Airfield runway FOD detection AI: adversarial millimetre-wave radar map injection hides a 15 cm tyre fragment from Xsight FODetect — and why FAA AC 150/5220-24 does not require adversarial robustness testing

How airfield runway FOD detection AI works

Foreign object debris on active runways, taxiways, and ramp areas is one of the most consistently documented causal and contributing factors in commercial aviation accidents and incidents. The FAA's Wildlife Strike Database and FOD incident reporting system capture thousands of documented FOD events per year on US commercial service airports alone, ranging from minor tyre damage from gravel on commuter runways to the extreme consequence established by Concorde AF 4590. The variety of FOD types — metallic fragments, tyre debris, ground equipment components, wildlife, ice accumulations, displaced concrete aggregate — and the operational requirement to detect any of them at night, in precipitation, in fog, and during high-tempo aircraft operations make manual visual runway inspection inadequate as a sole detection method for airports with operations exceeding approximately 50 per hour.

Automated FOD detection systems deployed at high-traffic international airports address this gap through three primary sensor modalities. Millimetre-wave radar — operating in the 76-77 GHz band, the same frequency range used for automotive pedestrian detection radar — measures the radar cross-section of surface objects at range resolutions of approximately 0.3-0.5 m, producing a 2D scan of the runway surface that is updated every 20-30 seconds per runway. Electro-optical and near-infrared camera systems — typically deployed on elevated towers or centreline masts — capture high-resolution images of the runway surface in visible and NIR wavelengths, providing object size and shape information that complements the radar cross-section measurement. Laser-based LIDAR systems scan the runway surface at 905 nm wavelength and produce a point cloud representation of the surface relief, detecting surface discontinuities above a minimum height threshold. In each case, the raw sensor data is processed — rendered — into a human-interpretable overlay image before being submitted to the AI classification engine that determines whether to generate a FOD alert.

The AI classification step — the point at which raw sensor signal is converted into an alert decision — is where the adversarial injection surface is introduced. The classifier receives a rendered raster image as input: the millimetre-wave radar scan overlay, the EO/NIR camera frame, the LIDAR point cloud projection. It does not receive the raw radar return data, the raw camera pixel values at sensor bit depth, or the raw LIDAR point cloud; it receives the rendered representation. This boundary is the attack surface for the adversarial injection we analyse below.

For detailed coverage of the specific systems deployed at individual airport categories and the four adversarial surfaces we identify across FOD radar AI, runway visual range AI, PAPI monitoring AI, and runway incursion detection AI, see our airfield runway FOD detection AI prompt injection overview.

The Xsight FODetect radar scan overlay adversarial injection surface

Xsight Systems FODetect is deployed at a significant share of the world's highest-traffic international airports including Ben Gurion International (Tel Aviv), Amsterdam Schiphol, Dubai International, and multiple Asian and European hub airports. The system uses a phased array millimetre-wave radar operating at 76-77 GHz to scan the runway surface from sensor heads mounted on the runway perimeter or centreline infrastructure. Each sensor head covers a runway strip of approximately 100-150 m width by 2,500-3,500 m length, with a scan update rate of approximately 20 seconds per full-runway coverage cycle.

The raw radar return from each scan cycle is a complex-valued matrix of received signal amplitudes across the 2D spatial coverage area. This data is processed — normalised against the calibrated baseline backscatter for each surface cell, filtered to remove moving targets (taxiing aircraft, runway maintenance vehicles), and rendered into a colour-coded scan overlay image. In the rendered overlay, each surface cell is mapped to a pixel colour according to its normalised backscatter deviation from the surface baseline: cells within the normal surface backscatter distribution are rendered in uniform grey, representing a clean runway surface. Cells with statistically elevated backscatter — indicating a surface discontinuity above the noise floor — are rendered in a gradient from yellow (marginal elevation, potential light debris) through orange (moderate elevation, candidate FOD) to red (strong elevation, high-confidence FOD above the minimum detectable object threshold).

