LidarFooler: A Physical Backdoor Attack Method for LiDAR Point Cloud Classification

Light detection and ranging (LiDAR) point-cloud classifiers are vulnerable to backdoor poisoning, while physical sensing can disrupt triggers designed in the digital domain. We propose LidarFooler, a physical backdoor attack that uses a global trigger composed of multiple spatially distributed local trigger components to establish an association between the complete trigger pattern and an attacker-specified target class. Trigger centers are optimized using classification, geometric-preservation, and dispersion constraints, while expectation-over-transformation augmentation is employed to simulate physical variations during poisoned-sample generation. Extensive experiments on benchmark and physical-world datasets demonstrate the effectiveness and robustness of LidarFooler across different point-cloud classification settings. On digital data, LidarFooler achieves an average clean accuracy of 0.92 and an attack success rate of 0.93. Physical experiments with a Livox Mid-40 sensor achieve corresponding values of 0.93 and 0.86, respectively, with a mean attack success improvement of 42.5 percentage points over IRBA. Further evaluations demonstrate the robustness of LidarFooler under different trigger configurations, poisoning rates, target classes, model architectures, augmentations, and defense strategies. These results reveal a practical physical backdoor vulnerability in LiDAR point-cloud classification and highlight the need for security evaluation and defenses that explicitly account for physical sensing conditions.