MOBA: A Material-Oriented Backdoor Attack against LiDAR-based 3D Object Detection Systems

LiDAR-based 3D object detection is widely used in safety-critical systems. However, these systems remain vulnerable to backdoor attacks that embed hidden malicious behaviors during training. A key limitation of existing backdoor attacks is their lack of physical realizability, primarily due to the digital-to-physical domain gap. Digital triggers often fail in real-world settings because they overlook material-dependent LiDAR reflection properties. On the other hand, physically constructed triggers are often unoptimized, leading to low effectiveness or easy detectability.This paper introduces Material-Oriented Backdoor Attack (MOBA), a novel framework that bridges the digital-physical gap by explicitly modeling the material properties of real-world triggers. MOBA tackles two key challenges in physical backdoor design: 1) robustness of the trigger material under diverse environmental conditions, 2) alignment between the physical trigger's behavior and its digital simulation. First, we propose a systematic approach to selecting robust trigger materials, identifying titanium dioxide (TiO_2) for its high diffuse reflectivity and environmental resilience. Second, to ensure the digital trigger accurately mimics the physical behavior of the material-based trigger, we develop a novel simulation pipeline that features: (1) an angle-independent approximation of the Oren-Nayar BRDF model to generate realistic LiDAR intensities, and (2) a distance-aware scaling mechanism to maintain spatial consistency across varying depths. We conduct extensive experiments on state-of-the-art LiDAR-based and Camera-LiDAR fusion models, showing that MOBA achieves a 93.50% attack success rate, outperforming prior methods by over 41%. Our work reveals a new class of physically realizable threats and underscores the urgent need for defenses that account for material-level properties in real-world environments.

Key Contributions

Systematic material selection for physical backdoor triggers, identifying titanium dioxide (TiO₂) for its high diffuse reflectivity and environmental resilience
Novel simulation pipeline using an angle-independent Oren-Nayar BRDF approximation and distance-aware scaling to align digital trigger behavior with physical LiDAR reflection properties
MOBA achieves 93.50% attack success rate on state-of-the-art LiDAR-based and Camera-LiDAR fusion models, outperforming prior physically realizable backdoor methods by over 41%

🛡️ Threat Analysis

Model Poisoning

MOBA embeds hidden, triggered malicious behavior into LiDAR-based 3D object detection models during training — the core definition of a backdoor/trojan attack. The primary novelty is in the physical trigger design (material selection and BRDF-based digital simulation pipeline), which is a novel contribution to the physically realizable backdoor attack literature.