# Fooling a Real Car with Adversarial Traffic Signs

arXiv: https://arxiv.org/abs/1907.00374 · HTML: https://mlsanity.com/paper/1907.00374/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Jun 2019.

## Built on by (most cited first, 29 of 29)

- [Explainability of deep vision-based autonomous driving systems: Review and challenges](https://mlsanity.com/paper/2101.05307/) (2021)
- [Explainable Artificial Intelligence (XAI) on TimeSeries Data: A Survey](https://mlsanity.com/paper/2104.00950/) (2021)
- [Optical Adversarial Attack](https://mlsanity.com/paper/2108.06247/) (2021)
- [Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective](https://mlsanity.com/paper/2210.04213/) (2022)
- [Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems](https://mlsanity.com/paper/2201.06192/) (2022)
- [A Survey on Physical Adversarial Attack in Computer Vision](https://mlsanity.com/paper/2209.14262/) (2022)
- [Adversarial Safety-Critical Scenario Generation using Naturalistic Human Driving Priors](https://mlsanity.com/paper/2408.03200/) (2024)
- [Exploiting epistemic uncertainty of the deep learning models to generate adversarial samples](https://mlsanity.com/paper/2102.04150/) (2021)
- [Adversarial Attacks on Traffic Sign Recognition: A Survey](https://mlsanity.com/paper/2307.08278/) (2023)
- [Improving Adversarial Robustness by Putting More Regularizations on Less Robust Samples](https://mlsanity.com/paper/2206.03353/) (2022)
- [Exact Spectral Norm Regularization for Neural Networks](https://mlsanity.com/paper/2206.13581/) (2022)
- [ZeBRA: Precisely Destroying Neural Networks with Zero-Data Based Repeated Bit Flip Attack](https://mlsanity.com/paper/2111.01080/) (2021)
- [Explainable and Trustworthy Traffic Sign Detection for Safe Autonomous Driving: An Inductive Logic Programming Approach](https://mlsanity.com/paper/2309.03215/) (2023)
- [Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairness](https://mlsanity.com/paper/2403.14641/) (2024)
- [Holistic Approach to Measure Sample-level Adversarial Vulnerability and its Utility in Building Trustworthy Systems](https://mlsanity.com/paper/2205.02604/) (2022)
- [Distribution-restrained Softmax Loss for the Model Robustness](https://mlsanity.com/paper/2303.12363/) (2023)
- [Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attacks](https://mlsanity.com/paper/2404.15881/) (2024)
- [Learning Fair Robustness via Domain Mixup](https://mlsanity.com/paper/2411.14424/) (2024)
- [Towards Fair Class-wise Robustness: Class Optimal Distribution Adversarial Training](https://mlsanity.com/paper/2501.04527/) (2025)
- [Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification](https://mlsanity.com/paper/2104.02155/) (2021)
- [Unreasonable Effectiveness of Last Hidden Layer Activations for Adversarial Robustness](https://mlsanity.com/paper/2202.07342/) (2022)
- [Semantic Preserving Adversarial Attack Generation with Autoencoder and Genetic Algorithm](https://mlsanity.com/paper/2208.12230/) (2022)
- [Attacking Motion Planners Using Adversarial Perception Errors](https://mlsanity.com/paper/2311.12722/) (2023)
- [DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies](https://mlsanity.com/paper/2408.08489/) (2024)
- [Experiments in Autonomous Driving Through Imitation Learning](https://mlsanity.com/paper/2011.12460/) (2020)
- [Towards interpreting computer vision based on transformation invariant optimization](https://mlsanity.com/paper/2106.09982/) (2021)
- [Dealing with Adversarial Player Strategies in the Neural Network Game iNNk through Ensemble Learning](https://mlsanity.com/paper/2107.02052/) (2021)
- [Scalable Whitebox Attacks on Tree-based Models](https://mlsanity.com/paper/2204.00103/) (2022)
- [PaniCar: Securing the Perception of Advanced Driving Assistance Systems Against Emergency Vehicle Lighting](https://mlsanity.com/paper/2505.05183/) (2025)

## Abstract (arXiv)

The attacks on the neural-network-based classifiers using adversarial images have gained a lot of attention recently. An adversary can purposely generate an image that is indistinguishable from a innocent image for a human being but is incorrectly classified by the neural networks. The adversarial images do not need to be tuned to a particular architecture of the classifier - an image that fools one network can fool another one with a certain success rate.The published works mostly concentrate on the use of modified image files for attacks against the classifiers trained on the model databases. Although there exists a general understanding that such attacks can be carried in the real world as well, the works considering the real-world attacks are scarce. Moreover, to the best of our knowledge, there have been no reports on the attacks against real production-grade image classification systems.In our work we present a robust pipeline for reproducible production of adversarial traffic signs that can fool a wide range of classifiers, both open-source and production-grade in the real world. The efficiency of the attacks was checked both with the neural-network-based classifiers and legacy computer vision systems. Most of the attacks have been performed in the black-box mode, e.g. the adversarial signs produced for a particular classifier were used to attack a variety of other classifiers. The efficiency was confirmed in drive-by experiments with a production-grade traffic sign recognition systems of a real car.