Adversarial Scan Attack against Scan Matching Algorithm for Pose Estimation in LiDAR-Based SLAM

Kota YOSHIDA; Masaya HOJO; Takeshi FUJINO

doi:10.1587/transfun.2021CIP0017

IEICE TRANSACTIONS on Fundamentals

Open Access
Adversarial Scan Attack against Scan Matching Algorithm for Pose Estimation in LiDAR-Based SLAM

Kota YOSHIDA, Masaya HOJO, Takeshi FUJINO

Full Text Views

43

Cite this

Free PDF (2.8MB)

Summary :

Autonomous robots are controlled using physical information acquired by various sensors. The sensors are susceptible to physical attacks, which tamper with the observed values and interfere with control of the autonomous robots. Recently, sensor spoofing attacks targeting subsequent algorithms which use sensor data have become large threats. In this paper, we introduce a new attack against the LiDAR-based simultaneous localization and mapping (SLAM) algorithm. The attack uses an adversarial LiDAR scan to fool a pose graph and a generated map. The adversary calculates a falsification amount for deceiving pose estimation and physically injects the spoofed distance against LiDAR. The falsification amount is calculated by gradient method against a cost function of the scan matching algorithm. The SLAM algorithm generates the wrong map from the deceived movement path estimated by scan matching. We evaluated our attack on two typical scan matching algorithms, iterative closest point (ICP) and normal distribution transform (NDT). Our experimental results show that SLAM can be fooled by tampering with the scan. Simple odometry sensor fusion is not a sufficient countermeasure. We argue that it is important to detect or prevent tampering with LiDAR scans and to notice inconsistencies in sensors caused by physical attacks.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E105-A No.3 pp.326-335

Publication Date: 2022/03/01

Publicized: 2021/10/26

Online ISSN: 1745-1337

DOI: 10.1587/transfun.2021CIP0017

Type of Manuscript: Special Section PAPER (Special Section on Cryptography and Information Security)

Category

Authors

Kota YOSHIDA
  Ritsumeikan University
Masaya HOJO
  Ritsumeikan University
Takeshi FUJINO
  Ritsumeikan University

Keyword

instrumentation security, SLAM, LiDAR, adversarial examples

Cite this

Copy

Kota YOSHIDA, Masaya HOJO, Takeshi FUJINO, "Adversarial Scan Attack against Scan Matching Algorithm for Pose Estimation in LiDAR-Based SLAM" in IEICE TRANSACTIONS on Fundamentals, vol. E105-A, no. 3, pp. 326-335, March 2022, doi: 10.1587/transfun.2021CIP0017.
Abstract: Autonomous robots are controlled using physical information acquired by various sensors. The sensors are susceptible to physical attacks, which tamper with the observed values and interfere with control of the autonomous robots. Recently, sensor spoofing attacks targeting subsequent algorithms which use sensor data have become large threats. In this paper, we introduce a new attack against the LiDAR-based simultaneous localization and mapping (SLAM) algorithm. The attack uses an adversarial LiDAR scan to fool a pose graph and a generated map. The adversary calculates a falsification amount for deceiving pose estimation and physically injects the spoofed distance against LiDAR. The falsification amount is calculated by gradient method against a cost function of the scan matching algorithm. The SLAM algorithm generates the wrong map from the deceived movement path estimated by scan matching. We evaluated our attack on two typical scan matching algorithms, iterative closest point (ICP) and normal distribution transform (NDT). Our experimental results show that SLAM can be fooled by tampering with the scan. Simple odometry sensor fusion is not a sufficient countermeasure. We argue that it is important to detect or prevent tampering with LiDAR scans and to notice inconsistencies in sensors caused by physical attacks.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.2021CIP0017/_p

Copy

@ARTICLE{e105-a_3_326,
author={Kota YOSHIDA, Masaya HOJO, Takeshi FUJINO, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Adversarial Scan Attack against Scan Matching Algorithm for Pose Estimation in LiDAR-Based SLAM},
year={2022},
volume={E105-A},
number={3},
pages={326-335},
abstract={Autonomous robots are controlled using physical information acquired by various sensors. The sensors are susceptible to physical attacks, which tamper with the observed values and interfere with control of the autonomous robots. Recently, sensor spoofing attacks targeting subsequent algorithms which use sensor data have become large threats. In this paper, we introduce a new attack against the LiDAR-based simultaneous localization and mapping (SLAM) algorithm. The attack uses an adversarial LiDAR scan to fool a pose graph and a generated map. The adversary calculates a falsification amount for deceiving pose estimation and physically injects the spoofed distance against LiDAR. The falsification amount is calculated by gradient method against a cost function of the scan matching algorithm. The SLAM algorithm generates the wrong map from the deceived movement path estimated by scan matching. We evaluated our attack on two typical scan matching algorithms, iterative closest point (ICP) and normal distribution transform (NDT). Our experimental results show that SLAM can be fooled by tampering with the scan. Simple odometry sensor fusion is not a sufficient countermeasure. We argue that it is important to detect or prevent tampering with LiDAR scans and to notice inconsistencies in sensors caused by physical attacks.},
keywords={},
doi={10.1587/transfun.2021CIP0017},
ISSN={1745-1337},
month={March},}

Copy

TY - JOUR
TI - Adversarial Scan Attack against Scan Matching Algorithm for Pose Estimation in LiDAR-Based SLAM
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 326
EP - 335
AU - Kota YOSHIDA
AU - Masaya HOJO
AU - Takeshi FUJINO
PY - 2022
DO - 10.1587/transfun.2021CIP0017
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E105-A
IS - 3
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - March 2022
AB - Autonomous robots are controlled using physical information acquired by various sensors. The sensors are susceptible to physical attacks, which tamper with the observed values and interfere with control of the autonomous robots. Recently, sensor spoofing attacks targeting subsequent algorithms which use sensor data have become large threats. In this paper, we introduce a new attack against the LiDAR-based simultaneous localization and mapping (SLAM) algorithm. The attack uses an adversarial LiDAR scan to fool a pose graph and a generated map. The adversary calculates a falsification amount for deceiving pose estimation and physically injects the spoofed distance against LiDAR. The falsification amount is calculated by gradient method against a cost function of the scan matching algorithm. The SLAM algorithm generates the wrong map from the deceived movement path estimated by scan matching. We evaluated our attack on two typical scan matching algorithms, iterative closest point (ICP) and normal distribution transform (NDT). Our experimental results show that SLAM can be fooled by tampering with the scan. Simple odometry sensor fusion is not a sufficient countermeasure. We argue that it is important to detect or prevent tampering with LiDAR scans and to notice inconsistencies in sensors caused by physical attacks.
ER -

IEICE TRANSACTIONS on Fundamentals