# They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors

arXiv: https://arxiv.org/abs/2101.10011 · HTML: https://mlsanity.com/paper/2101.10011/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 66 references that are in the map.
- First posted on arXiv 25 Jan 2021.

## Builds on (most cited first, 25 of 25)

- [Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks](https://mlsanity.com/paper/1506.01497/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Mask R-CNN](https://mlsanity.com/paper/1703.06870/) (2017)
- [SSD: Single Shot MultiBox Detector](https://mlsanity.com/paper/1512.02325/) (2015)
- [CARLA: An Open Urban Driving Simulator](https://mlsanity.com/paper/1711.03938/) (2017)
- [BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning](https://mlsanity.com/paper/1805.04687/) (2018)
- [Empirical Evaluation of Rectified Activations in Convolutional Network](https://mlsanity.com/paper/1505.00853/) (2015)
- [R-FCN: Object Detection via Region-based Fully Convolutional Networks](https://mlsanity.com/paper/1605.06409/) (2016)
- [High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks](https://mlsanity.com/paper/1905.13545/) (2019)
- [Physical Adversarial Examples for Object Detectors](https://mlsanity.com/paper/1807.07769/) (2018)
- [ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector](https://mlsanity.com/paper/1804.05810/) (2018)
- [Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving](https://mlsanity.com/paper/1907.06826/) (2019)
- [Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures](https://mlsanity.com/paper/2006.16974/) (2020)
- [DolphinAtack: Inaudible Voice Commands](https://mlsanity.com/paper/1708.09537/) (2017)
- [On the Suitability of Lp-norms for Creating and Preventing Adversarial Examples](https://mlsanity.com/paper/1802.09653/) (2018)
- [SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations](https://mlsanity.com/paper/2007.04137/) (2020)
- [Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect](https://mlsanity.com/paper/2011.13375/) (2020)
- [Invisible Mask: Practical Attacks on Face Recognition with Infrared](https://mlsanity.com/paper/1803.04683/) (2018)
- [Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems](https://mlsanity.com/paper/2006.11946/) (2020)
- [Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems](https://mlsanity.com/paper/2009.06996/) (2020)
- [Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating](https://mlsanity.com/paper/1905.09162/) (2019)
- [MobilBye: Attacking ADAS with Camera Spoofing](https://mlsanity.com/paper/1906.09765/) (2019)
- [GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems](https://mlsanity.com/paper/2001.07792/) (2020)
- [Trick or Heat? Manipulating Critical Temperature-Based Control Systems Using Rectification Attacks](https://mlsanity.com/paper/1904.07110/) (2019)
- [Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses](https://mlsanity.com/paper/1901.06935/) (2019)

## Built on by (most cited first, 17 of 17)

- [SoK: On the Semantic AI Security in Autonomous Driving](https://mlsanity.com/paper/2203.05314/) (2022)
- [Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition](https://mlsanity.com/paper/2204.02675/) (2022)
- [Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception](https://mlsanity.com/paper/2401.03582/) (2024)
- [State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems](https://mlsanity.com/paper/2303.12249/) (2023)
- [Signal Injection Attacks against CCD Image Sensors](https://mlsanity.com/paper/2108.08881/) (2021)
- [Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective](https://mlsanity.com/paper/2409.09860/) (2024)
- [Enhancing LLM-based Autonomous Driving Agents to Mitigate Perception Attacks](https://mlsanity.com/paper/2409.14488/) (2024)
- [What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?](https://mlsanity.com/paper/2602.17345/) (2026)
- [Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles](https://mlsanity.com/paper/2407.07510/) (2024)
- [Understanding Impacts of Electromagnetic Signal Injection Attacks on Object Detection](https://mlsanity.com/paper/2407.16327/) (2024)
- [RIFLE: Removal of Image Flicker-Banding via Latent Diffusion Enhancement](https://mlsanity.com/paper/2509.24644/) (2025)
- [Why Don't You Clean Your Glasses? Perception Attacks with Dynamic Optical Perturbations](https://mlsanity.com/paper/2307.13131/) (2023)
- [A Simulation Framework for Electromagnetic Signal Injection Attacks on Image Sensors](https://mlsanity.com/paper/2408.05124/) (2024)
- [In-Pixel Foreground and Contrast Enhancement Circuits with Customizable Mapping](https://mlsanity.com/paper/2410.18052/) (2024)
- [Side Eye: Characterizing the Limits of POV Acoustic Eavesdropping from Smartphone Cameras with Rolling Shutters and Movable Lenses](https://mlsanity.com/paper/2301.10056/) (2023)
- [Imperceptible CMOS camera dazzle for adversarial attacks on deep neural networks](https://mlsanity.com/paper/2311.16118/) (2023)
- [Intentional Electromagnetic Interference Attacks on Facial Recognition](https://mlsanity.com/paper/2607.15512/) (2026)

## Abstract (arXiv)

In this paper, we describe how the electronic rolling shutter in CMOS image sensors can be exploited using a bright, modulated light source (e.g., an inexpensive, off-the-shelf laser), to inject fine-grained image disruptions. We demonstrate the attack on seven different CMOS cameras, ranging from cheap IoT to semi-professional surveillance cameras, to highlight the wide applicability of the rolling shutter attack. We model the fundamental factors affecting a rolling shutter attack in an uncontrolled setting. We then perform an exhaustive evaluation of the attack's effect on the task of object detection, investigating the effect of attack parameters. We validate our model against empirical data collected on two separate cameras, showing that by simply using information from the camera's datasheet the adversary can accurately predict the injected distortion size and optimize their attack accordingly. We find that an adversary can hide up to 75% of objects perceived by state-of-the-art detectors by selecting appropriate attack parameters. We also investigate the stealthiness of the attack in comparison to a na"ive camera blinding attack, showing that common image distortion metrics can not detect the attack presence. Therefore, we present a new, accurate and lightweight enhancement to the backbone network of an object detector to recognize rolling shutter attacks. Overall, our results indicate that rolling shutter attacks can substantially reduce the performance and reliability of vision-based intelligent systems.