MadRadar: A Black-Box Physical Layer Attack Framework on mmWave Automotive FMCW Radars

MadRadar: A Black-Box Physical Layer Attack Framework on mmWave Automotive FMCW Radars

Speakers: David Hunt

Conference: NDSS Symposium

YouTube: (no public video)

Overview

In this presentation, David Hunt unveiled MadRadar, a groundbreaking black-box physical layer attack framework designed to target millimeter-wave (mmWave) automotive Frequency Modulated Continuous Wave (FMCW) radars. These radars are foundational to modern Advanced Driver Assistance Systems (ADAS), powering features such as automatic emergency braking, blind spot detection, and lane change assist. Their robustness in adverse weather, extended detection range, and unique ability to measure relative velocity make them indispensable for current and future autonomous driving platforms, including ambitious concepts like Mobileye's 360 Radar cocoon, which relies heavily on the latest 76-81 GHz mmWave technology for its superior range and velocity resolution.

Despite their critical role, the security of automotive radars, particularly against sophisticated physical layer attacks, has only recently begun to receive focused attention. While vulnerabilities in camera and LiDAR systems are well-documented, radar security has lagged. Prior physical layer attacks on FMCW radars primarily focused on false positive spoofing – injecting fake objects into a radar's point cloud. Crucially, most of these efforts operated under a white-box threat model, assuming full knowledge of the victim radar's internal configuration, severely limiting their real-world applicability. Furthermore, there has been a notable absence of demonstrated false negative attacks (making an existing object disappear) or translation attacks (making an object appear to move). MadRadar directly addresses these gaps by introducing a comprehensive black-box framework that not only enables more practical false positive attacks but also pioneers the demonstration of false negative and translation attacks.

MadRadar's significance lies in its ability to operate without any prior knowledge of the victim radar's parameters, dynamically estimating critical configurations in real-time. This capability allows an attacker to 'add', 'remove', or 'move' object detections within a victim vehicle's perceived environment with remarkable precision. The framework's demonstrated feasibility on a real-time physical prototype, using software-defined radio (SDR) platforms, underscores the urgent need for robust defensive mechanisms against these novel and potentially dangerous threats to automotive safety and autonomy.

Background

[▶ Watch: Introduction to mmWave radar vulnerabilities (0:00)]()

Understanding the vulnerabilities exploited by MadRadar requires a foundational grasp of FMCW radar signal processing. Radars function by transmitting a linearly increasing frequency signal, known as a chirp, and then analyzing the reflections from objects. This process allows for the determination of an object's range, velocity, and angle. The typical FMCW radar processing pipeline involves five key stages.

Step 1: Transmitter (Tx) and Receiver (Rx) Chirps. The radar emits a series of identical chirps, where the frequency increases linearly over time. The transmitted signal x(t) and the reflected signal y(t) from a target at range d(t) and velocity v_target are characterized by parameters like chirp start frequency (f_c), bandwidth (B), chirp period (T_chirp), and chirp slope (S).

Step 2: Dechirping and IF Signal Generation. The received signal y(t) is mixed with a replica of the transmitted signal x(t) to produce an Intermediate Frequency (IF) signal s(t). The frequency of this IF signal, f_IF, is directly proportional to the target's range, while a phase shift Φ_doppler is related to its velocity. Modern automotive radars typically filter IF frequencies above 10-20 MHz, which impacts maximum detection range and overall system cost.

Step 3: Range-Doppler Response. A Fast Fourier Transform (FFT) is applied to the IF signal to estimate f_IF, from which the target's range d_target is calculated. The range resolution (d_res) and maximum detection range (d_max) are determined by the radar's bandwidth and sampling characteristics. To detect velocity, multiple chirps within a frame are used. A second FFT, performed across chirps in each range bin, estimates Φ_doppler, allowing for the computation of relative velocity (v). Similarly, velocity resolution (v_res) and maximum velocity (v_max) are derived from frame parameters. The culmination of these 2D-FFT operations generates the Range-Doppler response, a 2D map of detected objects based on their range and velocity.

