# Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition

arXiv: https://arxiv.org/abs/2010.04331 · HTML: https://mlsanity.com/paper/2010.04331/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Oct 2020.

## Built on by (most cited first, 7 of 7)

- [Adversarial Attacks on Traffic Sign Recognition: A Survey](https://mlsanity.com/paper/2307.08278/) (2023)
- [Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey](https://mlsanity.com/paper/2303.06302/) (2023)
- [AICAttack: Adversarial Image Captioning Attack with Attention-Based Optimization](https://mlsanity.com/paper/2402.11940/) (2024)
- [The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition](https://mlsanity.com/paper/2409.12394/) (2024)
- [Consistent Valid Physically-Realizable Adversarial Attack against Crowd-flow Prediction Models](https://mlsanity.com/paper/2303.02669/) (2023)
- [Towards Unsupervised Graph Completion Learning on Graphs with Features and Structure Missing](https://mlsanity.com/paper/2309.02762/) (2023)
- [Evaluating Adversarial Attacks on Traffic Sign Classifiers beyond Standard Baselines](https://mlsanity.com/paper/2412.09150/) (2024)

## Abstract (arXiv)

Real world traffic sign recognition is an important step towards building autonomous vehicles, most of which highly dependent on Deep Neural Networks (DNNs). Recent studies demonstrated that DNNs are surprisingly susceptible to adversarial examples. Many attack methods have been proposed to understand and generate adversarial examples, such as gradient based attack, score based attack, decision based attack, and transfer based attacks. However, most of these algorithms are ineffective in real-world road sign attack, because (1) iteratively learning perturbations for each frame is not realistic for a fast moving car and (2) most optimization algorithms traverse all pixels equally without considering their diverse contribution. To alleviate these problems, this paper proposes the targeted attention attack (TAA) method for real world road sign attack. Specifically, we have made the following contributions: (1) we leverage the soft attention map to highlight those important pixels and skip those zero-contributed areas - this also helps to generate natural perturbations, (2) we design an efficient universal attack that optimizes a single perturbation/noise based on a set of training images under the guidance of the pre-trained attention map, (3) we design a simple objective function that can be easily optimized, (4) we evaluate the effectiveness of TAA on real world data sets. Experimental results validate that the TAA method improves the attack successful rate (nearly 10%) and reduces the perturbation loss (about a quarter) compared with the popular RP2 method. Additionally, our TAA also provides good properties, e.g., transferability and generalization capability. We provide code and data to ensure the reproducibility: https://github.com/AdvAttack/RoadSignAttack.