Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals

arXiv:2606.17562 · cs.CR, cs.SY, eess.SY · Submitted 2026-06-16 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals".

Elias: Here's the gist of the paper. The gist The work demonstrates that dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution.

Nadia: Threat Model and Attack Surface LiDAR sensors are complex cyber-physical systems (CPS) built from specialized optical, electronic, and software components sourced across distributed vendors <ref:2606.17562#pg2> This creates multiple plausible implantation paths, including malicious manufacturing-stage (supply-chain) insertion, compromised firmware or software updates, and adversarial maintenance access <ref:2606.17562#pg4> LiDAR specific malware has received little attention compared to external attacks, leaving a gap in understanding how and to what extent a compromised sensor could manipulate LiDAR output from within the sensing pipeline <ref:2606.17562#pg5> For sensor-internal LiDAR malware to be successful in practice, two conditions must hold: first, it must be feasibly triggered after deployment without access to the vehicle or sensor internals, and second, once activated, it must be capable of inducing safety-critical effects on LiDAR output <ref:2606.17562#pg4> Trigger Mechanism The authors focus on physical-channel triggers as the most viable activation mechanism because they activate malware through signals delivered over the same physical medium used by the LiDAR sensor <ref:2606.17562#pg5> They propose modulated signal activation, which exploits native dual-return sensing together with related low-level monitoring and filtering functionality already present in the LiDAR <ref:2606.17562#pg6> The triggering mechanism involves the attacker emitting a transmitted optical sequence into the sensing environment, which the victim LiDAR extracts timing-derived symbols via native signal processing <ref:2606.17562#pg5> The malware then assembles these symbols into a reconstructed message and compares it against stored target messages embedded in the malware <ref:2606.17562#pg6> Activation occurs when a match satisfies the trigger condition, selecting the corresponding attack mode and causing the malware to transition from dormant monitoring to execution of the selected behavior <ref:2606.17562#pg6> Feasibility Across Conditions The feasibility experiments characterize trigger delivery across diverse geometry, range, and victim-platform conditions <ref:2606.17562#pg5> Successful triggering was observed with both direct illumination and reflected delivery paths (for example, wall and ceiling reflections) <ref:2606.17562#pg5> These trials demonstrated on-demand activation and intended LiDAR-output alteration in various settings, including indoor static scenes at approximately 150 ft via wall and ceiling reflection <ref:2606.17562#pg5>, outdoor static conditions at 300 ft standoff distances, and mobile sensor drive-by runs reaching at least 35 mph <ref:2606.17562#pg5> Semantic Detectability and System Impact The study evaluates whether injected person-like artifacts can remain semantically detectable under a tuned LiDAR 3D detector <ref:2606.17562#pg5> They fine-tuned a state-of-the-art 3D object detector, FCAF3D

35: , on a custom person dataset and applied it to manipulated point clouds <ref:2606.17562#pg6> The results showed that injected person-like artifacts can remain detectable under a tuned 3D detector, supporting the plausibility of downstream perception-level manipulation <ref:2606.17562#pg5> Furthermore, attacks on a deployed tactical autonomous vehicle (TAV) demonstrated multiple modes of safety-critical impact, including emergency stops from sensor error induction and mission aborts from false data injection <ref:2606.17562#pg5> Implications for Security Existing defenses are poorly aligned because the trigger is transient and does not directly manipulate perception, and once activated, the malware operates inside the sensing pipeline <ref:2606.17562#pg5> The results imply that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines, requiring stronger guarantees about the integrity of the sensing infrastructure <ref:2606.17562#pg5> Mitigation priorities suggest focusing first on sensor integrity through secure boot and firmware signing, followed by runtime attestation to verify sensor state <ref:2606.17562#pg5> Finally, downstream consistency checks should be treated as secondary mitigations rather than primary ones <ref:2606.17562#pg5> This work shows that sensor-internal compromise of LiDAR is a distinct and underexplored autonomy risk <ref:2606.17562#pg5> Dormant malware embedded in the LiDAR sensing pipeline can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution <ref:2606.17562#pg5> Empirical evidence spanned three parts of the attack chain including sampled feasibility across static and mobile operating conditions, evidence that injected person-like artifacts can be taken up as person-class detections, and deployed TAV end-to-end impact demonstrations <ref:2606.17562#pg5> These results show that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines.

Elias: Once malicious logic is placed inside the sensor, downstream autonomy may consume outputs that remain operationally plausible while encoding fail-safe disruption or fail-dangerous manipulation <ref:2606.17562#pg5> Securing autonomy therefore requires not only robust perception algorithms, but also stronger guarantees about the integrity of the sensing infrastructure on which those algorithms depend.

Nadia: Page 1 --- Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals <ref:2606.17562#pg2> R.

