{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T10:25:30Z","timestamp":1787221530453,"version":"build-2736575974"},"reference-count":38,"publisher":"MDPI AG","issue":"16","license":[{"start":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T00:00:00Z","timestamp":1787184000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>LiDAR\u2013camera fusion is widely used for 3D perception in intelligent connected vehicles, but a clean camera branch does not necessarily compensate for structured LiDAR corruption. We propose CMS-Attack, a cross-modal search framework in which only the LiDAR point cloud is perturbed while the camera input remains unchanged; here, \u201ccross-modal\u201d denotes that a single-modality LiDAR perturbation propagates through the LiDAR\u2013camera fusion process and disrupts the multimodal detector, rather than simultaneous perturbation of both modalities. The framework has the following two access-dependent routes: the gray-box route contains FB-CMS, which uses camera-BEV, LiDAR-BEV, fused-BEV, and detection-head responses to construct a target-aware prior and prune an over-complete candidate pool, and Adaptive CMS, which substitutes architecture-specific intermediate responses; the decision-only black-box route contains FC-CMS, which refines candidates solely from display-level target states. On the nuScenes validation split, FB-CMS reduced matched target confidence from 0.80 to 0.03 under 140 injected points, corresponding to a 96.1% relative drop and 100% ASR@0.3. The ten-query FC-CMS achieved 58.97% ASR@0.3, compared with 6.17% for random frustum spoofing. On the query-based FUTR3D detector, Adaptive CMS reduced the mean matched-target score from 0.642 to 0.058, corresponding to a 90.97% relative reduction and 93.42% ASR@0.3. Intermediate camera-, LiDAR-, and fused-BEV region energies changed by less than 0.8% despite target suppression, indicating disruption at the fusion-decision stage (defined here as the decoder\/detection-head and post-processing path from fused representations to final object predictions) rather than a collapse of BEV feature magnitude. These results show that structured LiDAR fabrication is substantially more disruptive than information removal and that generic outlier filtering incurs a robustness\u2013accuracy tradeoff.<\/jats:p>","DOI":"10.3390\/s26165268","type":"journal-article","created":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T09:48:31Z","timestamp":1787219311000},"page":"5268","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["CMS-Attack: A Structured Cross-Modal Search Attack for Robustness Evaluation of LiDAR\u2013Camera Fusion Detectors"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-2437-1655","authenticated-orcid":false,"given":"Minzhou","family":"Wang","sequence":"first","affiliation":[{"name":"School of Vehicle and Energy, Yanshan University, No. 438 West Hebei Avenue, Haigang District, Qinhuangdao 066004, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yaoguang","family":"Cao","sequence":"additional","affiliation":[{"name":"School of Transportation Science and Engineering, Beihang University, No. 9 Gaojiaoyuannan 3rd Road, Changping District, Beijing 102200, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3426-7988","authenticated-orcid":false,"given":"Shichun","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Transportation Science and Engineering, Beihang University, No. 9 Gaojiaoyuannan 3rd Road, Changping District, Beijing 102200, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7406-5929","authenticated-orcid":false,"given":"Lisheng","family":"Jin","sequence":"additional","affiliation":[{"name":"School of Vehicle and Energy, Yanshan University, No. 438 West Hebei Avenue, Haigang District, Qinhuangdao 066004, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9335-3459","authenticated-orcid":false,"given":"Xianyi","family":"Xie","sequence":"additional","affiliation":[{"name":"School of Vehicle and Energy, Yanshan University, No. 438 West Hebei Avenue, Haigang District, Qinhuangdao 066004, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,20]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"2122","DOI":"10.1007\/s11263-023-01784-z","article-title":"Multi-Modal 3D Object Detection in Autonomous Driving: A Survey","volume":"131","author":"Wang","year":"2023","journal-title":"Int. J. Comput. Vis."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Ku, J., Mozifian, M., Lee, J., Harakeh, A., and Waslander, S.L. (2018). Joint 3D Proposal Generation and Object Detection from View Aggregation. Proceedings of the 2018 IEEE\/RSJ International Conference on Intelligent Robots and Systems (IROS), IEEE.","DOI":"10.1109\/IROS.2018.8594049"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Liu, Z., Tang, H., Amini, A., Yang, X., Mao, H., Rus, D.L., and Han, S. (2023). BEVFusion: Multi-Task Multi-Sensor Fusion with Unified Bird\u2019s-Eye View Representation. Proceedings of the 2023 IEEE International Conference on Robotics and Automation (ICRA), IEEE.","DOI":"10.1109\/ICRA48891.2023.10160968"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"579","DOI":"10.1016\/j.procs.2021.02.100","article-title":"A Survey of LiDAR and Camera Fusion Enhancement","volume":"183","author":"Zhong","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"5909","DOI":"10.1109\/TII.2026.3673218","article-title":"Fusion Filtering for RIS-Assisted Vehicle Localization With Unknown Inputs: A Privacy-Preserving Output-Mask Strategy","volume":"22","author":"Zhu","year":"2026","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Vora, S., Lang, A.H., Helou, B., and Beijbom, O. (2020). PointPainting: Sequential Fusion for 3D Object Detection. