Skip to main content

Shadow-Catcher: Looking into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing

Part of the Lecture Notes in Computer Science book series (LNSC,volume 12972)


LiDAR-driven 3D sensing allows new generations of vehicles to achieve advanced levels of situation awareness. However, recent works have demonstrated that physical adversaries can spoof LiDAR return signals and deceive 3D object detectors to erroneously detect “ghost" objects. Existing defenses are either impractical or focus only on vehicles. Unfortunately, it is easier to spoof smaller objects such as pedestrians and cyclists, but harder to defend against and can have worse safety implications. To address this gap, we introduce Shadow-Catcher, a set of new techniques embodied in an end-to-end prototype to detect both large and small ghost object attacks on 3D detectors. We characterize a new semantically meaningful physical invariant (3D shadows) which Shadow-Catcher leverages for validating objects. Our evaluation on the KITTI dataset shows that Shadow-Catcher consistently achieves more than 94% accuracy in identifying anomalous shadows for vehicles, pedestrians, and cyclists, while it remains robust to a novel class of strong “invalidation” attacks targeting the defense system. Shadow-Catcher can achieve real-time detection, requiring only between 0.003 s–0.021 s on average to process an object in a 3D point cloud on commodity hardware and achieves a 2.17x speedup compared to prior work.


  • Autonomous vehicle
  • LiDAR Spoofing
  • Attack detection

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-030-88418-5_33
  • Chapter length: 21 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   89.00
Price excludes VAT (USA)
  • ISBN: 978-3-030-88418-5
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   119.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.
Fig. 4.
Fig. 5.


  1. 1.

    The MOC contains discrete values, given the set of valid combinations \((\rho _c, N_c)\). For illustration purposes, we plot the MOC as a continuous contour.


  1. Procrustes analysis.

  2. Shadow-catcher project website.

  3. Google spin-off waymo to sell lidar it fought uber on., March 2019

  4. Cao, Y., et al.: Adversarial sensor attack on lidar-based perception in autonomous driving. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2267–2281 (2019)

    Google Scholar 

  5. Coldewey, D.: Here’s how Uber’s self-driving cars are supposed to detect pedestrians., March 2018

  6. Dutta, A., Zisserman, A.: The VIA annotation software for images, audio and video. In: Proceedings of the 27th ACM International Conference on Multimedia, MM 2019, New York, NY, USA. ACM (2019)

    Google Scholar 

  7. Ester, M., Kriegel, H.-P., Sander, J., Xiaowei, X., et al.: A density-based algorithm for discovering clusters in large spatial databases with noise. In KDD 96, 226–231 (1996)

    Google Scholar 

  8. Everingham, M., Van Gool, L., KI Williams, C., Winn, J., Zisserman, A.: The pascal visual object classes (VOC) challenge. Int. J. Comput. Vis. 88(2), 303–338 (2010)

    Google Scholar 

  9. Geiger, A.: Object detection evaluation.

  10. Geiger, A., Lenz, P., Stiller, C., Urtasun, R.: Vision meets robotics: The KITTI dataset. Int. J. Robot. Res. (IJRR) 32, 1231–1237 (2013)

    Google Scholar 

  11. Gips, M.: The future of lidar and security., March 2020

  12. Gower, J.C.: Generalized procrustes analysis. Psychometrika 40(1), 33–51 (1975)

    Google Scholar 

  13. Ivanov, R., Pajic, M., Lee, I.: Attack-resilient sensor fusion. In: 2014 Design, Automation & Test in Europe Conference & Exhibition (DATE), pp. 1–6. IEEE (2014)

    Google Scholar 

  14. Liu, D., Yu, R., Su, H.: Extending adversarial attacks and defenses to deep 3D point cloud classifiers. In: 2019 IEEE International Conference on Image Processing (ICIP), pp. 2279–2283 (2019)

    Google Scholar 

  15. Petit, J., Stottelaar, B., Feiri, M., Kargl, F.: Remote attacks on automated vehicles sensors: experiments on camera and lidar. Black Hat Europe 11, 2015 (2015)

    Google Scholar 

  16. Porter, J.: Go read this analysis of what the iPad Pro’s LiDAR sensor is capable of., April 2020

  17. Qi, C.R., Yi, L., Su, H., Guibas, L.J.: PointNet++: deep hierarchical feature learning on point sets in a metric space. In: Advances in Neural Information Processing Systems, pp. 5099–5108 (2017)

