LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies

LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies

Speakers: Takami Sato

Conference: NDSS Symposium

YouTube: (no public video)

Overview

LiDAR (Light Detection And Ranging) technology stands as a cornerstone for precise, long-range 3D sensing, critically enabling the rapid advancement and deployment of autonomous driving (AD) systems. Its pivotal role in AD perception, however, also renders it a prime target for security research, with prior studies demonstrating that malicious laser attacks—known as LiDAR spoofing—can manipulate point clouds to induce both false positives (injecting non-existent objects) and false negatives (removing existing objects). This talk, "LiDAR Spoofing Meets the New-Gen," addresses significant research gaps in these prior efforts by conducting the first large-scale measurement study into LiDAR spoofing attack capabilities.

The research presented here by Takami Sato delves into the evolving landscape of LiDAR technology, specifically examining the vulnerabilities of both first-generation and emerging new-generation LiDAR models. Prior work often focused on a single LiDAR model (e.g., Velodyne VLP-16), made unvalidated assumptions about attack capabilities, and had limited diversity in evaluating object detector susceptibility. To rectify these limitations, the study comprehensively assesses nine popular LiDARs, three major types of object detectors trained on five different datasets, and introduces novel attack strategies and mathematical modeling. The work is guided by three key research questions: the realizability of prior attack assumptions for new-gen LiDARs, the differential vulnerabilities across LiDAR types with security features, and the impact of new-gen LiDAR features on popular object detectors.

Background

[▶ Watch: Introduction: Research gaps in LiDAR spoofing and study goals (0:00)]()

LiDAR systems operate by emitting laser pulses and precisely measuring the time-of-flight of their reflections to construct a detailed 3D understanding of the environment in the form of a point cloud. A significant technological shift is occurring with the advent of new-generation LiDARs. Unlike their first-generation predecessors, these advanced units often integrate components onto a single chip, facilitating sophisticated features such as Microelectromechanical Systems (MEMS) for scanning, Flash LiDARs for broad laser firing, and complex signal processing for enhanced robustness. Crucially, new-gen LiDARs incorporate security-related features like laser timing randomization and pulse fingerprinting, which had not been experimentally investigated in prior spoofing research. Within AD, DNN-based 3D object detection on point clouds is paramount, with methods broadly categorized as voxel-based (e.g., PointPillars), point-based (e.g., 3DSSD), and point voxel-based (e.g., PV-RCNN).

LiDAR spoofing attacks exploit the fundamental time-of-flight mechanism by firing external laser pulses at a victim LiDAR to manipulate 3D position measurements. These attacks are typically classified as synchronized or asynchronized based on their timing requirements, and by their effect: object injection or object removal. Synchronized attacks, which require precise timing with the victim LiDAR's scanning pattern (often achieved via a photodetector), are considered white-box attacks. Conversely, asynchronized attacks operate without knowledge of the LiDAR's internal scanning logic, making them black-box.

For object injection, early relay attacks could inject points but were limited in range and angle. More advanced synchronized attacks (e.g., 8, 9, 10, 12 in the original paper's citation list) improved this, injecting hundreds of points to cause false positives. A critical, yet unverified, assumption in these works was the Chosen Pattern Injection (CPI) capability, where an attacker could accurately inject a specific, pre-chosen 3D point cloud pattern. For object removal, the saturating attack used a strong continuous laser to induce measurement errors, but suffered from limitations in removal area and duration (e.g., 41x42 cm² for 4 seconds). More recent synchronized methods like ORA and PRA (Physical Removal Attack) aimed to displace points to undetectable regions. PRA, considered state-of-the-art, could remove 4,000 points by moving them within the LiDAR's Minimum Operational Threshold (MOT), thereby causing false negatives for critical objects like pedestrians. The present study builds upon and critically re-evaluates these foundational attacks.

Key Findings

[▶ Watch: LiDAR background, new-gen security features, and prior attack limitations (2:00)]()

The large-scale measurement study yielded 15 novel findings, challenging existing assumptions and revealing new insights into LiDAR vulnerabilities and defenses. These are summarized below, grouped by their core contributions:

1. Enhanced Spoofing Capabilities and CPI Realizability (RQ1):

• Finding 1: With significant spoofer improvements (optical and electronic setups), LiDAR spoofing attacks can inject over 6,000 points across more than 80 degrees, a 50% increase over previous studies (e.g., 6,131 indoors, 6,514 outdoors for VLP-16). This negates prior assumptions about spoofing distance and lighting conditions being limiting factors.
• Finding 2: The assumed Chosen Pattern Injection (CPI) capability is practically achievable with a well-calibrated spoofer, albeit subject to inherent inner-frame errors (approx. 10 cm) and inter-frame errors (approx. 35 cm).
• Finding 3: The demonstrated CPI capability, combined with a larger number of spoofable points and wider angle coverage, allows an attacker to directly inject a realistic "near-front vehicle" pattern. This challenges the effectiveness of model-level defenses that rely on the spoofer's inability to inject indistinguishable patterns.
• Finding 6: Accurate error modeling is crucial for evaluating object detector-level attack results. Prior "naive" models (e.g., adding Gaussian errors to Cartesian coordinates) significantly overestimate errors, leading to success rates that differ by an average of 96% and 70% compared to the systematic, experimentally quantified modeling.

