Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

Rokuto Nagata, Kenji Koide, Kazuma Ikeda, Ozora Sako, Shion Horie, Kentaro Yoshioka

Abstract

LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.

MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

Abstract

LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.
Paper Structure (22 sections, 10 equations, 9 figures, 5 tables)

This paper contains 22 sections, 10 equations, 9 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related work and Background
  3. LiDAR-based localization
  4. Impact of False Point Clouds on LiDAR SLAM
  5. Attacks on LiDAR via Reflective Surfaces
  6. Methodology
  7. Threat model
  8. Mirror simulation
  9. Optimization of Mirror Placement Parameters
  10. Mirror Motion Pattern
  11. Attack device design
  12. Evaluation
  13. Validation of Mirror Simulation
  14. Definition of Experimental Conditions
  15. Proposed Method Performance Validation
  16. ...and 7 more sections

Figures (9)

  • Figure 1: Real-world MirrorDrift demonstration. The reference trajectory (white dashed) and the attacked trajectories estimated by KISS-ICP vizzo2023ral, FAST-LIO2 fastlio2, and GLIM koide2024glim (red/green/orange) show large deviations in the positive $y$-direction under attack.
  • Figure 2: (a) Overview of MirrorDrift. We optimize the mirror placement and orientation and determine its motion pattern. The mirror position and nominal orientation are optimized by maximizing the objective function defined in § \ref{['methodology:mirror_placement_optimize']}. To induce false point-to-point correspondences across frames, the mirror is periodically oscillated in the yaw direction. (b) Threat model overview. The adversary aims to deceive the victim vehicle’s ego-localization using mirror-induced ghost points and to cause deviations from the intended route. The mirror is placed in the environment, alongside the robot’s traveling route. The victim route is assumed to be known, allowing the adversary to pre-optimize the mirror placement and orientation using MirrorDrift.
  • Figure 3: Mirror-induced ghost point behavior under mirror angle changes. When the mirror rotates by $\Delta\theta$, the reflection direction changes by $2\Delta\theta$ according to the law of reflection. As a result, a ghost point at range $r$ undergoes an inter-frame displacement of $2r\sin(\Delta\theta)$.
  • Figure 4: Attack device and its effect on LiDAR measurements. (Left) Implemented mirror-actuation device consisting of a planar mirror mounted on a fixture and driven by a Dynamixel MX-28 servo motor to vary the mirror yaw angle over time. (Right) Comparison of LiDAR point clouds captured without the mirror (w/o attack device) and with the mirror present and actuated (w/ attack device).
  • Figure 5: Mirror simulation results. The reference point cloud is plotted in yellow-green, and the simulated point cloud is overlaid in red. The two point clouds closely overlap, yielding a very small Chamfer Distance of $0.028176$ m.
  • ...and 4 more figures