Security · 16 min read
We Attacked Our Own Drones 11,340 Times. Here's What We Learned.
October 22, 2025
None of the attacks worked — not the way you'd expect.
Over several weeks, we ran 11,340 simulation trials against our autonomous warehouse-search drone stack. We hit it with GNSS spoofing, RF jamming, proportional-navigation interceptors, and direct control takeover. Varied seeds, tasks, defense configurations. Tracked every trial.
The headline result: no attack degraded mission success rate beyond the 95% confidence interval. One attack even inflated it. If you stopped reading here, you'd conclude our drones are basically impervious to adversarial interference. That conclusion would be wrong — and the gap between what the numbers say and what they mean is exactly why we're writing this.
Mission Success Rate Is the Wrong Metric for C-UAS
This is the central finding. Every attack profile we tested returned a mission success rate within the confidence interval of baseline (57.6% ±6.7 pp). GNSS walk-off: +1.2 pp. RF jamming: 0.0 pp. PN interceptor: 0.0 pp.
Control takeover improved success rate by +8.1 pp. The attacker's redirect goal happened to sit closer to the mission target in ~8% of trials. The drone got hijacked and accidentally completed more tasks.
None of this means the attacks did nothing. It means mission success rate doesn't capture what C-UAS threats actually do. The right metrics are physical: capture percentage, maximum position error, detection latency, minimum miss distance.
What the Four Attack Types Actually Do
GNSS Walk-Off
Smooth-capture spoofing: position blends from true toward attacker-controlled offset over 5 seconds. Velocity is left untouched — preserving the IMU signal that enables dead-reckoning detection. Physical result: 5.14 m mean maximum position error under single-axis walk-off. Combined with RF jamming: 7.95 m.
RF Jamming
Packet loss (0.5–0.9) and latency (0.2–0.8 s) injected into the communication channel. Produces no measurable change in single-drone mission success. The jam failsafe — RTL on 3 s of neighbor silence — returns 0.0% false positives on clean baseline.
Control Takeover
Direct override of action.target_position. The goal-bounds defense (reject targets outside ±30 m geofence) stops this completely. False positives on clean baseline: 0.0%.
Why PN Interceptors Are the Real Threat
Proportional-navigation guidance (N=3.5, v_max=8 m/s, net capture radius 1.5 m) achieves a 79.5% capture rate with no defense active. Minimum miss distance: 0.11 m. When RF jamming is layered on: capture rate still 79.5%. Physical interception geometry is not sensitive to communication degradation.
This is the metric that matters. A 79.5% probability your drone gets physically removed from the air in a single engagement is operationally decisive. No mission success rate figure captures that.
Defenses: What Works
Plausibility detection: dead-reckoning vs. GPS position; flag when divergence >3 m. Under single walk-off: 39.8% TP. Under combined GNSS+RF jam: 79.5% TP(the jam forces faster spoofing, making detection easier). False positives on clean baseline: 0.0%.
Critical implementation lesson: the DR integrator must use elapsed wall time between controller calls (2 s), not the physics timestep (0.05 s). Using 0.05 s produced a 75.8% false-positive rate. This is an easy bug to introduce in any system where physics dt differs from control rate.
All defenses stacked: 0.0% FP on clean baseline, +1.9 pp mission success overhead. Properly tuned defenses impose no operational cost.
The Fidelity Boundary
Reliably testable in kinematic sim: GNSS position error, PN capture geometry, control takeover, jam failsafe, plausibility detection, goal-bounds enforcement.
Not testable without hardware or RF simulation: carrier-phase GPS, RAIM, Galileo OSNMA authentication (operational since July 2025), barrage vs. reactive jamming physics, EKF lock-pull, camera/radar interception detection, aerodynamic evasion effectiveness.
The evasion defense triggered at 0% — not because evasion is ineffective, but because interceptors are not inserted into the drone's onboard sensor list in the current harness. That is a simulation fidelity gap, not a finding about evasion.
Practical Takeaways
- Don't use mission success rate as your primary C-UAS metric. Track capture rate and position error separately.
- PN interceptors are your highest-priority threat — 79.5% capture against non-maneuvering drones.
- Plausibility detection is deployable today at 0% FP if you use the right clock.
- Goal-bounds enforcement stops control takeover with zero performance cost.