The FODetect AI classifier receives this rendered overlay as input and produces a FOD alert decision for each candidate anomaly cluster. The classifier is trained on a dataset of rendered overlay images annotated with the ground truth FOD state (confirmed object present vs. clean surface) across a range of object types, sizes, surface conditions, and ambient conditions. The adversarial injection surface targets the candidate anomaly cluster in the rendered overlay — specifically, the 4-8 pixel region corresponding to a 15 cm tyre fragment or equivalent minimum-size FOD object.

A 15 cm rubber tyre fragment — the approximate minimum fragment size from a tyre blowout that can damage an aircraft tyre at 200 psi inflation pressure — produces a radar cross-section of approximately 0.005-0.02 m² at 76 GHz (rubber has a relatively low dielectric constant at millimetre-wave frequencies, producing a weaker backscatter than a metallic object of the same size). In the rendered scan overlay, this cross-section maps to a 4-8 pixel cluster with values in the yellow-to-orange range: the lower end of the detectable signal band, well above the grey baseline but below the saturated red of a large metallic object. The classifier's decision boundary between ‘noise’ and ‘alert’ passes through this signal range.

The adversarial perturbation shifts this decision. A ±10 DN per-channel pixel value adjustment centred on the 4-8 pixel cluster — within the quantisation noise floor of JPEG-compressed rendered overlays at typical airport management system image quality settings — moves the cluster values from the yellow-to-orange range toward the grey background distribution. The classifier, whose decision boundary is trained on unperturbed rendered images, reclassifies the cluster as surface noise rather than a FOD candidate. No alert is generated. The tyre fragment remains on the active runway, invisible to the FODetect AI, undetectable through any automated monitoring channel, until an aircraft tyre or engine strike occurs.

Concorde Air France 4590: the titanium strip and the tyre strike sequence

The Concorde accident at CDG Airport on 25 July 2000 is the most precisely documented mass casualty event caused by a single FOD item in the history of commercial aviation. Its role in the context of adversarial FOD AI injection is not as a historic curiosity: it is the calibration point for the consequence envelope of a FOD AI miss at an international airport hub, expressed in the most specific physical terms available.

The titanium thrust reverser cowl strip that caused the accident measured 43 cm in length, 3 cm in width, 0.5 cm in thickness, and weighed approximately 435 grams. It had separated from the No. 3 engine thrust reverser cowl of a Continental Airlines DC-10 that had departed Runway 26R approximately 4 minutes and 20 seconds before the Concorde's takeoff roll. The strip came to rest approximately 1,450 metres from the runway 26R threshold, roughly centred on the runway centreline, sitting flat on the runway surface with its long axis approximately transverse to the runway direction.

The BEA investigation established the precise tyre contact sequence. The Concorde's No. 2 left main bogie tyre, inflated to 202 psi and in contact with the runway surface at approximately 280 knots ground speed during the takeoff roll, struck the titanium strip at the full contact speed. The strip's mass (435 grams) and the contact geometry (strip edge to tyre crown contact) produced a concentrated impact load that caused a catastrophic tyre blowout: the tyre carcass ruptured, ejecting a large rubber carcass fragment upward and rearward at high velocity. The BEA simulations estimated this fragment's impact velocity on the underside of the left wing fuel tank at approximately 140 m/s.

The resulting pressure pulse — the hydrodynamic shock through the Jet A-1 fuel filling Tank 5 — exceeded the tank structure's burst pressure without requiring physical penetration by the tyre fragment. The tank burst on the lower surface, releasing approximately 17,400 litres of fuel that ignited in contact with the jet blast from the No. 2 engine. The fire burned through the No. 1 and No. 2 left engine nacelles and caused surge and thrust loss in both left engines. The aircraft became airborne at V1+2 knots with insufficient thrust to maintain a positive climb profile, reached a maximum altitude of approximately 200 feet, and impacted the Hotel Hôtelissimo Les Relais Bleus at Gonesse 2 km from the airport at 16:44:31 local time. 113 persons died.

