MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

1. Problem Statement

LiDAR SLAM Vulnerability: LiDAR-based Simultaneous Localization and Mapping (SLAM) relies heavily on the geometric consistency of point clouds to estimate robot pose via scan matching. This reliance creates a fundamental vulnerability: if the observed point cloud is adversarially manipulated, pose estimation fails.

Limitations of Existing Attacks:

• Signal Injection (Spoofing): Prior attacks typically involve injecting fake laser signals to create "ghost points." However, modern LiDARs (e.g., Hesai AT-128) employ interference mitigation techniques like randomized emission patterns, pulse fingerprinting, and signal authentication. These defenses make external signal injection increasingly difficult or impossible.
• Passive Reflections: While specular reflections (from mirrors/glass) are known to cause SLAM drift, they have historically been treated as passive environmental noise rather than an active, controllable attack vector.

The Gap: There is a lack of research on whether controlled specular reflections can be systematically exploited to disrupt LiDAR SLAM without requiring external signal injection, specifically against modern, secure LiDAR sensors.

---

2. Methodology: MirrorDrift

The authors propose MirrorDrift, a physical attack framework that uses an actuated planar mirror to generate "ghost points" (virtual returns) and systematically bias scan-matching correspondences.

A. Core Mechanism

• Injection-Free: Unlike spoofing, MirrorDrift uses the LiDAR's own emitted pulses. The mirror reflects these pulses back to the sensor, creating virtual points that do not exist in the physical environment.
• Active Actuation: The mirror is not static. It is periodically oscillated in the yaw direction. This dynamic movement causes the ghost points to shift between frames, creating unnatural inter-frame displacements that force the SLAM algorithm to compute erroneous pose updates.
• Threat Model: The attacker knows the victim's route in advance (e.g., fixed-path robots) and places the mirror alongside the trajectory. The attacker has no access to the vehicle's software or internal parameters.

B. Optimization Framework

To maximize the attack's impact, the authors optimize the mirror's placement and motion:

1. Objective Function: The goal is to maximize the ratio of occluded points (dropout) and reflected points (ghost injection) in the downsampled point cloud used for registration.
   • They use an Exponential Moving Average (EMA) to ensure the disturbance persists over time, rather than being corrected by a single frame.
   • The objective $J$ is the sum of these ratios over $T$ frames.
2. Optimization Method: Since the gradient of the objective function is non-analytic, they use Bayesian Optimization to find the optimal mirror position $(x, y)$ and orientation $(\theta)$.
3. Motion Constraints: The mirror's yaw oscillation ($\Delta\theta$) is constrained to ensure the displacement of ghost points between frames does not exceed the SLAM algorithm's outlier rejection threshold ($M$).
   • Constraint: $\Delta\theta \leq \arcsin(\frac{M}{2r_{max}})$, where $r_{max}$ is the maximum range of the ghost points.

C. Simulation & Device

• Simulation: A ray-casting simulator models the mirror's effect by removing occluded points and synthesizing reflected ghost points based on the law of reflection.
• Hardware: The physical attack device consists of a planar mirror mounted on a Dynamixel MX-28 servo motor to control the yaw angle.

---

3. Key Contributions

1. Novel Attack Vector: Demonstrates the first successful injection-free physical attack on LiDAR SLAM using controlled specular reflections. It bypasses modern signal authentication and interference mitigation.
2. MirrorDrift Framework: A systematic design that optimizes mirror placement and actuation patterns to maximize SLAM drift, showing that optimized placement yields 6.1× higher error than random placement.
3. Real-World Validation on Secure Hardware: Successfully executed the attack on the Hesai AT-128, a state-of-the-art automotive LiDAR with built-in pulse fingerprinting and interference rejection, proving that even "secure" sensors are vulnerable to this physical vector.

---

4. Experimental Results

A. Simulation Results

• Setup: Tested on three popular SLAM algorithms: KISS-ICP, FAST-LIO2, and GLIM.
• Performance:
  • Compared to a "no mirror" baseline, the optimized attack increased Average Pose Error (APE) by 25.6×.
  • Compared to a "random mirror placement" baseline, the optimized attack increased APE by 6.1×.
  • Mean APE with attack: Ranged from 2.29 m to 3.31 m across the three algorithms.
• Ablation Study: Confirmed that reflection-induced ghost points are the primary cause of drift. Occlusion (point dropout) alone caused negligible error (< 0.25 m), while reflection alone caused errors comparable to the full attack.

B. Real-World Experiments

• Setup: Conducted outdoors using an electric wheelchair equipped with a Hesai AT-128 LiDAR and a manually oscillated mirror (1.6m × 0.8m).
• Results:
  • The attack induced significant localization drift in all three SLAM systems.
  • Maximum APE: 6.03 m (KISS-ICP).
  • Minimum APE: 3.46 m (FAST-LIO2).
  • Heading Errors: Up to 10.7°.
• Observation: The real-world error was higher than in simulation, likely due to the AT-128's higher angular resolution (more beams hitting the mirror) and narrower field of view (higher density of ghost points).

C. Robustness

• Distance Sensitivity: Attack effectiveness drops significantly if the mirror is placed > 3.0 m from the trajectory. However, within 3.0 m (feasible on narrow roads), the attack remains potent.
• Placement Errors: The attack is robust to placement errors of ±0.5 m and ±5° in yaw, maintaining higher error rates than random placement.

---

5. Significance and Implications

• Security Paradigm Shift: This work proves that interference mitigation (designed to stop signal injection) is insufficient against geometric manipulation via specular reflections.
• Safety Risk: The induced errors (3–6 meters) far exceed safety thresholds for autonomous navigation (e.g., 0.29 m for urban lane departure), posing a critical risk of collision or getting lost.
• Defense Challenges:
  • Current ghost-point detection methods often assume static mirrors; MirrorDrift's dynamic actuation makes detection harder.
  • The paper suggests that multi-modal redundancy (combining LiDAR with GNSS, wheel odometry, or multiple LiDARs) is a necessary countermeasure, as single-sensor reliance is fundamentally vulnerable to this physical attack.

In conclusion, MirrorDrift reveals a critical blind spot in LiDAR security: while sensors are becoming "secure" against digital spoofing, they remain highly vulnerable to simple, low-cost physical manipulation of the environment using mirrors.