MirrorDrift: Actuated Mirror-Based Attacks on LiDAR SLAM

TL;DR

MirrorDrift introduces a novel physical attack on LiDAR SLAM using an actuated mirror to create ghost points, significantly degrading localization accuracy even against modern defenses.

Contribution

This work demonstrates a new injection-free attack method on LiDAR SLAM using specular reflection and optimized mirror placement, effective against secure, interference-mitigating LiDARs.

Findings

Increases pose error by 6.1x in simulation

Degrades SLAM accuracy to 2.29-3.31 meters in simulation

Induces up to 6.03 meters localization error in real-world tests

Abstract

LiDAR SLAM provides high-accuracy localization but is fragile to point-cloud corruption because scan matching assumes geometric consistency. Prior physical attacks on LiDAR SLAM largely rely on LiDAR spoofing via external signal injection, which requires sensor-specific timing knowledge and is increasingly mitigated by modern defense mechanisms such as timing obfuscation and injection rejection. In this work, we show that specular reflection offers an injection-free alternative and demonstrate an attack, MirrorDrift, that uses an actuated planar mirror to cause ghost points in LiDAR scans and systematically bias scan-matching correspondences. MirrorDrift optimizes mirror placement, alignment, and actuation. In simulation, it increases the average pose error (APE) by 6.1x over random placement, degrading three SLAM systems to 2.29-3.31 m mean APE. In real-world experiments on a modern LiDAR with state-of-the-art interference mitigation, it induces localization errors of up to 6.03 m. To the best of our knowledge, this is the first successful SLAM-targeted attack against production-grade secure LiDARs.