Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles

Jul 16, 2026

Upload by Ezra

Poisoning attacks targeting public 3D point cloud datasets threaten connected and autonomous vehicle perception by (i) causing misclassification of objects during training and (ii) enabling backdoors that may later trigger under specific system conditions. The effect of data augmentation on such attacks remains unclear. This work evaluates how augmenting poisoned datasets propagates malicious influence, using GAN-based augmentation to test whether augmentation limits poisoning, increases poisoned samples, or preserves injected backdoors, and shows decision perturbations by general classifiers.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages9

Reading Time23 min

Introduction

Motivation

Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles∗ Marwan Lazrag SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [marwan.lazrag@telecom-sudparis.eu](marwan.lazrag@telecom-sudparis.eu) Badis Hammi SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [badis.hammi@telecom-sudparis.eu](badis.hammi@telecom-sudparis.eu) Lorena Gonzalez-Manzano Universidad Carlos III de Madrid Leganes, Spain [lgmanzan@inf.uc3m.es](lgmanzan@inf.uc3m.es) Joaquin Garcia-Alfaro SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris Palaiseau, France [joaquin.garcia-alfaro@telecom-sudparis.eu](joaquin.garcia-alfaro@telecom-sudparis.eu) arXiv :2607 .06484v 1 [ cs .CR] 7 Jul 2026 Abstract Poisoning attacks against public datasets lead to major concerns, such as (i) misclassification of perceived objects when the poisoned data is used for training and (ii) embedding of backdoors that may eventually be triggered later on, when specific conditions in the system apply over the learned models. Its impact over data augmentation models is unclear. While data augmentation reduces the likelihood of poisoning attack success, some valid questions remain. Is data augmentation affecting the impact of poisoning attacks? can it increase the number of poisoned samples or injected backdoors? We explore in this paper some of these questions. We assess the effects of augmenting poisoned 3D point cloud datasets and validate that poisoning is able to evade the sanitizing nature of augmentation techniques when using the concrete case of Generative Adversarial Network (GAN) techniques to exemplify the case of data augmentation processing. We also validate that poisoning propagates over the augmented datasets and perturbs the decision made by general-purpose classifiers, in the end. All the experimental material (including tools, datasets, and classifiers) is publicly available, to facilitate reproducibility and to foster further research in the topic. Keywords Connected and Autonomous Vehicle (CAV), 3D Point Cloud, LiDAR, CCAM, Poisoning Attack, Dataset, Data Augmentation, GAN, Data Sanitization. 1 INTRODUCTION Connected and Autonomous Vehicles (CAVs)1 have progressed rapidly from experimental prototypes to deployed systems, driven ∗ This is the authors’ accepted version of a paper to appear in the Proceedings of the 23rd International Conference on Security and Cryptography (SECRYPT 2026) -Volume 1, ISBN 978-989-758-858-7, ISSN 2184-7711, pages 712-722, Porto, Portugal, July 16 – 18, 2026 . The final published version will be available through SCITEPRESS. 1For the remainder of this paper, the terms “Connected Autonomous Vehicles (CAVs)"and “Autonomous Vehicles (AVs)" are used interchangeably in the context of perceptionlevel processing and LiDAR sensor inputs. Distinctions related to connectivity or higher-level vehicular functions are outside the scope of this work. by advances in sensing, computation, and connectivity [1] [2] . Central to CAV operation is perception: a safety-critical subsystem that fuses heterogeneous sensor data, mainly cameras, Light Detection and Ranging (LiDAR), and Radar, to build a reliable, real-time model of the surrounding environment for downstream planning and control [3] . The geometric richness and metric fidelity of LiDAR point clouds, in particular, present both an opportunity and a challenge: they enable precise spatial reasoning (e.g., object localization and shape estimation) but require specialized representations and learning methods to handle sparsity, occlusion, and sensor noise [4] . 1.1 Motivation The widespread adoption of 3D point cloud deep learning techniques has significantly advanced the ability of autonomous vehicles to recognize and classify objects on the road, enhancing their navigation and decision-making capabilities [5] . These tec

FAQs

Why are poisoning attacks a concern for connected and autonomous vehicles using 3D point clouds?

They can mislead object classification when poisoned data is used for training, and they may embed backdoors that trigger later under particular operational conditions.

How does the paper investigate the role of data augmentation in poisoning attack impact?

It assesses the effects of augmenting poisoned 3D point cloud datasets and uses GAN-based data augmentation to evaluate whether poisoning can bypass augmentation’s sanitizing properties.

What outcomes are observed when poisoned data is augmented and used for classification?

Poisoning propagates through augmented datasets and perturbs the decisions made by general-purpose classifiers.

Jul 16, 2026

Upload by Ezra