让下一篇重要论文，不再错过。

原文摘要

Autonomous vehicles (AVs) couple safety-critical perception to thermally constrained compute. Physical adversaries can spoof thermal infrared (IR) sensors used for night driving, while unprivileged software co-tenants can fingerprint perception workloads from thermal, dynamic voltage and frequency scaling (DVFS), and thermal event interrupt (TEI) telemetry required for package safety. These paths differ in mechanism and privilege, but both exploit interfaces that AV stacks cannot disable without compromising Safety of the Intended Functionality (SOTIF). Existing microarchitectural and CPS surveys cover cache timing, adversarial ML, and camera or LiDAR spoofing; none frames physical thermal IR attacks and unprivileged silicon thermal telemetry as one residual-risk class. This survey systematizes thirteen works into thermal perception integrity, telemetry leakage, and model-information extraction, comparing them by privilege, timescale, co-tenancy, deployability, and AV relevance while mapping defenses to residual risk. A commodity proxy supports the software co-tenant branch only; physical IR evidence comes from cited literature. We identify open problems in on-target automotive evaluation, fusion trust under IR spoofing, chiplet thermal coupling, capability-based telemetry, and standards-ready threat analysis, motivating co-design across sensors, operating systems, silicon, and automotive standards.