1. New-Gen LiDAR Vulnerabilities and the Impact of Security Features (RQ1, RQ2):

• Finding 4: The latest synchronized spoofing attack for object injection is only applicable to first-generation LiDARs (e.g., VLP-16). New-gen LiDARs, equipped with features like timing randomization or pulse fingerprinting, effectively render synchronization-based CPI attacks virtually impossible. This directly invalidates prior work's design assumptions against a broader range of LiDARs.
• Finding 5: Current implementations of pulse fingerprinting (e.g., Hesai XT32) are not sufficiently complex to perfectly prevent spoofing attacks. While effective against synchronization, random spoofing can still inject points (up to 113 for XT32), indicating a need for more complex designs that also maintain eye safety.
• Finding 8: Timing randomization, even with low entropy, provides significant defense capabilities against object injection attacks, dramatically reducing attack success rates (e.g., to at most 34% compared to over 88% without randomization). Its effectiveness varies across different training datasets. Current pulse fingerprinting complexity does not significantly enhance this defense when combined.
• Finding 9: The basic design assumption of the latest object removal attack, PRA (Physical Removal Attack), is broken for new-generation LiDARs due to common features like timing randomization and pulse fingerprinting, which foil its synchronization requirement.
• Finding 10: Despite their robustness to PRA, new-gen LiDARs remain vulnerable to object removal attacks through a novel asynchronized design called High-Frequency Removal (HFR). HFR achieves similar practical attack capabilities, removing 4k-206k points across various new-gen models.
• Finding 11: Both timing randomization and pulse fingerprinting exhibit high defense capabilities against object removal attacks, with fingerprinting being particularly strong (reducing success rates by 63% for removal vs. only 3% for injection). This highlights a trade-off: detectors robust to false negatives (common in AD) are more vulnerable to injection but more robust to removal.

1. Object Detector Robustness and System-Level Impact (RQ3):

• Finding 7: While sufficiently complex pulse fingerprinting could offer high defense capability, the complexity level in today's LiDARs (e.g., n=100 for XT32) only reduces attack success rates by about 3% on average for injection attacks.
• Finding 12: The robustness of object detection models to both object injection and removal attacks is highly diverse and significantly dependent on the choice of training dataset (e.g., Waymo and Apollo models were robust to injection but vulnerable to removal, while Lyft and nuScenes models showed the opposite).
• Finding 13: Despite potentially weaker point cloud or detector-level capabilities, the HFR attack achieves similar system-level effects as PRA, leading to a 100% collision rate in simulations when attacks start at distances greater than 18m. This makes all LiDARs vulnerable to practical removal attacks at the system level. Notably, pulse fingerprinting (e.g., XT32) demonstrated high effectiveness at the system level, achieving a 0% collision rate.

1. Specific LiDAR Characteristics (Case Studies):

• Finding 14: For Flash LiDARs (e.g., Leddar Pixell), which are typically not susceptible to scanning LiDAR-focused attacks, relay attacks are effective for object removal.
• Finding 15: The Hesai XT32's zero-distance sensing capability (down to 0m) directly breaks the design assumption of the latest PRA attack, which relies on a non-zero Minimum Operational Threshold (MOT).

Technical Deep Dive

[▶ Watch: Prior attack's unvalidated assumption: Chosen Pattern Injection (CPI) (3:10)]()

The research established a comprehensive threat model where an attacker, equipped with a malicious laser spoofer, can operate from various AD scenarios such as a front vehicle, an adjacent lane, or the roadside.

The study's backbone is its large-scale measurement setup, encompassing a diverse array of targeted LiDARs. This included nine popular models: three first-generation (Velodyne VLP-16, VLP-32c, VLS-128) and six new-generation (Leddar Pixell, Ouster OS1-32, Intel Realsense L515, Horizon, Hesai XT32, Helios 5515). These LiDARs span operating ranges from 9m to 300m, utilize various scanning types (rotating, MEMS, Flash), and incorporate crucial security mechanisms like simultaneous laser firing, timing randomization, and pulse fingerprinting. This breadth represents the first large-scale study covering such a diverse range of LiDAR models and generations.

