AI Safety · TAMU · 2026

Can a drone detect
when it's being lied to?

We built an unsupervised anomaly detector using JEPA — Joint Embedding Predictive Architecture — that learns what normal drone telemetry looks like, then flags tampering it's never seen before.

▶ Watch Demo ↓ Download Models Open in Colab

0.808

AUC Score

56%

Recall

6.2%

False Alarm Rate

+28%

vs Baseline

0 labels

Attack Labels Used

01 — The Problem

When sensor data becomes a weapon

Modern drones rely on telemetry — accelerometer, gyroscope, GPS, and barometer readings — to operate safely. If an attacker tampers with these signals, the drone can be hijacked, crashed, or redirected without the operator knowing anything is wrong.

The hard part: you can't collect every possible attack in advance. Attackers adapt. A model trained on yesterday's attacks won't catch tomorrow's. The solution is to flip the problem — instead of learning what attacks look like, learn what normal looks like, and flag everything else.

Live telemetry stream — 11 sensor channels

Sensor Input

11 telemetry features per timestep, chunked into windows

JEPA Encoder

Compresses into 384-dim embedding, trained on normal only

LOF Detector

Scores each embedding by local density vs neighbors

Alert

Threshold triggers anomaly flag if score ≥ 1.2534

02 — Architecture

JEPA: predict to understand

Joint Embedding Predictive Architecture works by masking random portions of the input and learning to predict the masked content — not in pixel or feature space, but in embedding space. This forces the model to build abstract, semantic representations rather than memorising surface patterns.

JEPA v3 configuration: encoder hidden layers at 1024 → 768 → 384, adaptive masking between 12–72%, cosine learning rate schedule, 140 epochs. The deeper encoder forces richer representations than earlier versions.

embedding_dim: 384

encoder_hidden: [1024, 768, 384]

predictor_hidden: [512, 256]

min_mask_ratio: 0.12

max_mask_ratio: 0.72

epochs: 140

lr_schedule: cosine

03 — Experiments

225 configurations, one winner

We froze the JEPA checkpoint and swept over detector hyperparameters. Each configuration was scored on a composite metric penalising false alarms: 1.4×AUC + 1.9×Recall + 0.25×F1 − 3.0×max(0, FAR−0.20).

Phase 1

Isolation Forest — Fast Loop

2.04 composite score

Broad sweep over n_estimators and contamination. FAR cap: 12%.

Phase 2

JEPA v3 + IF Relaxed

2.21 composite score

Freshly retrained JEPA v3. FAR cap relaxed to 20% to prioritise AUC+Recall.

Phase 3

Ensemble IF + LOF

2.39 composite score

Combined Isolation Forest and LOF scores. Better but tuning overhead high.

★ Winner

LOF Refinement — Cell 62

2.60 composite score

PCA(130) + Manhattan + k=21. 225 configs swept. +28% over baseline.

Manhattan distance outperformed Euclidean and Cosine consistently across all PCA dimensions — absolute feature differences are a better signal for telemetry anomalies than geometric distance.

Why LOF beats Isolation Forest here: Isolation Forest assigns anomaly scores globally by how easily a sample can be isolated. LOF is density-based — it compares each sample's local neighbourhood density to its k nearest neighbours. For drone telemetry where normal flight has highly structured local clusters in embedding space, LOF captures subtle deviations that IF misses.

04 — Results

Tested on attacks it's never seen

Three test splits — balanced, strong, and subtle attacks. Subtle attacks are small, deliberate perturbations designed to evade detection. The model was trained on zero attack samples.

Split

AUC

Recall

FAR

test_balanced

0.8078

0.5602

0.7105

0.0620

test_strong

0.7602

0.5072