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR42600.2020.00466"},{"key":"ref_7","first-page":"720","article-title":"3D-CVF: Generating Joint Camera and LiDAR Features Using Cross-View Spatial Feature Fusion for 3D Object Detection","volume":"Volume 12372","author":"Yoo","year":"2020","journal-title":"Computer Vision\u2014ECCV 2020"},{"key":"ref_8","first-page":"1992","article-title":"DeepInteraction: 3D Object Detection via Modality Interaction","volume":"Volume 35","author":"Chen","year":"2022","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Chen, X., Zhang, T., Wang, Y., Wang, Y., and Zhao, H. (2023). FUTR3D: A Unified Sensor Fusion Framework for 3D Detection. Proceedings of the 2023 IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), IEEE.","DOI":"10.1109\/CVPRW59228.2023.00022"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Xiang, C., Qi, C.R., and Li, B. (2019). Generating 3D Adversarial Point Clouds. Proceedings of the 2019 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR.2019.00935"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Cao, Y., Xiao, C., Cyr, B., Zhou, Y., Park, W., Rampazzi, S., Chen, Q.A., Fu, K., and Mao, Z.M. (2019). Adversarial Sensor Attack on LiDAR-Based Perception in Autonomous Driving. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS), ACM.","DOI":"10.1145\/3319535.3339815"},{"key":"ref_12","unstructured":"Sun, J., Cao, Y., Chen, Q.A., and Mao, Z.M. (2020). Towards Robust LiDAR-Based Perception in Autonomous Driving: General Black-Box Adversarial Sensor Attack and Countermeasures. Proceedings of the 29th USENIX Security Symposium, USENIX Association."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Tu, J., Ren, M., Manivasagam, S., Liang, M., Yang, B., Du, R., Cheng, F., and Urtasun, R. (2020). Physically Realizable Adversarial Examples for LiDAR Object Detection. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR42600.2020.01373"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Hau, Z., Co, K.T., Demetriou, S., and Lupu, E.C. (2021). Object Removal Attacks on LiDAR-Based 3D Object Detectors. Proceedings of the 3rd International Workshop on Automotive and Autonomous Vehicle Security (AutoSec), Internet Society.","DOI":"10.14722\/autosec.2021.23016"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Jin, Z., Ji, X., Cheng, Y., Yang, B., Yan, C., and Xu, W. (2023). PLA-LiDAR: Physical Laser Attacks against LiDAR-Based 3D Object Detection in Autonomous Vehicle. Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), IEEE.","DOI":"10.1109\/SP46215.2023.10179458"},{"key":"ref_16","unstructured":"Cao, Y., Bhupathiraju, S.H., Naghavi, P., Sugawara, T., and Mao, Z.M. (2023). You Can\u2019t See Me: Physical Removal Attacks on LiDAR-Based Autonomous Vehicles Driving Frameworks. Proceedings of the 32nd USENIX Security Symposium, USENIX Association."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Zhu, Y., Miao, C., Zheng, T., Hajiaghajani, F., Su, L., and Qiao, C. (2021). Can We Use Arbitrary Objects to Attack LiDAR Perception in Autonomous Driving?. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS), ACM.","DOI":"10.1145\/3460120.3485377"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1592","DOI":"10.1007\/s11263-023-01934-3","article-title":"A Comprehensive Study of the Robustness for LiDAR-Based 3D Object Detectors against Adversarial Attacks","volume":"132","author":"Zhang","year":"2024","journal-title":"Int. J. Comput. Vis."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"179094","DOI":"10.1109\/ACCESS.2020.3027372","article-title":"Adversarial Patch Attacks on Monocular Depth Estimation Networks","volume":"8","author":"Yamanaka","year":"2020","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Zhu, Z., Zhang, Y., Chen, H., Dong, Y., Zhao, S., Ding, W., Zhong, J., and Zheng, S. (2023). Understanding the Robustness of 3D Object Detection with Bird\u2019s-Eye-View Representations in Autonomous Driving. Proceedings of the 2023 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR52729.2023.02069"},{"key":"ref_21","unstructured":"Xie, S., Li, Z., Wang, Z., and Xie, C. (2023). On the Adversarial Robustness of Camera-Based 3D Object Detection. arXiv."},{"key":"ref_22","unstructured":"Guesmi, A., Hanif, M.A., Alouani, I., and Shafique, M. (2023). APARATE: Adaptive Adversarial Patch for CNN-Based Monocular Depth Estimation for Autonomous Navigation. