Neural Reconstruction of LiDAR Point Clouds under Jamming Attacks via Full-Waveform Representation and Simultaneous Laser Sensing

Abstract

LiDAR sensors are critical for autonomous driving perception, yet remain vulnerable to spoofing attacks. Jamming attacks inject high-frequency laser pulses that completely blind LiDAR sensors by overwhelming authentic returns with malicious signals. We discover that while point clouds become randomized, the underlying full-waveform data retains distinguishable signatures between attack and legitimate signals. In this work, we propose PULSAR-Net, capable of reconstructing authentic point clouds under jamming attacks by leveraging previously underutilized intermediate full-waveform representations and simultaneous laser sensing in modern LiDAR systems. PULSAR-Net adopts a novel U-Net architecture with axial spatial attention mechanisms specifically designed to identify attack-induced signals from authentic object returns in the full-waveform representation. To address the lack of full-waveform representations in existing LiDAR datasets under jamming attacks, we introduce a physics-aware dataset generation pipeline that synthesizes realistic full-waveform representations under jamming attacks. Despite being trained exclusively on synthetic data, PULSAR-Net achieves reconstruction rates of 92% and 73% for vehicles obscured by jamming attacks in real-world static and driving scenarios, respectively.

Figures (5)

• Figure 1: Reconstruction demo of our PULSAR-Net from LiDAR sensing under a jamming attack. Our PULSAR-Net can effectively recover the point cloud (d), which is faithful to the original one (b), by leveraging the intermediate full-waveform representation and simultaneous sensing feature available in modern LiDARs.
• Figure 2: Conceptual illustration of a LiDAR jamming attack and simultaneous sensing.
• Figure 3: Overview of PULSAR-Net, a U-Net-inspired architecture using depthwise-separable 3D convolutions for efficient, lightweight feature extraction. It incorporates axial attention to model both spatial and temporal dependencies within full-waveforms.
• Figure 4: Overview of the real-world experiment and its results: (i) experimental setup of a jamming attack on our LiDAR developed with a major LiDAR supplier to stream full waveform, (ii) benign, attack-compromised, and reconstructed point clouds in a static scenario with a reference vision, and (iii-iv) 3 frames of camera frames and point clouds of benign, attack-compromised, and reconstructed point clouds in driving scenarios
• Figure 5: Point cloud denoising methods fail under jamming attacks. Red points indicate valid structures (neighbors within 5cm), and gray points indicate isolated points.