Organizations: Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology
In this work, we introduce Dynamic SLAMSpoof (D-SLAMSpoof), a novel attack that compromises LiDAR SLAM even in feature-rich environments. The attack leverages LiDAR spoofing, which injects spurious measurements into LiDAR scans through external laser interference. By designing both spatial injection shapes and temporally coordinated dynamic injection patterns guided by scan-matching principles, D-SLAMSpoof significantly improves attack success rates in real-world, feature-rich environments such as urban areas and indoor spaces, where conventional LiDAR spoofing methods often fail. Furthermore, we propose a practical defense method, ISD-SLAM, that relies solely on inertial dead reckoning signals commonly available in autonomous systems. We demonstrate that ISD-SLAM accurately detects LiDAR spoofing attacks, including D-SLAMSpoof, and effectively mitigates the resulting position drift. Our findings expose inherent vulnerabilities in LiDAR-based SLAM and introduce the first practical defense against LiDAR-based SLAM spoofing using only standard onboard sensors, providing critical insights for improving the security and reliability of autonomous systems.
Figures & tables
Fig. 1: (Top) Real-world spoofing attack demonstration under a feature-rich environment is shown. Only D-SLAMSpoof (red line) successfully disrupted LiDAR odometry estimated by FAST-LIO2 [ 4 ] , whereas conventional attack methods (blue and green lines) had no effect on the estimation. (Bottom) While conventional point cloud injection injects a cylindrical wall at a fixed distance, our method strengthens the attack by designing efficient point cloud shapes and periodically varying their distance.
Fig. 2: An overview of our proposed method. (a) Threat model overview. The attacker aims to induce errors in the self-localization of the target vehicle by placing a roadside laser source that tampers the point cloud through malicious laser shooting. The attacker is assumed to know the target’s route in advance. (b) Overview of D-SLAMSpoof. The attacker designs the injected point cloud shape based on geometric constraints in scan matching and periodically moves the point cloud in the radial direction to maximize inter-frame displacement, thereby strengthening the attack. Details for designing the injection shape is detailed in § III-B , and the method for moving the injected point cloud is described in § III-C .
Fig. 3: Overview of ISD-SLAM. The system defends against LiDAR spoofing through four modules: (1) detection of localization errors, (2) switching to inertial navigation, (3) restarting SLAM after the attack, and (4) coordinate transformation to ensure trajectory consistency.
Fig. 4: Comparison between conventional static injection and the proposed D-SLAMSpoof attack. Attack Success Rate (ASR) values are expressed in %. (a) Comparison of ASR on an open dataset (MCD TUHH dataset) in simulation. D-SLAMSpoof achieves an ASR 3.82 times higher than that of the conventional static injection. (b) Comparison of ASR in real-world experiments (Sec. V-F ). The ASR is defined as the ratio of trials exceeding the threshold (3.0 m) over 100 trials with randomized seeds. D-SLAMSpoof is the only method that successfully compromises all three SLAM algorithms with high probability.
Fig. 5: Experimental environment. (a) MCD TUHH map. The start and goal positions vary depending on the scenarios (tuhh_03, 07, and 09); the map shown here encompasses the entire area covered by all scenarios.(b)Ablation study map. The starting point is set as the origin (x=0,y=0) , and the trajectory proceeds toward the lower-right direction (positive x-axis, negative y-axis). (c) Real-world experiment map. The start position is set as the origin, consistent with (b), and the vehicle travels straight along the positive x-axis.
Fig. 6: (Top) Attack success rate (ASR) versus injection shape under limited modifiable azimuth. Proposed shapes maintain high ASR even with a narrow attack range (e.g. 40∘ ), where the conventional method may fail. (Bottom) Attack effectiveness versus radial velocity for different correspondence gates( dmax=1.0 m and 0.5 m) The peak occurs near the gate boundary (9.8 m/s for 1.0 m, 4.9 m/s for 0.5 m), indicating correspondence gating dominates the effect.
Fig. 7: (Top) Precision–Recall curves on two validation sets (Val#1/Val#2), showing consistently high precision and recall across scenarios. (Bottom) Localization error with and without ISD-SLAM: without defense, spoofing triggers a sharp error increase; with ISD-SLAM, the error growth is suppressed.
Fig. 8: (a) Real-world experiment setup.The sensor system shown in (d) was operated, and sensor data were recorded when the point cloud was tampered with by the spoofing system. The structure of the spoofing system is shown in (b) and (c). (b) Spoofer configuration. The pulse laser is collimated by a plano-convex lens. (c) Tracker device [ 20 ] . A camera detects the target LiDAR, and the motor-driven turntable enables continuous spoofing against moving objects. (d) Sensor system. A mobile-robot-like setup consisting of a VLP-16 LiDAR with an attached IMU (WT-901C).
Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology