Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

TL;DR

This work reveals an invisible, infrared laser reflection (ILR) attack that can cause traffic sign perception systems in connected autonomous vehicles to misclassify signs without revealing any telltale artifacts to human observers. It develops a threat model and a comprehensive optimization pipeline that uses image-difference tracing and DNN-based trace interpolation to generate effective attack configurations, evaluated against multiple sign targets, cameras, and architectures. The study shows ILR achieving up to 100% attack success in indoor tests and over 80% in outdoor driving scenarios, while exposing the ineffectiveness of the current certifiable defense PatchCleanser for traffic-sign tasks. As a defense, the authors propose a speckle-based detection approach that leverages the unique physical characteristics of IR laser reflections, achieving promising true-positive rates with low false positives, highlighting a practical mitigation path for CAV safety against ILR threats.

Abstract

All vehicles must follow the rules that govern traffic behavior, regardless of whether the vehicles are human-driven or Connected Autonomous Vehicles (CAVs). Road signs indicate locally active rules, such as speed limits and requirements to yield or stop. Recent research has demonstrated attacks, such as adding stickers or projected colored patches to signs, that cause CAV misinterpretation, resulting in potential safety issues. Humans can see and potentially defend against these attacks. But humans can not detect what they can not observe. We have developed an effective physical-world attack that leverages the sensitivity of filterless image sensors and the properties of Infrared Laser Reflections (ILRs), which are invisible to humans. The attack is designed to affect CAV cameras and perception, undermining traffic sign recognition by inducing misclassification. In this work, we formulate the threat model and requirements for an ILR-based traffic sign perception attack to succeed. We evaluate the effectiveness of the ILR attack with real-world experiments against two major traffic sign recognition architectures on four IR-sensitive cameras. Our black-box optimization methodology allows the attack to achieve up to a 100% attack success rate in indoor, static scenarios and a >80.5% attack success rate in our outdoor, moving vehicle scenarios. We find the latest state-of-the-art certifiable defense is ineffective against ILR attacks as it mis-certifies >33.5% of cases. To address this, we propose a detection strategy based on the physical properties of IR laser reflections which can detect 96% of ILR attacks.

Figures (16)

• Figure 1: Overview of our ILR (Infrared Laser Reflection) attack. Unlike cameras without IR filters, humans can not see IR light. When an IR-sensitive camera images an object illuminated by an IR laser, the camera's output is altered at the pixel level. Our attack causes CAV perception stacks to misclassify traffic signs, causing dangerous misinterpretations.
• Figure 2: The two major traffic sign recognition system architectures used in our work. (a) A single-stage architecture detects and classifies traffic signs only with a single object detector; (b) A two-stage architecture's first-stage object detector finds and isolates (crops) the traffic sign in the image. The second-stage classifier provides the sign's class label.
• Figure 3: Overview of parameters of ILR attack
• Figure 4: Overview of Image Difference-based IR Trace Modeling (Left). The IR Laser module has a two-lens optical setup (right-top). A comparison of the simulated IR pattern with our modeling and the corresponding real-world IR pattern.
• Figure 5: 8-bit RGB pixel intensity and overall pixel intensity variation of the attack traces for $D=15$ cm IR pattern at increasing power (top). The impact of artificial ambient light on pixel intensity offset (bottom).