Advanced Seminar Embedded Systems and Internet of Things
We will announce the available topics and the application process on the 07th of September 2026. You will then be able to apply for a seminar topic until the 07th of October 2026 (23:59 pm).
It is mandatory to attend all the lectures of our Advanced Seminar in presence to complete the course successfully. Virtual Attendance is not possible.
Application Process
Topics are assigned in a match-making process in the kick-off meeting (14.10.2026). But if you are interested in a topic below, you have the possibility to pre-register. For this case, please send your application together with your CV and your transcript of records to seminar.esi@xcit.tum.de. Express your interest and explain why you want to have that specific topic and why you think that you are most suitable for the topic. This allows us to choose the most suitable candidate for the desired topic to maximize the seminar's learning outcome and to avoid dropouts.
Deadline for the pre-registration: We encourage you to apply until the 05.10.2026.
Mandatory participation in the kick-off seminar: Indepdent whether you pre-register or participate in the match-making process, you will be registered to the seminar course by the Advanced Seminar Manager after the Kick-Off meeting on 14th of October.
Kick-off meeting
This semester the seminar will be conducted in physical mode. This means that you must join the physical classes and presentation which you will find on the Moodle page. Additionally, you can schedule meetings with your supervisor via Teams or on campus. Lecture materials will be available on Moodle.
The kick-off meeting will be on the 14th of October at 9:45 on Campus (ESI Gallery - Room 4959). Please notify us in case you can not make it to the meeting, otherwise we will assume that you are no longer interested and give your place to another applicant.
Topics
- Physics-Based Forensic Analysis of LiDAR Point Clouds
Digital images carry traces of their acquisition pipeline, such as PRNU sensor noise and compression artifacts, which forensic methods exploit to verify authenticity and attribute images to a specific camera [1]. LiDAR point clouds carry analogous traces. Blooming around highly reflective targets, dead time following each detection in single-photon (SPAD) detectors, and saturation under strong returns all result from the physical interaction between emitted light and the sensor [2].
This seminar topic investigates whether such physical artifacts can serve two forensic purposes: (i) as a proof of reality, attesting that a measurement originates from light reaching the detector rather than from injected points, and (ii) as a device fingerprint, distinguishing individual sensors by their characteristic artifact behavior.
[1] P. Korus and J. Huang, “Multi-scale fusion for improved localization of malicious tampering in digital images,” IEEE Transactions on Image Processing, vol. 25, no. 3, pp. 1312–1326, 2016.
[2] D. Scheuble, H. Holzhüter, S. Peters, M. Bijelic, and F. Heide, “Lidar waveforms are worth 40x128x33words,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 28913–28924, 2025.
Supervisor: Marco Calipari
- Exploring AI-Agent Driven ZK-Circuit Design
Zero-Knowledge (ZK) proofs are a powerful cryptographic tool, but transitioning them from theory to practical applications begins with a challenging step: arithmetization. This process transforms a program into an Arithmetic Circuit (also known as a ZK-Circuit), which can then be verified using ZK proofs.
However, designing these circuits is often complex, error-prone, and requires low-level operations, making it a significant barrier for developers. With the emergence of Large Language Models (LLMs) and General Purpose AI Agents, there is growing potential to automate and simplify this process. In this seminar project, the student will: Investigate how AI agents can assist in the design of ZK-Circuits. Explore existing tools and frameworks that integrate AI with ZK proof systems. Benchmark AI-assisted circuit generation against traditional methods and models. Evaluate the accuracy, efficiency, and usability of AI-driven approaches.
