You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks

1 Introduction

• Prior work mainly lowered detector performance, leaving physical removal of genuine obstacle point clouds and its effects on AV driving behavior unexplored.The paper frames these as open questions about remote removal, realistic attack conditions, implications, and defenses.Source: §1 · pp. 1–2
• PRA uses laser injection to exploit LiDAR point-cloud transformations and filtering, removing genuine obstacle points before perception.The paper introduces PRA as a new attack family and describes leveraging existing laser-based spoofing techniques.Source: §1 · p. 2
• 45° attack capability is reported alongside obstacle-detection-rate drops of 43%–76% across three fusion models and failure of Integrated-Semantic Level Fusion when the target is fully removed.The evaluations also cover Apollo, PointPillars, and Autoware.Source: §1 · p. 2
• 92.7% success in removing 90% of target obstacle cloud points was achieved with a vehicle moving at 5 km/h.The paper also reports outdoor pedestrian attacks across lighting conditions and distances up to 10 meters.Source: §1 · p. 2
• The authors report that existing spoofing and object-hiding defenses are ineffective against PRA and propose two enhanced defense strategies.They evaluate defenses on synthesized and real-world attack traces, reporting TNR/TPR of 82.5%/91.2% for the first and 99.98%/100% for the second.Source: §1 · p. 2
• The work evaluates attack consequences in the LGSVL simulator and conducts real-world attacks on moving robots and vehicles.It also evaluates PRA against three state-of-the-art fusion models and two existing defenses.Source: §1 · p. 2

2.1 LiDAR Sensors in Autonomous Driving

• AV frameworks combine LiDAR and cameras across modules, and PRA targets automated point-cloud transformations in the sensor, middleware, and perception preprocessing.The paper focuses on spinning LiDARs used for obstacle detection and avoidance.Source: §2.1 · pp. 2–3
• A spinning LiDAR converts laser returns into point clouds whose points encode X, Y, and Z coordinates and intensity.It measures return time to estimate distance and captures return intensity while scanning around the vehicle.Source: §2.1 · p. 3

2.2 Spoofing Attacks on LiDAR Sensors

• Earlier spoofing attacks injected fake points, while object-hiding approaches manipulated detection confidence; PRA instead removes selected points before perception.The paper describes this lower-level removal as not requiring perception-module output knowledge or model-dependent adversarial examples.Source: §2.2 · p. 3
• PRA exploits sensor echo prioritization and automatic filtering to discard legitimate obstacle returns, which can leave the perception module without points needed for detection.The spoofing overview shows fake echoes sent below the LiDAR Minimum Operational Threshold.Source: §2.2 · p. 4, Figure 2 · p. 4

3.1 Physical Removal Attack Overview

• PRA injects invisible echoes below the LiDAR’s Minimum Operational Threshold (MOT), making it discard legitimate obstacle points in the range between the sensor and object.That range is the spoofing region, whose width varies with the LiDAR sensor and AD framework.Source: §3.1 · p. 4
• Synchronized laser pulses control spoofed-point locations; the attack angle ∆θ describes the affected horizontal view, and the resulting chord length is 2d × sin(∆θ/2).Pulse timing follows the victim LiDAR’s firing sequence; attack angle depends on the LiDAR and spoofer.Source: §3.1 · p. 4

3.2 Threat Model

• The threat model assumes the attacker can learn the LiDAR model and inject pulses of sufficient intensity, but does not require fine-tuning point locations into adversarial patterns.The attacker may estimate the spoofing region from the LiDAR and whether the vehicle uses ROS-based or Apollo-based frameworks.Source: §3.2 · pp. 4–5
• The attacker seeks to hide a scene region or specific obstacle, using roadside placement or a following vehicle and, for moving targets, potentially camera-based tracking.The attack aims to remove point-cloud regions remotely, below the MOT, with particular timing.Source: §3.2 · pp. 4–5