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Zheng, J., Lin, C., Sun, J., Zhao, Z., Li, Q., and Shen, C. (2024). Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving. Proceedings of the 2024 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR52733.2024.02308"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Bai, X., Hu, Z., Zhu, X., Huang, Q., Chen, Y., Fu, H., and Tai, C.L. (2022). TransFusion: Robust LiDAR-Camera Fusion for 3D Object Detection with Transformers. Proceedings of the 2022 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR52688.2022.00116"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"10421","DOI":"10.52202\/068431-0757","article-title":"BEVFusion: A Simple and Robust LiDAR-Camera Fusion Framework","volume":"Volume 35","author":"Liang","year":"2022","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Sindagi, V.A., Zhou, Y., and Tuzel, O. (2019). MVX-Net: Multimodal VoxelNet for 3D Object Detection. Proceedings of the 2019 IEEE International Conference on Robotics and Automation (ICRA), IEEE.","DOI":"10.1109\/ICRA.2019.8794195"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Park, W., Liu, N., Chen, Q.A., and Mao, Z.M. (2021). Sensor Adversarial Traits: Analyzing Robustness of 3D Object Detection Sensor Fusion Models. Proceedings of the 2021 IEEE International Conference on Image Processing (ICIP), IEEE.","DOI":"10.1109\/ICIP42928.2021.9506183"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Abdelfattah, M., Yuan, K., Wang, Z.J., and Ward, R. (2021). Adversarial Attacks on Camera-LiDAR Models for 3D Car Detection. Proceedings of the 2021 IEEE\/RSJ International Conference on Intelligent Robots and Systems (IROS), IEEE.","DOI":"10.1109\/IROS51168.2021.9636638"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Cao, Y., Wang, N., Xiao, C., Yang, D., Fang, J., Yang, R., Chen, Q.A., Liu, M., and Li, B. (2021). Invisible for Both Camera and LiDAR: Security of Multi-Sensor Fusion-Based Perception in Autonomous Driving under Physical-World Attacks. Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP), IEEE.","DOI":"10.1109\/SP40001.2021.00076"},{"key":"ref_30","first-page":"1013","article-title":"Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving","volume":"Volume 164","author":"Tu","year":"2022","journal-title":"Proceedings of the 5th Conference on Robot Learning (CoRL)"},{"key":"ref_31","unstructured":"Hallyburton, R.S., Liu, Y., Cao, Y., Mao, Z.M., and Pajic, M. (2022). Security Analysis of Camera-LiDAR Fusion against Black-Box Attacks on Autonomous Vehicles. Proceedings of the 31st USENIX Security Symposium, USENIX Association."},{"key":"ref_32","unstructured":"Cheng, Z., Choi, H., Feng, S., Liang, J., Tao, G., Liu, D., Zuzak, M., and Zhang, X. (2024, January 7\u201311). Fusion Is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection. Proceedings of the Twelfth International Conference on Learning Representations (ICLR), Vienna, Austria."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Chen, J., Jordan, M.I., and Wainwright, M.J. (2020). HopSkipJumpAttack: A Query-Efficient Decision-Based Attack. Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP), IEEE.","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref_34","first-page":"484","article-title":"Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search","volume":"Volume 12368","author":"Andriushchenko","year":"2020","journal-title":"Computer Vision\u2014ECCV 2020"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Caesar, H., Bankiti, V., Lang, A.H., Vora, S., Liong, V.E., Xu, Q., Krishnan, A., Pan, Y., Baldan, G., and Beijbom, O. (2020). nuScenes: A Multimodal Dataset for Autonomous Driving. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Tanaka, Y., Nomoto, K., Kobayashi, R., Tsuruoka, G., and Mori, T. (2025). Adversarial Fog: Exploiting the Vulnerabilities of LiDAR Point Cloud Preprocessing Filters. Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS), ACM.","DOI":"10.1145\/3708821.3733904"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"138049","DOI":"10.1016\/j.energy.2025.138049","article-title":"A dynamic spatiotemporal graph generative adversarial network for scenario generation of renewable energy with nonlinear dependence","volume":"335","author":"Hu","year":"2025","journal-title":"Energy"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"236206","DOI":"10.1088\/1361-6501\/ae7467","article-title":"An adaptive dynamic scenario clustering method for power system optimization control under spatiotemporal correlated uncertainties","volume":"37","author":"Hu","year":"2026","journal-title":"Meas. Sci. Technol."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/16\/5268\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T09:50:36Z","timestamp":1787219436000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/16\/5268"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,20]]},"references-count":38,"journal-issue":{"issue":"16","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["s26165268"],"URL":"https:\/\/doi.org\/10.3390\/s26165268","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,20]]}}}