Title and authors: Nadia: So we're looking at this paper called "Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals". It sounds like it’s about something really sneaky—malware that is dormant inside a LiDAR sensor but can be turned on remotely after it's already been installed.

Elias: Yeah, and the authors, R. Spencer Hallyburton and Miroslav Pajic from Duke University, they are tackling this by designing malware that actually manipulates the point cloud at a low level inside the firmware of the LiDAR sensor itself.

Nadia: What’s interesting is that they didn't come up with this by trying to break a production supply chain vulnerability; instead, they developed it in a closed research environment with vendor support. That suggests this is about an attack surface that’s already there, but dormant until triggered.

Elias: Exactly. The core idea is using a modulated optical signal—a kind of brief flash—to remotely activate this malware without needing any network connection or the attacker to be actively interacting with the vehicle during the attack itself.

Nadia: So, instead of hacking a computer or sending malicious packets over Wi-Fi, they're talking about using light signals to trigger a physical manipulation inside the sensor. That shifts the focus away from traditional network security into something much more physical.

Elias: Right. It’s about exploiting how these sensors process signals internally, using native functions like dual-return sensing and related low-level monitoring to reconstruct a message that matches something embedded in the malware.

The paper's summary: Nadia: The paper explains their approach by breaking it down into three main parts. First, they look at trigger delivery and attack mode execution across different conditions like indoor, outdoor static scenes, and even drive-by runs reaching at least thirty-five mps <ref:2606.17562#pg2,trigger delivery and attack mode execution across>.

Elias: Then they examine if the manipulated point cloud artifacts, specifically these injected person-like objects, can still be detected by a tuned LiDAR three dee object detector <ref:2606.17562#pg1>. This part supports the idea that you can manipulate the data without completely hiding it from downstream perception systems.

Nadia: And finally, they evaluate what happens on a deployed tactical autonomous vehicle, showing multiple modes of safety-critical impact, like triggering an emergency stop through sensor error induction or causing mission aborts with false data injection.

Elias: So the summary boils down to demonstrating feasibility across different operating environments and showing that even if you inject fake objects, they can still look like real things to the perception algorithms.

Nadia: It’s a lot of work to show that on a deployed platform, but it really highlights how this internal compromise can affect safety systems directly.

The paper's improvements: Elias: The authors suggest some key areas for improvement in the security landscape. They point out that existing defenses aren't aligned because the trigger is transient and doesn't directly manipulate perception, and once activated, the malware operates deep inside the sensing pipeline.

Nadia: So their suggestion is to move beyond just detecting a single attack vector and focus on stronger guarantees about the integrity of the entire sensing infrastructure. They propose prioritizing secure boot and firmware signing as a first step against this type of compromise.

Elias: And then they mention runtime attestation mechanisms, which would help downstream systems verify whether the LiDAR is running approved code and staying in an expected state, even after it’s been triggered. That's a way to check the sensor state itself.

Nadia: They also stress that cross-sensor consistency checks should be treated as secondary mitigations rather than primary ones because the paper shows that downstream algorithms cannot be assumed trustworthy by default when this kind of internal compromise is happening.

Elias: I agree, and they emphasize that focusing on sensor integrity through things like secure boot and firmware signing comes first, followed by runtime attestation to verify the sensor state. Downstream consistency checks are secondary.

Conclusion: Nadia: So wrapping up this paper "Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals," the main point is that sensor-internal compromise of LiDAR is a distinct risk in autonomy that hasn't been explored much before.

Elias: They show that dormant malware embedded in the sensing pipeline can be activated remotely using just a brief modulated optical signal, without needing any network access or sustained interaction from an attacker during the attack execution.

Nadia: It means that once malicious logic is inside the sensor, the downstream autonomy might consume outputs that look plausible but are actually encoding fail-safe disruptions or dangerous manipulations.

Elias: So securing autonomy now requires more than just robust perception algorithms; it demands stronger guarantees about the integrity of the sensing infrastructure on which those algorithms depend.

Priya: From my side, what really stands out is that even when you inject person-like artifacts, they can still be detected by a tuned three dee object detector, which means the manipulation isn't completely invisible to perception checks <ref:2606.17562#pg1>.

Nadia: That’s true, Priya. And if that's the case, then the focus has to be on making sure those perception systems are actually robust against these kinds of targeted injections.

Elias: We need those integrity guarantees on the sensor side first, and then we can build better checks downstream to handle what happens when things go wrong inside that pipeline.

Priya: Yeah, so it’s about layered defense, but with a heavy emphasis on verifying the foundation—the sensor itself.

