# Object Removal Attacks on LiDAR-based 3D Object Detectors

arXiv: https://arxiv.org/abs/2102.03722 · HTML: https://mlsanity.com/paper/2102.03722/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 14 references that are in the map.
- First posted on arXiv 7 Feb 2021.

## Builds on (most cited first, 9 of 9)

- [PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Space](https://mlsanity.com/paper/1706.02413/) (2017)
- [PointRCNN: 3D Object Proposal Generation and Detection from Point Cloud](https://mlsanity.com/paper/1812.04244/) (2018)
- [Point-GNN: Graph Neural Network for 3D Object Detection in a Point Cloud](https://mlsanity.com/paper/2003.01251/) (2020)
- [Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving](https://mlsanity.com/paper/1907.06826/) (2019)
- [Generating 3D Adversarial Point Clouds](https://mlsanity.com/paper/1809.07016/) (2018)
- [Physically Realizable Adversarial Examples for LiDAR Object Detection](https://mlsanity.com/paper/2004.00543/) (2020)
- [Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures](https://mlsanity.com/paper/2006.16974/) (2020)
- [Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks](https://mlsanity.com/paper/1810.00470/) (2018)
- [Nudge Attacks on Point-Cloud DNNs](https://mlsanity.com/paper/2011.11637/) (2020)

## Built on by (most cited first, 16 of 16)

- [SoK: On the Semantic AI Security in Autonomous Driving](https://mlsanity.com/paper/2203.05314/) (2022)
- [Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection](https://mlsanity.com/paper/2304.14614/) (2023)
- [LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies](https://mlsanity.com/paper/2303.10555/) (2023)
- [Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception](https://mlsanity.com/paper/2106.07833/) (2021)
- [Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses](https://mlsanity.com/paper/2605.02900/) (2026)
- [Real-time Detection of Practical Universal Adversarial Perturbations](https://mlsanity.com/paper/2105.07334/) (2021)
- [Roadmap for Cybersecurity in Autonomous Vehicles](https://mlsanity.com/paper/2201.10349/) (2022)
- [Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception](https://mlsanity.com/paper/2204.13973/) (2022)
- [Jacobian Regularization for Mitigating Universal Adversarial Perturbations](https://mlsanity.com/paper/2104.10459/) (2021)
- [Jacobian Ensembles Improve Robustness Trade-offs to Adversarial Attacks](https://mlsanity.com/paper/2204.08726/) (2022)
- [A First Physical-World Trajectory Prediction Attack via LiDAR-induced Deceptions in Autonomous Driving](https://mlsanity.com/paper/2406.11707/) (2024)
- [Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving](https://mlsanity.com/paper/2511.08015/) (2025)
- [Adversarial 3D Virtual Patches using Integrated Gradients](https://mlsanity.com/paper/2406.00282/) (2024)
- [LiDAttack: Robust Black-box Attack on LiDAR-based Object Detection](https://mlsanity.com/paper/2411.01889/) (2024)
- [Explainability-Aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors](https://mlsanity.com/paper/2606.29963/) (2026)
- [Fast Object Removal Attacks on Safety-Critical Video-based Perception Systems](https://mlsanity.com/paper/2608.02806/) (2026)

## Abstract (arXiv)

LiDARs play a critical role in Autonomous Vehicles' (AVs) perception and their safe operations. Recent works have demonstrated that it is possible to spoof LiDAR return signals to elicit fake objects. In this work we demonstrate how the same physical capabilities can be used to mount a new, even more dangerous class of attacks, namely Object Removal Attacks (ORAs). ORAs aim to force 3D object detectors to fail. We leverage the default setting of LiDARs that record a single return signal per direction to perturb point clouds in the region of interest (RoI) of 3D objects. By injecting illegitimate points behind the target object, we effectively shift points away from the target objects' RoIs. Our initial results using a simple random point selection strategy show that the attack is effective in degrading the performance of commonly used 3D object detection models.