3.3 Attack Principles

• PRA exploits sensors’ preference for strong echoes: injected high-intensity echoes can become the recorded strongest returns, displacing genuine obstacle echoes.The attack can also remove points when the LiDAR records multiple echoes.Source: §3.3 · p. 5
• The spoofing region extends to the highest MOT among sensor, middleware, and framework thresholds; default examples give 90 cm for VLP-16 with Apollo and 40 cm with Autoware.Sensor-level filtering remains relevant even if middleware and framework thresholds are manually set to zero.Source: §3.3 · p. 6

4.1 Attack Design

• The attacker synchronizes spoofed echoes below the LiDAR minimum operating threshold to remove genuine returns across a selected attack region.A photodiode captures LiDAR scan signals to trigger the pulse train at the required timing.Source: §4.1 · p. 7, Figure 4 · p. 7

4.2 Attacker Capability

• 45° is the maximum stable attack angle in controlled scenarios; below it, the attack removes all region points at 80 points per degree.Capability is constrained by the LiDAR photodiode receptive field and the spoofer laser's output power.Source: §4.2 · p. 8, Figure 5 · p. 8

4.3 Removing Selected Obstacles

• At 4°, the attack removes more than 80% of traffic-cone points at every tested distance; complete removal requires 6° at 2 and 3 m, and 4° at 4 m.The tested cone was 2, 3, or 4 m from the LiDAR.Source: §4.3 · p. 9, Figure 6 · p. 9

4.4 Effect on AVs Perception Models

• Autoware fully removes vehicle and pedestrian clusters at 23° and 8°, while Apollo and PointPillars can miss obstacles before their point clouds are fully removed.The confidence of the perception models drops quickly as attack angle increases, especially for pedestrians.Source: §4.4 · p. 10

4.5 Impact on Fusion

• At 4° pedestrian attack, DEF detection rates drop 69% for FC and 76% for AVOD; AVE rates drop 43% and 61%, respectively.For vehicles at 15°, DEF rates drop 59% for FC and 76% for AVOD; AVE rates drop 48.6% and 69%, respectively.Source: §4.5 · p. 11, Table 2 · p. 11
• Autoware fusion detection falls to 0% just before full obstacle removal, when LiDAR and camera detections overlap by less than 50%.The fusion failure occurs regardless of the IoU threshold when almost all cloud points are removed.Source: §4.5 · p. 11

5 Physical Removal Attack Evaluation

• The evaluation covers outdoor attacker capability and LGSVL end-to-end effects, using chord length to quantify removal in real-world driving geometry.Chord length accounts for obstacle dimensions, LiDAR distance, and attack angle; the simulation varies attack start distance and angle.Source: §5 · p. 11, §5.2 · pp. 12–13

5.1 Outdoor Scenario

• The outdoor attack fully removed a walking pedestrian’s points and Autoware cluster when the pedestrian entered the attack region.The spoofer was 8 m from the LiDAR and the pedestrian 4 m in front of it; point-removal capability also decreased with distance and daylight conditions.Source: §5.1 · pp. 11–12, Figure 10 · p. 12, Figure 9 · p. 12

5.2 Impact on Driving Decisions

• The simulated attack removes all points in the attack region from Apollo’s input to model the sensor changes and assess real-time control decisions.The simulated LiDAR traces were modeled to match VLP-16 attack traces.Source: §5.2 · p. 12
• 40% of the AV’s route time with the obstacle in the attack region was enough for the attack to lead to severe consequences such as collisions.In LGSVL, the AV can accelerate while the obstacle is removed and still collide after it reappears if it is too close to stop.Source: §5.2 · p. 13, Figure 11 · p. 13, Figure 12 · p. 13
• LGSVL’s fixed-region ray casting and available GPU limited point-cloud resolution, and the simulator does not model LiDAR interference below 5° resolution.The authors nevertheless report severe collision consequences with a 5° attack angle.Source: §5.2 · p. 14

