Robotics & Embodied WATCH CLOSELY OPPORTUNITY

Secure LiDAR chip: a sensor that rejects fake laser signals, for carmakers

ShiniFrontiers · Source: Keio University

Section 1 of 6 FREE PREVIEW

What is it, and who gains?

What it is: A prototype chip, built by researchers at Keio University in Japan, for the LiDAR on a self-driving vehicle: the laser sensor that tells the vehicle how far away every person and object is, by timing how long its laser flashes take to bounce back. The chip lets the sensor tell its own returning flashes apart from fake ones an attacker shines at it.

Who it's for: Companies that build or run self-driving vehicles. What they gain is a sensor that keeps seeing a pedestrian during a laser attack; in the researchers' test, the same sensor without the chip's check lost that pedestrian completely.

The catch: It is a lab prototype, not a product you can buy. Under attack it kept 73 of every 100 measurements, not all of them, and the protection was proven on recorded data, not yet live on the chip.

A. Keeping pedestrians in view when someone attacks the sensor — for heads of safety

Problem: Researchers have shown that most LiDAR sensors on the market can be fooled. An attacker fires rapid laser flashes at the sensor, the sensor cannot tell them from its own, and a pedestrian can vanish from what the vehicle sees. Some sensors defend themselves today by varying the timing of their flashes, and that defence has been beaten too.

What it does: The chip fires its laser in pairs and gives every pair a new random signature: a set gap between the two flashes and a set difference in brightness. It accepts only returning light that matches both. Think of a secret knock with both a rhythm and a loudness: an attacker who copies the rhythm still gets the loudness wrong, and is not let in.

See the difference

The situation	Today	With the secure chip
A pedestrian 40 m ahead while an attacker fires laser flashes at the sensor	0 of 100 measurements correct; the pedestrian disappears	73 of 100 correct; the pedestrian stays in view
The attacker's flashes happen to match the sensor's timing	Sensors that check only timing can be fooled	The flashes fail the brightness check and are ignored
Where the fake signal is caught	Software can spot fake points afterwards, but cannot recover what was lost	The sensor throws fake light away before it becomes a measurement
Normal driving, no attack	100 of 100 correct	100 of 100 correct; the protection costs no accuracy

All figures come from the Keio team's own lab tests. "Today" is the same prototype with its check switched off.

What a company gains: Vehicles that keep most of their view of people during a laser attack that wipes those people from view when the check is off, with no loss of accuracy in normal driving.
What it would take: Not for sale yet. A sensor maker would have to build the design into a future chip, and the paper gives no cost.
How ready: Proven in the lab

A working lab prototype, tested indoors. The attack protection was checked on recorded data; running it live on the chip is the next step.

Join free to unlock: how it works, what to do now, what it could change for the business, and what is not yet proven.

Join free to read it all →

Section 2 of 6 MEMBERS

How does it work?

Join free to read this section

Secure LiDAR chip — how it fits together.

Join free to unlock: how it works, what to do now, what it could change for the business, and what is not yet proven.

The big picture

A LiDAR works like shouting into a canyon and timing the echo: the longer the echo takes, the further away the wall. It does this with laser flashes across the whole scene, and each echo becomes one dot in a 3D picture of the road, called a point cloud. The vehicle's software finds pedestrians and vehicles in that picture.

The weakness is that the sensor accepts any light that arrives while it is listening for an echo. In a spoofing attack, someone aims a laser that fires rapid flashes at the sensor; the real echo from a pedestrian is drowned out, and that dot is lost. Researchers have shown this works on most LiDAR sensors on the market.

The secure chip fires its laser in pairs and picks, for every shot, a random gap between the two flashes and a random brightness ratio between them. Both flashes bounce off the same object within a fraction of a millionth of a second, so they fade by the same amount and the ratio survives the trip. The attacker cannot predict either value, so fake flashes fail the check.

Where the secure chip sits in a self-driving vehicle

Three layers, from the road to the vehicle's software.

The road. People, vehicles and objects: reflect the sensor's laser flashes back to it, for example a pedestrian 40 m ahead. The attacker needs no access to the vehicle's systems, only a laser aimed at its sensor.

The LiDAR sensor. Secure LiDAR chip: checks every returning pair of flashes against the gap and brightness ratio it chose for that shot, and throws away the rest. Laser driver: sets each flash's brightness anywhere from 10% to 100%, so every pair can differ from the last. Under attack, 73 of 100 measurements kept, against 0 without the check.

The vehicle's software. Perception software: builds the 3D picture and finds pedestrians and vehicles in it. Software checks can flag an attack but cannot restore a lost echo; the chip stops fakes before they arrive here.

Secure LiDAR: technical view

Why not just vary the timing, or check in software?

Sensors already defend themselves in two ways, and both fall short. Varying only the gap between flashes has been beaten: an attacker firing fast enough produces fake pairs that happen to match it. Software that checks the 3D picture can flag an attack, but cannot bring back a real echo that was drowned out.

