MadRadar Triggers "Hallucinations" in Autonomous Vehicle Sensor Systems, Researchers Say

A team of engineers at Duke University is warning of potential pitfalls in widespread autonomous vehicle use, demonstrating an attack that can mask real objects from the vehicle's sensors — or make "phantom" objects appear: MadRadar.

“Without knowing much about the targeted car's radar system, we can make a fake vehicle appear out of nowhere or make an actual vehicle disappear in real-world experiments," Miroslav Pajic, associate professor of electrical and computer engineering, explains of the team's work. "We're not building these systems to hurt anyone, we're demonstrating the existing problems with current radar systems to show that we need to fundamentally change how we design them."

In one demonstration, the team shows the attack — dubbed MadRadar — causing a "hallucination" in a Doppler radar system, forcing it to switch from correctly tracking a vehicle travelling away from the sensor into believing it has performed a complete one-eighty and is now hurtling towards a head-on collision. In other demonstrations, vehicles are imagined from whole cloth where none exist.

Although similar attacks have been demonstrated before, they've required an intimate knowledge of exactly what type of sensor system is in use in the target vehicle. "Think of it like trying to stop someone from listening to the radio," Pajic says. "To block the signal or to hijack it with your own broadcast, you’d need to know what station they were listening to first." MadRadar, by contrast, does not: the team claims it can detect and learn the radar type in use "in microseconds" and adapt its attack immediately.

"Imagine adaptive cruise control, which uses radar, believing that the car in front of me was speeding up, causing your own car to speed up, when in reality it wasn’t changing speed at all," Pajic says of the attack's potential. "If this were done at night, by the time your car’s cameras figured it out you’d be in trouble. These lessons go far beyond radar systems in cars as well. If you want to build drones that can explore dark environments, like in search and rescue or reconnaissance operations, that don’t cost thousands of dollars, radar is the way to go."

The MadRadar attack is to be presented at the 2024 Network and Distributed System Security Symposium, taking place in San Diego, California from 26 February to 1 March; technical details of the vulnerability have not yet been publicly released.