    Google Scholar 

  18. Redmon, J., Divvala, S., Girshick, R., Farhadi, A.: You only look once: unified, real-time object detection. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 779–788 (2016)

    Google Scholar 

  19. Ross, A.: Procrustes analysis. Course report, Department of Computer Science and Engineering, University of South Carolina, 26 (2004)

    Google Scholar 

  20. Shi, S., et al.: PV-RCNN: point-voxel feature set abstraction for 3D object detection. In: CVPR (2020)

    Google Scholar 

  21. Shi, W., Rajkumar, R.: Point-GNN: graph neural network for 3D object detection in a point cloud. ArXiv, abs/2003.01251 (2020)

    Google Scholar 

  22. Shin, H., Kim, D., Kwon, Y., Kim, Y.: Illusion and dazzle: adversarial optical channel exploits against lidars for automotive applications. In: Fischer, W., Homma, N. (eds.) CHES 2017. LNCS, vol. 10529, pp. 445–467. Springer, Cham (2017).

    CrossRef  Google Scholar 

  23. RT Staff: What is lidar and how does it help robots see?, October 2019

  24. Sun, J., Cao, Y., Chen, Q.A., Mao, Z.M.: Towards robust lidar-based perception in autonomous driving: general black-box adversarial sensor attack and countermeasures. In: 29th USENIX Security Symposium (USENIX Security 20), pp. 877–894. USENIX Association, August 2020

    Google Scholar 

  25. Wakabayashi, D.: Self-driving Uber car kills pedestrian in Arizona, where robots roam., March 2018

  26. Wen, Y., Lin, J., Chen, K., Jia, K.: Geometry-aware generation of adversarial and cooperative point clouds. arXiv preprint arXiv:1912.11171 (2019)

  27. Wicker, M., Kwiatkowska, M.: Robustness of 3D deep learning in an adversarial setting. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 11767–11775 (2019)

    Google Scholar 

  28. Xiang, C., Qi, C.R., Li, B.: Generating 3D adversarial point clouds. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9136–9144 (2019)

    Google Scholar 

  29. Yang, B., Luo, W., Urtasun, R.: PIXOR: real-time 3D object detection from point clouds. CoRR, abs/1902.06326 (2019)

    Google Scholar 

  30. Yang, J., Zhang, Q., Fang, R., Ni, B., Liu, J., Tian, Q.: Adversarial attack and defense on point sets. arXiv preprint arXiv:1902.10899 (2019)

  31. Yang, K., Rui Wang, Yu., Jiang, H.S., Luo, C., Guan, Y., Li, X., Shi, Z.: Sensor attack detection using history based pairwise inconsistency. Futur. Gener. Comput. Syst. 86, 392–402 (2018)

    CrossRef  Google Scholar 

  32. Zeng, X., et al.: Adversarial attacks beyond the image space. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4302–4311 (2019)

    Google Scholar 

  33. Zhou, H., Chen, K., Zhang, W., Fang, H., Zhou, W., Yu, N.: DUP-Net: denoiser and upsampler network for 3D adversarial point clouds defense. In: 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 1961–1970. IEEE (2019)

    Google Scholar 

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Zhongyuan Hau .

Editor information

Editors and Affiliations



A Limitation of Prior Art

Recently, Sun et al. proposed CARLO [24], a system for detecting model-level LiDAR spoofing attacks. CARLO consists of two components. The first, Laser Penetration Detection (LPD), serves as a quick anomaly detector to filter fake and valid objects. Objects for which LPD is not confident in its decision are sent for further analysis to a second component, the Free Space Detection (FSD), which is computationally more expensive. LPD’s design intuition is that points in the frustum correlate with occlusion patterns, and hence, uses the ratio of the number of points behind the object’s bounding box over the total the number of points in the frustum of an object; objects with high ratio are classified as suspicious or definitely fake. This approach uses points in the bounding box (as part of the frustum), and for smaller objects, the ratio is small and heavily influenced by noisy LiDAR measurements. Moreover, the approach does not take into account the location and characteristics of points in the region behind the bounding box, and could be susceptible to false positives from noise artifacts. FSD’s detection is based on the intuition that genuine vehicles have high density of points and hence, low free space in the bounding boxes as most of the space in the bounding box should be occluded by points in front. However, for smaller objects, this approach might be ineffective as the original space in the bounding box is small and mostly occupied by the points. Hence there are limited regions for analysis of free space. We implemented CARLO and evaluated its effectiveness to distinguish genuine from spoofed pedestrian objects.

