March 09, 2026

MadRadar: A Black-Box Physical Layer Attack Framework on mmWave Automotive FMCW Radars

Abstract

Frequency modulated continuous wave (FMCW) millimeter-wave (mmWave) radars play a critical role in many of the advanced driver assistance systems (ADAS) featured on today’s vehicles. While previous works have demonstrated (only) successful false-positive spoofing attacks against these sensors, all but one assumed that an attacker had the runtime knowledge of the victim radar’s configuration. In this work, we introduce MadRadar, a general black-box radar attack framework for automotive mmWave FMCW radars capable of estimating the victim radar’s configuration in real-time, and then executing an attack based on the estimates. We evaluate the impact of such attacks maliciously manipulating a victim radar’s point cloud, and show the novel ability to effectively ‘add’ (i.e., false positive attacks), ‘remove’ (i.e., false negative attacks), or ‘move’ (i.e., translation attacks) object detections from a victim vehicle’s scene. Finally, we experimentally demonstrate the feasibility of our attacks on real-world case studies performed using a real-time physical prototype on a software-defined radio platform.

Biography

David primarily researches radar (77 GHz) technology and its integration into autonomous vehicles and robotics. His work studies the security, sensing, and resiliency. For security, he designed a black-box attack against environmental sensing systems called MadRadar. His attack allows an adversary to move, add, or delete objects. His work is the first to show that, even in the constrained black box setting, it is possible to move and remove objects from a target sensing system. As for sensing, his research aims to design radar-based algorithms that enable robotic systems to more clearly and efficiently explore and understand their immediate environment. These algorithms are designed for vehicles (air and ground), meaning that they must be accurate and resilient to noise and interference.