LiDAR Spoofing

The core mechanism exploits the sensor's distance calculation. A LiDAR unit emits a laser pulse and measures the round-trip time to calculate distance. An attacker fires a synchronized laser pulse at the sensor's photodetector before the real reflection returns, creating a phantom point closer than any real object. By delaying pulses, the attacker can also delete real obstacles by saturating the detector or injecting pulses during the real return window, causing the sensor to ignore the legitimate signal. This requires precise synchronization with the target LiDAR's firing pattern, typically achieved by eavesdropping on the sensor's pulsation frequency.

The most dangerous spoofing outcome is the creation of a dense cluster of false points that the perception system interprets as a solid obstacle. An attacker can sculpt arbitrary 3D shapes—such as a wall, a vehicle, or a pedestrian—in the victim's point cloud. The autonomous agent's planning stack will then execute an emergency braking maneuver or a dangerous swerve to avoid a non-existent hazard. Advanced attacks can even simulate moving phantom objects by dynamically shifting the injection timing across successive LiDAR frames, forcing the tracker to predict a collision trajectory.

The inverse of injection, this attack erases real obstacles from the point cloud. By flooding the LiDAR's photodetector with a strong, precisely timed optical pulse during the expected return window of a real object, the attacker blinds the sensor to that specific reflection. The resulting point cloud shows an empty road where a vehicle or pedestrian actually exists. This is particularly dangerous because the planning system sees no obstacle and maintains speed, leading to a high-velocity collision. The attack requires the adversary to know the approximate distance of the real object they wish to hide.

A brute-force approach that floods the LiDAR's photodetector with continuous-wave or high-repetition-rate laser energy. This overwhelms the dynamic range of the receiver, creating a large blind spot in the field of view or causing the entire sensor to shut down as a safety precaution. Unlike surgical spoofing, saturation does not create precise phantom objects but causes a denial-of-service condition for the perception system. The autonomous agent loses all spatial awareness in the affected sector and must rely on fallback sensors or enter a degraded safety mode.

A hardware-level countermeasure where each LiDAR pulse is encoded with a unique, cryptographically random modulation pattern—such as a pseudo-random binary sequence in the pulse intensity or phase. The sensor's receiver only accepts returns that match the expected modulation, rejecting any unmodulated or incorrectly modulated spoofing pulses. This is analogous to GPS signal authentication. The defense requires no software changes to the perception stack and provides a physical-layer integrity check that is extremely difficult for an attacker to forge without knowing the secret sequence in real-time.

A software-level defense that cross-validates LiDAR returns against other sensing modalities. If a phantom object appears in the LiDAR point cloud but has no corresponding detection in camera imagery, radar returns, or thermal signatures, the fusion system flags it as a spoofing artifact and suppresses it from the occupancy grid. This defense exploits the fact that physical-world spoofing attacks are typically modality-specific—an attacker capable of precisely spoofing LiDAR is unlikely to simultaneously spoof a high-resolution camera with a physically consistent visual rendering of the phantom object.

An attack on a robot or autonomous agent that identifies and exploits the discrepancies between a simulation-trained policy and the physical world to cause catastrophic failure upon deployment. LiDAR spoofing can specifically target these gaps by injecting point cloud patterns that the sim-trained perception stack has never encountered.

• Domain Randomization Bypass: Attacks exploit residual non-randomized parameters in simulation.
• Physics Engine Inconsistencies: Spoofed points can mimic artifacts that real physics engines fail to model.
• Sensor Noise Profile Mismatch: Injected signals exploit the difference between simulated and real sensor noise characteristics.

An attack on an agent's internal belief about its environment by corrupting the sensor measurements or dynamics model used by Kalman filters, particle filters, or factor graphs. By feeding falsified LiDAR returns, an attacker causes the agent to maintain a confidently wrong state estimate.

• Sensor Fusion Corruption: Spoofed LiDAR points introduce inconsistencies with camera or radar data, degrading fusion.
• Covariance Manipulation: Carefully timed injections can inflate or deflate the filter's uncertainty estimates.
• SLAM Degradation: Phantom points corrupt the map-building process, causing localization drift and navigation failure.