Literature:
[1] https://hackmd.io/@jake/plonk-arithmetization
[2] https://learn.0xparc.org/materials/circom/additional-learning-resources/r1cs%20explainer/
[3] https://tlu.tarilabs.com/cryptography/rank-1
[4] https://zcash.github.io/halo2/
[5] https://arxiv.org/abs/2407.01502
[6] https://dl.acm.org/doi/full/10.1145/3655615
Supervisor: Marco Calipari
- Deterministic Converged Satellite Communication
Deterministic Converged Satellite Communication refers to the integration of satellite networks (such as LEO constellations) with terrestrial and aerial communication systems to provide predictable, bounded-latency, and ultra-reliable communication services. Deterministic satellite communication aims to offer strict delay, jitter, and reliability guarantees suitable for mission-critical applications such as autonomous systems, military coordination, industrial control, and remote robotic operations. In this seminar topic, the student will understand the end-to-end deterministic communication requirements in a converged satellite communication system. The focus will be primarily on deterministic routing and scheduling in large scale satellite networks.
Literature:
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10843333
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11161661
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11017403
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11223261
Supervisor: Rubi Debnath
- Agentic AI for computer networks
Agentic AI is envisioned to enable self-optimizing, self-healing, and self-evolving communication systems that dynamically adapt and operate autonomously. In this seminar, the student will investigate the role of Agentic AI in modern and future communication systems, particularly in 5G and emerging 6G networks. The student should review related documents, AI-native network architectures, as well as multi-agent and multi-LLM systems in computer networks. The student will further compare centralized AI with distributed agent-based systems and evaluate agent-based 5G and 6G architectures. The seminar will begin with an examination of the requirements and architectural principles of Agentic AI, including relevant mathematical formulations, followed by an analysis of its integration into 5G, 6G, and broader computer network environments.
Literature:
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11339915
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11152698
https://arxiv.org/pdf/2502.16866
https://arxiv.org/pdf/2510.19973
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11370176
https://arxiv.org/pdf/2601.06640
Supervisor: Rubi Debnath
- Deterministic 6G Communication
This seminar topic focuses on the design and analysis of deterministic 6G communication systems operating under adversarial network conditions such as jamming, interference, and mobility-induced instability. The emphasis of this topic is on strict performance guarantees, including bounded end-to-end latency, jitter control, and guaranteed packet delivery, even in hostile or highly dynamic environments. The topic explicitly excludes time synchronization aspects and instead concentrates on scheduling, resource allocation, routing, and resilience mechanisms that preserve deterministic performance. The student will begin with the foundational concepts of 6G by reading white papers and related publications, followed by wireless delay modeling, adversarial communication scenarios, performance analysis, and deterministic scheduling under adversarial load.
Literature:
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10254227
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11103479
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10945893
https://arxiv.org/pdf/2602.21444
Supervisor: Rubi Debnath
Status: Reserved
- Interoperable Collaborative Augmented Reality
In collaborative Augmented Reality (AR) several users and devices work together in a shared space. A requirement for this is, that the devices agree e.g. on a common spatial reference frame and on a consistent shared view on the virtual content. Currently, this is achieved almost exclusively within a single vendors ecosystem.
In this seminar, the student shall survey how existing collaborative AR systems establish, represent and discover that shared spatial reference.
Based on this survey, the student analyses what information devices would need to exchange for vendor-independent collaboration, and assesses to what extent existing standardized description formats, for example OGC GeoPose, OpenXR, or the W3C Web of Things Thing Description, cover these requirements
References:
B. Marques, S. Silva, J. Alves, T. Araújo, P. Dias and B. S. Santos, "A Conceptual Model and Taxonomy for Collaborative Augmented Reality," in IEEE Transactions on Visualization and Computer Graphics, 2022, doi: 10.1109/TVCG.2021.3101545.
S. Käbisch, M. McCool, and E. Korkan, “Web of Things (WoT) Thing Description 1.1,” https://www.w3.org/TR/wot-thing-description11/, 2023.
The Khronos Group, "The OpenXR™ Specification, Version 1.1.x," Khronos OpenXR Working Group, 2026. [Online]. Available: https://registry.khronos.org/OpenXR/specs/1.1/html/xrspec.html.
Supervisor: Roman Binkert
- Representing and Accessing Historical Sensor Data in the Web of Things
The W3C Web of Things Thing Description provides a unified way of defining how to interact with heterogeneous devices, for example, how to read and interpret a sensor value.
