ilessio-aiflowlab/project_eir

EIR — SLAM Adversarial Defense (ISD-SLAM)

Part of the ANIMA Perception Suite by Robot Flow Labs.

Paper

D-SLAMSpoof: Novel Adversarial Attack on LiDAR-SLAM Systems and Practical Defense via Inertial Dead Reckoning (arXiv:2603.11365, March 2026)

Rokuto Nagata, Kenji Koide, Kazuma Ikeda, Ozora Sako, Kentaro Yoshioka

Overview

EIR detects adversarial spoofing attacks on LiDAR-based SLAM systems using only standard IMU sensors. The core insight: LiDAR scans can be spoofed, but IMU-based inertial dead reckoning cannot (within short horizons). When injected fake points cause scan-matching to report fictitious pose changes, the IMU residual spikes — triggering immediate detection.

Key innovation: Requires NO additional hardware beyond standard onboard IMU sensors.

Architecture

Learned Anomaly Detector (MLP + Bidirectional GRU, 131K parameters):

Input (18-dim per frame):
  delta_lidar (6) + delta_imu (6) + accel (3) + gyro (3)
      |
  Feature Extractor: Linear(18->128->64->32) + LayerNorm + GELU + Dropout(0.3)
      |
  Temporal Encoder: Bidirectional GRU (hidden=64, 2 layers)
      |
  Classification Head -> [benign, spoofed] per frame
  Anomaly Score Head -> continuous score >= 0

Results (5-Fold Cross-Validation)

Metric	Mean	Std
Accuracy	96.8%	0.22%
Precision	94.9%	0.53%
Recall / Detection Rate	84.0%	1.48%
F1 Score	89.1%	0.82%
False Positive Rate	0.84%	0.10%

Best fold: F1=90.4%, Detection Rate=85.9%, FPR=0.77%

Exported Formats

Format	File	Size	Use Case
PyTorch (.pth)	pytorch/eir_v2.pth	1.5 MB	Training, fine-tuning
SafeTensors	pytorch/eir_v2.safetensors	0.5 MB	Fast loading, safe
ONNX	onnx/eir_v2.onnx	0.5 MB	Cross-platform inference
TensorRT FP32	tensorrt/eir_v2_fp32.trt	1.4 MB	Full precision (L4/A100)
TensorRT FP16	tensorrt/eir_v2_fp16.trt	1.1 MB	Edge deployment (Jetson)

Usage

import torch
from anima_eir.training.model import AnomalyNet

# Load model
model = AnomalyNet(input_dim=18, hidden_dims=[128, 64, 32], dropout=0.3,
                    use_temporal=True, gru_hidden=64, gru_layers=2)
ckpt = torch.load("pytorch/eir_v2.pth", map_location="cpu")
model.load_state_dict(ckpt["model_state_dict"])
model.eval()

# Inference (batch=1, seq_len=32)
result = model.predict(delta_lidar, delta_imu, accel, gyro)
# result["predictions"]: per-frame 0/1
# result["scores"]: continuous anomaly score

Training

• Data: 3 EuRoC MAV IMU sequences (116K samples @ 200Hz), 5x synthetic multiplier
• Samples: 7,630 sequences (seq_len=32 @ 10Hz)
• Hardware: NVIDIA L4 (23GB VRAM)
• Epochs: 500 max, early stopping patience=50
• Optimizer: AdamW (lr=3e-4, weight_decay=0.05)
• Scheduler: CosineAnnealingWarmRestarts (T0=20)
• Augmentation: Gaussian noise, channel dropout, temporal mixup (alpha=0.3)
• Regularization: Dropout=0.3, label smoothing=0.1
• Validation: 5-fold stratified cross-validation

See configs/training.yaml for full configuration. See TRAINING_REPORT.md for per-fold metrics.

ANIMA Integration

EIR sits between THOR (point cloud filtering) and BALDUR (loop closure) in the ANIMA SLAM security stack:

LiDAR Input -> THOR (filter) -> EIR (anomaly detect) -> SLAM Frontend -> BALDUR (verify)

• Detection latency: <1 frame (<100ms)
• Fallback: IMU-only dead reckoning when spoofing detected
• ROS2 topics: /anima/eir/health, /anima/eir/spoof_detection

License

Apache 2.0 -- Robot Flow Labs / AIFLOW LABS LIMITED