Sensor Spoofing

Projects carefully timed laser pulses at an autonomous vehicle's LiDAR sensor to inject phantom points or delete real obstacles from the resulting 3D point cloud. Attackers exploit the sensor's time-of-flight calculations by firing pulses that arrive just before the genuine reflection, creating false distance measurements. Advanced variants use photodiodes and delay lines to capture, delay, and re-emit the original signal, shifting perceived object positions by meters. This can cause emergency braking for non-existent obstacles or completely erase a pedestrian from the point cloud.

Broadcasts counterfeit satellite signals that overpower legitimate GNSS signals, causing the receiver to compute a false position, velocity, or time. A software-defined radio generates signals mimicking the GPS constellation, gradually increasing power to avoid triggering anomaly detectors. The victim's navigation solution drifts to attacker-chosen coordinates. Consequences include:

• Autonomous vehicles taking wrong exits or entering restricted zones
• Drone geofencing being bypassed, enabling flight into no-fly areas
• Timestamp corruption in distributed systems relying on GPS-disciplined clocks
• Maritime vessels deviating from shipping lanes without crew awareness

Uses directed light sources to saturate or confuse camera sensors. Laser dazzling floods the CMOS sensor with high-intensity light, creating blooming artifacts that obscure objects in critical regions of the frame. Rolling shutter attacks exploit the sequential readout of CMOS sensors by pulsing modulated light at frequencies synchronized with the shutter, injecting structured patterns that object detectors misinterpret. Infrared LED arrays can project adversarial patches invisible to humans but clearly captured by night-vision cameras, causing traffic sign misclassification.

Exploits the resonant frequencies of MEMS-based accelerometers and gyroscopes using acoustic or ultrasonic waves. Capacitive MEMS sensors mechanically vibrate when exposed to sound at their resonant frequency, producing spurious acceleration readings that the sensor interprets as legitimate motion. Attackers can:

• Cause drones to oscillate violently and crash by injecting false angular rate data
• Induce phantom steps in pedestrian dead-reckoning systems
• Trigger unnecessary stability corrections in balancing robots
• Corrupt sensor fusion outputs by poisoning the IMU data stream that Kalman filters rely on

Manipulates the wheel speed sensors and rotary encoders that ground robots use for dead-reckoning localization. Magnetic attacks place strong neodymium magnets near Hall-effect sensors to saturate or mask the magnetic field variations from encoder wheels, causing the system to report zero velocity while the robot is actually moving. Electromagnetic interference injected into unshielded encoder cables can induce false pulse counts, corrupting the odometry estimate. This causes the robot to believe it has traveled a different distance or trajectory than reality, leading to navigation failures in GPS-denied environments like warehouses.

Targets the ultrasonic rangefinders commonly used for close-range obstacle detection in robots and automotive parking systems. Jamming attacks emit continuous ultrasonic noise at the sensor's operating frequency (typically 40-50 kHz), saturating the receiver and preventing it from detecting genuine echoes. More sophisticated spoofing attacks replay crafted echo patterns with precise timing to fabricate obstacles at arbitrary distances. This can force a robot to halt for phantom walls or, conversely, mask a real obstacle by canceling its echo with destructive interference, causing collision.

A physical-layer attack that projects carefully timed laser pulses at an autonomous vehicle's LiDAR sensor to inject phantom points or delete real obstacles from the resulting 3D point cloud. Attackers can create false positive obstacles causing emergency braking, or delete real objects from perception entirely. Advanced variants use photodiodes to synchronize with the victim's pulse repetition frequency, enabling precise point injection at arbitrary distances.

An attack that creates adversarial perturbations in the physical world—such as stickers, 3D-printed objects, or altered textures—designed to fool perception systems under varying lighting and angles. Unlike digital-only attacks, these must maintain robustness to viewpoint shifts, distance changes, and environmental noise. Expectation Over Transformation (EOT) is the standard technique for generating these perturbations by optimizing over a distribution of real-world transformations.

A localized, often physically realizable perturbation pattern that, when placed in a scene, causes an object detector or classifier to ignore or misidentify the target object. Patches are designed to be printed and placed in the environment, making them practical for real-world attacks. They exploit the spatial invariance of convolutional neural networks, creating a region of the input that dominates the model's attention and suppresses other features.

An attack on an agent's internal belief about its environment by corrupting the sensor measurements or dynamics model used by a Kalman filter or particle filter, causing the agent to act on a false state. By injecting biased noise into inertial measurement units (IMUs) or wheel odometry, attackers can cause gradual drift in the agent's position estimate that compounds over time, leading to navigation failures without triggering anomaly detectors.

An attack on a robot or autonomous agent that identifies and exploits the discrepancies between a simulation-trained policy and the physical world to cause catastrophic failure upon deployment. Attackers study the domain randomization parameters used during training and craft physical inputs that fall outside the simulated distribution. This includes exploiting unmodeled physics like specular reflections, non-rigid body dynamics, or sensor noise profiles absent from the simulator.

A perturbation crafted to simultaneously fool multiple sensing modalities—such as vision, audio, and depth—or to exploit inconsistencies in how a model fuses cross-modal information. For autonomous vehicles, an attack might place an adversarial texture on a stop sign that is invisible to RGB cameras but creates a phantom depth discontinuity in stereo vision, causing the fusion module to hallucinate a non-existent obstacle.