The calibration this event provides for FOD AI consequence modelling is precise: a 43 cm metallic object with a projected area of approximately 21 cm² was sufficient, via the tyre contact mechanism, to trigger a fuel tank burst on a widebody aircraft. Any FOD AI system meeting FAA AC 150/5220-24 minimum detectable object specifications would be required to detect an object of these dimensions with 95% POD. An adversarially suppressed detection that causes a miss — regardless of whether the miss is caused by a model generalisation error or a crafted pixel perturbation — produces the identical airport operational state that existed on Runway 26R on 25 July 2000: a detectable object, present on an active runway, not detected by any automated system, during an active aircraft use cycle.

Runway Visual Range AI: the Vaisala luminance curve injection surface

Runway Visual Range is the primary meteorological parameter governing approach minima for instrument approaches at all ICAO-certified international airports. The RVR value measured at the approach end of the runway — and at mid-runway and roll-out positions for CAT III approaches — determines which approach category an inbound aircraft is cleared for: CAT I (RVR ≥ 550 m for most aircraft), CAT II (RVR ≥ 350 m), CAT IIIA (RVR ≥ 200 m), CAT IIIB (RVR ≥ 75 m with autoland), or CAT IIIC (RVR without minimum for autoland-capable aircraft).

The Vaisala PWD22 present weather detector and forward scatter sensor, deployed at the majority of ILS CAT II and CAT III certified runways worldwide, measures the atmospheric extinction coefficient at 875 nm wavelength using a forward scatter geometry. An AI processing layer converts this measurement — together with a co-located photometer measuring ambient luminance and a background luminance sensor — into the MOR (Meteorological Optical Range) and the derived RVR figure reported to the airport operations centre and to arriving aircraft via ATIS and ATC. The conversion from extinction coefficient measurement to reported RVR depends on an AI model calibrated to the ambient luminance and the airport’s approach lighting system (ALS) intensity settings.

The adversarial injection surface is the rendered luminance and extinction coefficient curve displayed on the airport operations centre dashboard — the visual representation of the time-series sensor outputs from which human operators and AI decision support systems monitor approach minima conditions. A perturbation that elevates the displayed extinction coefficient baseline — shifting the rendered curve toward lower values (better visibility) than the sensor is actually measuring — causes the RVR reporting system to output values consistent with better meteorological conditions than those present at the runway. The adversarial outcome: an actual RVR of 80 m (CAT IIIB conditions, requiring No-DH autoland capability) displayed as 350 m (CAT II conditions, usable by CAT II-equipped aircraft without autoland). Aircraft cleared for CAT II approaches in actual CAT IIIB conditions may encounter a runway visual environment below approach minima during the final 200 m of approach with no automation able to compensate for the shortfall in visibility.

This injection surface is architecturally parallel to the adversarial surfaces we have identified in physical inspection AI: the sensor data is rendered into a visual representation before the AI classification step, and the perturbation targets that rendered representation rather than the raw sensor output.

ASDE-X runway incursion detection AI: the surface map injection surface

The FAA's Airport Surface Detection Equipment — Model X (ASDE-X) programme has deployed automated surface surveillance and runway incursion detection at 35 major US commercial service airports, including Chicago O'Hare, Los Angeles International, John F. Kennedy, Hartsfield-Jackson Atlanta, and Dallas/Fort Worth. ASDE-X fuses inputs from terminal radar, ADS-B transponder data, multilateration positioning, and in some installations millimetre-wave surface radar to produce a unified 2D map of all aircraft and vehicle positions on the airport surface, updated at approximately 1-second intervals.

The ASDE-X runway incursion detection AI monitors the position tracks of all displayed targets relative to the active runway occupancy zones defined in the airport’s runway configuration. When an aircraft or vehicle track enters an active runway zone without an ATC clearance — a runway incursion — the system generates a RIMCAS (Runway Incursion Monitoring and Conflict Alert Subsystem) alert to the airport operations centre and ATC tower position. The alert response time under FAA Order 6360.1 ASDE-X Programme requirements is 3-5 seconds from incursion detection to alert display.

