# Adversarial Calibration Attack on Autonomous Vehicles

arXiv: https://arxiv.org/abs/2608.28778 · HTML: https://mlsanity.com/paper/2608.28778/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 34 of its 71 references that are in the map.
- First posted on arXiv 28 Aug 2026.

## Builds on (most cited first, 30 of 34)

- [PointPillars: Fast Encoders for Object Detection from Point Clouds](https://mlsanity.com/paper/1812.05784/) (2018)
- [PointPainting: Sequential Fusion for 3D Object Detection](https://mlsanity.com/paper/1911.10150/) (2019)
- [Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving](https://mlsanity.com/paper/1907.06826/) (2019)
- [Physically Realizable Adversarial Examples for LiDAR Object Detection](https://mlsanity.com/paper/2004.00543/) (2020)
- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures](https://mlsanity.com/paper/2006.16974/) (2020)
- [RegNet: Multimodal Sensor Registration Using Deep Neural Networks](https://mlsanity.com/paper/1707.03167/) (2017)
- [Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack](https://mlsanity.com/paper/2009.06701/) (2020)
- [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022)
- [DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems](https://mlsanity.com/paper/1812.10812/) (2018)
- [SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations](https://mlsanity.com/paper/2007.04137/) (2020)
- [Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving](https://mlsanity.com/paper/2101.06784/) (2021)
- [You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks](https://mlsanity.com/paper/2210.09482/) (2022)
- [Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving](https://mlsanity.com/paper/2403.17301/) (2024)
- [Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems](https://mlsanity.com/paper/2201.06192/) (2022)
- [Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles](https://mlsanity.com/paper/2106.07098/) (2021)
- [Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing (Extended Version)](https://mlsanity.com/paper/2006.10318/) (2020)
- [Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attacks](https://mlsanity.com/paper/2301.13487/) (2023)
- [Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition](https://mlsanity.com/paper/2204.02675/) (2022)
- [Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception](https://mlsanity.com/paper/2401.03582/) (2024)
- [Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection](https://mlsanity.com/paper/2304.14614/) (2023)
- [On Data Fabrication in Collaborative Vehicular Perception: Attacks and Countermeasures](https://mlsanity.com/paper/2309.12955/) (2023)
- [LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies](https://mlsanity.com/paper/2303.10555/) (2023)
- [Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception](https://mlsanity.com/paper/2106.07833/) (2021)
- [ADoPT: LiDAR Spoofing Attack Detection Based on Point-Level Temporal Consistency](https://mlsanity.com/paper/2310.14504/) (2023)
- [Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective](https://mlsanity.com/paper/2409.09860/) (2024)
- [Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception](https://mlsanity.com/paper/2204.13973/) (2022)
- [Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles](https://mlsanity.com/paper/2407.07510/) (2024)
- [Detecting and Identifying Optical Signal Attacks on Autonomous Driving Systems](https://mlsanity.com/paper/2110.10523/) (2021)
- [Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving](https://mlsanity.com/paper/2509.06071/) (2025)

## Abstract (arXiv)

Autonomous vehicles (AVs) rely on accurate camera-LiDAR calibration for multimodal sensor fusion. In practice, calibration can drift due to vibration, temperature variation, or minor sensor displacement, motivating online calibration algorithms that detect and correct misalignment at runtime while allowing the vehicle to continue operating without a factory visit. Existing AV attacks largely assume correct calibration. We instead identify online sensor calibration as a new attack plane. A corrupted calibration update can persist across subsequent fusion operations, causing system-wide errors that propagate from perception to planning and control. We present Adversarial Calibration Attack (ACA), the first physical attack against camera-LiDAR online calibration. Using a single adversarial poster, ACA first spoofs the miscalibration detector to trigger the calibration process and then steers the calibration estimator toward an incorrect transformation. A unified optimization jointly designs the poster's geometry and texture for both objectives. We evaluate ACA across benchmark datasets, simulation, and physical experiments. On benchmark datasets such as KITTI and nuScenes, ACA induces up to 33.9 degrees mean rotational calibration error, thereby severely degrading object detection. In the CARLA simulator, the attack causes a collision when the corrupted calibration is accepted in vulnerable scenarios crafted by the attacker. On a real Husky robot, a printed adversarial poster successfully reproduces the calibration error. These results demonstrate that online calibration is a practical and safety-critical attack surface for AVs.