LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies

(NDSS'24)

Due to requests of raw data, we placed the artifacts of the paper here:

https://keio-csg.github.io/lidar-spoofing-artifacts/

Chosen Pattern Injection (CPI)

So far, all prior works on object injection attack side [Shin et al., 2017 [9], Cao et al., 2019 [10] , Jiachen et al., 2020[11], Hallyburton et al., 2022 [13]] assume a Chosen Pattern Injection (CPI) attack capability, i.e., an attacker can successfully inject a specifically-chosen spoofed point cloud pattern that was carefully crafted/identified offline before the actual attack time (e.g., from an offline optimization process). However, none of these prior works have clearly demonstrated such an attack capability in the physical world.

これまでの物体挿入攻撃に関するすべての先行研究 [Shin et al., 2017 [9], Cao et al., 2019 [10], Jiachen et al., 2020 [11], Hallyburton et al., 2022 [13]] は、選択パターン挿入（CPI）攻撃能力を想定しています。つまり、攻撃者が実際の攻撃時間前にオフラインで慎重に作成/特定された、任意の偽の点群形状を挿入できるという能力です。しかし、これらの先行研究のいずれも、物理的な世界でこのような攻撃能力を明確に実証していませんでした。以下に我々の系で歩行者、車、そして文字データを注入攻撃した例を示します。

Comparison of LiDAR spoofing attack capabilities
with prior attacks and ours.

3D Pattern Injection: Pedestrian

3D Pattern Injection: Car

3D Pattern Injection: Text

Our Improved LiDAR Spoofer & Optics

To achieve the CPI attack capability, we significantly improved the LiDAR spoofing capability with more careful optics and more functional electronics.

Overview of our LiDAR spoofer setup, the optics design, and the setup of the indoor and outdoor experiments.

Parts used for the spoofer

Thorlabs LA1951-ML

Ø1" N-BK7 Plano-Convex Lens, SM1-Threaded Mount, f = 25.4 mm, Uncoated

EPC9126

Laser board

SPL PL90_3

Pulse laser

Spoofer frame design

The frame consists of a bottom acrylic plate, a top acrylic plate, and an aluminum hollow screw. The laser board is fixed to the bottom acrylic plate. A female screw is dug in the top acrylic plate so that the hollow screw can be moved up and down. The acrylic plates are joined to each other by hexagonal posts connected in series. Thorlab's lenses in the mount are internally threaded so they can be attached to the end of a hollow screw.

CAD File: lens_unit.f3z

acrylic_bottom Drawing.pdf

bottom plate

acrylic_top Drawing.pdf

top plate

lens_screw Drawing.pdf

hollow screw

Target LiDARs

Velodyne VLP-16 has been dominantly used in the prior works since it is viewed as a de facto choice for LiDAR spoofing evaluation after the first practical spoofing attack was proposed in 2017. Although these results are valid on VLP-16, there is no guarantee that these results are still valid in more recent LiDARs, known as next-generation LiDARs. However, none of the prior works on LiDAR spoofing attacks has evaluated the security property of such next-generation LiDAR. These major design differences are likely to cause significant differences in their security characteristics, which thus motivates this study.

Velodyne VLP-16は、2017年に最初の実用的なスプーフィング攻撃が提案されて以来、LiDARスプーフィング評価の事実上の選択肢とみなされているため、これまでの研究で主に使用されてきました。これらの結果はVLP-16では有効ですが、より最近のLiDAR、いわゆる次世代LiDARでもこれらの結果が依然として有効である保証はありません。しかし、LiDARスプーフィング攻撃に関するこれまでの研究では、このような次世代LiDARのセキュリティ特性を評価したものはありません。これらの主要な設計の違いは、セキュリティ特性に大きな違いをもたらす可能性が高く、本研究の動機となっています。

Our Attack: High-Frequency Removal (HFR) Attack

We identified a new type of LiDAR spoofing attack, named high-frequency removal (HFR) attack, which can achieve point removal without synchronizing with the LiDAR scanning patterns and can be effective against LiDAR even with the timing randomization. We compare our attack with the state-of-the-art removal attack. Physical Removal Attack (PRA) [Cao et al., 2022].

我々は、高周波除去（HFR）攻撃と名付けた新しいタイプのLiDARスプーフィング攻撃を特定しました。この攻撃は、LiDARのスキャンパターンと同期することなくポイントの除去を達成でき、タイミングのランダム化を施したLiDARに対しても効果的です。我々の攻撃を最先端の除去攻撃である物理的除去攻撃（PRA）[Cao et al., 2022] と比較しました。

Attack Demos

Target LiDAR: VLP-32c

Camera

Benign

PRA Attack w/ our spoofer

HFR Attack

Demos on other LiDARs

VLS-128: Injection Attack (Laser Pattern)

Helios: HFR Attack

Helios HFR Attack (Wide)

Leddar Pixell: Relay Attack

Livox Horizon: HFR Attack

OS1-32: HFR Attack

XT32: HFR Attack

Realsense L515: HFR Attack

Removal Attack Evaluation on Closed-Loop Simulation

We evaluate the end-to-end consequence in AD scenarios with closed-loop simulation. We apply the attack success rate at each azimuth for each point at every frame to decide whether the point is to be remained or be removed.

AD system: Baidu Apollo 7.0
Simulator: LGSVL
Attack Start Distance: 18 m
Driving Speed: 40 km/h