Scene 01 — Case · Bachelor thesis · 2025—26

SHIELD

Spectral Hybrid Interference Elimination LiDAR Defense

Detecting LiDAR spoofing from a single frame, while the vehicle is standing still.

Every published defence I could find asks the same question: what changed between this frame and the last one? SHIELD asks a different one — what does a single revolution look like in the frequency domain? That question still has an answer when nothing is moving.

STFT
Random Forest
CFAR
Point clouds
Signal processing

Kind: Bachelor thesis, 48 pp.
Title: Detection of Spoofing Attacks in LiDAR Sensors via Frequency-Domain Analysis
Advisor: Doç. Dr. Fatih Kılıç
Institution: Adana Alparslan Türkeş Science and Technology University

Authentic returns
Injected returns
Sweep — one revolution

One revolution in polar form: angle is the angular index, radius is the measured range. The sensor is a Velodyne VLP-16 — 16 channels, 0.4° resolution, one turn every 100 ms. The sweep here is slowed for legibility, and the scene is sampled to 150 of the 900 returns per turn. Schematic, generated deterministically at build time; not a capture.

Scene 02 — Problem

The defence that stops when the car stops

Almost every published LiDAR spoofing defence leans on motion. The detector compares consecutive frames and asks whether a return behaves the way a real object should as the vehicle advances. It is a reasonable question, and it has a fatal precondition: something has to be moving.

A vehicle at a junction is not moving. A vehicle in traffic is not moving. A vehicle waiting for a pedestrian is not moving. In exactly the moments where a wrong perception decision is most expensive, the frame-to-frame signal these methods depend on goes to zero — and an attacker holding a false return steady across frames looks, to that test, indistinguishable from a parked car.

So the problem was not to make the existing test more sensitive. It was to find a question that a single frame can answer.

The literature

A systematic review across IEEE Xplore, the ACM Digital Library and arXiv, 2017 to 2025, looking for time–frequency analysis applied to LiDAR security.

No prior work found.

Spectral methods are standard in radar and in acoustics. In LiDAR security the shelf was empty — which is a risk and an opening at the same time.

01Range(t−1)

02Range(t)

03|Δ| — anomaly score

The temporal test asks what changed since the last frame. On a moving vehicle it works — the reference reports roughly 75% detection. Standing still it has nothing to work with: the scene repeats, and the injected cluster repeats with it, so the subtraction cancels the attack along with everything else. What is left is sensor noise, here at most 0.59% of range. This is the Stopped Car Problem, and it is the reason the method moves into the frequency domain. Schematic, generated at build time; not a capture.

Scene 03 — Approach

Ask the frequency domain instead

The detection primitive is the Short-Time Fourier Transform of the raw sensor returns. That single choice makes detection motion-independent, and it makes detection possible from one frame.

A spoofed return is not just wrong about distance. Injecting it forces a spatial discontinuity into the range signal and a burst of interference into the intensity signal, and both of those are visible as energy in frequencies where a physical surface simply does not put energy. Nothing about that argument requires a previous frame, so nothing about it requires the vehicle to move.

Borrowing STFT from radar was not a matter of importing a function. LiDAR data breaks two assumptions the transform is built on, and both had to be solved before a single spectrogram was worth looking at.

Circular angular boundary conditions. A revolution is a closed loop: 359° is adjacent to 0°. A naive window treats the two ends as the far edges of a finite signal and manufactures an artificial discontinuity at exactly the seam — a false positive on every single frame.
Sparse point cloud resampling. The STFT wants a uniformly sampled signal. A LiDAR return series is sparse and unevenly spaced, and it gets sparser with distance. Resampling it without inventing structure that was never measured is the whole difficulty.

Architecture

single frame

Raw returns of one revolution
STFT — range channel and intensity channel
Dual spectrogram, 9 extracted features
Random Forest classifier
CFAR adaptive thresholding
Safety clamp and hysteresis
Frame verdict — clean or spoofed

Figure 3 — the dual spectrogram, schematically. Illustrative, not measured output. The two channels answer different questions and the classifier needs both: the range channel shows the geometric break an injected return leaves behind, the intensity channel shows the interference it drags in with it. Nine features are extracted from this pair and handed to a Random Forest, which returns a verdict for the frame it was given — with no reference to any other frame.

Figure 4 — adaptive thresholding, schematically. A fixed threshold either drowns in a noisy scene or fires constantly in a quiet one. CFAR sets the threshold from the local neighbourhood instead, with guard cells around the cell under test. The safety clamp stops it collapsing when the surroundings go quiet, and hysteresis holds a verdict open until the signal falls well back under it, so a frame near the boundary does not oscillate between clean and spoofed.

Recall

fixed vs. adaptive

Fixed threshold34%

CFAR + clamp + hysteresis93%

Same features, same classifier. The difference is entirely in how the decision boundary is drawn — and it is the difference between a detector that misses two attacks in three and one that catches almost all of them.

