Earlier physical attacks on LiDAR SLAM inject fake returns by firing laser pulses at the sensor, which needs sensor-specific timing and is now blocked by timing obfuscation and injection rejection in modern LiDARs. MirrorDrift injects nothing. An actuated planar mirror reflects the LiDAR’s own pulses, creating ghost points and dropouts, and the mirror’s yaw oscillates so the false correspondences persist through scan matching. The attack optimises where to place the mirror, how to align it and how to move it. It is tested against KISS-ICP, FAST-LIO2 and GLIM. Presented at IROS 2026 in the session on efficient and secure SLAM.
Findings
- In simulation, optimised placement raises average pose error 6.1 times over random placement, degrading the three SLAM systems to 2.29 to 3.31 m mean APE.
- On a modern LiDAR with interference mitigation, the real attack causes localisation errors of up to 6.03 m.
- The authors say this is the first successful SLAM attack on a production-grade secure LiDAR.
Limits
- The attacker must place a mirror near the robot’s route in advance, so the route has to be known.
- Existing mirror and glass handling in SLAM assumes static mirrors; how well it copes with a moving one is open (authors).
Relevance
A physical attack that defeats sensor-level defences by using the sensor’s own signal. It joins rigid-covert GNSS spoofing in robot-security: both bias the estimate slowly instead of breaking it. For robust-estimation, ghost points shaped to agree with each other are adversarial outliers, not random ones, which is the case most outlier rejection does not cover. In a team, one robot driven past such a mirror would pass a drifted pose into shared maps.
Links
- arXiv
- Subfield: Security, Mapping and localisation