{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/invisible-for-both-camera-and-lidar-security","title":"Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks","arxiv_id":"2106.09249","date":"2021-06-17","proceeding":null,"authors":["Yulong Cao*","Ningfei Wang*","Chaowei Xiao*","Dawei Yang*","Jin Fang","Ruigang Yang","Qi Alfred Chen","Mingyan Liu","Bo Li"],"abstract":"In Autonomous Driving (AD) systems, perception is both security and safety critical. Despite various prior studies on its security issues, all of them only consider attacks on camera- or LiDAR-based AD perception alone. However, production AD systems today predominantly adopt a Multi-Sensor Fusion (MSF) based design, which in principle can be more robust against these attacks under the assumption that not all fusion sources are (or can be) attacked at the same time. In this paper, we present the first study of security issues of MSF-based perception in AD systems. We directly challenge the basic MSF design assumption above by exploring the possibility of attacking all fusion sources simultaneously. This allows us for the first time to understand how much security guarantee MSF can fundamentally provide as a general defense strategy for AD perception. We formulate the attack as an optimization problem to generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. We propose a novel attack pipeline that addresses two main design challenges: (1) non-differentiable target camera and LiDAR sensing systems, and (2) non-differentiable cell-level aggregated features popularly used in LiDAR-based AD perception. We evaluate our attack on MSF included in representative open-source industry-grade AD systems in real-world driving scenarios. Our results show that the attack achieves over 90% success rate across different object types and MSF. Our attack is also found stealthy, robust to victim positions, transferable across MSF algorithms, and physical-world realizable after being 3D-printed and captured by LiDAR and camera devices. To concretely assess the end-to-end safety impact, we further perform simulation evaluation and show that it can cause a 100% vehicle collision rate for an industry-grade AD system.","url_abs":"https://arxiv.org/abs/2106.09249v1","url_pdf":"https://arxiv.org/pdf/2106.09249v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"invisible-for-both-camera-and-lidar-security","repo_url":"https://github.com/ASGuard-UCI/MSF-ADV","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"autonomous-driving","task_name":"Autonomous Driving"},{"task_slug":"sensor-fusion","task_name":"Sensor Fusion"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2106.09249","atlas_url":"https://app.syntology.ai/?focus=2106.09249","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.09249"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ASGuard-UCI/MSF-ADV","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":13,"unverified":7},"by_repo_kind":{"listed":{"samples":20,"ran":13,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7ef997c38a692004","entry":"DJSFind","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"cluster.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/cluster.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7ef997c38a692004"}},{"code_sha256_prefix":"6758cb0e62752d1e","entry":"DJSFindRecursive","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"cluster.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/cluster.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6758cb0e62752d1e"}},{"code_sha256_prefix":"c75aea10ccb39d17","entry":"get_ray","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"render.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/render.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c75aea10ccb39d17"}},{"code_sha256_prefix":"96451f3f663c7855","entry":"groupPc2Pixel","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"c2p_segmentation.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/c2p_segmentation.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"96451f3f663c7855"}},{"code_sha256_prefix":"73745a40802ffe29","entry":"mapPointToGrid","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"c2p_segmentation.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/c2p_segmentation.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"73745a40802ffe29"}},{"code_sha256_prefix":"0a647dcbd2ecc065","entry":"my_ransac","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"ground_detector_simple.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/ground_detector_simple.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0a647dcbd2ecc065"}},{"code_sha256_prefix":"7a7d3e104a7ab70c","entry":"processPC","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"inject_cube.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/inject_cube.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a7d3e104a7ab70c"}},{"code_sha256_prefix":"f29ebe1a2f55300d","entry":"rc2grid","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"c2p_segmentation.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/c2p_segmentation.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f29ebe1a2f55300d"}},{"code_sha256_prefix":"560fface17f291b4","entry":"read_cali","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"attack.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/attack.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"560fface17f291b4"}},{"code_sha256_prefix":"810e3276e34039fe","entry":"render","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"render.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/render.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"810e3276e34039fe"}},{"code_sha256_prefix":"99bee8a1ad6f406f","entry":"render_div","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"render.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/render.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"99bee8a1ad6f406f"}},{"code_sha256_prefix":"50f11d1830ea88b9","entry":"xyz2grid","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"xyz2grid.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/xyz2grid.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"50f11d1830ea88b9"}},{"code_sha256_prefix":"a59cf65f2fe6255f","entry":"xyzi2gridhard","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"xyz2grid.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/xyz2grid.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a59cf65f2fe6255f"}},{"code_sha256_prefix":"559aaaf2325a4e86","entry":"estimate_plane","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"ground_detector_simple.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/ground_detector_simple.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"559aaaf2325a4e86"}},{"code_sha256_prefix":"c9790fbf34397045","entry":"injectCube","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"inject_cube.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/inject_cube.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c9790fbf34397045"}},{"code_sha256_prefix":"4bc27814ce2c2d13","entry":"injectCylinder","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"inject_cube.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/inject_cube.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4bc27814ce2c2d13"}},{"code_sha256_prefix":"4eac161e796b8b53","entry":"lossRenderAttack","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"loss_LiDAR.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/loss_LiDAR.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4eac161e796b8b53"}},{"code_sha256_prefix":"f555463c4444b6aa","entry":"my_ransac_v3","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"ground_detector_simple.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/ground_detector_simple.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f555463c4444b6aa"}},{"code_sha256_prefix":"db86dfb6ec8f0a09","entry":"predict_convert","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"attack.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"db86dfb6ec8f0a09"}},{"code_sha256_prefix":"3c0901495eeeb97f","entry":"xyzi2grid_v2","repo":"ASGuard-UCI/MSF-ADV","repo_kind":"listed","path":"xyz2grid.py","file_url":"https://github.com/ASGuard-UCI/MSF-ADV/blob/HEAD/xyz2grid.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3c0901495eeeb97f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}