KineGuard: An Exogenous Kinematic Gatekeeper Against Feature-Space Illusion and Slow Drag-Off Attacks on Visual-Inertial UAV Navigation.

Unmanned aerial vehicles (UAVs) that operate in GNSS-denied environments increasingly rely on visual-inertial odometry (VIO) and visual-inertial simultaneous localization and mapping (V-SLAM), fused into the autopilot's extended Kalman filter (EKF) as an external position and velocity source. The autopilot implicitly trusts this source: the only barrier between a corrupted visual estimate and the flight controller is the EKF's normalized innovation squared (NIS) gate, a consistency test that was designed to reject random outliers, not an adaptive adversary. This paper characterizes feature-space illusion attacks, in which an adversary manipulates the optical scene so that the visual front-end produces geometrically self-consistent but false motion, and slow drag-off attacks, in which the injected error grows slowly enough that every innovation remains inside the NIS gate while the filter absorbs the discrepancy into its inertial-measurement-unit (IMU) bias states. We present the KineGuard Gatekeeper, a ROS 2 abstraction layer of four nodes interposed between the sensors and the PX4 autopilot. KineGuard audits the visual-SLAM (V-SLAM) solution against an exogenous kinematic reference obtained by exact discrete double integration of raw IMU specific force over a 1.0-second sliding window, using static calibrated biases and a velocity seed drawn from a source independent of the visual pipeline. Divergence is scored by a Dynamic Variance Divergence Coefficient $D_{v}$, the norm of the visual-inertial displacement residual over the window, against a bound scheduled on angular rate. On violation, KineGuard severs the visual channel to the autopilot, latches a zero-trust state, and commands a deterministic fail-soft to altitude-control (ALTCTL) flight, confirmed through both the command acknowledgment and the reported navigation state. Three hardening mechanisms close attack paths that a naive design leaves open: a 500 ms fail-closed monitoring lease against data denial, multi-axis yaw validation on timestamp-aligned quaternions, and independent velocity seeding that prevents a constant-velocity spoof from cancelling to zero. We give the threat model, the estimator-level mechanics of the attacks, the implemented detection and fail-soft logic with its default parameters, an analytical treatment of detectability, and a software-in-the-loop evaluation that drives the unmodified node code with synthetic sensor streams on ROS 2 Jazzy in a virtualized cloud container; no physical hardware, hardware-in-the-loop, or flight tests were performed. With a start-up grace period, KineGuard raised no false isolation in 372 s of simulated benign flight that included aggressive maneuvering. It isolated a $1~m/s$ constant-velocity spoof in about 0.5s, a 0.6 m position step within one result period, and loss of the visual stream in 0.47s, with latencies that follow the analytical model. The evaluation also found that the shipped configuration never opens the visual gate, because the 500 ms start-up lease expires before the first 1.0 s window can complete.