LiDAR is a critical sensor for autonomous driving and robotics, yet it remains vulnerable to adverse conditions such as fog, rain, transparent objects, and low-reflectance surfaces. Full-waveform LiDAR (FWL) addresses these limitations by capturing the complete return waveform as a histogram, preserving rich reflection characteristics including multi-path echoes and weak signals. While recent Transformer-based approaches have demonstrated promise on FWL data, two fundamental bottlenecks remain: high computational cost from redundant tokens in low-intensity background regions, and limited generalization due to scarce annotated training data. We address both bottlenecks by exploiting the physical structure inherent to FWL data. First, we propose FWL-ToPM, a token pruning and merging mechanism that leverages intensity distributions to selectively reduce tokens while retaining critical waveform content. Second, we introduce FWLAug, a data augmentation framework designed as a regularization method that preserves waveform structure, retaining the Time-of-Flight waveform of each ray and the frustum geometry, to improve generalization to unseen scenes. Evaluated on the Ghost-FWL benchmark, FWL-ToPM achieves over 8 times speedup at real-time throughput alongside a nearly 9-point F1 gain over the prior state of the art, establishing the first real-time FWL Transformer that simultaneously improves accuracy. FWLAug further improves performance on both the standard benchmark and an out-of-distribution test set of unseen scenes. Together, these methods push FWL-based perception toward practical deployment. The code and the OOD dataset are publicly available and can be accessed via the project page: https://keio-csg.github.io/FWL-ToPM
Figures & tables
Figure 1: Overview of the proposed framework. (Top) During training, FWLAug augments FWL samples while preserving ToF waveform structure and frustum geometry. High-intensity patches are selected by pruning, spatially reordered along a space-filling curve, and processed by the FWL-ToPM Encoder, which merges redundant tokens before self-attention and unmerges afterward across L Transformer blocks. (Bottom Left) Pruning removes low-intensity background tokens, and merging aggregates the remainder, concentrating computation on object-relevant waveform content. (Bottom Right) Proportion of pixel classes across intensity bins in FWL data. Most regions in FWL data correspond to noisy background, and our pruning strategy removes these dominant low-intensity regions.
Figure 2: Illustration of FWLAug. FWLShiftMix (top): an object in Sample 1 is shifted away from the LiDAR, creating a blank region Ωblank . A glass-containing region Ωsrc is then selected from Sample 2 and pasted into the blank, producing an augmented scene in which the waveform structure of each ray is preserved. FWLCutMix (bottom): a crop region Ωsrc containing minority class (glass) is selected from a source frame and pasted into a destination frame at a random location. Both methods prioritize glass-containing regions to mitigate class imbalance.
Method
Pruning
Merging
F1-mean
FPS
Scheuble et al. [ 31 ]
–
–
0.497
1.97
Ikeda et al. [ 10 ]
–
–
0.503
6.54
Ours w/o FWL-ToPM
–
–
0.555
2.01
DynamicViT [ 30 ]
✓
–
0.480
20.0
Ours w/Pruning
✓
–
0.591
20.3
ToMe [ 1 ]
–
✓
0.543
5.24
Table 1: Comparison with FWL-based methods and ablation of token pruning and merging components. For FWL-ToPM, we set ρlow=0.7 and ρm=0.9 . FWL-ToPM achieves the highest F1 and improves throughput by 8 × over the prior state of the art. Our pruning and merging components each outperform their image-based counterparts (DynamicViT and ToMe) and their combination achieves the best F1–FPS trade-off. All methods in this table are trained without FWLAug.
Figure 3: (Left) F1-mean vs. FPS trade-off for all compared methods. (Right) Comparison of F1-mean and FPS without additional training. For pruning and merging, ρlow and ρm are varied from 0 to 0.9, respectively. For pruning+merging, ρlow is fixed to 0.7 while ρm is varied. All models are trained without FWLAug.
Figure 4: Visualization of token merging on two real Ghost-FWL scenes. Color indicates patch intensity (red: high, white: low). After pruning low-intensity background tokens, the remaining high-intensity tokens are merged by aggregating similar-feature source tokens into destination tokens, reducing the total token count while preserving object-relevant content. The zoomed-in regions show that merged tokens retain the spatial structure of reflected objects across diverse scenes.
Method
FWLCutMix
FWLShiftMix
Ghost-FWL [ 10 ]
OOD Test
F1-mean
Glass
F1-mean
Glass
Ours w/o Aug
✗
✗
0.592
0.352
0.406
0.491
Ours w/ FWLAug
✗
✓
0.622
0.376
0.425
0.494
✓
✓
0.617
0.385
0.452
0.575
✓
✗
0.586
0.315
0.434
0.606
Table 2: Ablation study of FWLAug. To evaluate out-of-distribution generalization, we construct an OOD test set captured at a location entirely separate from Ghost-FWL [ 10 ] . The full FWLAug achieves the best F1 on the OOD test set, particularly for the minority Glass class, confirming improved generalization to unseen scenes.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 1: Our OOD Test Set. Based on the dense 3D maps as shown in Scene, we annotated FWL data with 4 labels: Ghost (red), Object (green), Glass (blue), Noise. Blue crosses indicate the LiDAR positions during data acquisition. The RGB images show the scenery of the capture locations.
