Explainability-aware Frustum Attack: Exposing Structural Vulnerabilities in LiDAR-Based 3D Object Detectors

The structural vulnerabilities of point cloud–based 3D objectdetectors remain poorly understood. Prior work has studied adversarialrobustness primarily on isolated 3D object models, while recent LiDARspoofing attacks target richer and more realistic driving scenes but focusmainly on physical realizability rather than understanding detector be-havior or attack efficiency. In this work, we investigate how LiDAR-baseddetectors rely on spatial evidence in complex scenes and whether these re-liance patterns can be exploited to induce failures more efficiently. To thisend, we propose an explainability-guided adversarial analysis methodology.We introduce the Saliency-LiDAR (SALL) method, which aggregates In-tegrated Gradient attributions across scenes to produce universal saliencymaps for LiDAR-based 3D object detectors. Guided by these maps, wedesign the Explainability-aware Frustum Attack (EFA), which selectivelyperturbs only the most influential frustums rather than uniformly attack-ing entire object regions. Experiments on KITTI and nuScenes, acrossdetectors such as PointPillars and SECOND, show that EFA reducesdetection recall by more than 15 percentage points while requiring 25–50%fewer perturbed frustums than the SOTA non–saliency-aware baseline.These findings reveal that modern 3D detectors concentrate discrimina-tive evidence in a small subset of spatial regions, exposing a structuralrobustness vulnerability in current LiDAR perception systems. Our codeis released at https://github.com/SecMindLab/Saliency_LiDAR.