Many applications also need access to past values of this sensor, which constrained devices can neither store nor serve themselves.
In this seminar, the student should investigate how existing approaches in the IoT and Semantic Web literature represent historical values, how, in which structure and where this data is stored and what this implies for heterogeneous sources.
Finally, the student should investigate how a client can discover, that historical data is available for a device.
References:
Krzysztof Janowicz, Armin Haller, Simon J.D. Cox, Danh Le Phuoc, Maxime Lefrançois, "SOSA: A lightweight ontology for sensors, observations, samples, and actuators", Journal of Web Semantics, https://doi.org/10.1016/j.websem.2018.06.003.
S. K. Jensen, T. B. Pedersen and C. Thomsen, "Time Series Management Systems: A Survey," in IEEE Transactions on Knowledge and Data Engineering, 2017, doi: 10.1109/TKDE.2017.2740932.
H. Xu, J. Wu, Q. Pan, X. Guan and M. Guizani, "A Survey on Digital Twin for Industrial Internet of Things: Applications, Technologies and Tools," in IEEE Communications Surveys & Tutorials, 2023, doi: 10.1109/COMST.2023.3297395.
S. Käbisch, M. McCool, and E. Korkan, “Web of Things (WoT) Thing Description 1.1,” https://www.w3.org/TR/wot-thing-description11/, 2023.
Supervisor: Roman Binkert
Status: Reserved
- Analysis of Physical Adversarial Attacks against Vision Language Models
Autonomous vehicles rely on cameras and other perception sensors to perceive and interpret their environment, enabling tasks such as object detection, traffic sign recognition, and decision-making. In recent years, Vision Language Models (VLMs) have emerged as a powerful AI paradigm that combines visual understanding with natural language reasoning, allowing vehicles to interpret complex scenes and respond to high-level instructions. By integrating visual perception with semantic reasoning, VLMs promise to enhance the robustness and flexibility of autonomous driving systems. However, the increasing reliance on these models also introduces new security challenges. One particularly concerning threat is the use of physical adversarial attacks, in which carefully crafted real-world modifications, such as stickers, patches, or altered traffic signs, can manipulate a model's perception and reasoning. Unlike digital attacks, these perturbations remain effective when viewed through cameras under real-world conditions. In this seminar topic, analyzing physical adversarial attacks against VLMs is crucial for understanding their vulnerabilities and ensuring the safe deployment of future autonomous systems.
Literature:
- K. Eykholt et al., “Robust physical-world attacks on deep learning visual classification,” in 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018.
- O. Vinyals, A. Toshev, S. Bengio, and D. Erhan, “Show and tell: A neural image caption generator,” in 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015.
- Q. Guo et al., “PhysPatch: A physically realizable and transferable adversarial patch attack for multimodal Large Language Models-based autonomous driving systems,” arXiv [cs.CV], 2025.
- X. Zhou et al., “Vision language models in autonomous driving: A survey and outlook,” IEEE Trans. Intell. Veh., pp. 1–20, 2025.
Supervisor: Michael Kühr
- Modeling of LiDAR data using EMVA1288
Modern autonomous systems rely on a variety of perception sensors, such as LiDARs or cameras, to understand and interact with their environment. While cameras provide visual information, LiDAR sensors offer accurate three-dimensional measurements of distances and object geometry. For camera systems, the EMVA 1288 standard is a widely accepted framework for objectively characterizing sensor performance, enabling reproducible comparisons between different imaging devices. LiDAR sensors are also optical perception sensors, but operate as actively emitting sensors. As LiDAR technologies continue to diversify, ranging from mechanical scanning systems to flash LiDARs, the need for standardized performance evaluation becomes increasingly important. This seminar investigates how the concepts of EMVA 1288 can be applied, adapted, or extended for LiDAR characterization and whether a unified evaluation framework can be developed for different LiDAR modalities.
