MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

• URL: http://arxiv.org/abs/2603.11364v1
• Date: Wed, 11 Mar 2026 23:03:05 GMT
• Title: MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM
• Abstract summary: LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency.<n>Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection.<n>We show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans.
• Score: 5.450994180292697
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.

Related papers

• Explainability-Aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors [5.47472857635307]
  Saliency-LiDAR method produces universal saliency maps for LiDAR-based 3D object detectors.<n>We design the Explainability-aware Frustum Attack (EFA), which selectively perturbs only the most influential frustums rather than uniformly attacking entire object regions.<n>EFA reduces detection recall by more than 15 percentage points while requiring 25-50% fewer frustums than the state-of-the-art non-saliency-aware baseline.
  arXiv  Detail & Related papers  (2026-06-29T08:40:16Z)
• ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception [2.216657815393579]
  ATLAS is the first large-scale, physically grounded evaluation benchmark for LiDAR perception models under black-box sensor attacks.<n>Models with stronger performance on standard benchmarks tend to better withstand removal attacks, yet are actually more vulnerable to injection attacks than weaker models.<n>We trace this vulnerability to standard object database sampling augmentations, revealing how current training practices can induce architecture-agnostic failures.
  arXiv  Detail & Related papers  (2026-06-01T21:56:57Z)
• D-SLAMSpoof: An Environment-Agnostic LiDAR Spoofing Attack using Dynamic Point Cloud Injection [5.775959675362423]
  We introduce Dynamic SLAMSpoof (D-SLAMSpoof), a novel attack that compromises LiDAR SLAM even in feature-rich environments.<n>D-SLAMSpoof significantly improves attack success rates in real-world, feature-rich environments such as urban areas and indoor spaces.<n>We propose a practical defense method, ISD-SLAM, that relies solely on inertial dead reckoning signals commonly available in autonomous systems.
  arXiv  Detail & Related papers  (2026-03-11T23:06:52Z)
• L3DR: 3D-aware LiDAR Diffusion and Rectification [85.5914944339043]
  Range-view (RV) based LiDAR diffusion has recently made huge strides towards 2D photo-realism.<n>However, it neglects 3D geometry realism and often generates various RV artifacts such as depth bleeding and wavy surfaces.<n>We design L3DR, a 3D-aware LiDAR Diffusion and Rectification framework that can regress and cancel RV artifacts in 3D space.
  arXiv  Detail & Related papers  (2026-02-22T06:31:58Z)
• Seeing is Deceiving: Mirror-Based LiDAR Spoofing for Autonomous Vehicle Deception [0.6865481844899556]
  We show a class of low-cost, passive LiDAR spoofing attacks that exploit mirror-like surfaces.<n>These attacks require no electronics or custom fabrication and can be deployed in real settings.<n>Experiments show mirror attacks corrupt occupancy grids, induce false detections, and trigger unsafe planning and control behaviors.
  arXiv  Detail & Related papers  (2025-09-21T22:05:36Z)
• ROLO-SLAM: Rotation-Optimized LiDAR-Only SLAM in Uneven Terrain with Ground Vehicle [49.61982102900982]
  A LiDAR-based SLAM method is presented to improve the accuracy of pose estimations for ground vehicles in rough terrains.<n>A global-scale factor graph is established to aid in the reduction of cumulative errors.<n>The results demonstrate that ROLO-SLAM excels in pose estimation of ground vehicles and outperforms existing state-of-the-art LiDAR SLAM frameworks.
  arXiv  Detail & Related papers  (2025-01-04T02:44:27Z)
• LiDAR-GS:Real-time LiDAR Re-Simulation using Gaussian Splatting [53.58528891081709]
  We present LiDAR-GS, a real-time, high-fidelity re-simulation of LiDAR scans in public urban road scenes.<n>The method achieves state-of-the-art results in both rendering frame rate and quality on publically available large scene datasets.
  arXiv  Detail & Related papers  (2024-10-07T15:07:56Z)
• VaLID: Verification as Late Integration of Detections for LiDAR-Camera Fusion [2.503388496100123]
  Vehicle object detection benefits from both LiDAR and camera data.<n>We propose a model-adaptive late-fusion method, VaLID, which validates whether each predicted bounding box is acceptable.<n>Our approach is model-adaptive and demonstrates state-of-the-art competitive performance even when using generic camera detectors.
  arXiv  Detail & Related papers  (2024-09-23T20:27:10Z)
• LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies [26.9731228822657]
  A recent line of research finds that one can manipulate the LiDAR point cloud and fool object detectors by firing malicious lasers against LiDAR. We conduct the first large-scale measurement study on LiDAR spoofing attack capabilities on object detectors with 9 popular LiDARs. We uncover a total of 15 novel findings, including not only completely new ones due to the measurement angle novelty, but also many that can directly challenge the latest understandings in this problem space.
  arXiv  Detail & Related papers  (2023-03-19T03:46:27Z)
• Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusion [70.60038549155485]
  Deep 3D point cloud models are sensitive to adversarial attacks, which poses threats to safety-critical applications such as autonomous driving. This paper introduces a novel distortion-aware defense framework that can rebuild the pristine data distribution with a tailored intensity estimator and a diffusion model.
  arXiv  Detail & Related papers  (2022-11-29T14:32:43Z)
• LiDAR Distillation: Bridging the Beam-Induced Domain Gap for 3D Object Detection [96.63947479020631]
  In many real-world applications, the LiDAR points used by mass-produced robots and vehicles usually have fewer beams than that in large-scale public datasets. We propose the LiDAR Distillation to bridge the domain gap induced by different LiDAR beams for 3D object detection.
  arXiv  Detail & Related papers  (2022-03-28T17:59:02Z)
• Physically Realizable Adversarial Examples for LiDAR Object Detection [72.0017682322147]
  We present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demonstrate that placing an adversarial object on the rooftop of any target vehicle to hide the vehicle entirely from LiDAR detectors with a success rate of 80%. This is one step closer towards safer self-driving under unseen conditions from limited training data.
  arXiv  Detail & Related papers  (2020-04-01T16:11:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.