ATLAS: A Large-Scale Evaluation Benchmark for Adversarial LiDAR Perception

2026-06-01

AI Summary

Current LiDAR perception evaluations lack robustness testing against physically realizable black-box attacks—such as point injection and removal—limiting their ability to reflect real-world safety risks. This work proposes ATLAS, the first large-scale adversarial LiDAR perception benchmark built upon real-world driving sequences, which systematically evaluates state-of-the-art detection models under physically feasible point cloud injection and removal attacks. The study reveals, for the first time, an asymmetry in robustness among high-performing models: they exhibit greater resilience to point removal but are significantly more vulnerable to point injection. Furthermore, it identifies that commonly used object database sampling augmentations introduce architecture-agnostic vulnerabilities. To advance the field, the authors open-source the ATLAS generation code, advocating for sensor-level robustness to be integrated into perception system design.

Abstract

Autonomous driving perception is typically evaluated on clean benchmark data, yet real-world deployment requires robustness to rare, structured, and potentially adversarial sensor anomalies. This gap is especially critical for LiDAR, where external actors can physically manipulate the sensing process to induce black-box perception failures without accessing the model. Existing LiDAR benchmarks provide little visibility into this failure mode. Prior adversarial LiDAR studies have largely centered on attack hardware, geometric and algorithmic defenses, and early-generation detectors, leaving the robustness of modern perception systems unexplored. To address this evaluation gap, we introduce ATLAS (Adversarial Temporal LiDAR Attack Suite), the first large-scale, physically grounded evaluation benchmark for LiDAR perception models under black-box sensor attacks, simulating the two primary attack modes -- point injection and point removal -- across real driving sequences. Evaluating a broad cross-section of current state-of-the-art LiDAR perception models, ATLAS reveals a surprising robustness asymmetry: models with stronger performance on standard benchmarks tend to better withstand removal attacks, yet are actually more vulnerable to injection attacks than weaker models. We trace this vulnerability to standard object database sampling augmentations, revealing how current training practices can induce architecture-agnostic robustness failures, and study initial directions for mitigating both attack modes. We release the ATLAS generation code to support extensible, reproducible evaluations as attack capabilities evolve, helping make black-box sensor robustness an explicit consideration in future LiDAR perception development.

Problem

• adversarial LiDAR
• sensor attacks
• perception robustness
• black-box attacks
• autonomous driving

Innovation

• adversarial LiDAR
• black-box sensor attacks
• robustness asymmetry
• point injection
• evaluation benchmark