Adversarial Calibration Attack on Autonomous Vehicles

Liangkai Liu; Qingzhao Zhang; Kang G. Shin

cs.ROAug 28, 2026

Adversarial Calibration Attack on Autonomous Vehicles

Authors: Liangkai Liu, Qingzhao Zhang, Kang G. Shin

Organizations: Texas Tech University · University of Arizona · University of Michigan

Abstract

Autonomous vehicles (AVs) rely on accurate camera-LiDAR calibration for multimodal sensor fusion. In practice, calibration can drift due to vibration, temperature variation, or minor sensor displacement, motivating online calibration algorithms that detect and correct misalignment at runtime while allowing the vehicle to continue operating without a factory visit. Existing AV attacks largely assume correct calibration. We instead identify online sensor calibration as a new attack plane. A corrupted calibration update can persist across subsequent fusion operations, causing system-wide errors that propagate from perception to planning and control. We present Adversarial Calibration Attack (ACA), the first physical attack against camera-LiDAR online calibration. Using a single adversarial poster, ACA first spoofs the miscalibration detector to trigger the calibration process and then steers the calibration estimator toward an incorrect transformation. A unified optimization jointly designs the poster's geometry and texture for both objectives. We evaluate ACA across benchmark datasets, simulation, and physical experiments. On benchmark datasets such as KITTI and nuScenes, ACA induces up to 33.9 degrees mean rotational calibration error, thereby severely degrading object detection. In the CARLA simulator, the attack causes a collision when the corrupted calibration is accepted in vulnerable scenarios crafted by the attacker. On a real Husky robot, a printed adversarial poster successfully reproduces the calibration error. These results demonstrate that online calibration is a practical and safety-critical attack surface for AVs.

Figures & tables

Figure 1: An example illustrates the impact of the calibration attack on downstream detection.

Figure 2: Extrinsic calibration (rotation $R$ and translation $t$ ) between camera and LiDAR for sensor fusion.

Panel of Figure 3 — Figure 3: End-to-end pipeline of ACA . A single physical object $\mathcal{A}$ affects both camera and LiDAR observations. Stage 1 pushes the miscalibration score above $\tau_{\mathrm{det}}$ to trigger online recalibration. Stage 2 then steers the invoked calibrator toward an incorrect extrinsic $\hat{T}_{\ell\to c}$ , which is subsequently consumed by downstream fusion.

Figure 4: Adversarial-object parameterization and one planar realization. We represent $\mathcal{A}$ using (a) physical geometry $G_{\mathcal{A}}$ , (b) deployment pose $T_{\mathcal{A}}$ , and (c) surface appearance $C_{\mathcal{A}}$ . The illustrated planar panel is one realization of the general object model; the same formulation applies to other physical objects exposing a printable surface jointly observable by camera and LiDAR. For a chosen deployment, $G_{\mathcal{A}}$ and the nominal $T_{\mathcal{A}}$ are fixed, while $C_{\mathcal{A}}$ carries both attack stages and is optimized.

Panel of Figure 5 — Figure 5: Joint two-stage optimization. The same attacked observations feed the miscalibration detector and the unrolled calibration surrogate, producing the trigger and corruption losses, respectively. Both losses back-propagate to the same physical appearance $C_{\mathcal{A}}$ . The hinged Stage 1 loss becomes inactive once recalibration is triggered with sufficient margin, allowing optimization to focus on Stage 2.

Figure 6: Deployment platform: Clearpath Husky A300 with Ouster OS1-128 LiDAR and OAK-D depth camera, running ACA on an NVIDIA Jetson AGX Orin.

condition ( $96$ held-out frames)	fires	mean conf.
ACA , Stage-1-only texture	$\mathbf{0.98}$	$0.047$
ACA , joint artifact	$\mathbf{0.89}$	$0.187$

Table 1: Stage-1 firing against the global rigid-displacement detector of [ 53 ] , at the same

3.6\times 1.8

m board. fires is the fraction of held-out frames flagged as miscalibrated. The gray-board (

0.28

) and truck-rear (

0.00

) controls reported in the text that distinguishes an adversarial trigger from a near-field occlusion effect; both are passed.

init. miscal.	baseline	hard print	smooth print	gray ctrl
$5^{\circ}$ (in-dist.)	$2.2^{\circ}$	$+10.8^{\circ}$ / $76\%$	$+16.2^{\circ}$ / $96\%$	—
$10^{\circ}$ (in-dist.)	$3.0^{\circ}$	$+10.3^{\circ}$ / $72\%$	$+15.8^{\circ}$ / $92\%$	—
$15^{\circ}$ (in-dist.)	$2.3^{\circ}$	$+15.6^{\circ}$ / $72\%$	$+27.1^{\circ}$ / $100\%$	$+3.5^{\circ}$
$25^{\circ}$ (OOD)	$6.6^{\circ}$	$+17.9^{\circ}$ / $64\%$	$+29.0^{\circ}$ / $92\%$	—

