Adversarial and physical spoofing (lidar, radar/MadRadar, GPS, IMU, audio)

"You spent a year hardening my neural network, and an attacker beat it with a $40 signal generator and a line of sight to my antenna."

A Chastened AI Agent

A note on prerequisites. This section assumes the measurement models of Chapter 2, the sampling and timing ideas of Chapter 3, and the innovation-based consistency checking you first met with the Kalman family in Chapter 9. Those three give us the vocabulary to say precisely why each attack works and how a residual test can flag it.

Optical time-of-flight: spoofing and relaying lidar

A lidar measures range by timing a returned laser pulse, \(d = c\,\Delta t / 2\). It cannot tell your echo from an attacker's photon at the same wavelength. This is the whole vulnerability. A relay (record-and-replay) attack receives the victim's pulse and re-emits it after a controlled delay \(\tau\), placing a phantom point at \(d' = d + c\tau/2\) or, with a negative effective delay via a pre-fired pulse, pulling an obstacle closer. A spoofing attack fires attacker-generated pulses synchronized to the victim's firing schedule to inject a cluster of points where nothing exists, or to saturate the receiver and delete real returns. The consequential demonstrations (Cao et al., Adversarial Sensor Attack on LiDAR-based Perception, 2019, and the later object-removal work) showed that injecting or removing only a few dozen points near the ego vehicle, well under one percent of a scan, is enough to spawn a phantom car that triggers emergency braking or to erase a real pedestrian, because the downstream 3D detector of Chapter 42 was trained on clean returns and treats the point cloud as ground truth. Defenses exploit what the attacker finds hard to forge: pulse-fingerprint randomization (per-pulse timing or waveform codes that a naive replay cannot match), multi-echo and intensity consistency, and cross-modal agreement with camera or radar.

Radar: FMCW injection and the MadRadar threat model

Automotive radar estimates range from beat frequency and velocity from Doppler shift on a frequency-modulated continuous-wave (FMCW) chirp. An attacker with a transmitter in the same band and a model of the victim's chirp slope \(S\) can inject a false beat frequency \(f_b\), and since range maps as

a chosen \(f_b\) places a ghost target at any range the attacker likes; a matched frequency offset forges an arbitrary Doppler velocity. The 2024 MadRadar work (Hunt et al.) is the reference point because it removed the last unrealistic assumption in earlier radar attacks: it estimates the victim radar's operating parameters (chirp slope, timing, bandwidth) blindly and in real time, then launches false-positive (ghost object), false-negative (masking a real object under a noise floor), and translation (shifting a real object's apparent position and speed) attacks without prior knowledge of the victim's configuration. That matters because it turns radar spoofing from a lab curiosity into a same-band, over-the-air threat against fielded systems. The radar-AI stack of Chapter 44 inherits this exposure, and the mitigations mirror lidar's: randomize the chirp parameters per frame so the attacker cannot match \(S\), and demand cross-sensor consistency before a single-modality detection is allowed to command a safety action.

GPS spoofing and the IMU resonance attack

Civilian GPS is unauthenticated and arrives at roughly \(-125\) dBm, weaker than the thermal noise floor, so a spoofer transmitting slightly stronger counterfeit signals can capture a receiver and walk its computed position anywhere. The public demonstrations are unambiguous: the 2013 University of Texas team steered the yacht White Rose of Drachs off course, and location-poisoning of drones and phones is now routine in contested airspace. Spoofing is more dangerous than jamming precisely because the receiver reports a confident, plausible fix rather than a loss of lock. The positioning stack of Chapter 25 defends with signal-level tests (received-power monitoring, angle-of-arrival with an antenna array so all "satellites" arriving from one direction are exposed), and increasingly with authenticated signals such as Galileo OSNMA.

Inertial sensors seem immune because they are self-contained, yet they are among the easiest to spoof acoustically. A MEMS gyroscope or accelerometer is a tiny vibrating proof mass; drive it at its mechanical resonant frequency with sound and the reading corrupts. The WALNUT attack (Trippel et al., 2017) used tuned acoustic tones to inject chosen accelerometer outputs; a related result crashed a hovering drone by resonating its gyroscope with an audible tone matched to the MEMS structure. The orientation and dead-reckoning pipeline of Chapter 24 is the victim, and the defenses are physical (acoustic isolation, resonant-frequency randomization across a production run) plus algorithmic out-of-band energy detection.

Audio and cross-modal injection

Voice interfaces are spoofable through the transducer itself. DolphinAttack (Zhang et al., 2017) exploited the nonlinearity of the microphone amplifier: modulate a voice command onto an ultrasonic carrier above human hearing, and the amplifier demodulates it back into the audible band inside the device, so an inaudible transmission becomes a silent, machine-only command to a smart speaker or phone assistant. Laser-based variants (Light Commands) inject commands by pointing a modulated laser at the MEMS microphone port. These are the audio analog of the optical and RF attacks above: the adversary reaches past the software and manipulates the physical quantity the sensor is built to measure. The common thread across all five channels is that hardening the model is necessary but never sufficient, because the falsified value is already trusted by the time your network sees it.

import numpy as np

def innovation_gate(z, z_pred, S, gamma=9.0):
    """Chi-square consistency gate on a measurement innovation.
    z, z_pred : measured and predicted vectors (e.g. a radar range/velocity).
    S         : innovation covariance from the fusion filter.
    gamma     : threshold; 9.0 ~ 99% for 2 DoF. Return True to ACCEPT."""
    nu = z - z_pred                       # innovation (residual)
    d2 = float(nu @ np.linalg.solve(S, nu))   # squared Mahalanobis distance
    return d2 <= gamma, d2

# A legitimate radar return vs. a MadRadar ghost injected 6 m closer.
z_pred = np.array([42.0, -8.0])           # predicted [range m, velocity m/s]
S = np.diag([0.5**2, 0.7**2])             # filter's uncertainty
legit = np.array([42.3, -8.1])            # small, plausible innovation
ghost = np.array([36.0, -8.0])            # physically valid, historically impossible

for name, z in (("legit", legit), ("ghost", ghost)):
    ok, d2 = innovation_gate(z, z_pred, S)
    print(f"{name:5s} accept={ok}  d2={d2:6.1f}")

Code 68.2.1 makes the defense concrete. The gate never inspects the raw waveform; it only asks whether each measurement is consistent with the recursive state estimate, which is exactly what a physically valid but injected value cannot guarantee over time.

When the model is the wrong place to defend

It is tempting to answer spoofing with adversarial training, and for digital perturbations that helps. But physical spoofing injects data that is in-distribution by construction, a valid point, a valid chirp return, a valid pseudorange, so a more robust classifier still trusts it. The correct response lives in three other layers: signal-level authentication and randomization at the sensor (make the physical channel hard to forge), temporal and cross-modal consistency at the fusion filter (make the falsehood detectable in context, per Chapter 48), and a safety envelope that refuses to let any single modality command an irreversible action (Section 68.3). Choosing the wrong layer, spending your budget on model robustness against attacks that never touch the model, is the most common and most expensive mistake in this whole area.

What's Next

In Section 68.3, we turn the consistency arguments of this section into architecture: redundancy, voting across diverse sensors, and the safety envelopes that guarantee no single spoofed or failed modality can command an unsafe action. If this section explained why cross-modal agreement is the strongest defense, the next explains how to design the vote and bound the residual risk.