Organizations: Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology
In this work, we introduce Dynamic SLAMSpoof (D-SLAMSpoof), a novel attack that compromises LiDAR SLAM even in feature-rich environments. The attack leverages LiDAR spoofing, which injects spurious measurements into LiDAR scans through external laser interference. By designing both spatial injection shapes and temporally coordinated dynamic injection patterns guided by scan-matching principles, D-SLAMSpoof significantly improves attack success rates in real-world, feature-rich environments such as urban areas and indoor spaces, where conventional LiDAR spoofing methods often fail. Furthermore, we propose a practical defense method, ISD-SLAM, that relies solely on inertial dead reckoning signals commonly available in autonomous systems. We demonstrate that ISD-SLAM accurately detects LiDAR spoofing attacks, including D-SLAMSpoof, and effectively mitigates the resulting position drift. Our findings expose inherent vulnerabilities in LiDAR-based SLAM and introduce the first practical defense against LiDAR-based SLAM spoofing using only standard onboard sensors, providing critical insights for improving the security and reliability of autonomous systems.
Figures & tables
Fig. 1: (Top) Real-world spoofing attack demonstration under a feature-rich environment is shown. Only D-SLAMSpoof (red line) successfully disrupted LiDAR odometry estimated by FAST-LIO2 [ 4 ] , whereas conventional attack methods (blue and green lines) had no effect on the estimation. (Bottom) While conventional point cloud injection injects a cylindrical wall at a fixed distance, our method strengthens the attack by designing efficient point cloud shapes and periodically varying their distance.
Fig. 2: An overview of our proposed method. (a) Threat model overview. The attacker aims to induce errors in the self-localization of the target vehicle by placing a roadside laser source that tampers the point cloud through malicious laser shooting. The attacker is assumed to know the target’s route in advance. (b) Overview of D-SLAMSpoof. The attacker designs the injected point cloud shape based on geometric constraints in scan matching and periodically moves the point cloud in the radial direction to maximize inter-frame displacement, thereby strengthening the attack. Details for designing the injection shape is detailed in § III-B , and the method for moving the injected point cloud is described in § III-C .
Fig. 3: Overview of ISD-SLAM. The system defends against LiDAR spoofing through four modules: (1) detection of localization errors, (2) switching to inertial navigation, (3) restarting SLAM after the attack, and (4) coordinate transformation to ensure trajectory consistency.
Fig. 4: Comparison between conventional static injection and the proposed D-SLAMSpoof attack. Attack Success Rate (ASR) values are expressed in %. (a) Comparison of ASR on an open dataset (MCD TUHH dataset) in simulation. D-SLAMSpoof achieves an ASR 3.82 times higher than that of the conventional static injection. (b) Comparison of ASR in real-world experiments (Sec. V-F ). The ASR is defined as the ratio of trials exceeding the threshold (3.0 m) over 100 trials with randomized seeds. D-SLAMSpoof is the only method that successfully compromises all three SLAM algorithms with high probability.
Fig. 5: Experimental environment. (a) MCD TUHH map. The start and goal positions vary depending on the scenarios (tuhh_03, 07, and 09); the map shown here encompasses the entire area covered by all scenarios.(b)Ablation study map. The starting point is set as the origin (x=0,y=0) , and the trajectory proceeds toward the lower-right direction (positive x-axis, negative y-axis). (c) Real-world experiment map. The start position is set as the origin, consistent with (b), and the vehicle travels straight along the positive x-axis.
Fig. 6: (Top) Attack success rate (ASR) versus injection shape under limited modifiable azimuth. Proposed shapes maintain high ASR even with a narrow attack range (e.g. 40∘ ), where the conventional method may fail. (Bottom) Attack effectiveness versus radial velocity for different correspondence gates( dmax=1.0 m and 0.5 m) The peak occurs near the gate boundary (9.8 m/s for 1.0 m, 4.9 m/s for 0.5 m), indicating correspondence gating dominates the effect.
Fig. 7: (Top) Precision–Recall curves on two validation sets (Val#1/Val#2), showing consistently high precision and recall across scenarios. (Bottom) Localization error with and without ISD-SLAM: without defense, spoofing triggers a sharp error increase; with ISD-SLAM, the error growth is suppressed.
Fig. 8: (a) Real-world experiment setup.The sensor system shown in (d) was operated, and sensor data were recorded when the point cloud was tampered with by the spoofing system. The structure of the spoofing system is shown in (b) and (c). (b) Spoofer configuration. The pulse laser is collimated by a plano-convex lens. (c) Tracker device [ 20 ] . A camera detects the target LiDAR, and the motor-driven turntable enables continuous spoofing against moving objects. (d) Sensor system. A mobile-robot-like setup consisting of a VLP-16 LiDAR with an attached IMU (WT-901C).
LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.
Rokuto Nagata, Kenji Koide, Kazuma Ikeda +3
Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology
LiDAR sensors are critical for autonomous driving perception, yet remain vulnerable to spoofing attacks. Jamming attacks inject high-frequency laser pulses that completely blind LiDAR sensors by overwhelming authentic returns with malicious signals. We discover that while point clouds become randomized, the underlying full-waveform data retains distinguishable signatures between attack and legitimate signals. In this work, we propose PULSAR-Net, capable of reconstructing authentic point clouds under jamming attacks by leveraging previously underutilized intermediate full-waveform representations and simultaneous laser sensing in modern LiDAR systems. PULSAR-Net adopts a novel U-Net architecture with axial spatial attention mechanisms specifically designed to identify attack-induced signals from authentic object returns in the full-waveform representation. To address the lack of full-waveform representations in existing LiDAR datasets under jamming attacks, we introduce a physics-aware dataset generation pipeline that synthesizes realistic full-waveform representations under jamming attacks. Despite being trained exclusively on synthetic data, PULSAR-Net achieves reconstruction rates of 92% and 73% for vehicles obscured by jamming attacks in real-world static and driving scenarios, respectively.
Ryo Yoshida, Takami Sato, Wenlun Zhang +7
Keio University, Yokohama, Japan · Sony Semiconductor Solutions, Atsugi, Japan · Hainan University, Haikou, China
The structural vulnerabilities of point cloud-based 3D object detectors remain poorly understood. Prior work has studied adversarial robustness primarily on isolated 3D object models, while recent LiDAR spoofing attacks target richer and more realistic driving scenes but focus mainly on physical realizability rather than understanding detector behavior or attack efficiency. In this work, we investigate how LiDAR-based detectors rely on spatial evidence in complex scenes and whether these reliance patterns can be exploited to induce failures more efficiently. To this end, we propose an explainability-guided adversarial analysis methodology. We introduce the Saliency-LiDAR (SALL) method, which aggregates Integrated Gradient attributions across scenes to produce universal saliency maps for LiDAR-based 3D object detectors. Guided by these maps, we design the Explainability-aware Frustum Attack (EFA), which selectively perturbs only the most influential frustums rather than uniformly attacking entire object regions. Experiments on KITTI and nuScenes, across detectors such as PointPillars and SECOND, show that EFA reduces detection recall by more than 15 percentage points while requiring 25-50% fewer perturbed frustums than the state-of-the-art non-saliency-aware baseline. These findings reveal that modern 3D detectors concentrate discriminative evidence in a small subset of spatial regions, exposing a structural robustness vulnerability in current LiDAR perception systems. Our code is released at https://github.com/SecMindLab/Saliency_LiDAR.