Step 4: CFAR Detection. After generating the Range-Doppler response, Constant False Alarm Rate (CFAR) detectors are applied to distinguish genuine object detections from noise. These algorithms estimate the local noise levels around each Range-Doppler cell, which can vary due to environmental clutter, and then compute an adaptive threshold. Any cell exceeding this threshold is classified as a detection. MadRadar specifically targets Cell-Averaging CFAR (CA-CFAR) detectors, which are widely used but known to be susceptible to high clutter levels.

Step 5: Clustering. Finally, a clustering algorithm, typically DBSCAN, groups adjacent detection points that likely belong to the same physical object, filtering out spurious noise or multipath reflections.

Beyond adversarial attacks, radars are also prone to non-adversarial interference, such as same slope, similar slope, and sweeping interference, arising from self-interference or other nearby radars. These can degrade performance by saturating the receiver, reducing the Signal-to-Noise Ratio (SNR), generating false peaks, or even causing the radar to lose track of targets. Existing mitigation techniques primarily focus on detecting and nullifying interference in the time domain of the IF signal. MadRadar's novel false negative attacks are meticulously designed using carefully crafted similar slope interference that is specifically engineered to evade these conventional time-domain detection methods.

MadRadar operates under a black-box threat model, meaning the attacker possesses no prior knowledge of the victim radar's configuration parameters. The attacker is assumed to have environmental awareness, such as the victim's relative position and velocity for false positive attacks, and the target object's position and velocity for false negative attacks. The attack objectives are threefold:

• False Positive (FP) attack: Injecting a spoofed object with realistic range and velocity into the victim's point cloud.
• False Negative (FN) attack: Causing the victim radar to fail to detect an existing physical object by creating localized clutter that raises the CFAR detection threshold.
• Translation attack: A sophisticated combination of an FN attack to 'remove' a real target and a simultaneous FP attack to 'insert' a fake object at a new, desired location, effectively 'moving' the object from the victim's perspective.

The framework focuses on attacking the victim's FMCW radar sensor in the range and velocity domains, assuming the attacker is physically positioned at the desired angle of attack.

Key Findings

[▶ Watch: Summary of MadRadar's key contributions (4:00)]()

MadRadar represents a significant leap forward in understanding and demonstrating the vulnerabilities of mmWave automotive FMCW radars. The core contributions and key findings are:

1. First Black-Box Framework: MadRadar is the inaugural black-box attack framework for effective physical layer attacks on mmWave radars. Unlike previous efforts that relied on prior knowledge of radar parameters, MadRadar operates entirely without such information, making its attacks significantly more practical and realistic in real-world scenarios.

1. Novel Attack Types: The framework uniquely enables and demonstrates false negative and translation attacks, in addition to refined false positive attacks. These new capabilities allow an attacker to not only 'add' fake objects but also to 'remove' existing objects or 'move' them to arbitrary locations within the victim's perceived environment. This significantly expands the threat landscape beyond simple spoofing.

1. Real-Time, High-Accuracy Parameter Estimation: A critical advancement is MadRadar's ability to achieve real-time and highly accurate estimation of victim radar parameters, including chirp slope (S), chirp period (T_chirp), and frame duration (T_frame). The system estimates chirp slope with a mean error of 0.01 MHz/µs and chirp period with a mean error of 0.14 nanoseconds. This precision is paramount, as a mere 20-nanosecond error in frame start time prediction can result in a 3-meter perceived location error for a spoofed object. MadRadar achieves this robust estimation within just six victim frames, making its attacks rapidly deployable.

1. Effective and Precise Attacks: Both simulations and physical experiments confirm the high effectiveness and accuracy of MadRadar's attacks. Simulated spoofing attacks achieved 90% accuracy within 1.09 meters of the desired range and 0.12 meters per second of the desired velocity. False negative attacks consistently decreased the victim radar's probability of detection (PD) for targets, particularly when the attacker's signal power matched the target's reflection.