Scene 04 — Obstacle

The first result was a lie

97.1% in simulation. Then 8.2% on data from a real sensor, with more than nine out of ten alarms false. The model had not learned to detect spoofing. It had learned what a simulator looks like.

There was an easy way out of that number and I did not take it: keep training on synthetic data, report the simulation figure, put the real-world result in a footnote. Instead the collapse became the finding, and the question turned into where exactly the gap between the two worlds lives.

Simulation only97.1%
Synthetic scenes, synthetic attacks. Nothing in this number had ever met a physical sensor.
Real sensor data8.2%
The same model, unchanged, on authentic captures — with over 90% false positives. Not a weak result. A collapse.
Hybrid dataset79.3%
Trace-based injection: synthetic attacks placed onto authentic UGV captures. 3,836 samples.
Final system81.6%
Full pipeline — dual spectrogram, CFAR thresholding, safety clamp, hysteresis — on authentic captures.

Diagnose the gap, do not paper over it

A simulator produces returns that are too clean, too regular and too complete. Real captures carry dropouts, reflectivity variation, multipath and a noise floor that moves with the scene. A classifier trained only on the first kind learns the simulator's regularity as its notion of "normal", so every ordinary imperfection in a real capture reads as an anomaly. Hence 90% false positives: the model was not broken, it was answering a question nobody had asked it.

The fix had to keep the realism and still provide labelled attacks, which no real capture contains. So the attacks were moved instead of the data: synthetic spoofing signatures are injected directly onto authentic UGV recordings, at the trace level, before any feature is computed. The noise floor, the dropouts and the reflectivity behaviour stay exactly as the sensor recorded them; only the attack is synthetic, and because it was placed deliberately, its ground truth is exact.

That produced a 3,836-sample hybrid dataset and took real-world accuracy from 8.2% back to 79.3% — before any of the thresholding work that finished the system.

Turning point

The honest number was the one worth having. Tuning the model until simulation looked good would have produced a better thesis figure and a detector that fails on the first real sensor it meets.

Authentic UGV capture

Synthetic attack, known label

Hybrid sample

Trace-based injection, drawn the way it works: the third disc is not redrawn, it is the first two combined. Real noise from the capture, ground truth from the injection. Schematic of the method, not measured data.

Scene 05 — Result

Measured on authentic captures

Every figure below comes from the hybrid dataset built on real sensor recordings, not from simulation. That is the whole point of the number being what it is.

81.6%

Accuracy on authentic UGV captures, full pipeline.

94.1%

Precision — of everything flagged, this much really was an attack.

87.3%

Recall — of every attack present, this much was caught.

3.1%

False positives on clean frames, with no attack present.

Frame budget

10 Hz sensor

38.8 ms usedof a 100 ms budget

A 10 Hz LiDAR delivers a frame every 100 ms. Detection takes 38.8 ms of that, so the verdict for a frame is ready long before the next one arrives — the detector runs in the loop rather than beside it, and nothing has to be dropped to make room.

On the headline numbers

Published methods report higher figures than these. They are also, almost without exception, validated in simulation — the same condition under which this system scored 97.1% before meeting a real sensor.

81.6% on authentic captures is the number I can defend. I would rather hand over a detector whose reported accuracy survives contact with hardware than one whose accuracy was measured in the only place it works.

81.6%

Authentic UGV captures, full pipeline

94.1%

Of everything flagged, this much was really an attack

87.3%

Of every attack present, this much was caught

3.1%

On clean frames, with no attack present

38.8ms

Per frame — a 10 Hz LiDAR allows 100 ms

Final SHIELD measurements and the conditions they were measured under
Metric	Value	Measured under
Accuracy	81.6 %	Authentic UGV captures, full pipeline
Precision	94.1 %	Of everything flagged, this much was really an attack
Recall	87.3 %	Of every attack present, this much was caught
False positives	3.1 %	On clean frames, with no attack present
Latency	38.8 ms	Per frame — a 10 Hz LiDAR allows 100 ms
Dataset	3,836	Hybrid samples — synthetic attacks injected onto authentic captures
Features	9	Extracted from the range and intensity spectrogram pair
Frames needed	1	Detection is motion-independent — a stationary vehicle is covered

Scene 06 — Close

What this case is evidence of

I work on measurement, and on what depends on it.Ali Batuhan Özsürmeli

The technical content is signal processing. The transferable part is what happened between 97.1% and 81.6%: a result that looked finished, a decision not to report it, and a method built to find out what the first number had actually measured.

Techniques

applied

STFT
Random Forest
CFAR
Point clouds
Signal processing

Programme: B.Sc. Software Engineering, 09/2021 — 15 June 2026
Metric: 81.6% accuracy · 38.8 ms/frame