  To enable safe and reliable decision-making, autonomous vehicles (AVs) feed
sensor data to perception algorithms to understand the environment. Sensor
fusion with multi-frame tracking is becoming increasingly popular for detecting
3D objects. Thus, in this work, we perform an analysis of camera-LiDAR fusion,
in the AV context, under LiDAR spoofing attacks. Recently, LiDAR-only
perception was shown vulnerable to LiDAR spoofing attacks; however, we
demonstrate these attacks are not capable of disrupting camera-LiDAR fusion. We
then define a novel, context-aware attack: frustum attack, and show that out of
8 widely used perception algorithms - across 3 architectures of LiDAR-only and
3 architectures of camera-LiDAR fusion - all are significantly vulnerable to
the frustum attack. In addition, we demonstrate that the frustum attack is
stealthy to existing defenses against LiDAR spoofing as it preserves
consistencies between camera and LiDAR semantics. Finally, we show that the
frustum attack can be exercised consistently over time to form stealthy
longitudinal attack sequences, compromising the tracking module and creating
adverse outcomes on end-to-end AV control.