1. Experimental Validation on Physical System: MadRadar's feasibility was rigorously demonstrated on a real-time physical prototype using Software-Defined Radio (SDR) platforms. This first-of-its-kind demonstration validated the framework's ability to estimate parameters and execute FP, FN, and translation attacks on a physical system, even with hardware limitations. Real-world case studies with both stationary and moving attackers further underscored the practical implications and dangerous potential of these attacks for autonomous driving systems.

Technical Deep Dive

[▶ Watch: FMCW radar signal processing background (4:15)]()

MadRadar's core innovation lies in its ability to dynamically sense a victim radar's configuration and then generate precise attack signals in a black-box environment. The framework is architected into two main components: the Sensing Component and the Attacking Component.

The Sensing Component is responsible for real-time parameter estimation, which is notoriously challenging. Even a small error, such as 20 nanoseconds in predicting the victim's frame start time, can lead to a 3-meter range error for a spoofed object. MadRadar addresses this through a three-step process:

1. Spectrogram Generation: The system continuously monitors the environment, operating at a 25 MSps sampling rate. Upon detecting a victim radar frame, it records the received signal for slightly over 2 ms and generates a spectrogram, sampling frequency every 2 µs. This entire computation is completed in under 10 ms.
2. Chirp Identification: A custom peak detection and clustering algorithm is employed to identify individual chirps within the spectrogram. For each identified chirp, least squares regression (implemented using the Eigen C++ library) is used to estimate its start time and slope.
3. Victim Parameter Estimation: To achieve high accuracy, the estimated chirp slopes (S), chirp periods (T_chirp), and frame durations (T_frame) are averaged across multiple recorded victim chirps and frames. For frame start time, where fewer samples are available, cross-correlation of the initial 10 µs of the received signal with a computed victim chirp (generated from estimated parameters) is used for higher precision. Outlier filtering using the inter-quartile range further enhances robustness. This robust sensing pipeline quickly and accurately estimates parameters within just 6 victim frames.

Once the victim's parameters are estimated, the Attacking Component leverages this information to craft specific attack signals:

B. False Positive (FP) Spoofing Attacks:

For FP attacks, MadRadar transmits identically sloped radar chirps using the estimated S, T_chirp, and T_frame. The crucial elements are a specific delay (t'_a) and a phase shift (Φ'_doppler,n) for each chirp. These parameters are derived from the desired spoofing range (d_spoof) and velocity (v_spoof), as well as the attacker's relative range (d_atk) and velocity (v_atk) to the victim. The n-th chirp of the FP attack signal is precisely calculated using these derived values. To ensure realism, the amplitude of the transmitted attack signal (A_atk) is dynamically scaled to emulate realistic propagation loss, making the spoofed object appear legitimate to the victim radar's processing pipeline.

C. False Negative (FN) Attacks:

FN attacks are designed to make an existing physical object "disappear" from the victim radar's perception. The strategy involves adding clutter specifically around the target in the Range-Doppler response, thereby raising the CA-CFAR detection threshold and significantly decreasing the target's probability of detection.

The process begins by generating an FP attack signal that would spoof a false object at the exact range and velocity of the actual target. This signal is then subtly "smeared" in two domains:

• Range Domain Smearing: A very similar, but slightly offset, chirp slope (S') is used, differing from the estimated victim slope (S) by approximately 0.01 MHz/µs. This precise offset is calculated to spread the spoofed signal by 1-3 meters in range, considering the victim radar's estimated bandwidth, chirp period, and slope.
• Velocity Domain Smearing: The Φ_doppler,n phase shift between subsequent chirps is subtly increased.

This dual smearing creates localized clutter that effectively "blinds" the CA-CFAR detector to the actual target. A critical aspect of MadRadar's FN attacks is that they are carefully designed to be undetectable by existing time-domain interference mitigation techniques, which primarily look for strong, single-frequency interference.

D. Translation Attack:

The translation attack combines the destructive power of an FN attack with the deceptive capabilities of an FP attack. It is achieved by simultaneously transmitting both the FN attack signal and the FP attack signal. The FN component targets the actual physical object's location, effectively 'removing' it from the victim's perception. Concurrently, the FP component inserts a fake object at a new, desired range and velocity. The combined effect is that the object in the victim radar's point cloud appears to 'move' from its real location to the attacker-specified fake location, creating a highly misleading perception for the victim vehicle.

