Physical Adversarial Attack Against LiDAR-Based 3D Perception via 2D Patches

Point cloud data, renowned for its capability in capturing the shapes and spatial structures of objects, has grown increasingly vital in domains such as scene reconstruction and virtual/augmented reality. Nevertheless, deep learning models for point clouds have been shown vulnerable to adversarial attacks. Existing physical attacks against LiDAR-based perception typically rely on specialized laser-emitting devices, custom-fabricated 3D objects, or predefined roadway-shadow templates, which limits their practicality or generality. In this paper, we present a model-guided digital-to-physical attack that fools LiDAR-based 3D perception with 2D specular reflective patches on existing objects. We exploit the weakness of LiDAR in handling specular surfaces, identify task-critical points, group them into a small number of connected regions on the LiDAR projection plane, and map these regions to patch locations on the object surface. We first validate the attack in the digital domain and then realize the patches in the physical world with low-cost reflective materials. Extensive experiments on benchmark datasets and real-world objects show substantial accuracy degradation across ten state-of-the-art models and strong transferability in black-box settings. The same connected return-suppression strategy also reduces Moderate 3D AP for cars, pedestrians, and cyclists on the KITTI detection benchmark. These results expose an effective, low-cost attack surface for LiDAR-based systems.