Literature:
- European Machine Vision Association, “EMVA Standard 1288 – Standard for Characterization of Image Sensors and Cameras,” Release 4.0 Linear, 2021, Online: https://www.emva.org/wp-content/uploads/EMVA1288Linear_4.0Release.pdf
- B. Jähne, “Release 4 of the EMVA 1288 Standard: Adaption and Extension to Modern Image Sensors,” in Tagungsband "Forum Bildverarbeitung 2020. KIT Scientific Publishing, November 2020, pp. 13–24.
- R. Roriz, J. Cabral, and T. Gomes, “Automotive LiDAR technology: A survey,” IEEE Trans. Intell. Transp. Syst., vol. 23, no. 7, pp. 6282–6297, 2022.
- B. Behroozpour, P. A. M. Sandborn, M. C. Wu, and B. E. Boser, “Lidar System Architectures and Circuits,” IEEE Commun. Mag., vol. 55, no. 10, pp. 135–142, 2017.
Supervisor: Michael Kühr
- Who Vouches for an Orbit? Trust and Integrity of Space Situational Awareness Data
Every satellite operator depends on orbit knowledge that comes from outside. Radars, telescopes, and space-based sensors observe objects. Tracking networks fuse these observations into catalogs such as the public Two-Line Element sets or commercial products. Operators exchange ephemerides and receive conjunction warnings. Collision avoidance, maneuver planning, and security mechanisms then act on this data. Almost none of these steps is authenticated end to end. Prior work shows the risk. Manipulated tracking data can trigger unnecessary maneuvers or provoke collisions, which turns the data pipeline itself into an anti-satellite weapon. Point defenses exist, for example EphemeriShield for conjunction warnings, and first studies hide or detect deceptive entries in SSA catalogs. A systematic security view of the whole pipeline is missing.
In this seminar, the student will develop this systematization. The seminar topic will involve the following tasks:
1. Model the orbit-knowledge pipeline as a distributed sensing and data-sharing system, from sensor to catalog to operator decision.
2. Collect and classify reported attacks and attack concepts for each stage, for example sensor spoofing, data injection during distribution, catalog poisoning, and stale or degraded orbit elements.
3. Collect and classify existing defenses, for example multi-source cross-validation, independent verification of orbit claims, anomaly detection, and trusted data-sharing frameworks.
4. Compare the trust assumptions behind these defenses and identify open gaps in a paper-style report.
Classic GNSS signal spoofing against navigation receivers is out of scope. The focus is the data that describes where space objects are, not the navigation service they provide.
Literature:
Building a launchpad for satellite cyber-security research: lessons from 60 years of spaceflight. Journal of Cybersecurity, 2022. https://doi.org/10.1093/cybsec/tyac008
EphemeriShield: defence against cyber-antisatellite weapons. https://arxiv.org/abs/2101.12620
On Detecting Deception in Space Situational Awareness. 2021.
https://dl.acm.org/doi/10.1145/3433210.3453081
NASA: Recommendations on Trust and Interoperability in Space Situational Awareness Data. 2020. https://www.nasa.gov/wp-content/uploads/2020/04/white_paper_on_saa_data_findings_and_recommendations_rev2020-10-22b.pdf
Supervisor: Leon Birkel
- Bridging the Cyber-Physical Gap: How to confirm a sensor measurement reflects physical reality
A sensor turns a physical quantity into a number, and every control system downstream trusts that number as ground truth about the world. The problem is that an attacker can inject energy directly into the transducer, using sound, light, electromagnetic interference or radio, so the sensor faithfully digitizes a signal that was never physically present. Cryptography does not help here because it protects the bits only from the ADC onward, leaving the analog transduction stage unguarded. This topic surveys the general strategies for establishing that a measurement is real before it enters the control loop, such as randomized physical challenges, cross-modal consistency checks, physical-invariant verification and raw-signal anomaly detection, and asks which of them genuinely raise the bar against an adaptive attacker rather than only defeating a naive one.
