Simultaneous Localization and Mapping Poisoning

The attacker injects a false positive loop closure constraint into the pose graph. This forces the optimizer to reconcile the current pose with a distant, incorrect historical pose, creating a catastrophic map distortion. The agent's trajectory is warped to satisfy the fraudulent constraint, causing it to navigate based on a completely corrupted spatial understanding without triggering standard sensor anomaly alerts.

This attack directly tampers with the backend optimization process by modifying the edges (constraints) between nodes (poses) in the factor graph. By subtly altering the information matrix associated with an odometry or landmark edge, the attacker can introduce a slow, systematic bias. The global map remains locally consistent, making the drift invisible to local consistency checks while progressively skewing the entire reference frame.

An adversary spoofs or relocates static environmental landmarks within the agent's perceptual data stream. By shifting the recognized position of a key visual feature (e.g., an AprilTag or a distinct architectural corner) over successive frames, the attacker anchors the agent's bundle adjustment to a moving reference. This causes the agent to silently recalibrate its own position relative to a false fixed point, leading to precise but incorrect navigation.

The attacker compromises the frontend odometry stream by injecting a persistent, low-magnitude bias into the inter-frame motion estimates. Unlike sensor spoofing that creates obvious jumps, this attack adds a mathematically consistent drift vector—such as a constant 0.1-degree yaw bias per second—that accumulates over time. The Extended Kalman Filter or factor graph incorporates this as legitimate motion, causing the agent's belief state to diverge smoothly from physical reality.

During the mapping phase, the attacker inserts adversarial training samples into the environment's representation. This could involve placing physical adversarial patches in the environment that are recorded during the mapping run. When the agent later localizes against this poisoned map, the corrupted features cause a feature mismatch that forces the localization algorithm to converge on an attacker-chosen incorrect pose, effectively creating a logic bomb in the spatial database.

This attack targets the global localization or 'kidnapped robot' recovery module. By presenting a carefully crafted sensor view that matches a distant, incorrect location in the pre-built map with high confidence, the attacker forces the system to instantly 'teleport' its belief state. The agent's pose is snapped to a false location, and all subsequent navigation is executed relative to this hijacked origin, bypassing the gradual drift detection mechanisms of the SLAM backend.

A sophisticated attack that injects mutually consistent but false data across multiple virtual sensor modalities simultaneously. The attacker crafts coordinated spoofed inputs for LiDAR, camera, and IMU sensors that all corroborate the same false reality. This cross-modal consistency makes the deception extremely difficult to detect through traditional sensor disagreement checks. Key techniques include:

• Generating adversarial point clouds that align with manipulated visual frames
• Injecting false inertial measurements that match fabricated odometry
• Exploiting the fusion algorithm's trust weighting to override legitimate sensor readings
• Creating phantom obstacles that persist across all perception channels

A stealthy attack that introduces a slowly accumulating error into an agent's calculated pose, position, or velocity. Unlike abrupt spoofing attacks that trigger immediate anomaly detection, drift attacks operate below the threshold of standard residual monitoring. The attacker injects sub-threshold perturbations into the Extended Kalman Filter or factor graph optimization that compound over time. Attack characteristics:

• Error grows linearly or exponentially over the mission duration
• Agent deviates from intended path without triggering fault detection
• Particularly effective against long-duration autonomous navigation tasks
• Can cause physical collisions or mission failure after extended operation

A direct attack on the place recognition module of a SLAM system that corrupts the mechanism used to correct accumulated drift. The attacker injects false loop closure constraints that force the pose graph optimizer to reconcile contradictory spatial information. Attack vectors include:

• Inserting fraudulent visual feature matches between non-identical locations
• Manipulating the bag-of-words database to create phantom revisitations
• Exploiting the perceptual aliasing vulnerability in appearance-based place recognition
• Causing the optimizer to warp the map to satisfy conflicting constraints
• Creating persistent map distortions that survive subsequent optimization cycles

The act of feeding an agent's perception pipeline with crafted, malicious data streams that manipulate its understanding of the environment. This attack targets the raw sensor interfaces before fusion occurs. Common spoofing modalities:

• LiDAR spoofing: Injecting phantom points to create ghost obstacles or erase real ones
• Camera spoofing: Projecting adversarial patterns that cause misclassification
• IMU spoofing: Generating false acceleration and rotation data to corrupt dead reckoning
• GPS spoofing: Broadcasting counterfeit satellite signals to shift global position estimates
• Ultrasonic spoofing: Using tuned acoustic signals to blind proximity sensors

An attack that exploits a generative world model's tendency to confabulate plausible but entirely false environmental predictions. When an agent uses a learned dynamics model for planning, the attacker triggers the model to generate convincing yet fabricated future states. Exploitation mechanisms:

• Triggering the model to predict non-existent obstacles in the planned path
• Causing the model to hallucinate open pathways through solid barriers
• Forcing the agent to plan trajectories based on a false understanding of environment dynamics
• Leveraging the agent's own learned priors against it for stealthier attacks

An integrity attack involving the unauthorized modification of critical environmental variables within a simulation used for training or testing SLAM systems. By altering parameters such as gravity, friction coefficients, or sensor noise profiles, the attacker creates a mismatch between the simulated and real-world dynamics. Tampering targets:

• Modifying IMU noise characteristics to corrupt filter tuning
• Altering feature extraction thresholds to degrade visual odometry
• Changing lighting models to create adversarial visual conditions
• Manipulating the motion model to introduce systematic biases in prediction steps