Neural Reconstruction of LiDAR Point Clouds under Jamming Attacks via Full-Waveform Representation and Simultaneous Laser Sensing

Ryo Yoshida; Takami Sato; Wenlun Zhang; Yuki Hayakawa; Shota Nagai; Takahiro Kado; Taro Beppu; Ibuki Fujioka

cs.CVApr 1, 2026

Neural Reconstruction of LiDAR Point Clouds under Jamming Attacks via Full-Waveform Representation and Simultaneous Laser Sensing

Authors: Ryo Yoshida, Takami Sato, Wenlun Zhang, Yuki Hayakawa, Shota Nagai, Takahiro Kado, Taro Beppu, Ibuki Fujioka,

Organizations: Keio University, Yokohama, Japan · Sony Semiconductor Solutions, Atsugi, Japan · Hainan University, Haikou, China

Abstract

LiDAR sensors are critical for autonomous driving perception, yet remain vulnerable to spoofing attacks. Jamming attacks inject high-frequency laser pulses that completely blind LiDAR sensors by overwhelming authentic returns with malicious signals. We discover that while point clouds become randomized, the underlying full-waveform data retains distinguishable signatures between attack and legitimate signals. In this work, we propose PULSAR-Net, capable of reconstructing authentic point clouds under jamming attacks by leveraging previously underutilized intermediate full-waveform representations and simultaneous laser sensing in modern LiDAR systems. PULSAR-Net adopts a novel U-Net architecture with axial spatial attention mechanisms specifically designed to identify attack-induced signals from authentic object returns in the full-waveform representation. To address the lack of full-waveform representations in existing LiDAR datasets under jamming attacks, we introduce a physics-aware dataset generation pipeline that synthesizes realistic full-waveform representations under jamming attacks. Despite being trained exclusively on synthetic data, PULSAR-Net achieves reconstruction rates of 92% and 73% for vehicles obscured by jamming attacks in real-world static and driving scenarios, respectively.

Figures & tables

Figure 1: Reconstruction demo of our PULSAR-Net from LiDAR sensing under a jamming attack. Our PULSAR-Net can effectively recover the point cloud (d), which is faithful to the original one (b), by leveraging the intermediate full-waveform representation and simultaneous sensing feature available in modern LiDARs.

Figure 2: Conceptual illustration of a LiDAR jamming attack and simultaneous sensing.

Figure 3: Overview of PULSAR-Net, a U-Net-inspired architecture using depthwise-separable 3D convolutions for efficient, lightweight feature extraction. It incorporates axial attention to model both spatial and temporal dependencies within full-waveforms.

	Ours		Naive Average Sub.		Neural DSP [ 22 ]		No Defense
$\phi$	nuScenes-J	KITTI-J	nuScenes-J	KITTI-J	nuScenes-J	KITTI-J	nuScenes-J	KITTI-J
1	67.95	73.21	-	-	4.57	3.92	3.37	2.92
4	82.66	89.63	38.22	28.6	6.21	21.4	3.36	2.87
5	86.13	89.90	38.26	30.33	9.56	26.39	3.39	2.92
10	85.95	89.86	37.77	35.93	36.67	29.47	3.39	2.93
25	86.35	89.62	36.91	42.28	46.35	21.03	3.42	2.90

Table 1: Point-level recovery accuracy of PULSAR-Net (Ours) and the baselines (Naive Average Subtraction and Neural DSP) on the nuScenes-J and KITTI-J datasets.

\phi

is the number of simultaneous sensing lasers.

		nuScenes-J (mAP)		KITTI-J (mAP)
$\phi$	Method	PointPillars	CenterPoint	PointPillars	PV-RCNN
25	No Defense	0.00	0.00	0.00	0.00
	Naive Average Sub.	1.94	0.00	21.81	41.06
	Neural DSP [ 22 ]	20.09	4.07	4.32	6.25
	Ours	64.03	59.08	48.33	56.06
110	No Defense	0.00	0.00	0.00	0.00

Table 2: Object detector-level mAP of PULSAR-Net (Ours) and baselines on the nuScenes-J and KITTI-J datasets.

\phi

denotes the number of simultaneous sensing lasers.

