Snowball Adversarial Attack on Traffic Sign Classification
Anthony Etim, Jakub Szefer
TL;DR
The paper investigates vulnerabilities of traffic sign classifiers to physically realizable, occlusion-based adversarial perturbations. It introduces the Snowball Adversarial Attack, which progressively accumulates snow-like occlusions to misclassify signs while remaining natural to human observers. A digital evaluation framework using Street View imagery and AI-generated snow patches demonstrates the attack's broad effectiveness across multiple sign types under a black-box threat model. These results highlight the need for robust, defense-aware traffic sign recognition systems in real-world autonomous driving scenarios.
Abstract
Adversarial attacks on machine learning models often rely on small, imperceptible perturbations to mislead classifiers. Such strategy focuses on minimizing the visual perturbation for humans so they are not confused, and also maximizing the misclassification for machine learning algorithms. An orthogonal strategy for adversarial attacks is to create perturbations that are clearly visible but do not confuse humans, yet still maximize misclassification for machine learning algorithms. This work follows the later strategy, and demonstrates instance of it through the Snowball Adversarial Attack in the context of traffic sign recognition. The attack leverages the human brain's superior ability to recognize objects despite various occlusions, while machine learning algorithms are easily confused. The evaluation shows that the Snowball Adversarial Attack is robust across various images and is able to confuse state-of-the-art traffic sign recognition algorithm. The findings reveal that Snowball Adversarial Attack can significantly degrade model performance with minimal effort, raising important concerns about the vulnerabilities of deep neural networks and highlighting the necessity for improved defenses for image recognition machine learning models.