Table 2: ACA vs. initial miscalibration magnitude on KITTI. Cells are marginal rotation damage / ASR

>\!5^{\circ}

. The trained calibrator’s in-distribution range is

5

–

15^{\circ}

condition (held-out seqs, $n=150$ )	$\Delta_{\mathrm{rot}}$	ASR $>5^{\circ}$
gray board (occlusion control)	$+3.3^{\circ}$	$18\%$
ACA , hard-patch print	$+16.2^{\circ}$	$76\%$
ACA , smooth print	$+33.9^{\circ}$	$92\%$

Table 3: Cross-sequence universality, aggregated over held-out seq 14, 15, 20 and 21. The poster is trained on one window of seq 13 and evaluated unchanged.

	gray	hard print		smooth print
window (seq 13)	$\Delta_{\mathrm{rot}}$	$\Delta_{\mathrm{rot}}$	ASR	$\Delta_{\mathrm{rot}}$	ASR
0–15	$+1.3^{\circ}$	$+8.6^{\circ}$	$100\%$	$+11.3^{\circ}$	$100\%$
50–65	$+3.0^{\circ}$	$+5.6^{\circ}$	$62\%$	$+10.4^{\circ}$	$100\%$
100–115	$+1.5^{\circ}$	$+6.7^{\circ}$	$100\%$	$+9.3^{\circ}$	$100\%$
200–215	$+3.1^{\circ}$	$+11.9^{\circ}$	$100\%$	$+15.7^{\circ}$	$100\%$
500–515	$+3.7^{\circ}$	$+26.3^{\circ}$	$94\%$	$+57.9^{\circ}$	$100\%$

Table 4: Cross-window deployment of one trained artifact across all of KITTI seq 13, at

15^{\circ}

initial miscalibration. Cells are marginal rotation damage and ASR

>\!5^{\circ}

; gray is the same board with the adversarial content removed, measured per window. Twelve of 13 windows exceed their own control by more than

5^{\circ}

; window 2000–2015 does not.

target	role	gray	scram.	ACA
CalibNet [ 18 ]	white-box	$+3.43^{\circ}$	$+3.38^{\circ}$	$+18.87^{\circ}$
LCCNet [ 29 ]	transfer	$+0.98^{\circ}$	$+8.87^{\circ}$	$+6.55^{\circ}$
RGGNet [ 60 ]	transfer	$+1.44^{\circ}$	$+1.21^{\circ}$	$+1.16^{\circ}$

Table 5: Cross-architecture evaluation of an artifact optimized against CalibNet. LCCNet and RGGNet are evaluated without re-optimization.

detector	input	clean	attacked
PointPainting (fusion)	cam+LiDAR	$51.72$	$\mathbf{0.36}$
PointPillars (control)	LiDAR-only	$78.45$	$78.45$

Table 6: End-to-end downstream impact: Car 3D AP@R40 (Moderate, IoU

0.7

) on KITTI val (3,769 frames). The fusion detector collapses under ACA ; the extrinsic-free LiDAR-only control is unchanged (

\Delta\!=\!+0.04

), isolating the calibration corruption as the cause.

PointPainting condition	AP	corrupted
clean	$51.72$	nothing
Design A (GT FoV, bad paint)	$1.51$	association only
Design B (bad FoV+paint)	$\mathbf{0.36}$	association + FoV

Table 7: Mechanism ablation. Corrupting only the cross-modal association (Design A, geometry correct) is near-fatal on its own; the full deployment (Design B) additionally drops the real cars from the FoV crop.

region ( $15^{\circ}$ init)	poster	ASR $>5^{\circ}$	gray	net (mean/med)
trained window	$+44.1^{\circ}$	$89\%$	$+15.1^{\circ}$	$+29.0$ / $+28.9^{\circ}$
near held-out (same scene)	$+47.2^{\circ}$	$98\%$	$+17.9^{\circ}$	$+29.3$ / $+28.5^{\circ}$
far held-out (cross-scene)	$+39.4^{\circ}$	$94\%$	$+21.6^{\circ}$	$+17.8$ / $+15.6^{\circ}$

Table 8: ACA on nuScenes at

15^{\circ}

initial miscalibration, with a CalibNet surrogate fine-tuned on v1.0-trainval. Cells are marginal rotation damage (poster) and ASR

>\!5^{\circ}

; gray is the same board with no adversarial content; net isolates the learned texture. The net effect matches KITTI’s

+16

–

34^{\circ}

band.

Panel of Figure 7 — Figure 7: End-to-end attack in closed-loop Carla simulation. Each column, top to bottom: (1) the scenario in third person; (2) clean scenario without attack (green BEVFusion detection boxes); (3) the attacked frame, where the online calibrator is triggered and poisoned, leading to miscalibration errors of $7.72^{\circ}$ and $7.89^{\circ}$ , respectively, and wrong BEVFusion detection (red); and (4) the consequence—collision if adopting the miscalibration, permanent stop if triggering a failsafe policy.

Figure 8: Three cases: gray board, attack board, and no board.

Placement error	Gray control	ACA (mean/median)	ASR ${}_{>5^{\circ}}$
$0^{\circ}$	$-0.5^{\circ}$	$+6.1^{\circ}/+10.0^{\circ}$	$62\%$
$\pm 1.5^{\circ}$	$-0.3^{\circ}$	$+6.4^{\circ}/+9.8^{\circ}$	$62\%$
$\pm 3^{\circ}$	$-0.4^{\circ}$	$+4.5^{\circ}/+7.1^{\circ}$	$59\%$

Table 9: Physical Husky evaluation. ACA values show mean/median marginal rotation damage over the gray control; ASR is the fraction exceeding

5^{\circ}

. Sample counts are

n=120

840

, and

840

by row.

Physical Adversarial Attacks

Physical adversarial attacks exploit real-world objects, light, sound, or sensor interference to mislead machine-learning systems.

See all 83 papers

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving
Oct 12, 2026Ce Zhou, Yubo Wu, Khang Nguyen +3Camera-Radar Fusion Adversarial Robustness
Missouri University of Science and Technology, USA · Virginia Tech, USA · Michigan State University, USA
Native-Domain Cross-Attention for Camera-LiDAR Extrinsic Calibration Under Large Initial Perturbations
Mar 31, 2026Ni Ou, Zhuo Chen, Xinru Zhang +1Lidar-Camera Extrinsic Calibration Camera Calibration
Ni Ou, Junzheng Wang are with the School of Automation, Beijing Institute of Technology, Beijing, 100081, China. · Zhuo Chen is with the Robot Perception Lab, Centre for Robotics Research, Department of Engineering, King’s College London, London WC2R 2LS, United Kingdom. · Xinru Zhang is with the School of Integrated Circuits and Electronics, Beijing Institute of Technology, Beijing, 100081, China.
ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception
Jun 1, 2026Mellon M. Zhang, Siddhant Panse, Zimo Fan +3Lidar-Based 3D Object Detection Adversarial Attacks
Georgia Institute of Technology

Oct 12, 2026J/K move · Enter open · S save

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving

Ce Zhou, Yubo Wu, Khang Nguyen, Liyang Xiao+2

Missouri University of Science and Technology, USA · Virginia Tech, USA · Michigan State University, USA

Camera-Radar Fusion Adversarial Robustness Autonomous Driving Perception 3D Object Detection Depth Estimation

Open paper AskPDF arXiv

Autonomous driving (AD) relies on multi-sensor perception to interpret the surrounding environment. However, the robustness of camera--radar fusion under adversarial conditions remains largely unexplored. This paper presents a systematic measurement study of the robustness of camera--radar sensor fusion in AD. We construct a unified evaluation pipeline on the nuScenes dataset that simulates attacks on both sensing modalities, including eight camera-image perturbations and three radar point-cloud perturbations. We evaluate five camera--radar fusion algorithms across two perception tasks, 3D object detection and depth estimation, and quantify their performance under clean and attacked inputs using standard metrics. Our evaluation reveals a clear asymmetry in the robustness of fusion systems. Camera perturbations substantially degrade both object detection and depth estimation, and moderate attack strengths are already sufficient to cause severe performance degradation. In contrast, the evaluated radar perturbations produce smaller and task-dependent effects, with object-detection models showing particularly limited degradation. Our analysis attributes this difference to the strong dependence of existing fusion architectures on dense camera features, together with the filtering, association, and confidence-weighting mechanisms commonly applied to sparse radar measurements. These results demonstrate that sensor fusion does not inherently guarantee robustness and that the contribution and reliability of each sensing modality must be explicitly considered under adversarial conditions. Based on four empirical findings, we derive measurement-guided design implications for future robust camera--radar fusion, including modality-specific reliability estimation, cross-modal consistency checking, adaptive fusion, and graceful failover under severe sensor degradation.

Abstract

Physical Adversarial Attacks

Explore similar work

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving

Native-Domain Cross-Attention for Camera-LiDAR Extrinsic Calibration Under Large Initial Perturbations

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception