Leveraging Intensity as a New Feature to Detect Physical Adversarial Attacks Against LiDARs

Recently, LiDARs have attracted a lot of attention because they enable Advanced Driver Assistance Systems (ADAS) by precisely measuring their surroundings. However, with this increased interest, adversarial attacks on LiDARs have also been demonstrated. Since LiDARs, by default, recognize the strongest reflected pulse among multiple returning pulses, these attacks exploit high-intensity laser pulses to remove original real points and create spoofed points in the point cloud. These spoofed points can serve as perturbations that cause detection errors in a object detection model using LiDAR data. To detect spoofed points, existing defense methods have only analyzed their locations in a point cloud (i.e., x, y, z). Although LiDARs provide the intensity of the reflected pulses, defense methods have ignored the intensity when detecting spoofed points. In this paper, we present a new method to detect spoofed points that are created by high-intensity laser pulse injection. Based on the fact that a higher intensity level is required to generate spoofed points in a point cloud, our method is designed to analyze the intensity of reflected pulses to identify injected pulses by attackers. Using the Adam optimization algorithm, our method resulted in a false positive rate of 3.88% for SECOND and 4.40% for PointPillar. The true positive rate was generally over 40% higher than that of other defense methods, and at least 10% higher in the worst-case scenario.