You know how a strobe light at a concert makes dancers look frozen — your eyes catch them in one flash, miss them in the dark gap, and your brain stitches together something that doesn't match reality? Temporal HDR cameras do the same thing, but with less skepticism. They snap multiple exposures at different brightness levels, then fuse them into one image, trusting that the scene didn't change between shots. FLASH (Fusion-Level Attack by Saturating HDR) deliberately breaks that trust by pulsing a light source so that some brackets get blasted with photons while others don't, creating contradictory evidence that the fusion algorithm can't reconcile. The result: the camera's own software darkens, overexposes, or erases parts of the scene. The committed claim is straightforward and well-scoped: temporal HDR fusion pipelines contain a fundamental, exploitable assumption — scene stability across exposure brackets — and an external attacker can violate it without touching the camera, knowing the fusion algorithm, or phase-locking to the shutter. This isn't a sensor-blinding laser attack or a hardware exploit. It's an algorithmic-assumption attack, which is a meaningfully different category. The breadth of hardware tested is the paper's strongest card. Eight physical camera platforms spanning embedded (Arducam), surveillance (Wyze Battery Cam Pro), smartphone (iPhone 16 Pro), photography (Sony A7R III), and automotive (comma.ai's OpenPilot with OAK-1 Lite) all exhibit the effect. The iPhone 16 Pro showed extreme darkening in 50% of frames; the Wyze camera hit 33.7% and triggered its own low-visibility alert in 10/10 FLASH trials versus 0/10 for continuous-light and randomized-frequency controls. These aren't cherry-picked demos — the controls are matched and the failure modes are pipeline-specific, which tells you the vulnerability is real and generalizable. The automotive case study is where the stakes sharpen. In a controlled stationary OpenPilot setup, 23% of frames showed severe darkening in the target region (traffic cones), with contrast-to-noise ratio dropping by up to 90.8%. The OpenPilot interface failed to display path state during FLASH that it displayed in control trials. This isn't a full driving scenario — the authors are careful to note it's stationary and controlled — but the signal is clear: if your self-driving stack depends on HDR fusion for night visibility, FLASH degrades the input before any neural network even sees the frame. Integrity is solid for a security paper. Physical experiments on real hardware, matched optical controls (continuous light, randomized frequency), and quantitative metrics (brightness deviation, CNR, extreme-darkening rates) all ground the claims. The proof-of-concept defense — an exposure-rejection filter that reduces median brightness deviation by 79.16% — is honest: it works in a controlled HDR reconstruction stress test, not in a deployed pipeline. The authors don't oversell it. The ladder position is interesting. Prior work on camera attacks (Rolling Shutter attacks, laser dazzling, adversarial patches) targets different layers of the imaging stack. FLASH is the first to specifically target the fusion step in temporal HDR as an algorithmic vulnerability class. There's no direct SOTA to beat because nobody was attacking this layer. The contribution is opening the attack surface, not outperforming a prior attack. What's missing is the moving-vehicle test and the adversarial-ML integration. The automotive demo is stationary. The defense is proof-of-concept. The obvious next experiment — mount FLASH on a roadside and run OpenPilot through a real driving scenario — wasn't done. Honest read: ethics and safety constraints prevented it, and possibly also the difficulty of synchronizing attack timing with a moving vehicle's variable HDR cadence. That's the experiment that would convert this from 'interesting vulnerability disclosure' to 'urgent recall-level finding.'