The adversarial injection surface is the rendered ASDE-X surface map — the top-down airport display with colour-coded position icons for aircraft (typically green or yellow based on status) and vehicles (blue or white). A ±12 DN pixel perturbation that shifts an aircraft icon from the active runway centreline position (rendered against the runway colour field) toward the adjacent taxiway grey can cause the AI runway incursion detection system to reclassify the aircraft track as a taxiway operation rather than a runway incursion, suppressing the RIMCAS alert. The ATC tower receives no incursion warning. A landing aircraft on approach to the occupied runway has no alert basis for a go-around command. The incursion proceeds to the potential collision point without automated warning in the ATC workflow.

The adversarial injection consequence for ASDE-X is shorter-cycle than for FOD detection: the RIMCAS alert is a 3-5 second response requirement, and a suppressed alert has consequences during the seconds-scale window in which an incursion aircraft can be instructed to exit the runway before a landing aircraft touches down. For context on how adversarial pixel injection into AI systems with formal verification frameworks operates in similarly tight decision windows, see our analysis of ACAS Xu adversarial pixel injection, where formally verified neural network policy properties are bypassed by corrupting the sensor inputs before they reach the verified network.

The FAA AC 150/5220-24 qualification gap

FAA Advisory Circular 150/5220-24 defines the performance requirements, testing criteria, and operational specifications for automated FOD detection equipment at US airports. Its 95% POD acceptance criterion is the dominant performance metric that FOD detection system vendors demonstrate during acceptance testing. The testing protocol specifies a set of reference object types — metallic, rubber, composite objects of defined sizes, placed at defined positions on the runway surface — and evaluates whether the system generates a FOD alert for each object within the required 60-second window and at the required positional accuracy.

The acceptance test is conducted under controlled conditions, with known objects placed at known positions, on a runway that is otherwise in its normal operational configuration. The test objects are not adversarially perturbed before being submitted to the AI classifier. The rendered radar scan overlays used in the acceptance test are not subjected to structured pixel perturbations designed to suppress the detection signal below the threshold. The acceptance test demonstrates the system’s ability to detect real physical objects under expected operational conditions — precipitation, reduced visibility, vehicle traffic — but not its robustness against an adversary who manipulates the rendered image input to the AI classifier.

This is the same structural gap we identified in API 1163 4th edition for pipeline integrity ILI AI: a rigorous qualification standard that demonstrates performance against expected operational variability and known noise sources, with no adversarial robustness criterion because the standard was developed before adversarial machine learning was a practical deployment consideration. The gap is compounded in the airfield FOD context by the operational consequences being substantially faster-cycle: a missed ILI defect detection produces a consequence that unfolds over months to years before the pipeline fails; a missed FOD detection produces a consequence that unfolds over the seconds of a landing roll or takeoff roll.

FAA Order 6360.1 ASDE-X programme specifications similarly define the RIMCAS alert performance requirements in terms of detection latency and positional accuracy against expected target types — aircraft transponders, vehicle transponders, multilateration targets — with no adversarial perturbation requirement for the rendered surface map inputs to the incursion detection AI. ICAO Annex 14 Volume I Chapter 9 FOD management programme requirements reference the FAA and equivalent national civil aviation authority standards without establishing adversarial robustness criteria of their own.

The pattern is consistent across aviation AI qualification frameworks: EASA AMC 20-16 for borescope inspection AI, CENELEC EN 50129 SIL 4 for railway signalling AI, API 1163 for pipeline ILI AI, and FAA AC 150/5220-24 for runway FOD AI all share the same structural limitation. They qualify AI systems against the operational variability for which the standards were designed, without defining an adversarial attacker as an in-scope threat model. A system holding a full qualification certificate under any of these standards can be defeated by a structured pixel perturbation applied at the rendered image ingestion boundary of the AI classifier.

