Paper accepted at USENIX Security 2025: “Invisible but Detected”
LiDAR point clouds contain “shadow” regions behind objects where no points are returned. These shadows never appear in the detection output, yet they implicitly influence how object detection models make decisions. This work presents Shadow Hack, the first attack that fabricates such shadows to induce misdetection.
Using mirror sheets — a material LiDAR struggles to range accurately — and optimizing the position and size of the resulting shadows, the attack achieved a 100% success rate against multiple models at distances of 11–21 m in simulation, and up to 100% against PointPillars and 98% against SECOND-IoU at 10 m in physical-world experiments. The paper also proposes and evaluates a defense that detects and mitigates the attack.
[Paper]
Ryunosuke Kobayashi, Kazuki Nomoto, Yuna Tanaka, Go Tsuruoka, Tatsuya Mori, “Invisible but Detected: Physical Adversarial Shadow Attack and Defense on LiDAR Object Detection,” Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025), Seattle, WA, USA, August 2025.