SLACK: Attacking LiDAR-based SLAM with Adversarial Point Injections

TL;DR

This paper studies adversarial point injections (PiJ) targeting LiDAR-based SLAM and introduces SLACK, an end-to-end deep generative model that injects dynamic points without noticeably degrading LiDAR quality. Central to SLACK is AE_mask, a segmentation-aware autoencoder trained with contrastive learning and hard negatives, paired with a pretext-task discriminator (PD) in an adversarial loop to produce effective PiJ. The authors extend the approach to real-world data with SLACK-MMD, enabling unsupervised domain adaptation to KITTI, and validate the method on CARLA-64 and KITTI datasets, demonstrating degradation in SLAM performance while preserving LiDAR quality. The work highlights security vulnerabilities in LiDAR-based SLAM systems and underscores the need for defenses and real-world validation, while also noting limitations such as the white-box assumption and dependence on paired scans.

Abstract

The widespread adoption of learning-based methods for the LiDAR makes autonomous vehicles vulnerable to adversarial attacks through adversarial \textit{point injections (PiJ)}. It poses serious security challenges for navigation and map generation. Despite its critical nature, no major work exists that studies learning-based attacks on LiDAR-based SLAM. Our work proposes SLACK, an end-to-end deep generative adversarial model to attack LiDAR scans with several point injections without deteriorating LiDAR quality. To facilitate SLACK, we design a novel yet simple autoencoder that augments contrastive learning with segmentation-based attention for precise reconstructions. SLACK demonstrates superior performance on the task of \textit{point injections (PiJ)} compared to the best baselines on KITTI and CARLA-64 dataset while maintaining accurate scan quality. We qualitatively and quantitatively demonstrate PiJ attacks using a fraction of LiDAR points. It severely degrades navigation and map quality without deteriorating the LiDAR scan quality.

Figures (6)

• Figure 1: Left: SLAM results before attack using CARLA sequences - the map is precise. Navigation trajectory is accurate. Right: After adversarial attack with 0.8% points - map quality is degraded. High navigation error in estimated trajectory.
• Figure 2: Contrastive Loss using Anchor, positive and corresponding dynamic hard negatives.
• Figure 3: Hard Negative mining using corresponding static-dynamic pairs. Given an anchor (static), multiple hard negatives - corresponding dynamic and close-by scans (right) are selected as hard negatives.
• Figure 4: (a) Segmentation-based Attention Setup for $AE{mask}$(b) Adversarial Module tricks PD with an adversarial label. To classify the input pair as 1 - PD injects dynamism in $s_j$. (c) SLACK-MMD adapts CARLA-64 to KITTI.
• Figure 5: Visual demonstration of an original scan v/s an attacked scan. It is very difficult to distinguish the attacked scan from the original scan. Video demo in the https://drive.google.com/drive/folders/1BtrTwUbgFKYkIQ6UGitQAuClHH-pHjBH?usp=sharing.