Demo / Proof of Concept

[▶ Watch: CFAR detection and clustering in radars (6:00)]()

To demonstrate the practical feasibility and effectiveness of MadRadar, a proof-of-concept prototype was developed using USRP B210 Software-Defined Radio (SDR) platforms. Both the victim radar and the MadRadar attack prototype were controlled by host laptops running a C++-based USRP Hardware Driver (UHD). The MadRadar prototype alone required approximately 4,500 lines of code.

Due to the inherent limitations of the USRP B210 hardware—specifically its frequency range of 70 MHz to 6 GHz and a maximum sampling rate of 56 MHz—the prototype operated at a scaled-down intermediate frequency (f_c) of 1.5 GHz and a sampling rate of 25 MSps. This configuration resulted in a victim range resolution (d_res) of approximately 6 meters and a maximum timing accuracy for MadRadar of about 40 nanoseconds. To achieve a more realistic velocity resolution of approximately 0.8 meters per second, longer chirps and frames were utilized. While this prototype operates at a scaled-down frequency, the MadRadar framework is designed to be fully extendable to a full-scale mmWave implementation, which would necessitate more capable and expensive high-frequency SDR hardware, including RF chains for 77-81 GHz operation and RFSOC boards supporting complex sampling rates of at least 4 Gsps for full 4 GHz bandwidths.

In the experimental setup, the victim radar transmitted FMCW chirps and recorded received signals for offline processing to obtain Range-Doppler responses. In contrast, the MadRadar prototype operated in real-time: it continuously estimated the victim radar's chirp slope, chirp period, and frame duration. Based on these real-time estimates, the attacker designed and transmitted the corresponding attack signals for FP, FN, or translation attacks. This prototype represents the first real-time black-box demonstration of FP, FN, and translation attacks on a physical system.

Physical Evaluation Results (Section VII):

Extensive physical experiments validated MadRadar's parameter estimation accuracy on the SDR prototype using 500 different victim configurations with chirp bandwidths up to 25 MHz.

• Chirp Period Estimation: 95% of chirp period estimates were within 39.09 nanoseconds (mean error 18.95 ns). While higher than simulation results (0.59 ns) due to hardware constraints, this was still within one sampling period of the victim radar.
• Chirp Slope Estimation: 95% of chirp slope estimates were within 0.00175 MHz/µs (mean error 0.0025 MHz/µs), with a relative error of 0.403%. This accuracy was comparable to simulations, though the absolute error was higher due to the lower sampling bandwidth.

For physical spoofing accuracy, across 100 real-time trials, 90% of spoofed ranges were within 9.67 meters of the desired range (mean error 7.53m), and 90% of spoofed velocities were within 1.80 m/s (mean error 1.42m/s). Interestingly, physical range spoofing was slightly more accurate than predicted by simulations, while velocity spoofing was less accurate, attributed to the USRP B210's phase noise not modeled in simulations. Overall, the physical experiments confirmed MadRadar's ability to estimate parameters and insert spoofed objects with anticipated accuracy given the hardware limitations.

Real-World Case Studies (Section VIII):

MadRadar's capabilities were further demonstrated through several real-world case studies:

• Stationary Attacker: A stationary MadRadar platform attacked a stationary victim radar while a target vehicle drove away at 9 m/s.
• FN Attack: When an FN attack targeted a vehicle at 50 meters, the victim radar immediately failed to detect it, effectively 'removing' the object from its point cloud.
• Translation Attack: By simultaneously launching an FN attack on the real target and an FP attack inserting a fake object moving towards the victim, the victim erroneously perceived the target vehicle moving towards it, even though it was actually moving away. The spoofed object's power level increased realistically, simulating its apparent approach.
• Moving Attacker: The MadRadar platform was placed in the trunk of a moving attack vehicle (driving at 13 m/s), attacking a victim radar in a separate, independently moving vehicle (at 4.5 m/s).
• Translation Attack: A translation attack was launched where the FN component targeted the attacker vehicle (moving away), and the FP component inserted a fake object moving towards the victim. The victim was led to believe the attack vehicle was moving towards it, only detecting the fake location and failing to detect the attacker's actual position. This highlights the dangerous implications for autonomous driving, where a vehicle's perception of surrounding traffic could be fundamentally altered.

