LiDAR Point Cloud Injection

Mitigations focus on identifying statistical anomalies in the point cloud that deviate from expected sensor physics. Defenses include:

• Point cloud saliency analysis: Identifying clusters of points with disproportionately high influence on the detector's output.
• Sensor physics validation: Checking if injected points conform to the LiDAR's known beam pattern, intensity return profile, and multi-echo characteristics.
• Temporal consistency checks: Flagging objects that appear or disappear abruptly without a corresponding track initiation or termination.
• Adversarial training: Augmenting the training dataset with known attack patterns to harden the model.

A sophisticated attack that injects mutually consistent but false data across multiple virtual sensor modalities simultaneously. Unlike a single-sensor LiDAR injection, this technique creates a coordinated illusion across cameras, radar, and IMU streams.

• Corrupts the redundancy that sensor fusion architectures rely on for safety
• Forces the perception stack into a high-confidence false positive state
• Requires the attacker to understand cross-modal calibration parameters
• Often used to create phantom obstacles that appear in every sensor channel

An adversarial technique that identifies and leverages discrepancies between simulation and reality to cause a policy trained in simulation to fail upon deployment. LiDAR point cloud injection is a direct method of widening this gap.

• Exploits differences in sensor noise models, material reflectivity, and atmospheric scattering
• Attackers study the simulator's rendering pipeline to find blind spots
• Can cause an agent to behave correctly in simulation but catastrophically in the real world
• Mitigation requires high-fidelity domain randomization and adversarial training

An attack that corrupts the loop closure or graph optimization process in a SLAM system, causing a persistent and undetectable distortion of the agent's map and pose. Injected LiDAR points can serve as the attack vector.

• Targets the back-end optimization that corrects accumulated odometry drift
• Injected ghost points can create false loop closures that warp the entire map
• The distortion persists even after the malicious points are removed
• Particularly dangerous for multi-session SLAM where maps are reused

Input perturbations that cause misclassification or erroneous actions in multimodal and embodied agent systems. LiDAR point cloud injection is a physical-world instantiation of this broader adversarial machine learning concept.

• Includes both digital perturbations and physical adversarial objects
• Transferability allows attacks developed against one model to work on others
• Defenses include adversarial training, input sanitization, and certified robustness
• The 3D nature of point clouds creates a larger attack surface than 2D images

An attack that feeds a physics engine false information about object proximities, either masking a real collision or triggering a phantom one to halt or divert an agent. Injected LiDAR points can directly trigger collision avoidance systems.

• Exploits the narrow phase of collision detection algorithms
• Phantom obstacles can force emergency braking or evasive maneuvers
• Masked real obstacles allow an agent to collide with physical objects
• Requires understanding of the agent's safety envelope and reaction thresholds

A stealthy attack that slowly introduces a cumulative error into an agent's calculated pose or velocity, causing it to deviate from its intended path without triggering immediate alarms. LiDAR injection can seed this drift.

• Operates below the threshold of anomaly detection systems
• Exploits the integrator in Kalman filters and other state estimators
• Over time, the agent's perceived position diverges significantly from reality
• Can cause lane departures, navigation failures, or industrial robot misplacement