Every AI component in the ship's stack is an attack surface. The camera that detects vessels can be fooled by adversarial imagery; the anomaly detector that flags spoofed AIS can be trained to ignore a real spoof; the classifier that reads navigation lights can be perturbed into misreading. This is not hypothetical paranoia — it is the known vulnerability profile of the entire class of models maritime AI is built on.
The maritime-specific literature is younger than the attack surface. This article maps what's demonstrated, what generalises from terrestrial work, and what the defences look like aboard a ship.
Key findings
- Adversarial examples — small, targeted perturbations that fool ML — are a demonstrated, well-characterised property of deep models; maritime models are not exempt. Established
- The maritime literature is thin: most work is lab-scale, on limited datasets, against standard models — real-world transfer aboard is not demonstrated. Established
- The most tractable maritime attack vectors are on the radio layer (AIS/GNSS manipulation) rather than the physical camera. Maritime-GPT analysis
- Defences are the same as anywhere: adversarial training, input sanitisation, ensemble/redundancy, and — critically aboard — the fusion cross-check. Research demonstration
- The high-consequence case is a spoof that defeats the detector meant to catch it — adversarial attacks on the anomaly detectors themselves. Maritime-GPT analysis
What an adversarial attack is, at sea
The canonical adversarial attack adds a small, invisible perturbation to an input that changes the model's answer while leaving the human's view unchanged. Aboard a ship the corresponding attacks are: physically perturbing a camera's view (a light pattern, a projected image), digitally perturbing a stored or replayed feed, or — most tractably — manipulating the radio/telemetry layer where inputs are already adversarial. AIS and GNSS spoofing (covered in our companion piece) are adversarial attacks on the perception stack's inputs; adversarial ML is the broader family. Maritime-GPT analysis
What's demonstrated vs generalised
- <strong>Demonstrated in ML generally:</strong> small perturbations reliably fool vision classifiers, object detectors, and anomaly detectors on land benchmarks. Established
- <strong>Maritime-specific work:</strong> published attacks on AIS-anomaly detectors, spoofing detectors, and ship classification models — mostly on the same small public datasets the defences train on. Research demonstration
- <strong>Transfer to the field:</strong> real-world physical attacks (printed perturbations, transmitted signals) are much harder than digital ones — the maritime evidence for field-deployable attacks is sparse. Established
- <strong>The meta-attack:</strong> fooling the <em>detector of attacks</em> — an adversary who knows the anomaly detector's boundaries crafts traffic just inside them. This is the highest-consequence and least-studied case. Maritime-GPT analysis
Where the ship is weakest
The vulnerability ranking is roughly inverse to how much the channel is physically secured. The camera's optics are hard to perturb without access; the radar is hard to deceive at scale; but the <em>network layer</em> — the AIS feed, the sensor bus, the shore link — is routinely reachable. The honest threat model puts most of the adversarial risk on the data channels and the detectors watching them, not on a hypothetical sticker on the horizon. Maritime-GPT analysis
The defences that matter aboard
- <strong>Redundancy as defence.</strong> The fusion architecture is itself an adversarial mitigation — a spoof that fools AIS must also fool radar and camera to be believed. Maritime-GPT analysis
- <strong>Adversarial training.</strong> Exposing the model to perturbed examples during training — standard practice, partial protection. Research demonstration
- <strong>Input validation.</strong> Physical-plausibility checks (a ship cannot teleport) are the simplest and most effective defence on the radio layer. Established
- <strong>Detection-of-the-detector.</strong> Monitoring the anomaly detector's own behaviour for signs it's being probed or evaded. Maritime-GPT analysis
What we know
- Adversarial vulnerability is a property of the model class, not a maritime exception.
- Maritime attack surfaces concentrate on the radio/network layer where inputs are already contested.
- Fusion redundancy is the most practical aboard defence — an attacker must fool multiple modalities.
What we don't
- Published evidence of physical adversarial attacks succeeding on a real vessel's perception stack.
- How transferable lab perturbations are to a real, noisy, marine environment.
- Whether production maritime AI has any adversarial robustness evaluated at all.
Being tested
- Adversarial training on maritime datasets.
- Physics-constrained attack models for AIS/GNSS.
- Certified-robustness approaches for safety-critical maritime ML.
Maritime-GPT analysis
The honest concern isn't that a hologram will fool the camera — it's that the anomaly detector meant to catch a spoof is itself a model that can be fooled. Adversarial risk aboard is real but narrower than the hype: concentrated on contested data channels and the detectors watching them, mitigated by the fusion architecture the safety case already requires, and largely undemonstrated on a real ship. Threat-model the radio layer first. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The foundational adversarial-examples paper — the class of vulnerability maritime ML inherits.
The canonical explanation of why the attack class exists.
The compliance frame any maritime AI defence must satisfy.
The radio-layer attack family adversarial ML extends.