Defensive Implications

[▶ Watch: Defining attack objectives and threat model (8:00)]()

The MadRadar framework exposes significant vulnerabilities in current mmWave automotive FMCW radars, particularly those employing CA-CFAR detectors. The ability to launch precise, real-time, black-box false positive, false negative, and translation attacks means that critical ADAS features and future autonomous driving systems are susceptible to manipulation at the physical layer. These attacks can cause vehicles to perceive non-existent obstacles, ignore real threats, or misinterpret the motion of other vehicles, leading to potentially catastrophic safety outcomes. Crucially, MadRadar's carefully crafted false negative attacks are designed to bypass existing time-domain interference mitigation techniques, rendering many current defenses ineffective.

To counter these sophisticated threats, future radar systems and their integration into autonomous vehicles must incorporate robust defensive mechanisms:

1. Parameter Randomization: One potential defense involves introducing small, random changes to the radar's chirp period, slope, and frame duration. This would make real-time parameter estimation significantly more challenging for black-box attackers. However, current commercial radars typically lack the flexibility to dynamically randomize these parameters. Even if implemented, MadRadar could potentially be modified to detect such randomization using a Likelihood Ratio Test. Once randomization is detected, an attacker could adapt by launching a broader, optimal FN "jamming" attack, leveraging the existing FN attack methodology to cover a much larger range and velocity spread, still preventing target detection. This indicates that parameter randomization alone might not be a silver bullet and would require careful design to avoid being circumvented by adaptive attackers.

1. Multi-sensor Fusion: Modern vehicles already employ multiple sensors, including cameras, LiDARs, and radars, with their data fused to create a more comprehensive environmental model. While MadRadar specifically targets radar data, the hope is that information from other sensors could help detect and mitigate these physical layer radar attacks. However, prior research has demonstrated successful attacks against LiDAR-camera fusion systems, suggesting that multi-sensor fusion is not inherently immune to sophisticated attacks. Future research must rigorously investigate the resilience of radar-camera and radar-LiDAR-camera sensor fusion systems against MadRadar-like physical layer radar attacks to develop truly robust, multi-modal defenses.

In essence, the findings from MadRadar underscore the urgent need for a paradigm shift in automotive radar security, moving towards dynamic, adaptive, and multi-sensor defensive strategies that can detect and counter sophisticated physical layer manipulations in real-time.

Key Takeaways

• Black-Box Attacks are Practical: MadRadar demonstrates that sophisticated physical layer attacks on mmWave automotive FMCW radars are practical and effective even without prior knowledge of the victim's parameters.
• Novel Attack Capabilities: The framework introduces and experimentally validates the first false-negative and translation attacks, enabling attackers to 'remove' existing objects or 'move' them to arbitrary locations in the victim's perception.
• Accurate Real-Time Parameter Estimation: MadRadar achieves high-accuracy, real-time estimation of critical radar parameters (chirp slope, chirp period, frame duration) within just six victim frames, a crucial enabler for black-box attacks.
• Vulnerability of CA-CFAR Detectors: The research highlights the susceptibility of widely used CA-CFAR detectors to carefully crafted interference, which can be designed to evade existing time-domain mitigation techniques.
• Significant Risks to ADAS and Autonomous Driving: These physical layer attacks pose severe safety implications for Advanced Driver Assistance Systems and future autonomous vehicles by manipulating their fundamental perception of the environment.
• Need for Robust Defenses: Current radar systems and existing interference mitigations are insufficient. Future defenses must explore dynamic parameter randomization and robust, secure multi-sensor fusion to counter these advanced threats.

About the Speaker(s)

David Hunt is the speaker who presented MadRadar. Based on the provided transcript and metadata, no further biographical details regarding his title or affiliation are available.