoofed, simulated signals in the form of Basic Safety Messages (BSM), Traveler Information Messages (TIM), and Local Dynamic Map (LDM). We measure evasion rates against signature verification and a kinematics-only Misbehavior Detection Systems (MBDS) using Monte Carlo experiment involving three attacker classes with 27,000 trials. The results demonstrate that attackers can gain access to the LLM input stage with valid credentials in 92% of cases across each attacked message type and channel, without detection. Our experiments reveal a fundamental weakness in V2X security, which escalates with the introduction of LLMs to the autonomous driving pipeline.