Protocol: Robust compared to whom? A systematic review of physical-world adversarial attacks on automated vehicle perception, judged against a human-driver baseline

Protocol (version 1.0) for a systematic review of physical-world adversarial attacks on the perception of automated vehicles, judged against a human-driver baseline. It follows PRISMA-P 2015 and fixes the review methods before screening begins. Status at deposit. The database searches ran from 28 October to 5 November 2026, so that the strings could be tested against a validation set; all 10 known studies were retrieved. No record had been screened when this protocol was deposited. Contents. Review questions and PICOC frame; eligibility criteria; information sources and search strategy (IEEE Xplore, Scopus, ACM Guide to Computing Literature, TRID, arXiv and hand-searched security programmes); selection process; data items and outcomes; quality appraisal; synthesis without meta-analysis (SWiM); confidence in findings; PRISMA-P 2015 checklist. Supplementary record. Every search string as run, with its date and record count: https://doi.org/10.5281/zenodo.24056184 Author: Samiur Rahman, University of Gloucestershire. Second reviewer: Afrin Nahar. The review is unfunded.