Aperture
Every phantom bearing crosses the attacker's board and every phantom lies behind its plane. The phantom is the image seen through the mirror.
MirrorGuard: Software-Only Removal of Passive-Mirror Phantoms from Automotive LiDAR
Paper under double-blind review
A mirror at the roadside can make a vehicle brake for its own reflection. MirrorGuard removes that phantom from the LiDAR stream, in software, from the data the sensor already ships.
TL;DR
- A planar mirror board at the roadside folds the LiDAR's own beams back onto the vehicle, and the vehicle sees its own image as an obstacle on the lane ahead.
- Every phantom return is a genuine time-of-flight measurement, so defenses built to recognize injected pulses have nothing to detect.
- MirrorGuard removes 96.12% of the phantom vehicle's returns at 98.40% precision on nine real-world outdoor recordings of the attack, and no labeled real return.
- In a closed loop with Autoware the phantom stops the vehicle in 10 of 10 attack episodes; with MirrorGuard no episode produces a phantom stop.
- It runs at 88 ms mean per scan on a CPU, with no camera, map, learned model or second return.
The car behind does not expect the stop
A mirror at the roadside makes the vehicle brake for its own image in the middle of a right turn. We drove the closed loop in CARLA with Autoware again, now with a human-driven car following it. The follower model reacts to an unexpected stop after 1.75 s and keeps a 2.0 m standstill gap.
Without the defense, the follower hits the vehicle in all 5 counted attack drives, 1.60 to 1.70 s after the vehicle's hard brake, at 7.7 to 10.7 km/h relative speed. In the 12 other drives, 4 each on the clean road, with the board in place and the reflection off, and under attack with MirrorGuard, it never comes closer than its 2.0 m gap.
Live rear-end demo in the simulator: video coming soon.
The band under each video gives its setup; each video ends with a replay of the contact at 0.4 times speed. Rendered after the drives at the recorded poses.
After the collision both vehicles are held at the contact position for illustration; the recorded drive went on, because the simulator has no damage model.
Traffic lights were held green only while the videos were rendered; Autoware in these drives uses no traffic lights.
The attack in 30 seconds
Yahia et al. showed that planar mirrors at the roadside fold the sensor's own beams onto a real object, and the vehicle perceives the object's virtual image as an obstacle. The attack emits nothing and costs tens of dollars in materials. In the self-image variant the object is the vehicle itself.
- The LiDAR fires a pulse toward the mirror board at the roadside.
- The board reflects the pulse onto the vehicle's own flank.
- The echo returns along the same path. The sensor only knows the bearing and the travel time, so it places the return behind the mirror, along the beam's continuation.
- Scan after scan the returns build a car on the road the vehicle is about to turn into: its own image, on its planned path. The planner brakes for it.
- direct beam
- reflected beam
- where the sensor places the return
- mirror board
- phantom (the vehicle's own image)
- vehicle with LiDAR
- planned path (right turn)
Why it matters
On a real vehicle running Autoware, the phantom ended in an emergency stop at every tested mirror angle (Yahia et al.). The only countermeasure shown to work adds a thermal camera, a sensor deployed vehicles do not carry, and the single software-only cue tested, per-point intensity, was shown to fail.
Why the phantom is detectable
What the attacker cannot change is what reflection forces on the phantom. MirrorGuard uses four physical signatures.
Opacity
The board is opaque: a return whose beam crosses the board inside its outline cannot be a direct return. The test needs one scan and no history of the scene.
Darkness
The pulse is reflected at the mirror twice, once out and once back, so a diffuse phantom surface returns dark: 0.14 to 0.17 of its range-matched background on the real six-tile recordings.
Glint
The board itself returns a specular glint: every labeled board reads 4.4 to 13.4 times its range-matched surroundings, above the 2.353 ceiling of diffuse structure in simulation.
MirrorGuard
MirrorGuard is a filter between the LiDAR driver and the perception stack. It consumes one scan at a time, as the range and reflectivity image the sensor already produces, and emits the same scan with the returns it attributes to a mirror image removed. Geometry proposes, opacity and darkness confirm, and the glint decides what may act as a mirror at all.
LiDAR scan: range and reflectivity image
Phase I
Candidate localization
Finds the mirror board by its glint and the structures seen through it.
Phase II
Phantom-core verification
Tests each candidate by opacity and darkness and confirms it within five scans.
Phase III
Mask refinement and release
Completes the removal and releases the cleaned scan.
Same scan, phantom returns removed, to perception
A scan in which no board is accepted and no track is carried passes unchanged.
- No learned parameter: every constant is set once by a stated rule and frozen.
- Reads only the single-return range and reflectivity stream; no camera, map or learned model.
- A defense that consumes only the data the sensor already produces can be deployed to an existing fleet without a hardware change.