References:
Kevin Fu, Wenyuan Xu. "Risks of Trusting the Physics of Sensors." Communications of the ACM 61(2), pp. 20 to 23, 2018. DOI 10.1145/3176402
Chen Yan, Wenyuan Xu, Jianhao Liu. "Can You Trust Autonomous Vehicles: Contactless Attacks against Sensors of Self-Driving Vehicles." DEF CON 24, 2016
Chen Yan, Hocheol Shin, Connor Bolton, Wenyuan Xu, Yongdae Kim, Kevin Fu. "SoK: A Minimalist Approach to Formalizing Analog Sensor Security." IEEE Symposium on Security and Privacy (S&P) 2020, pp. 480 to 495
Supervisor: Maximilian Lüdecke
Status: Reserved
- Attacks on Ultrasonic Sensors, and Defenses
Ultrasonic ranging is the cheapest and most widely deployed obstacle sensor, found in parking assistance, blind-spot monitoring, robotics and industrial proximity detection, which makes it a high-value target. It is also structurally easy to attack, because it emits a known pulse and simply times the returning echo, so any attacker who can emit ultrasound is able to forge phantom obstacles, erase real ones through jamming, or manipulate the reported distance. This topic maps the full attack taxonomy against ultrasonic sensing and the defenses that have been proposed against it, including physical-shift authentication, randomized emission and multi-sensor consistency checking. The central question the student must answer is whether any of these defenses hold up against an attacker who knows the defense is present, or whether they merely demonstrate feasibility against a static adversary.
Literature:
Wenyuan Xu, Chen Yan, Weibin Jia, Xiaoyu Ji, Jianhao Liu. "Analyzing and Enhancing the Security of Ultrasonic Sensors for Autonomous Vehicles." IEEE Internet of Things Journal 5(6), pp. 5015 to 5029, 2018. DOI 10.1109/JIOT.2018.2867917
Chen Yan, Wenyuan Xu, Jianhao Liu. "Can You Trust Autonomous Vehicles: Contactless Attacks against Sensors of Self-Driving Vehicles." DEF CON 24, 2016
Tsvika Gluck, Moshe Kravchik, Samuel Chocron, Yuval Elovici, Asaf Shabtai. "Spoofing Attack on Ultrasonic Distance Sensors Using a Continuous Signal." Sensors 20(21), Article 6157, 2020. DOI 10.3390/s20216157
Literature: Maximilian Lüdecke
Status: Reserved
- Detection and Sanitization of Adversarial Examples in the Automotive Context
Automated driving functions decide when to brake and where to steer on the output of deep neural networks that read cameras, LiDAR and radar, and those networks inherit the well-known vulnerability of deep models to adversarial perturbation. The automotive setting both constrains the attacker and arms the defender. Perturbations must survive the physical world, its printing, viewing angles, distance and motion blur, which rules out most digital-only attacks but still leaves a demonstrated surface of adversarial patches, road-surface markings and LiDAR spoofing. In return the defender has leverage that image classification lacks, namely multiple heterogeneous sensors, temporal continuity across frames and hard physical priors such as occlusion consistency. The topic separates two defensive philosophies that are easily conflated: detection, which flags an input as adversarial and hands control to a safe fallback, and sanitization, which removes the perturbation and continues normal operation. Each carries a distinct cost, since a detection false positive means phantom braking, itself a safety hazard, while sanitization risks silently degrading clean performance. The student maps attacks and defenses onto this distinction and asks which defenses survive an adaptive attacker who knows the defense is in place.
Literature
Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, Z. Morley Mao. "Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving." ACM CCS 2019, pp. 2267 to 2281. DOI 10.1145/3319535.3339815
Jiachen Sun, Yulong Cao, Qi Alfred Chen, Z. Morley Mao. "Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures." 29th USENIX Security Symposium, pp. 877 to 894, 2020
Chong Xiang, Prateek Mittal. "DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks." ACM CCS 2021, pp. 3177 to 3196. DOI 10.1145/3460120.3484757
Supervisor: Maximilian Lüdecke