Abstract:Integrated sensing and communication (ISAC) emerged as a key feature of next-generation 6G wireless systems, allowing them to achieve high data rates and sensing accuracy. While prior research has primarily focused on addressing communication safety in ISAC systems, the equally critical issue of sensing safety remains largely ignored. In this paper, a novel threat to the sensing safety of ISAC vehicle networks is studied, whereby a malicious reconfigurable intelligent surface (RIS) is deployed to compromise the sensing functionality of a roadside unit (RSU). Specifically, a malicious attacker dynamically adjusts the phase shifts of an RIS to spoof the sensing outcomes of a vehicular user (VU)'s echo delay, Doppler shift, and angle-of-departure (AoD). To achieve spoofing on Doppler shift estimation, a time-varying phase shift design on the RIS is proposed. Furthermore, the feasible spoofing frequency set with respect to the Doppler shift is analytical derived. Analytical results also demonstrate that the maximum likelihood estimator (MLE) of the AoD can be significantly misled under spoofed Doppler shift estimation. Simulation results validate our theoretical findings, showing that the RIS can induce a spoofed velocity estimation from 0.1 m/s to 14.9 m/s for a VU with velocity of 10 m/s, and can cause an AoD estimation error of up to 65^{\circ} with only a 5^{\circ} beam misalignment.