Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition

Shuai Yuan, Xingshuo Han, Hongwei Li, Guowen Xu, Wenbo Jiang, Tao Ni, Qingchuan Zhao, Yuguang Fang

TL;DR

This work introduces FIPatch, a fluorescent ink–based physical adversarial patch that stealthily alters traffic sign recognition by triggering fluorescence under UV illumination. The authors develop a four‑module framework—automatic sign localization, fluorescence modeling, optimization with goal‑oriented losses and PSO, and robustness enhancements via EOT‑style transformations—to achieve high attack success in real‑world conditions. Extensive evaluations across 10 TSR models show near‑perfect ASR in low light for generative and misrecognition attacks, with substantial resilience to several defenses; real‑world tests reveal ASR remains high across varying ambient light, distance, and UV power. The results highlight a potent, hard‑to‑defend attack vector and motivate new defenses, such as high‑definition maps and collaborative perception, to bolster the robustness of autonomous driving systems against physical AEs.

Abstract

Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.

The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition

TL;DR

This work introduces FIPatch, a fluorescent ink–based physical adversarial patch that stealthily alters traffic sign recognition by triggering fluorescence under UV illumination. The authors develop a four‑module framework—automatic sign localization, fluorescence modeling, optimization with goal‑oriented losses and PSO, and robustness enhancements via EOT‑style transformations—to achieve high attack success in real‑world conditions. Extensive evaluations across 10 TSR models show near‑perfect ASR in low light for generative and misrecognition attacks, with substantial resilience to several defenses; real‑world tests reveal ASR remains high across varying ambient light, distance, and UV power. The results highlight a potent, hard‑to‑defend attack vector and motivate new defenses, such as high‑definition maps and collaborative perception, to bolster the robustness of autonomous driving systems against physical AEs.

Abstract

Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.
Paper Structure (30 sections, 13 equations, 18 figures, 7 tables)

This paper contains 30 sections, 13 equations, 18 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Background and Related Works
  3. Traffic sign recognition
  4. Physical adversarial examples
  5. Threat Model
  6. Attack goals
  7. Attacker capabilities
  8. Methodology
  9. Automatic traffic sign localization
  10. Fluorescence modeling
  11. Fluorescence optimization
  12. Robustness improvement
  13. Evaluation
  14. Experimental setup
  15. Overall performance
  16. ...and 15 more sections

Figures (18)

  • Figure 1: An example of FIPatch attack. The attacker first applies carefully crafted fluorescent ink to a traffic sign. When the attack is not triggered, the TSR system correctly classifies the sign. However, the attacker can uses a UV lamp from the side of the road to launch the attack against the victim’s vehicle, causing it to misrecognize a no-parking sign as a STOP sign, which leads to the vehicle suddenly stopping.
  • Figure 2: The workflow of our FIPatch.
  • Figure 3: Experimental setup in real-world environments. (A) A traffic sign in front of a Tesla Model Y with a UV lamp. The Tesla’s front cameras capture videos sent to the TSR system. (B) Sixteen fluorescent material colors. (C) Equipment: stand, Tesla USB, photometer, and 3 UV lamps.
  • Figure 3: Impact of the vehicle speed on ASRs.
  • Figure 4: Untriggered (top) and triggered (bottom) attack examples in real-world environments.
  • ...and 13 more figures