MOBA: A Material-Oriented Backdoor Attack against LiDAR-based 3D Object Detection Systems

TL;DR

This paper tackles the vulnerability of LiDAR-based 3D object detectors to backdoor attacks by introducing MOBA, a material-oriented backdoor framework that explicitly models trigger reflectance properties to bridge the digital and physical domains. It presents a two-stage pipeline: Stage 1 selects robust trigger materials (identifying TiO$_2$) using a BRDF-informed material objective, and Stage 2 simulates LiDAR intensity with an angle- and distance-robust model based on an angle-independent approximation of the Oren–Nayar BRDF and a depth-aware sampling scheme. The approach yields high physical-world effectiveness, achieving an average ASR of around $92.7\%$ on LiDAR-only models and up to $95.91\%$ on a camera-LiDAR fusion model, with ablations confirming the importance of both angle and distance robustness and material reflectance. The findings underscore a new class of physically realizable threats and motivate defense strategies that account for material-level properties in real-world deployment.

Abstract

LiDAR-based 3D object detection is widely used in safety-critical systems. However, these systems remain vulnerable to backdoor attacks that embed hidden malicious behaviors during training. A key limitation of existing backdoor attacks is their lack of physical realizability, primarily due to the digital-to-physical domain gap. Digital triggers often fail in real-world settings because they overlook material-dependent LiDAR reflection properties. On the other hand, physically constructed triggers are often unoptimized, leading to low effectiveness or easy detectability.This paper introduces Material-Oriented Backdoor Attack (MOBA), a novel framework that bridges the digital-physical gap by explicitly modeling the material properties of real-world triggers. MOBA tackles two key challenges in physical backdoor design: 1) robustness of the trigger material under diverse environmental conditions, 2) alignment between the physical trigger's behavior and its digital simulation. First, we propose a systematic approach to selecting robust trigger materials, identifying titanium dioxide (TiO_2) for its high diffuse reflectivity and environmental resilience. Second, to ensure the digital trigger accurately mimics the physical behavior of the material-based trigger, we develop a novel simulation pipeline that features: (1) an angle-independent approximation of the Oren-Nayar BRDF model to generate realistic LiDAR intensities, and (2) a distance-aware scaling mechanism to maintain spatial consistency across varying depths. We conduct extensive experiments on state-of-the-art LiDAR-based and Camera-LiDAR fusion models, showing that MOBA achieves a 93.50% attack success rate, outperforming prior methods by over 41%. Our work reveals a new class of physically realizable threats and underscores the urgent need for defenses that account for material-level properties in real-world environments.

Figures (5)

• Figure 1: Overview of MOBA. MOBA injects a digitally simulated, BRDF-informed trigger into a small subset of training data to poison the model. MOBA leverages material reflectance modeling to ensure that the trigger is physically realizable and effective under real-world conditions. When the physical trigger is deployed at inference time, the backdoored model produces adversarial predictions (e.g., shrunk or missing bounding boxes).
• Figure 2: MOBA two-stage pipeline: the construction of a material-specific trigger in Stage 1, and the LiDAR- intensity simulation via angle- and distance-robust modeling in Stage 2. These simulated triggers are injected into point clouds to poison the training data.
• Figure 3: Visualization of incident and reflection angles ($\theta_i$, $\theta_r$) and azimuthal difference ($\Delta\phi$) used in the diffuse reflectance approximation over rough surfaces.
• Figure 4: Real-world testbed setup and performance demo.
• Figure 5: Examples of different "Baby on Board" physical triggers used in the evaluation. The top row shows triggers made of copper (left), aluminum (middle), and TiO$_2$ (right) materials. The bottom row includes similar "Baby on Board" triggers printed on paper materials.