Abstract
Modern vehicles are distributed embedded computing platforms whose expanding network connectivity-CAN bus, Bluetooth, cellular telematics, and over-the-air (OTA) update channels-exposes them to the same class of adversarial attacks studied in cloud and enterprise environments. Machine learning (ML)-based intrusion detection systems (IDS) have emerged as the primary defensive response, yet these models are themselves vulnerable to adversarial perturbation: a well-crafted malicious CAN frame can evade an ML-based IDS in the same way that an adversarial image patch fools a computer-vision classifier. This paper traces the threat landscape from foundational automotive attack-surface studies through contemporary adversarial ML research, examines how resource-constrained embedded platforms limit defensive options, and proposes a defense architecture that combines behavioral anomaly detection with zero-knowledge proof (ZKP) attestation for invehicle control units. We argue that ZKP-based component attestation-previously dismissed as computationally impractical for embedded systems-is now feasible given recent advances in succinct non-interactive arguments of knowledge (SNARKs), and that combining it with adversarially trained ML-IDS models yields defensein-depth that addresses both network-layer and hardware-layer attack vectors.