For targeted object detection models and datasets, the study included five popular DNN-based 3D object detectors: PointPillars, SECOND, Part-A2 (voxel-based), 3DSSD (point-based), and PV-RCNN (point voxel-based). To assess the impact of training data, PointPillars was evaluated across five distinct versions trained on the KITTI, Waymo, nuScenes, Lyft, and Apollo 6.0 datasets. All pre-trained models were sourced from MMdetection3D, OpenPCDet, or the Apollo repository.

Crucially, the researchers implemented significant spoofer improvements to enhance attack capabilities. On the optics side, prior setups suffered from uncontrolled laser beam diffusion or convergence, limiting the number and angular coverage of spoofable points. The improved design utilizes a collimated beam setup with a 25.4mm focal length plano-convex lens and a hollow screw for precise calibration. This allowed the spoofer to maintain a large number and wide angular coverage of spoofable points robustly over hundreds of meters. Electronically, the photodetector (PD) amplifier was improved for increased laser detection accuracy, and the function generator (FG) setup was refined to achieve precise nanosecond-level configuration and calibration. These enhancements demonstrably increased spoofed point number, angle coverage, pattern control, and robustness over distance. The raw hardware design files and bill of materials have been released for reproducibility.

The study reproduced the latest synchronized spoofing techniques for object injection and the Physical Removal Attack (PRA) for object removal. However, a significant contribution is the identification and development of a new asynchronized spoofing technique for object removal called High-Frequency Removal (HFR). Motivated by the limitations of the original saturation attack (small removal area, short duration) and the inapplicability of PRA to new-gen LiDARs due to their synchronization requirements, HFR adapts the saturation attack. Instead of a continuous high-power laser, HFR employs high-frequency pulsed lasers. The core principle is to fire a large number of attack laser pulses at a frequency higher than the victim LiDAR's firing frequency. This ensures that the attack laser hits every legitimate laser-firing event within the spoofer's scanning range, critically without requiring synchronization. The random receiving timing of the attack laser causes legitimate surface points to be moved to random positions or undetectable areas (e.g., within the Minimum Operational Threshold (MOT)), effectively destroying point cloud patterns and achieving object removal.

To enable large-scale, systematic measurements, the research developed novel mathematical models for point injection and removal capabilities. The injection model (Eq. 1 in the paper) is the first to systematically incorporate CPI attack capability, pulse fingerprinting (modeled as random downsampling of the chosen pattern), inner-frame errors (sampled from N(0, 10cm)), inter-frame errors (sampled from N(0, 35cm)), and timing randomization errors (based on measured distributions, e.g., 1.4µs to 4.5µs standard deviation). This comprehensive model covers features of both first- and new-generation LiDARs. The removal model (Eq. 2 in the paper) utilizes a per-azimuth probability (pj) derived from measurements to determine if a point is removed. For HFR, removed points are distributed randomly (U(a,b)), while for PRA, they are moved to the origin (MOT). These models were validated against prior "naive" error modeling, demonstrating significant improvements in accuracy, with differences in success rates up to 96% and 70%.

Demo / Proof of Concept

[▶ Watch: Large-scale study setup: Diverse LiDARs and object detectors (4:00)]()

The "demo" in this context refers to the extensive, first-of-its-kind large-scale measurement study itself, which systematically demonstrated the feasibility and impact of these enhanced and novel LiDAR spoofing attacks. The researchers conducted rigorous experiments in controlled indoor and outdoor environments, utilizing their significantly improved spoofer hardware and sophisticated mathematical models.

For object injection, they empirically validated the Chosen Pattern Injection (CPI) capability on the Velodyne VLP-16. This involved demonstrating the ability to inject over 6,000 points, exceeding prior benchmarks by 50%, and quantifying the precision limitations through measured inner-frame errors (10 cm) and inter-frame errors (35 cm). The ability to inject a realistic "near-front vehicle" pattern directly challenged assumptions about the spoofer's pattern control. For new-generation LiDARs, where synchronized CPI was impossible, they demonstrated injection vulnerability using a random attack with high-frequency pulses. The varied results (e.g., Horizon: >19k points, OS1-32: 28 points) highlighted the impact of different security features. The impact of pulse fingerprinting was demonstrated by varying the downsampling levels (n) in the injection model, showing that current complexity (n=100) reduced success rates by only 3%, while significant defense required much lower n values (e.g., n=10). The efficacy of timing randomization was demonstrated by showing dramatic reductions in attack success rates (to at most 34% from over 88%) across various models and datasets.

