MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

Rokuto Nagata; Kenji Koide; Kazuma Ikeda; Ozora Sako; Shion Horie; Kentaro Yoshioka

cs.ROMar 11, 2026

MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

Authors: Rokuto Nagata, Kenji Koide, Kazuma Ikeda, Ozora Sako, Shion Horie, Kentaro Yoshioka

Organizations: Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology

Abstract

LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.

Figures & tables

Fig. 1: Real-world MirrorDrift demonstration. The reference trajectory (white dashed) and the attacked trajectories estimated by KISS-ICP [ 4 ] , FAST-LIO2 [ 5 ] , and GLIM [ 6 ] (red/green/orange) show large deviations in the positive $y$ -direction under attack.

LiDAR model	VLP-32c	Horizon	HAP	AT-128
Appearance
Release (Year)	2017	2020	2020	2022
Channels (lines)	32	$\sim$ 48	$\sim$ 64	128
Interference Mitigation	–	✓	✓	✓
Nagata et al. [ 2 ]
Real-world	✓	–	–	–

TABLE I: Comparison of attack feasibility against LiDAR models.

Fig. 2: (a) Overview of MirrorDrift . We optimize the mirror placement and orientation and determine its motion pattern. The mirror position and nominal orientation are optimized by maximizing the objective function defined in § III-C . To induce false point-to-point correspondences across frames, the mirror is periodically oscillated in the yaw direction. (b) Threat model overview. The adversary aims to deceive the victim vehicle’s ego-localization using mirror-induced ghost points and to cause deviations from the intended route. The mirror is placed in the environment, alongside the robot’s traveling route. The victim route is assumed to be known, allowing the adversary to pre-optimize the mirror placement and orientation using MirrorDrift .

Fig. 3: Mirror-induced ghost point behavior under mirror angle changes. When the mirror rotates by $\Delta\theta$ , the reflection direction changes by $2\Delta\theta$ according to the law of reflection. As a result, a ghost point at range $r$ undergoes an inter-frame displacement of $2r\sin(\Delta\theta)$ .

Fig. 4: Attack device and its effect on LiDAR measurements. (Left) Implemented mirror-actuation device consisting of a planar mirror mounted on a fixture and driven by a Dynamixel MX-28 servo motor to vary the mirror yaw angle over time. (Right) Comparison of LiDAR point clouds captured without the mirror (w/o attack device) and with the mirror present and actuated (w/ attack device).

Fig. 5: Mirror simulation results. The reference point cloud is plotted in yellow-green, and the simulated point cloud is overlaid in red. The two point clouds closely overlap, yielding a very small Chamfer Distance of $0.028176$ m.

LiDAR / IMU	Velodyne VLP-32c / WIT Motion WT901C
LiDAR horizontal FoV	$180^{\circ}$ (front-facing)
Mirror size	$1.8\,\mathrm{m}\times 0.9\,\mathrm{m}$
Mirror yaw motion	periodic swing, $7.0~\mathrm{deg/s}$
Environment / route	Fig. 6 (Start $\rightarrow$ Goal)
SLAM methods	KISS-ICP, FAST-LIO2, GLIM
SLAM parameters	default (changes are explicitly stated)

TABLE II: Default experimental settings (unless otherwise stated).

Fig. 6: Experimental environment used in our evaluation. The Start location in the upper-left is set as the origin, and the platform moves toward the Goal location in the lower-right, proceeding in the positive $x$ and negative $y$ directions.

SLAM algorithms	APE (no mirror)	APE (random)	APE (Optimized, ours)	Head. (no mirror)	Head. (random)	Head. (Optimized, ours)
KISS-ICP [ 4 ]	$0.064\pm 0.080$	$0.429\pm 0.288$	3.305 $\pm$ 0.047	$0.277\pm 0.346$	$0.237\pm 0.166$	9.700 $\pm$ 0.516
FAST-LIO2 [ 5 ]	$0.198\pm 0.159$	$0.425\pm 0.235$	2.292 $\pm$ 0.019	$0.710\pm 0.240$	$2.387\pm 1.686$	6.462 $\pm$ 0.078
GLIM [ 6 ]	$0.213\pm 0.146$	$0.551\pm 0.737$	2.900 $\pm$ 0.141	$1.454\pm 0.626$	$2.960\pm 4.150$	8.081 $\pm$ 0.784

TABLE III: Simulation results. Unit: meter / degree.

