DisorientLiDAR: Physical Localization Attack
- DisorientLiDAR is a physical attack framework that degrades LiDAR localization by removing critical geometric regions without sensor tampering.
- It reverse-engineers models like HRegNet, D3Feat, and GeoTransformer to identify and occlude top keypoints, resulting in registration and trajectory errors.
- Evaluations on digital and physical platforms show that targeted occlusions can cause significant pose drift and navigation failures even under imperfect deployment.
DisorientLiDAR is a physical attack framework for LiDAR-based localization in which an adversary induces localization error not by injecting fake points or modifying the sensor, but by hiding a small number of geometrically influential regions so that the victim scan loses the correspondences on which registration depends most. The name appears explicitly in the title of "DisorientLiDAR: Physical Attacks on LiDAR-based Localization" (Lao et al., 16 Sep 2025), whose central claim is that reverse-engineering localization models allows an attacker to identify critical keypoints and strategically remove them, causing registration degradation, localization drift, and, in chained operation, severe trajectory deviation. Within the broader LiDAR literature represented here, the topic also intersects with object-removal attacks on 3D detection, LiDAR motion correction, and LiDAR odometry, but DisorientLiDAR is specifically a localization attack rather than a fake-object spoofing method or a de-skewing pipeline.
1. Definition, objective, and threat model
DisorientLiDAR targets LiDAR-based localization pipelines, especially learning-based point-cloud registration systems, under a physical threat model in which the adversary knows the victim localization pipeline or can infer it from public documentation, open-source code, manuals, or datasheets. The attacker chooses an ambush location along the vehicle path and places near-infrared-absorbing materials near the road without modifying the vehicle or LiDAR hardware. In system-level analysis, the attacker may also have access to localization software in open-source stacks such as Autoware (Lao et al., 16 Sep 2025).
The attack goal is to disorient the victim vehicle by inducing erroneous localization estimates and therefore incorrect trajectory planning. The operative mechanism is removal rather than fabrication: selected roadside objects are made to disappear from the LiDAR scan, so the registration module must estimate pose from weaker or less stable geometric evidence. The paper formalizes registration as rigid alignment between two point clouds and frames the attack around the removal of the most reliable correspondences. This suggests that the vulnerability is not tied to a single architecture, but to the dependence of registration accuracy on a limited subset of high-confidence geometric matches.
A common misconception is to equate DisorientLiDAR with LiDAR spoofing attacks that create phantom objects. Its threat model is materially different. The adversary does not inject return signals, and the sensor need not be directly tampered with. Instead, the attack is stealthy precisely because the selected objects are physically present but rendered effectively invisible to LiDAR by near-infrared absorptive covering (Lao et al., 16 Sep 2025).
2. Saliency-driven removal mechanism
The core intuition of DisorientLiDAR is that modern localization systems often derive pose from a relatively small set of high-confidence correspondences, keypoints, or superpoints. The attacker therefore reverse-engineers the victim registration model, extracts a saliency or confidence signal, ranks points or regions by their contribution to registration quality, and hides the Top-K most important regions. The paper contrasts this with two baselines: Rand-K, which hides random regions, and Min-K, which hides the least important regions. Top-K is reported as consistently the most effective because it removes the geometry the model relies on most (Lao et al., 16 Sep 2025).
The attack workflow is explicitly staged. The adversary first obtains or emulates the victim model, then scores and ranks candidate points or regions, maps selected keypoints to physically occludable regions, deploys near-infrared-absorbing material, and waits for the victim vehicle to pass the ambush site. At that point, critical scan regions are missing, registration becomes inaccurate, and pose estimates drift. The design is therefore model-aware but sensor-external: it exploits the inductive structure of the localization pipeline while acting only on the physical scene.
This mechanism is closely related in spirit to removal-style attacks on LiDAR perception, but its target is localization rather than object detection. In "Object Removal Attacks on LiDAR-based 3D Object Detectors" (Hau et al., 2021), the attacker displaces genuine object points out of an object's region of interest so that the object is missed by 3D detectors. DisorientLiDAR instead hides highly informative environmental regions so that scan registration deteriorates. The distinction is operationally important: one attack removes detections of scene objects, the other corrupts ego-pose estimation.
