MOBA: A Material-Oriented Backdoor Attack against LiDAR-based 3D Object Detection Systems

TL;DR

This paper introduces MOBA, a novel backdoor attack framework for LiDAR-based 3D object detection that uses material properties to create physically realizable triggers, significantly improving attack success rates.

Contribution

MOBA explicitly models material properties to bridge the digital-physical gap, enabling effective and robust physical backdoor triggers for LiDAR systems.

Findings

Achieves 93.50% attack success rate, outperforming prior methods by over 41%.

Identifies titanium dioxide as an effective trigger material due to its reflectivity and resilience.

Develops a simulation pipeline that accurately mimics physical trigger behavior in digital models.

Abstract

LiDAR-based 3D object detection is widely used in safety-critical systems. However, these systems remain vulnerable to backdoor attacks that embed hidden malicious behaviors during training. A key limitation of existing backdoor attacks is their lack of physical realizability, primarily due to the digital-to-physical domain gap. Digital triggers often fail in real-world settings because they overlook material-dependent LiDAR reflection properties. On the other hand, physically constructed triggers are often unoptimized, leading to low effectiveness or easy detectability.This paper introduces Material-Oriented Backdoor Attack (MOBA), a novel framework that bridges the digital-physical gap by explicitly modeling the material properties of real-world triggers. MOBA tackles two key challenges in physical backdoor design: 1) robustness of the trigger material under diverse environmental conditions, 2) alignment between the physical trigger's behavior and its digital simulation. First, we propose a systematic approach to selecting robust trigger materials, identifying titanium dioxide (TiO_2) for its high diffuse reflectivity and environmental resilience. Second, to ensure the digital trigger accurately mimics the physical behavior of the material-based trigger, we develop a novel simulation pipeline that features: (1) an angle-independent approximation of the Oren-Nayar BRDF model to generate realistic LiDAR intensities, and (2) a distance-aware scaling mechanism to maintain spatial consistency across varying depths. We conduct extensive experiments on state-of-the-art LiDAR-based and Camera-LiDAR fusion models, showing that MOBA achieves a 93.50% attack success rate, outperforming prior methods by over 41%. Our work reveals a new class of physically realizable threats and underscores the urgent need for defenses that account for material-level properties in real-world environments.