SLAM algorithms	Occl.+Refl.	Occl.	Refl.
KISS-ICP [ 4 ]	3.305 $\pm$ 0.047	$0.188\pm 0.022$	$3.259\pm 0.026$
FAST-LIO2 [ 5 ]	2.292 $\pm$ 0.019	$0.237\pm 0.008$	$2.237\pm 0.220$
GLIM [ 6 ]	2.900 $\pm$ 0.141	$0.128\pm 0.045$	$2.292\pm 0.617$

TABLE IV: Ablation study results. Metric is APE.(simulation)

Fig. 7: Relationship between the mirror–trajectory distance and attack effectiveness (APE). As the distance between the mirror and the trajectory increases, the number of mirror-induced ghost points and the resulting APE decrease.

Fig. 8: (Upper) Estimated trajectories across 100 trials with stochastic placement noise ( $\pm 0.5$ m for $x,y$ and $\pm 5^{\circ}$ for yaw). (Lower)APE heatmap over mirror pose $(x,y,\text{yaw})$ (FAST-LIO2). Sustained errors across the noise range demonstrate the attack’s robustness, showing that coarse placement within the LiDAR’s FoV suffices without cm-level precision.

Fig. 9: Real-world experimental setup. (a) Mirror in the experimental environment (planar mirror, $1.6,\mathrm{m}\times 0.8,\mathrm{m}$ ), manually oscillated in yaw. (b) Victim vehicle (electric wheelchair) with sensors. (c) Sensor system: Hesai AT128 LiDAR and an external IMU (WT-901C).

Metric	KISS-ICP [ 4 ]	FAST-LIO2 [ 5 ]	GLIM [ 6 ]
APE [m]	$6.028$	$3.458$	$4.772$
Head. Error [deg]	$10.731$	$7.264$	$6.923$

TABLE V: Real-world experiment results.

Physical Adversarial Attacks

Physical adversarial attacks exploit real-world objects, light, sound, or sensor interference to mislead machine-learning systems.

See all 83 papers

D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection
Mar 11, 2026Rokuto Nagata, Kenji Koide, Kazuma Ikeda +2Physical Adversarial Attacks Simultaneous Localization and Mapping
Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology
ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception
Jun 1, 2026Mellon M. Zhang, Siddhant Panse, Zimo Fan +3Lidar-Based 3D Object Detection Adversarial Attacks
Georgia Institute of Technology
LIN-SLAM: Lightweight LiDAR--Inertial Neural SLAM for Real-Time Onboard Navigation
Oct 15, 2026Shiqi Che, Yijie Liu, Shuo Wang +1Simultaneous Localization and Mapping Robot Localization
School of Automation Science and Electrical Engineering, Beihang University, Beijing 100191, China

Mar 11, 2026J/K move · Enter open · S save

D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection

Rokuto Nagata, Kenji Koide, Kazuma Ikeda, Ozora Sako+1

Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology

Physical Adversarial Attacks Simultaneous Localization and Mapping

Open paper AskPDF arXiv

In this work, we introduce Dynamic SLAMSpoof (D-SLAMSpoof), a novel attack that compromises LiDAR SLAM even in feature-rich environments. The attack leverages LiDAR spoofing, which injects spurious measurements into LiDAR scans through external laser interference. By designing both spatial injection shapes and temporally coordinated dynamic injection patterns guided by scan-matching principles, D-SLAMSpoof significantly improves attack success rates in real-world, feature-rich environments such as urban areas and indoor spaces, where conventional LiDAR spoofing methods often fail. Furthermore, we propose a practical defense method, ISD-SLAM, that relies solely on inertial dead reckoning signals commonly available in autonomous systems. We demonstrate that ISD-SLAM accurately detects LiDAR spoofing attacks, including D-SLAMSpoof, and effectively mitigates the resulting position drift. Our findings expose inherent vulnerabilities in LiDAR-based SLAM and introduce the first practical defense against LiDAR-based SLAM spoofing using only standard onboard sensors, providing critical insights for improving the security and reliability of autonomous systems.

Abstract

Physical Adversarial Attacks

Explore similar work

D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception

LIN-SLAM: Lightweight LiDAR--Inertial Neural SLAM for Real-Time Onboard Navigation