Self-driving systems lean on stereo cameras for low-cost depth perception, but a team spanning three universities found the technology can be steered with nothing more than projected light patterns.
Researchers from The University of Electro-Communications, the University of Florida, and Keio University demonstrated the attack on a RealSense D435, a widely used commercial stereo camera with a closed-source depth-matching algorithm. They showed that simple repeated patterns projected into the scene exploit an intrinsic weakness in the camera’s image-pixel sampling, giving attackers fine-grained control over the estimated depth of real obstacles.
The manipulation works because stereo matching algorithms make assumptions about how pixels correspond between the left and right images. Structured light at the right frequency interferes with that correspondence, letting an adversary make a genuine object appear closer or farther away than it is.
Wrong depth estimates can cascade through an autonomous stack. A pedestrian or parked car that reads as farther away gives the planner less time to react, while a false close reading can trigger unnecessary emergency braking.
The demo, presented at the VehicleSec 2026 demo session in Baltimore, highlights a vulnerability class outside the usual camera spoofing research: rather than injecting adversarial images into the perception pipeline, the attack shapes the physical input the sensor captures.
The authors argue the results expose limits in depth-estimation algorithms used across autonomous systems and call for defenses that treat the sampling layer itself as untrusted.