For object removal, the study demonstrated the enhanced capability of PRA on VLP-16, achieving over 6,600 removed points (a 65.5% increase). Crucially, the High-Frequency Removal (HFR) attack was demonstrated as a universally applicable asynchronized method, effective on both first- and new-gen LiDARs. HFR achieved comparable removal capabilities to PRA on first-gen LiDARs (over 5,300 points in >85 degrees azimuth) and proved highly effective on new-gen models, removing between 4,000 and 206,000 points. The system-level impact of these attacks was demonstrated using the Baidu Apollo 7.0 autonomous driving stack integrated with the LGSVL simulator. HFR achieved a 100% collision rate when the attack began at distances greater than 18m, mirroring PRA's effectiveness. In contrast, the Hesai XT32, with its pulse fingerprinting, achieved a 0% collision rate, providing a clear system-level proof of concept for the effectiveness of certain sensor-level defenses.

Defensive Implications

[▶ Watch: Introducing High-Frequency Removal (HFR) and spoofer improvements (6:00)]()

The findings provide critical insights for developing more robust defenses against LiDAR spoofing attacks, categorized into sensor-level and software-level strategies.

For sensor-level defenses, the study evaluated existing and potential mechanisms (summarized in Table X of the original paper):

• Timing Randomization: This feature emerged as highly effective against both object injection and removal attacks. Its implementation has minimal limitations regarding eye safety, latency, or sensing range. The researchers strongly recommend its widespread adoption in future LiDAR designs as a cost-effective and potent security measure.
• Pulse Fingerprinting: Showed mid-level effectiveness against injection attacks but high effectiveness against removal attacks. However, current implementations (e.g., XT32's n=100 complexity) were found to lack sufficient complexity to be fully robust. There's a dilemma in increasing fingerprinting complexity (which often requires more pulses per measurement) while maintaining eye safety and detection range. Future research should explore more complex coding designs that use fewer pulses or leverage human-eye-resistant wavelengths like 1550nm.
• Simultaneous Firing: While it offers some low-level defense against injection by preventing precise CPI, it provides no discernible defense against removal attacks. Its primary purpose is often related to scanning speed and density, not security.

For software-level defenses, the findings necessitate a re-evaluation of prior work:

• Existing injection defenses such as CARLO, SVF, and Shadow-Catcher often assume that spoofers cannot precisely control complex point cloud patterns. This assumption is directly challenged by the demonstrated CPI capability on first-generation LiDARs (e.g., VLP-16) with improved spoofers. Future research on these software defenses should specifically focus on their efficacy against new-generation LiDARs and the enhanced spoofer capabilities.
• For removal attacks, PRA is a relatively new threat. For the novel High-Frequency Removal (HFR) attack, a potential defense could involve detecting the unique "salt-and-pepper noise" or highly randomized point distribution it causes. Such patterns are rare in benign environmental conditions, suggesting that AD perception systems could be trained or programmed to identify and filter out these anomalous point clouds.

The study also highlighted the significant variability in object detector robustness based on training datasets. This suggests that AD developers should carefully consider the diversity and adversarial robustness of their training data to build systems that are resilient to various spoofing attack vectors.

Key Takeaways

• Underestimated Attacker Capabilities: Prior LiDAR spoofing research significantly underestimated the capabilities of well-engineered spoofers. With improved optics and electronics, attackers can inject over 6,000 points and achieve precise Chosen Pattern Injection (CPI) on first-generation LiDARs, enabling direct injection of realistic object patterns.
• New-Gen LiDARs Introduce New Challenges and Defenses: Features like timing randomization and pulse fingerprinting in new-generation LiDARs effectively foil synchronized attacks like CPI and PRA. However, this necessitates new attack strategies like High-Frequency Removal (HFR), an asynchronized attack effective against all LiDARs.
• Timing Randomization is a Strong Defense: Timing randomization consistently demonstrated high effectiveness against both injection and removal attacks, making it a critical sensor-level defense that should be widely adopted in future LiDAR designs.
• Pulse Fingerprinting Needs More Complexity: While pulse fingerprinting shows promise, especially against removal attacks, current implementations lack sufficient complexity to provide robust defense against sophisticated spoofing, particularly for injection attacks.
• Detector Robustness Varies Wildly: The vulnerability of 3D object detectors to spoofing attacks is highly dependent on their architecture and, critically, the dataset they were trained on. Models robust to injection might be vulnerable to removal, and vice-versa.
• System-Level Impact Remains Critical: Despite varying point cloud or detector-level success rates, attacks like HFR can achieve 100% collision rates in simulated AD environments, underscoring the severe real-world safety implications of LiDAR spoofing.

About the Speaker(s)

The talk was presented by Takami Sato. No further biographical details regarding their title or company were provided within the transcript or metadata.