Runtime on a CPU
88 msmean per scan, 8 threads
87 msmedian per scan
73%of scans within the 100 ms scan period
96.8 msmean including decode
Detector process path replayed over the nine real-world recordings on a quiet Intel Xeon Gold 5420+; the dominant stages run as native kernels that reproduce the Python decisions bit for bit.
Live demo: one real outdoor recording
One of the nine real-world outdoor recordings of the attack: an Ouster OS1-128 at 10 Hz passes a six-tile board at 45 degrees (recording 45-6mr). Play through the scans, orbit with the mouse or touch, and switch between what the sensor reports and what MirrorGuard releases.
Recording setup
- Recording
- outdoor drive-by recording of the reference attack
- Mirror board
- tilted 45 degrees, six tiles, reflective area 0.60 m²
- LiDAR
- roof-mounted Ouster OS1-128, 10 Hz, 128 beams by 1024 columns, single return
- Approach
- from about 20 m at about 8 km/h
From the paper's description of the real-world recordings and the recording's own sensor metadata.
- reflectivity, dark to bright (log scale)
- other returns
- mirror board
- phantom (hand label)
- phantom background (hand label)
- removed by MirrorGuard
- sensor
On this recording, inside its declared window of 23 scans, MirrorGuard removes 95.97% of the 2383 labeled phantom points at 96.01% whole-frame precision, 100.00% on the driven path, and removes no labeled real return.
Point cloud downsampled for the web; phantom, board and removed returns are kept at full density. Hand labels are the benchmark ground truth and are used only to score the output.
Keyboard: space plays or pauses, the left and right arrows step one scan.
Closed loop: does the vehicle still brake?
We closed the loop in CARLA with the shipped Autoware Universe planner driving the vehicle through the 45 degree self-image scene at a junction, with the attack injected live and MirrorGuard as a process on the same stream. Four conditions ran ten episodes each; one defended episode failed on infrastructure before any phantom scan and was not replaced.
Scenario setup
- Place
- CARLA Town04, junction 483, right turn
- Threat model
- own image: the mirror shows the vehicle its own body
- Mirror board
- six tiles, 0.775 m square aperture, reflective area 0.6 m²
- Board tilt
- 45 degrees
- Heights
- board centre 1.5 m; LiDAR at the bridge mount, vehicle frame z 1.840 m
- Board surface
- opaque, dense specular glints; phantom returned at 0.14 of its surroundings
- Encounter speed
- about 8 km/h, set by Autoware's own curve-speed limit
- Driving stack
- shipped Autoware Universe planner, CenterPoint perception
- Defense
- MirrorGuard off, or on with a 0.6 s hold per scan
- Episodes
- ten per condition
Values read by script from the frozen design of the closed-loop series and the paper.
One episode per condition from the same block of the series. Each video shows the chase camera, the LiDAR scan as the sensor reports it and as Autoware receives it, the counts of phantom returns, and the speed profile; the band under it gives its setup.
How Autoware sees and then loses the phantom
Under attack, CenterPoint places a CAR box on the phantom in every frame of the approach, at a median score of 0.615, and the tracker's existence probability for it reaches 0.998 to 0.999. As the vehicle closes in, the visible slice of the phantom thins, the score falls below the 0.35 cut, and the tracker deletes the track 0.35 to 0.45 s after the last CAR box. The planner has already braked for it: the vehicle halts in the junction 0.10 to 0.40 s after the track is deleted. With MirrorGuard the phantom is never tracked.
Lines are medians and bands are episode ranges (10 attack, 9 defended, 10 clean episodes). Score and slice are drawn where at least 8 of the 10 attack episodes still show a phantom slice.
The cost is latency: MirrorGuard holds each scan for 0.6 s before passing it to the stack, so the defended vehicle receives a scan 0.716 to 0.730 s after its timestamp, against 0.029 to 0.042 s without the defense. With that hold its speed profile matches the clean run.
Results at a glance
96.12%of the phantom vehicle's returns removed, nine real-world recordings
98.40%precision, and no labeled real return removed
0 of 242filtered scans with a CenterPoint phantom CAR (14 of 242 under attack)
10 of 10attack episodes with a phantom stop; none of 9 with MirrorGuard
88 msmean per scan on a CPU
Per recording, inside each recording's declared window
Pooled over the nine recordings: recall 96.12%, whole-frame precision 98.40%, path-only precision 100.00% (one unlabeled removal on the driven corridor across all nine recordings). The best learned baseline, trained on the simulated attacks, reaches 38.71% recall at 1.15% precision on the same recordings.
Scope: nine real-world recordings of one sensor at one site and a simulation of one town; MirrorGuard targets phantom addition, not object removal, and holds each scan for 0.6 s before release.
BibTeX
@inproceedings{anonymous2026mirrorguard,
title = {MirrorGuard: Software-Only Removal of Passive-Mirror Phantoms from Automotive LiDAR},
author = {Anonymous},
booktitle = {Under review},
year = {2026}
}
Acknowledgements
Withheld for review.