Method
F1-mean
Object-F1
Glass-F1
Ghost-F1
FPS
Scheuble et al. [ 31 ]
0.497 ± 0.043
0.648
0.304
0.541
1.97
Ikeda et al. [ 10 ]
0.503 ± 0.005
0.680
0.268
0.561
6.54
Ours
0.592 ± 0.005
0.741
0.358
0.678
53.2
Appendix
Table 1: Statistical significance of the main comparison with FWL-based methods. F1-mean is reported as mean ± standard deviation over 3 independent runs with different random seeds. All methods are trained without FWLAug.
Figure 2: Waveforms along single rays in Ghost-FWL Scene 001 (left) and Scene 007 (right). Markers indicate annotated Object (green), Glass (blue), and Ghost (red) bins, labels indicate the Top-3 highest-intensity peaks of each ray, and the dashed line indicates the intensity threshold below which patches are pruned at ρlow=0.7 . The photographs show the corresponding scenes, with the red marker indicating the observed ray. Top-3 peak extraction discards the Object and the Glass return, whereas our intensity-based pruning retains both because they lie above the pruning threshold.
Setting
Curve
Object-F1
Glass-F1
Ghost-F1
F1-mean
Merging
Hilbert
0.690
0.349
0.652
0.564
Morton (Ours)
0.702
0.369
0.624
0.565
Pruning + Merging
Hilbert
0.740
0.355
0.672
0.589
Morton (Ours)
0.741
0.358
0.678
0.592
Appendix
Table 2: Comparison of space-filling curves used to serialize tokens for merging. F1 scores on the Ghost-FWL test set are reported. We set ρlow=0.7 (pruning + merging only), ρm=0.9 , and ρd=0.1 . All models are trained without FWLAug.
Figure 3: Qualitative comparison of classification results with existing FWL-based recognition methods.
LiDAR has become an essential sensing modality in autonomous driving, robotics, and smart-city applications. However, ghost points (or ghosts), which are false reflections caused by multi-path laser returns from glass and reflective surfaces, severely degrade 3D mapping and localization accuracy. Prior ghost removal relies on geometric consistency in dense point clouds, failing on mobile LiDAR's sparse, dynamic data. We address this by exploiting full-waveform LiDAR (FWL), which captures complete temporal intensity profiles rather than just peak distances, providing crucial cues for distinguishing ghosts from genuine reflections in mobile scenarios. As this is a new task, we present Ghost-FWL, the first and largest annotated mobile FWL dataset for ghost detection and removal. Ghost-FWL comprises 24K frames across 10 diverse scenes with 7.5 billion peak-level annotations, which is 100x larger than existing annotated FWL datasets. Benefiting from this large-scale dataset, we establish a FWL-based baseline model for ghost detection and propose FWL-MAE, a masked autoencoder for efficient self-supervised representation learning on FWL data. Experiments show that our baseline outperforms existing methods in ghost removal accuracy, and our ghost removal further enhances downstream tasks such as LiDAR-based SLAM (66% trajectory error reduction) and 3D object detection (50x false positive reduction). The dataset and code is publicly available and can be accessed via the project page: https://keio-csg.github.io/Ghost-FWL
LiDAR sensors are critical for autonomous driving perception, yet remain vulnerable to spoofing attacks. Jamming attacks inject high-frequency laser pulses that completely blind LiDAR sensors by overwhelming authentic returns with malicious signals. We discover that while point clouds become randomized, the underlying full-waveform data retains distinguishable signatures between attack and legitimate signals. In this work, we propose PULSAR-Net, capable of reconstructing authentic point clouds under jamming attacks by leveraging previously underutilized intermediate full-waveform representations and simultaneous laser sensing in modern LiDAR systems. PULSAR-Net adopts a novel U-Net architecture with axial spatial attention mechanisms specifically designed to identify attack-induced signals from authentic object returns in the full-waveform representation. To address the lack of full-waveform representations in existing LiDAR datasets under jamming attacks, we introduce a physics-aware dataset generation pipeline that synthesizes realistic full-waveform representations under jamming attacks. Despite being trained exclusively on synthetic data, PULSAR-Net achieves reconstruction rates of 92% and 73% for vehicles obscured by jamming attacks in real-world static and driving scenarios, respectively.
Ryo Yoshida, Takami Sato, Wenlun Zhang +7
Keio University, Yokohama, Japan · Sony Semiconductor Solutions, Atsugi, Japan · Hainan University, Haikou, China
Autonomous driving perception is typically evaluated on clean benchmark data, yet real-world deployment requires robustness to rare, structured, and potentially adversarial sensor anomalies. This gap is especially critical for LiDAR, where external actors can physically manipulate the sensing process to induce black-box perception failures without accessing the model. Existing LiDAR benchmarks provide little visibility into this failure mode. Prior adversarial LiDAR studies have largely centered on attack hardware, geometric and algorithmic defenses, and early-generation detectors, leaving the robustness of modern perception systems unexplored. To address this evaluation gap, we introduce ATLAS (Adversarial Temporal LiDAR Attack Suite), the first large-scale, physically grounded evaluation benchmark for LiDAR perception models under black-box sensor attacks, simulating the two primary attack modes -- point injection and point removal -- across real driving sequences. Evaluating a broad cross-section of current state-of-the-art LiDAR perception models, ATLAS reveals a surprising robustness asymmetry: models with stronger performance on standard benchmarks tend to better withstand removal attacks, yet are actually more vulnerable to injection attacks than weaker models. We trace this vulnerability to standard object database sampling augmentations, revealing how current training practices can induce architecture-agnostic robustness failures, and study initial directions for mitigating both attack modes. We release the ATLAS generation code to support extensible, reproducible evaluations as attack capabilities evolve, helping make black-box sensor robustness an explicit consideration in future LiDAR perception development.