R. Spencer Hallyburton, Miroslav Pajic

Duke University

cs.CR, cs.SY, eess.SY

Submitted: 2026-06-16

Updated: 2026-10-20

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 74/100

The gist: The gist The work demonstrates that dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or

Key concepts

Dormant Malware Activation: Malware is hidden within LiDAR firmware and remains inactive during normal operation. It can be remotely activated by an external, physical optical signal delivered into the sensing environment. This allows an attacker to trigger malicious behavior without needing network access or sustained interaction with the vehicle or sensor.
Modulated Optical Trigger: The activation mechanism uses a modulated optical sequence sent by an attacker. The victim LiDAR extracts timing-derived symbols from this signal using its native processing capabilities. The malware then compares these received symbols against stored target messages to select and execute the desired attack mode.
Semantic Detectability: The study tested whether manipulated point clouds, specifically those containing person-like artifacts injected by the malware, could still be recognized by advanced 3D object detectors. The results showed that these artifacts often remain detectable by tuned detectors, suggesting that perception-level manipulation can occur while maintaining some level of semantic plausibility.

Summary

The gist The work demonstrates that dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution.

Threat Model and Attack Surface

LiDAR sensors are complex cyber-physical systems (CPS) built from specialized optical, electronic, and software components sourced across distributed vendors <ref:2606.17562#pg2> This creates multiple plausible implantation paths, including malicious manufacturing-stage (supply-chain) insertion, compromised firmware or software updates, and adversarial maintenance access <ref:2606.17562#pg4> LiDAR specific malware has received little attention compared to external attacks, leaving a gap in understanding how and to what extent a compromised sensor could manipulate LiDAR output from within the sensing pipeline <ref:2606.17562#pg5> For sensor-internal LiDAR malware to be successful in practice, two conditions must hold: first, it must be feasibly triggered after deployment without access to the vehicle or sensor internals, and second, once activated, it must be capable of inducing safety-critical effects on LiDAR output <ref:2606.17562#pg4>

Trigger Mechanism

The authors focus on physical-channel triggers as the most viable activation mechanism because they activate malware through signals delivered over the same physical medium used by the LiDAR sensor <ref:2606.17562#pg5> They propose modulated signal activation, which exploits native dual-return sensing together with related low-level monitoring and filtering functionality already present in the LiDAR <ref:2606.17562#pg6> The triggering mechanism involves the attacker emitting a transmitted optical sequence into the sensing environment, which the victim LiDAR extracts timing-derived symbols via native signal processing <ref:2606.17562#pg5> The malware then assembles these symbols into a reconstructed message and compares it against stored target messages embedded in the malware <ref:2606.17562#pg6> Activation occurs when a match satisfies the trigger condition, selecting the corresponding attack mode and causing the malware to transition from dormant monitoring to execution of the selected behavior <ref:2606.17562#pg6>

Feasibility Across Conditions

The feasibility experiments characterize trigger delivery across diverse geometry, range, and victim-platform conditions <ref:2606.17562#pg5> Successful triggering was observed with both direct illumination and reflected delivery paths (for example, wall and ceiling reflections) <ref:2606.17562#pg5> These trials demonstrated on-demand activation and intended LiDAR-output alteration in various settings, including indoor static scenes at approximately 150 ft via wall and ceiling reflection <ref:2606.17562#pg5>, outdoor static conditions at 300 ft standoff distances, and mobile sensor drive-by runs reaching at least 35 mph <ref:2606.17562#pg5>

Semantic Detectability and System Impact

The study evaluates whether injected person-like artifacts can remain semantically detectable under a tuned LiDAR 3D detector <ref:2606.17562#pg5> They fine-tuned a state-of-the-art 3D object detector, FCAF3D [35], on a custom person dataset and applied it to manipulated point clouds <ref:2606.17562#pg6> The results showed that injected person-like artifacts can remain detectable under a tuned 3D detector, supporting the plausibility of downstream perception-level manipulation <ref:2606.17562#pg5> Furthermore, attacks on a deployed tactical autonomous vehicle (TAV) demonstrated multiple modes of safety-critical impact, including emergency stops from sensor error induction and mission aborts from false data injection <ref:2606.17562#pg5>

Implications for Security

Existing defenses are poorly aligned because the trigger is transient and does not directly manipulate perception, and once activated, the malware operates inside the sensing pipeline <ref:2606.17562#pg5> The results imply that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines, requiring stronger guarantees about the integrity of the sensing infrastructure <ref:2606.17562#pg5> Mitigation priorities suggest focusing first on sensor integrity through secure boot and firmware signing, followed by runtime attestation to verify sensor state <ref:2606.17562#pg5> Finally, downstream consistency checks should be treated as secondary mitigations rather than primary ones <ref:2606.17562#pg5>

Conclusion

This work shows that sensor-internal compromise of LiDAR is a distinct and underexplored autonomy risk <ref:2606.17562#pg5> Dormant malware embedded in the LiDAR sensing pipeline can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution <ref:2606.17562#pg5> Empirical evidence spanned three parts of the attack chain including sampled feasibility across static and mobile operating conditions, evidence that injected person-like artifacts can be taken up as person-class detections, and deployed TAV end-to-end impact demonstrations <ref:2606.17562#pg5> These results show that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines. Once malicious logic is placed inside the sensor, downstream autonomy may consume outputs that remain operationally plausible while encoding fail-safe disruption or fail-dangerous manipulation <ref:2606.17562#pg5> Securing autonomy therefore requires not only robust perception algorithms, but also stronger guarantees about the integrity of the sensing infrastructure on which those algorithms depend.

