LiDAR systems defend against signal injection — spoofed laser pulses that create false point returns. Modern LiDAR units include interference mitigation: randomized pulse timing, waveform validation, saturation detection. The defenses assume the attack operates at the signal level.
An actuated planar mirror attacks at the physics level instead (arXiv:2603.11364). A flat mirror positioned near a LiDAR unit creates ghost points through specular reflection. The LiDAR emits a pulse, the mirror redirects it, and the reflected return comes from a geometrically incorrect direction. The ghost points are indistinguishable from real returns because they are real returns — the laser pulse genuinely bounced off a surface. No signal injection, no spoofed waveform, nothing for the interference mitigation to detect.
The attack corrupts SLAM — simultaneous localization and mapping — by systematically biasing the scan-matching process. As the mirror's angle changes, the ghost points drift, dragging the estimated position away from truth. Optimized mirror placement increases average pose error by 6.1x compared to random placement. Real-world tests on production-grade secure LiDAR achieved localization errors up to 6.03 meters.
The defense model assumed adversaries would inject false signals into the sensor. The mirror produces true signals from false geometry. The distinction is fundamental: you can authenticate a signal's origin but not a photon's path. The mirror exploits the gap between signal integrity and geometric truth.