Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

Dongfang Guo, Yuting Wu, Yimin Dai, Pengfei Zhou, Xin Lou, Rui Tan

TL;DR

This work introduces GhostStripe, an attack system that uses LEDs to inject rolling shutter induced stripes onto traffic signs, fooling camera-based traffic sign recognition in autonomous vehicles. By designing attack timing control and vehicle movement adaptation, GhostStripe achieves stable misclassification across consecutive frames, with two variants: GhostStripe1 for untargeted stability and GhostStripe2 for targeted misclassification via phase synchronization using a framing sniffer. The authors validate the approach on outdoor and lab testbeds, reporting high success rates (up to 97% targeted and 94% untargeted) and analyze factors such as distance, speed, exposure, and ambient lighting. They also discuss countermeasures at sensor, perception, and system levels, and acknowledge limitations and directions for future work in extending to more cameras and remote sensing possibilities.

Abstract

Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94\% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

TL;DR

This work introduces GhostStripe, an attack system that uses LEDs to inject rolling shutter induced stripes onto traffic signs, fooling camera-based traffic sign recognition in autonomous vehicles. By designing attack timing control and vehicle movement adaptation, GhostStripe achieves stable misclassification across consecutive frames, with two variants: GhostStripe1 for untargeted stability and GhostStripe2 for targeted misclassification via phase synchronization using a framing sniffer. The authors validate the approach on outdoor and lab testbeds, reporting high success rates (up to 97% targeted and 94% untargeted) and analyze factors such as distance, speed, exposure, and ambient lighting. They also discuss countermeasures at sensor, perception, and system levels, and acknowledge limitations and directions for future work in extending to more cameras and remote sensing possibilities.

Abstract

Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94\% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.
Paper Structure (36 sections, 1 equation, 18 figures, 1 table)

This paper contains 36 sections, 1 equation, 18 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background and Preliminaries
  3. Traffic Sign Recognition
  4. Rolling Shutter Operation and Effect
  5. RSE-Based Adversarial Examples
  6. Design Principles of GhostStripe
  7. Attack Timing Control
  8. Vehicle Movement Adaptation
  9. GhostStripe Design
  10. Basic Attack Assumptions
  11. System Overview
  12. Attack Signal Optimization
  13. Locating Traffic Sign in Camera FoV
  14. Phase Synchronization
  15. GhostStripe Implementation
  16. ...and 21 more sections

Figures (18)

  • Figure 1: Invisible optical adversarial-example attack against traffic sign recognition.
  • Figure 2: Rolling shutter's operation and RSE.
  • Figure 3: Illustrations of the designs of attack timing control and vehicle movement adaptation.
  • Figure 4: Overview of GhostStripe.
  • Figure 5: Estimation of the traffic sign's vertical position and size in the captured image.
  • ...and 13 more figures