- Jam failsafe (RTL on link silence) should be standard firmware on every drone.
- Update your GNSS threat model for OSNMA — capable adversaries now layer RF denial on top of spoofing.
Full paper with methodology and all tables: research: C-UAS study.
Technical paper
Counter-UAS Attack and Defense Characterization in Autonomous Drone Swarms: A Kinematic Simulation Study
Technical report
TL;DR
- 11,340 seeded trials across 4 attack classes and 6 defenses in a 4-drone warehouse swarm.
- Mission-success rate is the wrong primary C-UAS metric — physical effects are measurable even when task completion is unaffected (79.5% PN capture, 5–8 m position error).
- A kinematic plausibility detector achieves 39.8% true-positive rate at 0% false positives.
| Seeded trials | 11,340 |
|---|---|
| Attack classes | 4 |
| Matched defenses | 6 |
| PN capture rate | 79.5% |
| Detector | 39.8% TP @ 0% FP |
Abstract
11,340 seeded trials across four attack classes (GNSS spoofing, RF jamming, kinetic interception, control takeover) and six matched defenses in a four-drone warehouse swarm. Central finding: mission success rate is the wrong primary metric for C-UAS — physical effects (79.5% PN capture rate, 5–8 m position error) are clearly measurable even when aggregate task completion is unaffected. A kinematic plausibility detector achieves 39.8% TP at 0% false-positive rate. Includes an explicit fidelity boundary analysis delineating what kinematic simulation can and cannot faithfully reproduce.
Counter-UAS research has a measurement problem. The natural metric for evaluating an autonomous swarm — mission success rate — turns out to be almost useless for characterizing attack severity. This paper documents why, and what to measure instead.
The measurement problem
Suppose you inject a GNSS spoofing attack into a four-drone warehouse swarm. One drone flies to the wrong location. The other three compensate dynamically — redundant coverage, rerouted task assignments. Mission success rate: 94%. Does that mean the attack failed? No. A drone flew to the wrong place. That is an exploitable physical effect, and mission-success rate hid it.
This is the problem across all four attack classes we study: GNSS spoofing, RF jamming, kinetic interception, and control takeover. Swarm redundancy is a feature for resilience and a bug for C-UAS measurement — it absorbs attacks at the mission level while the physical effects of those attacks remain clearly measurable.
Experimental setup
11,340 seeded trials. Four attack classes, six matched defenses, run in a four-drone warehouse swarm with controlled task load. Seeded design means each trial has a fixed random seed, so we can compare attack vs. no-attack on identical swarm trajectories. This controls for the variance in swarm behavior that would otherwise obscure small attack effects.
The swarm performs a coverage task: inspect every zone in the warehouse. We measure mission success (did it cover everything?), time to completion, and — critically — the physical traces of each attack type.
Physical-effects metrics
For each attack class, we track the metric that directly captures the attack's physical signature:
- GNSS spoofing: position error — how far did the affected drone fly from its intended location? Median: 5–8 m under active spoofing.
- Kinetic interception: proportional navigation (PN) capture rate — what fraction of intercept attempts achieved physical proximity? 79.5% in our trials.
- RF jamming: control latency and packet loss rate during jamming windows.
- Control takeover: trajectory divergence from intended path post-takeover.
Kinematic detection
We also evaluate a passive kinematic plausibility detector — a module that watches each drone's trajectory and flags motion that is inconsistent with normal navigation physics (impossible accelerations, heading reversals inconsistent with the task, velocity spikes above the flight controller's limits).
The detector achieves a 39.8% true-positive rate at a 0% false-positive rate. That is not a high detection rate. But it is a 0% FP rate, which means every flag the detector raises is a real anomaly. In a security context, 0% FP is often more operationally useful than higher TP with non-zero FP — a system operator can act on every alert without alert fatigue.
Fidelity boundary
We include an explicit fidelity boundary section that delineates what kinematic simulation can and cannot faithfully reproduce for C-UAS work. RF propagation, antenna patterns, and electronic warfare effects are not modeled. The kinematic outcomes (trajectory under attack, physical interception geometry) are modeled. Readers should weight the RF-jamming results less heavily than the kinetic and GNSS results.
Full discussion in the companion blog post: We attacked our own drones 11,340 times.