	Timing-only check	Software check afterwards	Secure chip
Attacker matches the gap by chance	❌ Fooled	⚠️ May flag the attack	✅ Fails the brightness check
Real echo drowned out	❌ Point lost	❌ Can flag it, cannot restore it	✅ 73 of 100 kept in the test
Where it acts	In the sensor	After the 3D picture is built	In the sensor, before any measurement

A different kind of LiDAR, called FMCW, resists such light by design. The authors note that its cost keeps it out of most cars, which is why they protect the common, cheaper kind instead.

What the tests showed

Test	Result	What it means
Pedestrian at 40 m, under attack	73% of measurements correct with the check; 0% without	The pedestrian stays in the picture instead of disappearing
No attack	100% correct, with or without the check	The protection costs no accuracy in normal use
Range	Up to 120 m for a highly reflective target; reliable to 50 m for a dark one	The authors say a lab optical part, not the chip, set this limit

Inside the chip	Figure
Chip	65 nm CMOS, 16 channels, 1.5 mm × 0.65 mm; light detector off the chip
Power of the measuring circuit	3.1 mW per channel, 60% below the 7.8 mW of the best earlier design compared
How it saves power	The converter wakes only around each echo's peak, reading three samples 1 ns apart; 99% less converter power
Distance resolution	1 cm, by fitting a curve through the three samples
Laser brightness control	10% to 100%, set by charging the laser's capacitor for 100 to 1,000 ns
Daylight	Works in ambient light up to 30,000 lux, in the authors' optical simulation

Join free → I have an account

Section 3 of 6 MEMBERS

What to do now

Join free to read this section

Secure LiDAR chip — next steps and signals to watch.

Join free to unlock: how it works, what to do now, what it could change for the business, and what is not yet proven.

Is this your problem?

	Secure LiDAR chip
Your risk if	Your vehicles or robots rely on LiDAR to see people
	You buy LiDAR sensors and set the requirements they must meet
	Your safety case has to cover deliberate attacks, not only faults
Who acts on it	The head of safety sets the requirement, procurement questions suppliers, and the head of autonomy watches for a product
Lower priority if	Your sensors are the FMCW kind, which resists such light by design
	You need a protected sensor to buy this year: this is a lab prototype

Part A: Find out where you stand

List which vehicles or robots depend on LiDAR to detect people (the head of autonomy) Note each sensor model and its supplier.
Ask each LiDAR supplier, in writing, how their sensor handles a laser spoofing attack (procurement) Ask whether it checks returning light on anything beyond timing, and whether it has been tested against the rapid-flash attack published in 2024 and its 2025 follow-up. Expect: a written answer naming what the sensor checks, with any test results.
Add resistance to spoofing to your sensor requirements (the head of safety) Ask for results under attack as the share of measurements still correct, the measure this paper reports.

Part B: Signals to watch

Signal	Why it matters
The check running live on the chip, within a single shot	So far it was applied afterwards to recorded data
Results outdoors, with the light detector built onto the chip	Tests so far were indoors, with a separate detector
Tests against other attacks, such as replaying the sensor's own flashes	Only one attack was tested; the authors say replay attacks need other defences
A sensor maker adopting the design	That is when it becomes something you can buy

What it costs

Item	Cost
Buying it	Not available: a university prototype, and the paper gives no price
Acting now	Staff time to question suppliers and update sensor requirements

Join free → I have an account

	What changes	What it can mean for the business
Safety under attack	73 of 100 measurements kept, against 0 without the check	A vehicle can keep seeing a pedestrian it would otherwise lose
Where the defence sits	Fake light is rejected inside the sensor	Protection that does not depend on software catching the attack afterwards
Everyday driving	Same accuracy with the check switched on	Protection with no trade-off in normal use

Limit	Why it matters	What to do
Not yet live on the chip	The brightness check was applied afterwards to data recorded in two scans at different laser strengths.	Wait for a live, single-shot demonstration before counting on it.
27 of 100 measurements still lost under attack	The protection is partial; parts of the picture can still drop out.	Treat it as one layer of defence, not the only one.
One attack tested	Only the rapid-flash attack was tested; the authors say attackers who replay the sensor's own flashes need other defences.	Ask suppliers which attacks they have tested against.
Indoor lab test	Tested indoors with a separate light detector; outdoor tests and an on-chip detector are future work.	Treat the range and results as lab figures.

Secure LiDAR chip: a sensor that rejects fake laser signals, for carmakers

What is it, and who gains?

How does it work?

The big picture

Where the secure chip sits in a self-driving vehicle

Why not just vary the timing, or check in software?

What the tests showed

What to do now

Is this your problem?

Part A: Find out where you stand

Part B: Signals to watch

What it costs

What could it change for the business?

What is proven, and what is not yet?

What is proven, and what is not yet

What it does not do

Sources