3. Model-specific reverse engineering and physical realization
DisorientLiDAR is evaluated against three learning-based registration models: HRegNet, D3Feat, and GeoTransformer. The saliency logic differs by model because each architecture encodes reliability differently (Lao et al., 16 Sep 2025).
| Model | Registration dependence | Reported attack intuition |
|---|---|---|
| HRegNet | Hierarchical correspondences with weighted SVD | Early-stage high-confidence removals propagate through later stages |
| D3Feat | Salient keypoints for RANSAC | Removing highest-confidence keypoints directly weakens transform estimation |
| GeoTransformer | High-consensus superpoint matches | Occluding best superpoints lowers inlier count |
For HRegNet, the paper highlights a hierarchical pipeline with point correspondences, with the first 256-point stage especially important because its transform estimate propagates through later stages. For D3Feat, which jointly learns detection and description, non-maximum suppression selects high-repeatability, distinctive keypoints for RANSAC, so removing those points directly damages transformation estimation. GeoTransformer is described as more keypoint-free in spirit, but still depends on high-consensus superpoint matches; it is more robust than the other two, yet still vulnerable under sufficiently strong Top-K removal (Lao et al., 16 Sep 2025).
The transition from digital saliency to real-world attackability is mediated by a four-stage screening process. First, height filtering removes ground points and excludes points higher than 3 m. Second, a trajectory proximity check avoids regions intersecting the vehicle path, both for stealth and to avoid obvious driving anomalies. Third, overlapping handling retains only the nearest candidate when multiple keypoints refer to the same object or direction. Fourth, the ambush tool is placed about 1 m ahead of the target point, perpendicular to the ground, to ensure coverage (Lao et al., 16 Sep 2025).
The physical realization uses VL Flock Sheet by KOYO CO., LTD., described as a black cloth or material with more than 95% absorption in the $2$–$2200$ nm range, including the 905 nm wavelength used by the LiDAR. The paper reports that after coverage, almost no point-cloud data is returned from the hidden region. The material choice is therefore not incidental; it operationalizes the attack by converting saliency-ranked scene elements into LiDAR-dark occlusions (Lao et al., 16 Sep 2025).
4. Evaluation on KITTI, Autoware, and physical platforms
The digital evaluation uses the KITTI odometry dataset with a Velodyne HDL64 LiDAR, using sequences 00–05 for training, 06–07 for validation, and 08–10 for testing. The parameter sweep varies the number of ambush positions from 1 to 10 and the cloth side length across $0.3, 0.6, 0.9, 1.2, 1.5, 1.8, 2.1, 2.4, 2.7,$ and $3$ m. Metrics are Relative Rotation Error (RRE), Relative Translation Error (RTE), and Registration Recall (RR), with RR thresholds set to for RRE and $0.3$ m for RTE (Lao et al., 16 Sep 2025).
The reported results establish a consistent ranking: Top-K is more damaging than Rand-K or Min-K. HRegNet is described as the most unstable under attack, with Top-K producing RTE roughly in the range $0.319$–0 m, RRE roughly 1–2, and RR dropping from 3 to 4. D3Feat exhibits increasing degradation as more critical regions are removed: under Top-K, RTE rises from 5 m to 6 m, RRE from 7 to 8, and RR falls from 9 to 0. GeoTransformer is the most robust of the three in the digital experiments, but still degrades under stronger Top-K removal, with RTE rising from 1 m to 2 m, RRE from 3 to 4, and RR falling from 5 to 6 (Lao et al., 16 Sep 2025).
The paper further reports that local registration perturbations accumulate over time. When attacked registration outputs are chained across frames, the global trajectory can drift significantly, with some routes exhibiting nearly a 7 flip in direction. This is a critical systems result because it converts framewise registration degradation into navigation-scale failure.
The Autoware experiments broaden the scope beyond learning-based registration. In this setting, localization uses NDT against an HD map, with GPS and IMU for initial pose, on a vehicle equipped with a 128-beam Velodyne VLS-128. At a crossroads, removing 6 distinct regions induces measurable localization drift: at position 1, the attacked localization error is RTE 8 m and RRE 9; at position 2, the errors increase to RTE $2$0 m and RRE $2$1. After leaving the attack zone, the trajectory gradually corrects with GPS support. The result is significant because it shows that the attack persists even when the localization module is not correspondence-based in the same way as the three learned models (Lao et al., 16 Sep 2025).
