Skip to content
← All projects
View the code on GitHub

AI SECURITY · IEEE SOUTHEASTCON 2025

Catching reflective surfaces that distort what a LiDAR sees

ReAL watches a LiDAR's readings and flags when a reflective surface is distorting them, fast enough to run live on a Jetson Orin Nano. In our tests, a layer of aluminum foil made the LiDAR misjudge object widths by 20 to 24 percent.

View the code on GitHubRead the paper · IEEE SoutheastCon 2025
A scan profile from the real LiDAR recordings, range against beam angle for about 25,000 returns each: the normal surface traces a clean curve, while returns from the reflective surface come back about 10 mm farther and broken up.
  • 99.97% accuracy
  • 0.083 ms latency

THE GAP

A reflective surface can fool a LiDAR without anyone touching the sensor.

LiDAR measures distance by firing laser pulses and timing how long they take to come back. A reflective surface scatters those pulses, so parts of an object return sparse points or none at all. We named this a Surface Reflectivity-Induced Perturbation (SRIP) attack. It needs no access to the emitter or the receiver, just something reflective in the scene.

01

No sensor access

The attack changes the scene, not the LiDAR. Its emitter and receiver are never touched.

02

Objects shrink

Covered in foil, a 240 mm object measured 191.1 mm, and a 210 mm object measured 158.6 mm.

03

An everyday trigger

The paper's example is ordinary: a silver car on a sunny day could misdirect the pulses.

WHAT IT DOES

A small detector that flags bad LiDAR data and hands off to another sensor.

ReAL is a support vector machine that reads the angle and distance of LiDAR returns and labels them normal or reflective. When it spots an attack, it raises a binary alarm for the vehicle's driver-assistance module, and the design hands width measurement to the depth camera. It is for autonomous systems that rely on LiDAR and need to know when not to. Luke Beirne and I contributed equally to the paper, with Syed Rafay Hasan and Wesam Al Amiri, and I presented it at IEEE SoutheastCon 2025.

Two numbers per return

The detector reads only angle and distance from the LiDAR. It needs no camera or extra hardware to detect.

Runs on the edge

Inference runs on a Jetson Orin Nano wired to an RPLiDAR A1M8-R6, in 0.083 to 4.727 ms.

Alert in under 1 ms

A positive call triggers a binary alarm for the driver-assistance module, adding less than 1 ms.

Open data

The recorded scans, training scripts and trained SVM models are all in the public repo.

HOW IT WORKS

From laser sweep to alarm

  1. 1

    Scan

    The LiDAR sweeps the scene, reporting angle, distance and quality for every point.

  2. 2

    Cluster

    Points become X, Y coordinates, and DBSCAN groups them into objects.

  3. 3

    Measure

    An object's width is the distance between the outermost points in its cluster.

  4. 4

    Label

    Scans whose width misses the hand-measured width are labeled reflective; the rest, normal.

  5. 5

    Train

    A support vector machine learns to tell normal readings from reflective ones.

  6. 6

    Alert

    On the Jetson, a reflective call raises an alarm in under 1 ms.

SYSTEM DESIGN

Trained offline, detecting on a Jetson next to the sensor.

Models are trained offline on recorded scans, then run on a Jetson Orin Nano connected to the LiDAR over USB. The output is a single bit, normal or attacked, sent on as an alert.

RESULTS

What we measured on the bench

20–24%

width error when foil covered an object: a 240 mm box read as 191.1 mm

99.97%

detection accuracy in Scenario 3, with 92.71% and 95.53% in Scenarios 1 and 2

0.083 ms

latency in Scenario 3 on a Jetson Orin Nano, and 4.727 ms at the slowest

< 1 ms

added by the real-time alert

Accuracy and latency are as reported in the paper. Each scenario has its own trained model, and all of it comes from a lab bench: one RPLiDAR, four boxes and aluminum foil as the reflector.

WHAT IT TAUGHT ME

What it taught me, and where it stops

What stuck with me is how cheap the attack is. No hacking and no special gear, just foil, and the width readings were off by a fifth or more. That is why I wanted a detector small enough to run beside the sensor. The limits are real. This is a bench study with one LiDAR, four boxes and foil, and the model sees only angle and distance, so a new setup would likely need new training data.

BUILT WITH

  • Python
  • scikit-learn (SVM)
  • DBSCAN
  • pandas
  • rplidar
  • NVIDIA Jetson Orin Nano
  • RPLiDAR A1M8-R6

Like what you see?

Thanks for reading. There's more where this came from.

See all projectsView the code on GitHub