LiDAR-SHIELD: A Fully Dockerized Adversarial Robustness Assessment Framework for LiDAR-Based 3D Perception Models

Alexandros Gkillas; Ioulia Kapsali; Christos Anagnostopoulos; Aris S. Lalos

cs.CVOct 29, 2026

LiDAR-SHIELD: A Fully Dockerized Adversarial Robustness Assessment Framework for LiDAR-Based 3D Perception Models

Authors: Alexandros Gkillas, Ioulia Kapsali, Christos Anagnostopoulos, Aris S. Lalos

Organizations: AviSense.AI, Patras Science Park, Greece · Industrial Systems Institute, Athena Research Center, Patras Science Park, Greece

Abstract

LiDAR-based 3D perception underpins autonomous driving and robotics, yet deploying these models safely requires stress-testing them against adversarial inputs before real-world use. Although state-of-the-art adversarial attacks exist, their implementations are often fragmented across individual repositories, each tied to a specific architecture or task and requiring manual environment reconstruction and model-specific integration code. We present LIDARSHIELD, a unified and fully Dockerized framework that reverses this workflow: rather than installing the target model inside the toolkit, LIDARSHIELD exposes any model through three lightweight HTTP endpoints, namely /info, /forward, and /gradient As a result, connecting a new model or dataset requires only a single loader function or adapter. The framework supports both 3D semantic segmentation and 3D object detection through the same engine-service protocol, integrating a task-aware suite of state-of-the-art attacks, including PGD and Square Attack for segmentation, and point perturbation, point removal, point injection, and LiDAttack for detection. This enables systematic exposure of corner cases and vulnerabilities across heterogeneous LiDAR backbones. The LiDAR-Shield codebase is publicly available at https://github.com/alexandrosgk/LiDAR-shield.

Figures & tables

Fig. 1: LiDAR-SHIELD architecture. The target model stays in its native environment and is reached through three HTTP endpoints ( /info , /forward , /gradient ). A data contract normalizes dataset samples on the left and a model contract normalizes backbone access on the right, leaving the engine to run a task-aware, model-agnostic attack pipeline. White-box attacks use /gradient ; black-box attacks use /forward only.

Task	Attack	Access	Perturbation Space
3D segmentation	PGD	White-box	Range-view tensor
3D segmentation	Square Attack	Black-box	Range-view tensor
3D detection	Point perturbation, removal, injection	White-box	Point cloud
3D detection	LiDAttack	Black-box	Point cloud

TABLE I: Task-specific attack support in LiDAR-SHIELD .

		Point Perturbation: $\epsilon$ (cm)						Point Removal: Drop Ratio (%)						Point Injection: $\epsilon$ (m)
		5		7		10		0.5		1.0		1.5		0.3		0.5		0.7
Dataset	Detector	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD	mAP Ratio	CD
KITTI	SECOND	90.91	0.00403	83.10	0.00703	65.48	0.01247	83.15	0.00255	74.18	0.00649	67.98	0.01533	71.73	0.00083	65.28	0.00195	71.12	0.00703
KITTI	PointPillars	33.02	0.00399	19.56	0.00703	10.59	0.01252	80.25	0.01247	62.07	0.03597	57.40	0.06159	87.85	0.00014	75.83	0.00032	76.76	0.00057
CARLA	SECOND	89.06	0.00466	82.80	0.00842	73.21	0.01533	95.28	0.02177	91.77	0.07035	85.32	0.19999	87.72	0.00054	78.46	0.00126	77.24	0.00226
CARLA	PointPillars	22.82	0.00452	13.87	0.00823	3.46	0.01500	89.97	0.01924	85.23	0.05876	80.02	0.11100	95.93	0.00011	93.90	0.00021	89.72	0.00037

TABLE II: Adversarial impact on 3D detection across KITTI and CARLA: mAP ratio (%) and Chamfer Distance (CD).