The physical experiments use a platform with a Velodyne VLP-16, Xsens MTi-300 IMU, and GNSS INS CGI-410. Vulnerable frame pairs are identified by thresholds $2$2 or $2$3 m, then near-infrared-absorbing patches are deployed on selected regions. HRegNet, despite poor baseline performance on 16-beam LiDAR due to sparse point clouds, still degrades from RRE $2$4 / RTE $2$5 m to RRE $2$6 / RTE $2$7 m. D3Feat shows substantial post-attack trajectory deviation. GeoTransformer has the best low-beam baseline performance, but hiding just one key region can drive RTE from $2$8 m to $2$9 m, with estimated poses between attacked frame pairs remaining nearly unchanged even when the vehicle moves, especially at turns. The paper characterizes this as simulation-to-reality consistency (Lao et al., 16 Sep 2025).
An additional ablation studies placement error by varying the material orientation within $2200$0 in $2200$1 increments with $2200$2 and $2200$3 m. Even under this angular misalignment, RR remains below $2200$4 versus $2200$5 baseline for HRegNet, below $2200$6 versus $2200$7 for D3Feat, and below $2200$8 versus $2200$9 for GeoTransformer. The attack therefore tolerates imperfect placement, provided the material generally faces the vehicle and covers the right regions (Lao et al., 16 Sep 2025).
5. Terminological overlap and relation to adjacent LiDAR research
The name "DisorientLiDAR" is not semantically isolated within LiDAR research. A plausible implication of the supplied literature is that the term sits at the intersection of several distinct problem families: localization attacks, object-removal attacks, and motion-distortion correction.
The closest adversarial relative is the object-removal attack literature. ORA attacks hide real objects from LiDAR-based 3D object detectors by injecting illegitimate points behind the target object, thereby shifting measurements away from the target object's region of interest and degrading detector recall and average precision (Hau et al., 2021). DisorientLiDAR shares the removal motif, but changes the victim task from object detection to localization. The practical consequence is that the attack surface shifts from object RoIs to correspondence-bearing environmental structure.
A different line of work concerns motion distortion rather than adversarial interference. "Real-Time Truly-Coupled Lidar-Inertial Motion Correction and Spatiotemporal Dynamic Object Detection" describes a real-time LiDAR-IMU motion correction and dynamic object detection pipeline that estimates a continuous local trajectory from IMU preintegration and feature-based point-to-line and point-to-plane residuals, parameterized by eleven discrete state variables, and then computes spatiotemporal normals for learning-free dynamic/static classification without global registration (Gentil et al., 2024). This is conceptually orthogonal to the 2025 attack framework: one removes critical scene geometry to corrupt localization; the other undistorts LiDAR and classifies motion.
The same distinction applies to odometry and de-skewing papers such as "DeLiO: Decoupled LiDAR Odometry," which estimates rotation from surface-normal patterns on the unit sphere and translation from line-cloud registration after unrotation (Thomas et al., 2019), and "Piecewise Linear De-skewing for LiDAR Inertial Odometry," which corrects motion distortion by integrating high-frequency IMU motion information and de-skewing each point individually (Henawy et al., 2021). These methods attempt to stabilize pose estimation under motion, whereas DisorientLiDAR attempts to destabilize it by withholding the most informative geometric evidence.
6. Defenses, limitations, and research significance
The paper discusses two defense directions. The first is adversarial training at the data level, with fine-tuning on attacked samples ranging from 200 to 1000. The reported outcome is that adversarial training significantly improves robustness: HRegNet benefits most visibly, D3Feat recovers gradually, and GeoTransformer improves quickly with a smaller number of adversarial samples and then stabilizes. The second is sensor-level anomaly detection, especially cross-modal checks. Proposed examples include vision-LiDAR consistency checks, semantic-based anomaly region perception, and auxiliary spectral sensing with thermal cameras and millimeter-wave radar (Lao et al., 16 Sep 2025).
These defenses reflect the paper’s stated limitations. Keypoint-free or more robust models such as GeoTransformer are harder to attack when only a few regions are hidden. If too many regions are hidden, the deployment becomes visually noticeable. Some high-saliency points are physically inaccessible because they are too high, too close to traffic, or awkwardly located. Current deployment is labor-intensive because keypoints must be identified separately for each registration model. The authors therefore suggest future work on more universal selection of high-contribution points across architectures (Lao et al., 16 Sep 2025).
The broader significance of DisorientLiDAR is that it reframes LiDAR localization vulnerability around physical scene editing rather than sensor spoofing. In that sense, it expands the attack taxonomy for autonomous driving: not only can LiDAR be confused by fake returns or object-removal effects in detection pipelines, but localization itself can be impaired by hiding a small number of high-value regions. For research on secure autonomy, the main implication is that robustness must be evaluated not only against additive perturbations and signal-level spoofing, but also against structured absence of geometric information induced by selective physical occlusion.