Table 6

Figure 4: Overview of the real-world experiment and its results: (i) experimental setup of a jamming attack on our LiDAR developed with a major LiDAR supplier to stream full waveform, (ii) benign, attack-compromised, and reconstructed point clouds in a static scenario with a reference vision, and (iii-iv) 3 frames of camera frames and point clouds of benign, attack-compromised, and reconstructed point clouds in driving scenarios

Scenario	Condition	PointPillar	CenterPoint	PV-RCNN
Static (4 scenarios)	No Attack	49.7	67.1	44.0
	No Defense	0.10	0.00	0.00
	Ours	49.8	69.4	49.8
Moving (3 scenarios)	No Defense	0.70	0.20	0.00
Moving (3 scenarios)	Ours	50.7	63.1	53.8

Table 5: Quantitative results of the case study. We evaluate the mAP across three driving (moving) and four static scenarios. Note that benign (no attack) data is not available for moving scenarios.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Point cloud denoising methods fail under jamming attacks. Red points indicate valid structures (neighbors within 5cm), and gray points indicate isolated points.

Table 10

Table 11

		nuScenes-J (mAP)		KITTI-J (mAP)
$\phi$	Method	PointPillars	CenterPoint	PointPillars	PV-RCNN
1	No Defense	0.00	0.00	0.00	0.00
	Naive Average Sub.	-	-	-	-
	Neural DSP [ 22 ]	0.43	0.02	0.00	0.00
	Ours	0.94	0.19	15.09	27.36
4	No Defense	0.00	0.00	0.00	0.00

Appendix

Table 10: Object detector-level mAP of PULSAR-Net (Ours) and baselines on the nuScenes-J and KITTI-J datasets.

\phi

denotes the number of simultaneous sensing lasers.

Panel of Table 11 — Table 11: Simultaneous laser sensing capabilities of commercial LiDAR systems. $\phi$ is the number of simultaneous sensing lasers.

Point Cloud Learning

Point Cloud Learning develops methods for representing and interpreting unordered 3D point sets from LiDAR, depth sensors, radar, and 3D models.

See all 159 papers

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception
Jun 1, 2026Mellon M. Zhang, Siddhant Panse, Zimo Fan +3Lidar-Based 3D Object Detection Adversarial Attacks
Georgia Institute of Technology
D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection
Mar 11, 2026Rokuto Nagata, Kenji Koide, Kazuma Ikeda +2Physical Adversarial Attacks Simultaneous Localization and Mapping
Department of Electronics and Electrical Engineering, Keio University · Department of Information Technology and Human Factors, the National Institute of Advanced Industrial Science and Technology
Simulating Realistic LiDAR Data Under Adverse Weather for Autonomous Vehicles: A Physics-Informed Learning Approach
Apr 1, 2026Vivek Anand, Bharat Lohani, Rakesh Mishra +1Autonomous Driving Simulation Synthetic Data Augmentation
Geoinformatics Group, Department of Civil Engineering, Indian Institute of Technology Kanpur, India · Department of Geodesy and Geomatics Engineering, University of New Brunswick, NB, Canada · Department of Engineering Technology & Industrial Distribution (ETID) of Texas A&M University

Jun 1, 2026J/K move · Enter open · S save

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception

Mellon M. Zhang, Siddhant Panse, Zimo Fan, Akshal Dhal+2

Georgia Institute of Technology

Lidar-Based 3D Object Detection Adversarial Attacks Adversarial Robustness Autonomous Driving Perception Black-Box Adversarial Attacks Physical Adversarial Attacks

Open paper AskPDF arXiv

Autonomous driving perception is typically evaluated on clean benchmark data, yet real-world deployment requires robustness to rare, structured, and potentially adversarial sensor anomalies. This gap is especially critical for LiDAR, where external actors can physically manipulate the sensing process to induce black-box perception failures without accessing the model. Existing LiDAR benchmarks provide little visibility into this failure mode. Prior adversarial LiDAR studies have largely centered on attack hardware, geometric and algorithmic defenses, and early-generation detectors, leaving the robustness of modern perception systems unexplored. To address this evaluation gap, we introduce ATLAS (Adversarial Temporal LiDAR Attack Suite), the first large-scale, physically grounded evaluation benchmark for LiDAR perception models under black-box sensor attacks, simulating the two primary attack modes -- point injection and point removal -- across real driving sequences. Evaluating a broad cross-section of current state-of-the-art LiDAR perception models, ATLAS reveals a surprising robustness asymmetry: models with stronger performance on standard benchmarks tend to better withstand removal attacks, yet are actually more vulnerable to injection attacks than weaker models. We trace this vulnerability to standard object database sampling augmentations, revealing how current training practices can induce architecture-agnostic robustness failures, and study initial directions for mitigating both attack modes. We release the ATLAS generation code to support extensible, reproducible evaluations as attack capabilities evolve, helping make black-box sensor robustness an explicit consideration in future LiDAR perception development.

Abstract

Point Cloud Learning

Explore similar work

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception

D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection

Simulating Realistic LiDAR Data Under Adverse Weather for Autonomous Vehicles: A Physics-Informed Learning Approach