$\ell_{2}$ attack
Dataset	Method	mIoU
		$\boldsymbol{\epsilon{=}3}$	$\boldsymbol{\epsilon{=}6}$	$\boldsymbol{\epsilon{=}9}$
SemanticKITTI	No Attack	64.7	64.7	64.7
SemanticKITTI	Attack	50.1	46.9	41.7
SemanticPOSS	No Attack	52.7	52.7	52.7
SemanticPOSS	Attack	39.8	36.5	34.4

TABLE III: Segmentation robustness on SemanticKITTI and SemanticPOSS.

	Segmentation (SemanticKITTI)		Detection (KITTI)
	No Attack	Square Attack	No Attack	LiDAttack
mIoU / mAP	64.70	19.50	70.43	52.51

TABLE IV: Black-box robustness.

	LENet [ 11 ]		CENet [ 9 ]		FIDNet [ 10 ]
	Clean	Attack	Clean	Attack	Clean	Attack
SemanticKITTI, $\epsilon=6$	64.70	46.90	61.70	44.30	60.80	44.10

TABLE V: Segmentation backbone robustness, SemanticKITTI (

\ell_{2}

\epsilon=6

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 484 papers

Comprehensive Robustness Analysis of LiDAR-based 3D Object Detection in Autonomous Driving
Jul 2, 2026Adwait Chandorkar, Kai Krink, Yerdana Maulenbay +2Lidar-Based 3D Object Detection Adversarial Robustness
Institute for TMDT, University of Wuppertal, Germany · IKB Faculty of Science, University of British Columbia, Canada
ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception
Jun 1, 2026Mellon M. Zhang, Siddhant Panse, Zimo Fan +3Lidar-Based 3D Object Detection Adversarial Attacks
Georgia Institute of Technology
Explainability-Aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors
Jun 29, 2026Chengzeng You, Binbin Xu, Soteris DemetriouFeature Attribution Lidar-Based 3D Object Detection
Imperial College London, UK · Now at Google.

Jul 2, 2026J/K move · Enter open · S save

Comprehensive Robustness Analysis of LiDAR-based 3D Object Detection in Autonomous Driving

Adwait Chandorkar, Kai Krink, Yerdana Maulenbay, Hasan Tercan+1

Institute for TMDT, University of Wuppertal, Germany · IKB Faculty of Science, University of British Columbia, Canada

Lidar-Based 3D Object Detection Adversarial Robustness Adversarial Examples 3D Object Detection

Open paper AskPDF arXiv

Recent advancements in LiDAR-only 3D object detection have demonstrated improved detection accuracy over benchmark datasets. However, the adversarial robustness of these models remains untested. Very few adversarial robustness studies exist for LiDAR-only 3D object detection and unfortunately, even they are limited to legacy models. Moreover, there is a systemic gap in the existing evaluation frameworks that rely simply on mAP ignoring other structural and predictive factors. To fill this gap, we propose a holistic framework that evaluates adversarial robustness using two structural factors (point cloud density and point cloud localization) and three predictive factors (misclassification, localization error, distance from ego). Using this framework, we perform an empirical study and critical analysis on recent and legacy state-of-the-art models using adversarial attacks specifically designed for LiDAR-based models. Our key finding is that high-capacity, voxel-based detectors are more susceptible to structured coordinate perturbations than pillar-based detectors. Additionally, non-anchor-based detectors demonstrate poor adversarial robustness, which necessitates rethinking model training techniques. Overall, our results demonstrate that recent models are as vulnerable to adversarial attacks as their predecessors. Therefore, we argue that there is a need to improve the evaluation benchmarks for 3D object detection that not only reward architectural modifications for improving detection accuracy, but also evaluate whether the design choices improve adversarial robustness.

Abstract

Adversarial Robustness

Explore similar work

Comprehensive Robustness Analysis of LiDAR-based 3D Object Detection in Autonomous Driving

ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception

Explainability-Aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors