Research map / Adversarial robustness and security / Attacks on text and graphs
The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FIPatch, a black-box physical adversarial attack on traffic sign recognition that uses UV-triggered fluorescent ink patches, optimized with PSO and EOT, and evaluated on detectors and classifiers in simulation and a real Tesla setup.
Problem
Physical adversarial attacks on traffic sign recognition (TSR) are either visible (stickers, projections, lasers), easily blocked (IR filters, acoustic protection), or easily tracked, so they are poorly stealthy or easily countered.
Approach
Use transparent fluorescent ink applied to the sign, invisible when untriggered and activated by UV light so its emission falls in the visible spectrum; model fluorescence as parameterized circles (position, radius, color, opacity) in LAB space and optimize them with PSO under goal-based losses and EOT transformations.
Key results
- Physical-world generative attack on Yolov3 reaches 98.31% ASR at 200 lux, and misrecognition attacks reach 100% on ResNet50 and GoogleNet at 200 lux.
- Hiding attack on Faster R-CNN drops to 25.92% at 3000 lux, showing strong dependence on ambient light.
- Under five defenses, misrecognition ASR stays high (at least 96.72% for defensive dropout), with image smoothing and input randomization changing ASR by under about 1-2%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| increase ambient light from 200 lux to 3000 lux | FIPatch hiding attack on Yolov3 · Physical world | ASR: 91.59% -> 31.48% | Hurt |
| increase ambient light from 200 lux to 3000 lux | FIPatch hiding attack on Faster R-CNN · Physical world | ASR: 87.81% -> 25.92% | Hurt |
| increase the number of circles from 1 to 3 (ablation) | FIPatch on ResNet50 · Digital-world misrecognition attack | ASR: 88.42% -> 96.41% | Helped |
| increase the number of circles from 1 to 5 (ablation) | FIPatch on Inception v3 · Digital-world misrecognition attack | ASR: 49.26% -> 78.26% | Helped |
| increase the number of circles (ablation) | FIPatch across digital-world classifiers · Digital-world misrecognition attack | ASR: 96.11% -> 94.19%; 95.60% -> 89.10% | Mixed |
| use a larger fluorescent ink radius (ablation) | FIPatch · Digital-world misrecognition attack | ASR | Helped |
| use black rather than the higher-performing tested colors (ablation) | FIPatch · Digital-world misrecognition attack | ASR | Hurt |
| place perturbations in the center rather than at the image edges (ablation) | FIPatch · Digital-world misrecognition attack | ASR | Helped |
| use circles rather than straight or curved lines (ablation) | FIPatch · Digital-world misrecognition attack | ASR: below 60% | Helped |
| add image smoothing defense | FIPatch on ResNet50 · Digital-world misrecognition attack | ASR: 99.47% -> 98.54%(-0.93%) | Hurt |
| add feature compression defense | FIPatch on ResNet50 · Digital-world misrecognition attack | ASR: 99.47% -> 97.82%(-1.65%) | Hurt |
| add input randomization defense | FIPatch on ResNet50 · Digital-world misrecognition attack | ASR: 99.47% -> 99.18%(-0.29%) | No clear effect |
Surprising findings
- Adversarial training does not significantly reduce the attack's success, attributed to attackers varying colors and positions.
- Faster R-CNN is more robust than Yolov3 to the physical attack, and ASR falls sharply with ambient light for hiding attacks.
Limitations
- Outdoor experiments assess only the AI component level, not the full autonomous vehicle system.
- Ambient light affects different attack goals in varying ways, reducing hiding attack effectiveness in bright conditions.
- Feasibility of fluorescence on curved surfaces and object detection systems is not addressed.
Experimental setup
Datasets: GTSRB CTSRD COCO
Benchmarks: GTSRB CTSRD
Metrics: attack success rate
Baselines: Yolov3 (hiding/generative baseline comparison across detectors) Faster R-CNN Image smoothing Feature compression Input randomization Adversarial training Defensive dropout
Builds on: expectation over transformation particle swarm optimization defensive dropout
Closest papers by meaning
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.80)
- Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition (ICML 2025 · similarity 0.80)
- ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector (CVPR 2025 · similarity 0.79)
- Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.79)
- CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors (NeurIPS 2024 · similarity 0.79)
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.