6.1 Technical Challenges and Solutions

• Moving attacks require LiDAR synchronization and accurate aiming, while sparse scans at a distance make synchronization difficult.A larger optical setup improves the photodiode’s receptive field, but its size and weight reduce attack capability over long distances.Source: §6.1 · p. 14
• A camera-based system detected and tracked the LiDAR to aim the spoofer, using stored aiming points calibrated for different distances.The SSD MobileNet model achieved 93 mAP at 50 IoU and ran at 20 FPS; SORT tracking ran at approximately 20 Hz.Source: §6.1 · pp. 14–15

6.2 Evaluation

• The moving-vehicle attack was feasible on both a robot and a car, but imprecise aiming prevented full removal in several frames.The robot moved at 0.1 m/s and the car at approximately 5 km/h; the car experiment used a traffic cone for safety.Source: §6 · p. 14, §6.2 · p. 15

7.1 Existing Defenses

• The defense analysis evaluates CARLO’s ray-casting approach because its alternative, Sequential View Fusion, requires a pedestrian model not supplied by its authors.The existing shadow-based defense was also tested after reproducing its benign-case object-shadow association rate.Source: §7.1 · pp. 15–16
• With all target points removed, the shadow-based hiding defense had 100% TNR and 0% TPR on 80 selected KITTI samples.It expects points in the frustum of a detected shadow to reveal a hidden object; CARLO reached 100% attack success under the stated threshold settings.Source: §7.1 · pp. 15–16

7.2 Proposed Defenses

• Fake Shadow Detection compares observed shadow regions with expected object shadows and flags a removal attack when the remaining shadow exceeds an empirical threshold of about 15 cubic meters.On 80 PRA samples and 80 benign cases, it achieved 82.5% TNR and 91.2% TPR.Source: §7.2 · p. 16
• Azimuth-based detection identifies gaps in sorted horizontal point-cloud angles; it achieved 99.98% TNR on 7,480 KITTI scenes and 100% TPR on 3,000 synthesized attack scenes.On collected VLP-16 traces, it achieved 100% TPR and TNR across 611 attack and 75 benign scenes, with 7.9 ms average runtime per KITTI scene; it does not cover spoofing or ORA attacks.Source: §7.2 · p. 16

8 Discussion

• The attack evaluation covers one spinning LiDAR and does not consider multiple LiDARs, solid-state LiDARs, or groups of LiDARs and cameras.The fusion-model evaluation attacks only the spinning LiDAR.Source: §8 · p. 16
• For moving vehicles, distance complicates synchronization and weakens spoofed signals, while higher speeds require more precise aiming.The authors identify larger optical systems, improved signal convergence, and higher-resolution motion or wider-area laser coverage as engineering needs.Source: §8 · pp. 16–17

• 92.7% success removing 90% of a target obstacle’s cloud points in moving-vehicle scenarios.Source: §9 · p. 17
• 45° attacker capability lets sensor-level point-cloud ablation cause perception modules to fail to recognize obstacles and their locations.Source: §9 · p. 17
• The study evaluates PRA’s effects on three AV perception and fusion models.Source: §9 · p. 17
• The authors propose two defense strategies to help mitigate the threat.Source: §9 · p. 17

• The outdoor spoofer emitted at most 4,000 pulses per 100 ms scan, with typical laser-diode emission power around 70 W and 40 ns pulse width.Source: A Laser Safety Details · p. 20
• At 905 nm and t = 0.25 s, the estimated maximum permissible exposure was 6.36 J/m2, and the calculation considered fewer than 12,000 pulses.Source: A Laser Safety Details · p. 20
• 11.6 mm was the radiated-area diameter in the setup, smaller than the measured size, which the authors say demonstrates outdoor-experiment safety.Source: A Laser Safety Details · p. 20

• PRA exploits automatic transformation and filtering common to commercial spinning LiDARs and popular AD frameworks, and was demonstrated across three object detectors and three fusion models.Source: B Generality of the Methodology · p. 20
• The authors argue the approach can generalize to other LiDAR-based AV perception systems, with other sensors likely vulnerable because they may share Velodyne VLP-16 interface and filter phases.Source: B Generality of the Methodology · p. 20
• The LiDAR spoofing capability can generalize across AV systems because it is independent of the AV system.Source: B Generality of the Methodology · p. 20