LPD Evaluated on Pedestrians. To evaluate the LPD ratios of genuine and spoofed pedestrians, we collected the LPD ratios of genuine pedestrian objects in the KITTI dataset as well 200 spoofed front-near pedestrians (6 m in front of ego-vehicle). Figure 6 shows the distribution of LPD ratios of genuine and spoofed pedestrians. We observe that there is an overlap of the two distributions from 0.5 to 0.8, which presents opportunities for attackers to invoke FSD. Additionally, as the LPD ratio’s denominator accounts for all the points in the frustum, and for small objects the number of points in frustum is small, there is a possibility of an attacker to inject points (within the total adversary \(\mathcal {A}\) budget) in the frustum to lower the ratio to trigger FSD.

Fig. 6.
figure 6

LPD ratio distribution of genuine and spoofed pedestrian objects.

Fig. 7.
figure 7

FSD ratio distribution of pedestrian objects with full and down-sampled point cloud.

FSD Evaluated on Pedestrians. We randomly sampled 60 genuine pedestrian objects from KITTI and injected their point cloud 6 m in front of the ego-vehicle to spoof a front-near obstacle. Using the same 60 pedestrian objects, these objects’ point clouds were also down-sampled to the size of 60 points (below adversary \(\mathcal {A}\)’s budegt of 200 points) and were similarly injected (Point-GNN detected all down-sampled traces as pedestrians). We then used the implementation of Free Space Detection (FSD) in CARLO to evaluate the FSD ratio of spoofed objects with the full-sized and down-sampled point clouds. Figure 7 shows that the distribution of FSD ratio overlaps for pedestrians objects of full and down-sampled point clouds, with the majority of them having an FSD ratio of 0. This shows that the approach of FSD will not result in a separable distribution to effectively distinguish small spoofed pedestrians from genuine pedestrians. FSD expects ghost objects to result in very high FSD ratios which as we showed does not happen for small objects.

B 2D Shadow Region Estimation

We analyze Shadow-Catcher’s accuracy of 2D shadow region generation by comparing it with the 597 manually labeled shadows (see Sect. 4). We evaluate the 2D region generation separately since 3D regions build on top of it. The significance of 2D vs 3D region estimations in the detection performance is evaluated separately in Subsect. 6. To quantify how closely Shadow-Catcher can match the objects’ observed shadows, we measure their Intersection over the Union (IoU) and perform a Procrustes shape analysis. An IoU value of 1 means that the two regions are perfectly matched and 0 means the two regions are disjoint. Procrustes provides us with two metrics: (a) similarity of the shapes; and (b) scale differences of the shapes [1, 12, 19]. For similarity, values close to 1 mean that the shapes are identical. For scale, a value of 1 means that the size of the shapes are identical and anything less than 1 means the ground-truth shadow shape is smaller, and larger than 1 is the opposite.

Table 5. Aggregated correspondence metrics of all objects

Table 5 summarizes our results across all object types. Detailed results are deferred to the project website [2]. From the median values of the corresponding metrics, it can be observed that, for more than half the objects, the computed shadow matches closely with the ground-truth shadow—IoU, Similarity and Scale values are well above 0.5 which indicates a good prediction (object detection bounding box accuracy is commonly evaluated at IoU \(\ge 0.5\)  [8, 18]). We do observe some variation in the results which can be attributed to measurement inaccuracies and human-errors in the labeling process, and to over-estimation of shadow areas (Illustration provided on the project’s website [2]). Shadow-Catcher uses bounding boxes which are larger than the actual objects and this results in larger shadow regions. However, Shadow-Catcher’s exponential decay approach to weighting the significance of 3D points in shadows (see Sect. 5) compensates for this. This is verified with Shadow-Catcher’s overall accuracy in detecting genuine shadows, ghost and invalidation attacks (see Sect. 6).

Rights and permissions

Reprints and Permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Hau, Z., Demetriou, S., Muñoz-González, L., Lupu, E.C. (2021). Shadow-Catcher: Looking into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing. In: Bertino, E., Shulman, H., Waidner, M. (eds) Computer Security – ESORICS 2021. ESORICS 2021. Lecture Notes in Computer Science(), vol 12972. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-88417-8

  • Online ISBN: 978-3-030-88418-5

  • eBook Packages: Computer ScienceComputer Science (R0)