ACA: The First Physical Attack That Corrupts Camera-LiDAR Calibration in Autonomous Vehicles

Main Story

Autonomous vehicles depend on the seamless fusion of camera and LiDAR data to perceive their environment. Cameras deliver high-resolution colour information while LiDAR provides accurate spatial depth — together, their fused output underpins object detection, path planning, and collision avoidance. But that fusion is only as reliable as the calibration that aligns the two sensors in a shared coordinate frame.

In practice, calibration is not a fixed property. Vibration, temperature variation, and minor mechanical displacement can cause the extrinsic parameters — the rigid-body transformation between sensors — to drift over a vehicle's operational lifetime. Because a factory recalibration visit is impractical for every drift event, modern autonomous systems increasingly deploy online calibration algorithms that detect and correct sensor misalignment at runtime, allowing continuous operation without interruption.

A newly published preprint on arXiv (cs.RO) identifies this routine, safety-critical function as an unexploited attack surface. The paper introduces the Adversarial Calibration Attack (ACA), described as the first physical attack specifically targeting camera-LiDAR online calibration. Where previous adversarial work against autonomous vehicles largely assumed that sensor calibration was accurate and fixed, ACA treats the calibration pipeline itself as the target.

The attack operates in two sequential stages, both executed via a single physical adversarial poster placed in the vehicle's environment. In the first stage, the poster is designed to fool the miscalibration detector — the subsystem that monitors whether the current calibration is valid — into believing that the sensors have drifted out of alignment, thereby triggering a recalibration event. In the second stage, the same poster steers the calibration estimator toward an incorrect transformation, causing the vehicle to accept a corrupted set of extrinsic parameters as ground truth.

Critically, once accepted, a corrupted calibration update persists across all subsequent fusion operations. Unlike an attack on a single perception frame, the error is not transient: it propagates upstream through the entire AV stack, from 3D object detection through path planning to vehicle control.

The poster's geometry and texture are designed jointly through a single unified optimisation, satisfying both attack objectives — detector spoofing and estimator steering — simultaneously. This avoids the need for two physically separate artefacts, keeping the attack apparatus minimal and practically deployable.

Benchmark and Physical Results

The researchers evaluated ACA across three tiers of increasing physical fidelity. On the KITTI and nuScenes benchmark datasets — two standard references for multi-sensor autonomous driving research — ACA induced up to 33.9 degrees of mean rotational calibration error, a magnitude sufficient to severely degrade 3D object detection performance. In the CARLA driving simulator, a vehicle that accepted the corrupted calibration parameters collided with obstacles in attacker-crafted scenarios. Finally, on a physical Clearpath Husky ground robot, a printed adversarial poster successfully reproduced the calibration error in real-world conditions, validating the attack's transferability from simulation to hardware.

Technical Breakdown

Industry Impact

Manufacturers and platform integrators deploying online calibration pipelines — which includes most production-intent AV stacks seeking to avoid factory recalibration downtime — must now account for adversarial miscalibration as a threat model. The ACA paper demonstrates that the miscalibration detector, a component typically treated as a safety mechanism, is itself an exploitable control surface.

Sensor fusion architects will need to evaluate whether their calibration estimators include integrity verification — for example, comparing calibration outputs across multiple independent trigger events or cross-validating against inertial or GPS-aided estimates — to reject statistically anomalous updates before they are committed to the system.

Dataset and simulation tool providers (KITTI, nuScenes, CARLA) should note that ACA's demonstrated effectiveness across all three platforms underscores the need to include adversarial calibration scenarios in robustness benchmarks, not merely adversarial object-detection scenarios.

Robotics and field automation operators using ground robots — as evidenced by the Husky physical experiment — face the same exposure as automotive AV platforms. Any mobile robot running online camera-LiDAR calibration in an environment where an adversary can place or display a physical object is potentially within scope.

Safety regulators and standards bodies (including ISO and SAE working groups on AV safety) may need to extend existing adversarial robustness requirements, currently focused on perception-layer attacks, to cover the calibration subsystem. The ACA result suggests that a single passive physical artefact — a printed poster — can silently corrupt an AV's spatial reference frame, with effects that persist and compound over time rather than degrading a single inference frame.