PAPI optical monitoring AI: the failed unit injection

Precision Approach Path Indicators — PAPI light bars installed at the runway edge providing visual glidepath information to approaching aircraft — are a safety-critical element of the visual approach infrastructure at all ICAO-certified instrument runways. ICAO Annex 14 Volume I specifies that PAPI systems must be maintained to ±0.5° glidepath angle accuracy, and that the airport operator must publish a NOTAM when a PAPI unit is unserviceable. Monitoring AI systems — deployed at some international airports as part of the airfield lighting monitoring infrastructure — use optical cameras pointed at the PAPI bar units to detect unit failures: a unit that has failed will appear dark or off-colour in the camera image, indicating that its high-intensity lamp has failed and that the unit is no longer providing the correct red-over-white colour coding to approaching pilots.

The adversarial injection surface for PAPI monitoring AI is the rendered camera image from the monitoring camera. A ±15 DN pixel perturbation that shifts the pixel values of a failed (dark) PAPI unit in the rendered image toward the expected on-state luminance of a functioning unit — brightening the dark pixels to appear as a white-illuminated unit — causes the PAPI monitoring AI to classify the failed unit as functional. No NOTAM is generated. Pilots on approach receive a glidepath indication that is based on one fewer functioning PAPI unit, reducing the angular resolution of the path indication to an extent that ICAO Annex 14 determines to be unsafe without a NOTAM warning to crews to verify by other means.

Glyphward threshold 35 for airfield runway AI

Glyphward’s adversarial detection API operates as a pre-scan gate at the rendered image ingestion boundary of each airfield AI classifier: the Xsight FODetect radar scan overlay before the FOD classification CNN, the Vaisala RVR extinction coefficient curve before the approach minima reporting system, the ASDE-X surface map before the runway incursion detection AI, the PAPI monitoring camera frame before the serviceability classification model. Each rendered image is submitted to Glyphward’s API (8-15 ms latency per image), receives a risk score (0-100), and is compared to the configured threshold.

We configure this threshold at 35 for all four airfield runway AI surfaces. The threshold selection reflects two structural features of runway AI that distinguish it from contexts where we use higher thresholds. First, the operational consequence of a false negative — passing an adversarially crafted radar scan to the FOD classifier — is a missed FOD detection during an active aircraft use cycle, with the consequence profile established by Concorde AF 4590. There is no complementary automated detection pathway: if the FODetect AI does not alert, no automated system alerts. Human runway visual inspection can supplement automated detection, but the 20-second scan update cycle and the operational tempo of high-traffic runways mean that a human inspection resource cannot substitute for the automated system during peak operations. The consequence of a false positive by the Glyphward gate — routing a clean radar scan to duty officer review — is a 60-90 second verification cycle that delays the clear-FOD confirmation but does not allow a false FOD alert to ground traffic.

Second, the time scale of the consequence: runway AI decisions — whether to alert, whether to dispatch, whether to hold traffic — operate on the seconds scale of aircraft operations, not the months-scale of pipeline integrity management. A threshold of 35 reflects the highest adversarial sensitivity calibration appropriate for the FOD detection context, accepting the highest Glyphward false positive rate in exchange for the lowest achievable false negative rate for AI systems whose misses produce consequences in the 113-fatality range.

The Glyphward scan log for airfield runway AI generates a timestamped record — scan_id, risk score, sensor type (FOD radar, RVR optical, ASDE-X fusion, PAPI optical), runway identifier, scan timestamp, and perturbation class — that satisfies the FAA AC 150/5220-24 equipment performance monitoring record requirements and the airport’s Safety Management System documentation requirements under FAA Order 8000.369. For each scan flagged above threshold 35, the log entry records ‘adversarial perturbation detected — image routed to duty officer verification, AI classification suppressed’, providing the documentation chain that the airport’s SMS programme and ICAO Annex 14 Chapter 9 FOD management programme records require for any automated system operating in the runway safety area.

Free tier — 10 scans/day, no card required. Submit a rendered FOD radar scan overlay or ASDE-X surface map image to the Glyphward scanner to generate a baseline adversarial risk score for your runway AI detection pipeline.