Timing-Aware Perception Manipulation of Human-Supervised Drones: A Recovery-Window Model and a Closed-Loop Point of No Return

Adversarial manipulation of perception is usually scored per frame by an adversarial success rate (ASR). For a remotely supervised drone this is insufficient: a manipulation is dangerous when neither the modeled remote-human path nor the onboard autonomous response can complete an avoidance maneuver before the point of no return. We shape the detector’s confidence-versus-range profile so that it stays normal and then collapses at a chosen range, and we judge it by the recovery window it leaves. We contribute a recovery-window model, a PX4 software-in-the-loop (SITL) closed-loop testbed, and a calibration showing that braking is limited by the autopilot’s tilt limit (peak deceleration about 9.5 m/s2) and by an effective control-response lag of about 0.8 s that the idealized model omits. In 160 simulated flights, a 30 m gate defeats the modeled remote-human path above roughly 9–12 m/s, while the onboard response recovers into the mid-teens. Fifty repeated flights at the ten cells next to the recovery boundaries reproduced the original outcome in every case. A stopping model fitted only to calibration flights predicts 157 of 160 outcomes and shows that this ordering persists across braking authority, camera geometry, link latency, and operator latency. Per-frame ASR can rank severity opposite to recovery. A static patch, re-optimized five times independently, reproduces the profile on held-out cars; its collapse transfers to a second YOLO detector, but its timing does not transfer to a transformer detector, and its collapse range of about 33 m depends on the assumed camera.