Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Street-Legal Physical-World Adversarial Rim for License Plates

Nikhil Kalidasu, Sahana Ganapathy

Abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.

Street-Legal Physical-World Adversarial Rim for License Plates

Abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.

Paper Structure

This paper contains 20 sections, 11 equations, 8 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Related Work
  4. Methods
  5. Data Collection and Preprocessing
  6. Patch Application
  7. Loss Function
  8. Gradient Descent
  9. Evaluation
  10. Physical World:
  11. Digital World:
  12. Distance Correlation Analysis:
  13. Results
  14. Physical World
  15. Digital World
  16. ...and 5 more sections

Figures (8)

  • Figure 1: Sample images from each lighting condition.
  • Figure 2: Final adversarial rims for disruption and impersonation objectives.
  • Figure 3: fast-alpr output on horizontal viewing angle test.
  • Figure 4: Detection model's confidence distributions under various lighting conditions.
  • Figure 5: Horizontal viewing-angle test results (metrics averaged over all lighting conditions).
  • ...and 3 more figures