Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals

• URL: http://arxiv.org/abs/2606.17562v1
• Date: Tue, 16 Jun 2026 06:07:41 GMT
• Title: Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals
• Abstract summary: We identify a previously unexplored attack surface in which dormant malware embedded in the LiDAR sensing pipeline remains inactive during normal operation.<n>To operationalize this threat, we design malware capable of low-level point-cloud manipulation and embed it into LiDAR firmware.<n>Results highlight the need for stronger integrity guarantees throughout the LiDAR sensor development and deployment pipeline.
• Score: 10.62010640053627
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LiDAR sensors are widely deployed in autonomous systems for 3D perception and safety-critical decision-making. We identify a previously unexplored attack surface in which dormant malware embedded in the LiDAR sensing pipeline remains inactive during normal operation and can be externally triggered after deployment, without requiring access to sensor hardware or networking at attack time. To operationalize this threat, we design malware capable of low-level point-cloud manipulation and embed it into LiDAR firmware. This malware was developed in a closed research test environment with vendor technical support, rather than by exploiting an inherent production supply-chain vulnerability. To selectively trigger attack activation, we design and implement an optical trigger that remotely activates the malware by delivering a modulated signal into the sensing environment. Once triggered, the malware performs real-time point cloud manipulation, and we demonstrate false object injection and real object suppression on static and mobile victim platforms. Our evaluation first establishes attack feasibility, including static operation at 300~ft and recorded drive-by runs reaching 35~mph. We then illustrate quantitatively that injected person-like artifacts can remain semantically detectable by a state-of-the-art 3D object detector. Finally, we demonstrate multiple modes of safety-critical impact on a deployed tactical autonomous vehicle. Together, these results highlight the need for stronger integrity guarantees throughout the LiDAR sensor development and deployment pipeline.

Related papers

• (A)iSpy: Parasitic Trojans for Machine Learning Infrastructure [7.1179345405416035]
  Current machine learning pipelines rely heavily on third party libraries for graph compilation and hardware acceleration.<n>We present (A)iSpy, a parasitic infrastructure Trojan that subverts ML systems through an active observe and execute paradigm.<n>We demonstrate broad practicality across the machine learning lifecycle by validating auxiliary attacks in the appendix, including subpopulation label flipping, availability disruptions, and inference stage manipulations.
  arXiv  Detail & Related papers  (2026-07-20T04:51:20Z)
• Exploiting LLM Agent Supply Chains via Payload-less Skills [10.141577783380281]
  We introduce Semantic Compliance Hijacking (SCH), a payload-less supply chain attack targeting autonomous coding environments.<n>The SCH approach translates malicious goals into unstructured natural language instructions formatted as necessary compliance rules, leading the agent to generate and execute unauthorized code.<n>The findings demonstrate the pervasive nature of this threat, with SCH achieving peak success rates of up to 77.67% for confidentiality breaches.
  arXiv  Detail & Related papers  (2026-05-14T06:55:47Z)
• Cross-Modal Phantom: Coordinated Camera-LiDAR Spoofing Against Multi-Sensor Fusion in Autonomous Vehicles [2.1485350418225244]
  We investigate whether an attacker can bypass Multi-Sensor Fusion's redundancy by fabricating cross-sensor consistency.<n>We simulate its sensor-level outcomes by inserting perspective-aware image patches and synthetic LiDAR point clusters aligned in 3D space.<n>Using 400 KITTI scenes, our large-scale evaluation shows that the coordinated spoofing deceives a state-of-the-art perception model with an 85.5% successful attack rate.
  arXiv  Detail & Related papers  (2026-04-23T16:32:01Z)
• Glitch in the Sky: Exploiting Voltage Fault Injection in UAV Flight Controllers [0.14777718769290527]
  We introduce a dual evaluation approach: software-based fault simulation using ARMORY and hardware-based experiments with a voltage glitching platform (Chip-Whisperer)<n>Our targeted analysis of specific fail-safe modes uncovers timing-sensitive vulnerabilities that can suppress or alter safety responses.<n>We validate software-based fault injection results against real hardware behavior, demonstrating how simulated attacks translate into tangible risks for CPS security and reliability.
  arXiv  Detail & Related papers  (2026-04-17T20:56:13Z)
• Evasion of IoT Malware Detection via Dummy Code Injection [0.0]
  This work presents a novel adversarial strategy against power side-channel-based malware detection.<n>By injecting structured dummy code into the scanning phase of the Mirai botnet, we dynamically perturb power signatures to evade AI/ML-based anomaly detection.<n>Our approach systematically analyzes the trade-offs between stealthiness, execution overhead, and evasion effectiveness.
  arXiv  Detail & Related papers  (2026-02-09T00:18:23Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• Poison Once, Control Anywhere: Clean-Text Visual Backdoors in VLM-based Mobile Agents [54.35629963816521]
  This work introduces VIBMA, the first clean-text backdoor attack targeting VLM-based mobile agents.<n>The attack injects malicious behaviors into the model by modifying only the visual input.<n>We show that our attack achieves high success rates while preserving clean-task behavior.
  arXiv  Detail & Related papers  (2025-06-16T08:09:32Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Sensor Deprivation Attacks for Stealthy UAV Manipulation [51.9034385791934]
  Unmanned Aerial Vehicles autonomously perform tasks with the use of state-of-the-art control algorithms. In this work, we propose a multi-part. Sensor Deprivation Attacks (SDAs), aiming to stealthily impact. process control via sensor reconfiguration.
  arXiv  Detail & Related papers  (2024-10-14T23:03:58Z)
• What Would Trojans Do? Exploiting Partial-Information Vulnerabilities in Autonomous Vehicle Sensing [14.776762612634906]
  Tier 1 manufacturers have already exposed vulnerabilities to attacks introducing Trojans that can stealthily alter sensor outputs.<n>We analyze the feasible capability and safety-critical outcomes of an attack on sensing at a cyber level.<n>We introduce security-aware sensor fusion incorporating a probabilistic data-asymmetry monitor and scalable track-to-track fusion of 3D LiDAR and monocular detections.
  arXiv  Detail & Related papers  (2023-03-06T19:52:41Z)
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving [87.3492357041748]
  In this paper, we showcase practical susceptibilities of multi-sensor detection by placing an adversarial object on top of a host vehicle. Our experiments demonstrate that successful attacks are primarily caused by easily corrupted image features. Towards more robust multi-modal perception systems, we show that adversarial training with feature denoising can boost robustness to such attacks significantly.
  arXiv  Detail & Related papers  (2021-01-17T21:15:34Z)
• Physically Realizable Adversarial Examples for LiDAR Object Detection [72.0017682322147]
  We present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demonstrate that placing an adversarial object on the rooftop of any target vehicle to hide the vehicle entirely from LiDAR detectors with a success rate of 80%. This is one step closer towards safer self-driving under unseen conditions from limited training data.
  arXiv  Detail & Related papers  (2020-04-01T16:11:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.