--- Page 1 ---

Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals <ref:2606.17562#pg2> R. Spencer Hallyburton Department of Electrical and Computer Engineering Duke University Durham, NC, USA spencer.hallyburton@duke.edu Miroslav Pajic Department of Electrical and Computer Engineering Duke University Durham, NC, USA miroslav.pajic@duke.edu Abstract LiDAR sensors are widely deployed in autonomous systems for 3D perception and safety-critical decision-making <ref:2606.17562#pg2> We identify a previously unexplored attack surface in which dormant malware embedded in the LiDAR sensing pipeline remains inactive during normal operation and can be externally triggered after deployment, without requiring access to sensor hardware or networking at attack time <ref:2606.17562#pg2> To operationalize this threat, we design malware capable of low-level point-cloud manipulation and embed it into LiDAR firmware <ref:2606.17562#pg2> This malware was developed in a closed research test environment with vendor technical support, rather than by exploiting an inherent production supply-chain vulnerability <ref:2606.17562#pg4> To selectively trigger attack activation, we design and implement an optical trigger that remotely activates the malware by delivering a modulated signal into the sensing environment <ref:2606.17562#pg5> Once triggered, the malware performs real-time point cloud manipulation, and we demonstrate false object injection and real object suppression on static and mobile victim platforms <ref:2606.17562#pg5> Our evaluation first establishes attack feasibility, including static operation at 300 ft and recorded drive-by runs reaching 35 mph <ref:2606.17562#pg5> We then illustrate quantitatively that injected person-like artifacts can remain semantically detectable by a state-of-the-art 3D object detector <ref:2606.17562#pg5> Finally, we demonstrate multiple modes of safety-critical impact on a deployed tactical autonomous vehicle <ref:2606.17562#pg5> Together, these results highlight the need for stronger integrity guarantees throughout the LiDAR sensor development and deployment pipeline <ref:2606.17562#pg5> Keywords LiDAR Sensing Sensor Security Autonomy Trojan Malware 1 Introduction Light Detection and Ranging (LiDAR) has become a foundational sensor for safety-critical decision-making across domains including autonomous ground vehicles, aerial platforms, intelligent transportation systems, and precision agriculture [11, 22, 42, 45] <ref:2606.17562#pg2> As reliance on LiDAR has increased, so too has the impact of adversarial manipulation <ref:2606.17562#pg4> Prior work has shown that perturbations to LiDAR inputs can induce emergency braking, unsafe maneuvers, or collisions in autonomous vehicles [4, 36] <ref:2606.17562#pg4> Most existing LiDAR security analyses focus on adversaries who remain outside the sensor, whether at the network layer or attacking solely across physical channels <ref:2606.17562#pg4> Network-layer attacks, such as packet injection, require the strong assumption of an attacker with network access <ref:2606.17562#pg4> Physical-channel attacks, including LiDAR spoofing, require less assumed access but often require meeting tight spatial constraints, careful timing, and continued, uninterrupted interaction with the victim sensor throughout the attack window <ref:2606.

Improvements for AI systems

Improve sensor integrity by implementing secure boot, firmware signing, hardware roots of trust, and stronger firmware controls to address Component and assembly stages trust dependencies. This prevents malicious functionality that stays dormant under nominal conditions can plausibly evade both pre-deployment validation and routine post-deployment maintenance checks.
Enhance runtime attestation mechanisms to help downstream systems determine whether the LiDAR is running approved code, addressing the need for Sensor state verification. This helps mitigate risks when the sensor continues publishing plausible outputs after compromise by verifying that the LiDAR is running approved code and remains in an expected state.
Implement cross-sensor consistency checks as secondary mitigations, but prioritize sensor integrity and state verification over relying on these checks alone, as the paper suggests downstream algorithms cannot be assumed trustworthy by default.
Develop perception algorithms that are resilient to false data injection by incorporating robust semantic checks, recognizing that injected person-like artifacts can remain semantically detectable by a state-of-the-art 3D object detector even when they are used for False Data Injection (Attack Set B3).
Design downstream autonomy stacks with fail-safe modes that account for both sensor failure and targeted data manipulation, ensuring the system responds correctly to scenarios where malware-triggered sensor failure alone can produce immediate operational disruption.

Sources

What Would Trojans Do? Exploiting Partial-Information Vulnerabilities in Autonomous Vehicle Sensing