mlsanityData to 7 Oct 2026

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

arXiv 2407.07510 ↗First posted 10 Jul 2024cs.CR cs.CV cs.SYcited by 5

Not on the map. Why?

Abstract (arXiv)

Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 14 of its 54 references that are in the map. First posted on arXiv 10 Jul 2024.

Builds on

14 of 54 references.

References · 14

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  3. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  5. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  6. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  7. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  8. 2020Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attackcited by 64
  9. 2018DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systemscited by 50
  10. 2020SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbationscited by 50
  11. 2020Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effectcited by 40
  12. 2021They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensorscited by 17
2 more
  1. 2024Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perceptioncited by 14
  2. 2020Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systemscited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026Temperature Scaling Attack Disrupting Model Confidence in Federated Learningcited by 0
  2. 2026Robust Vision Systems for Connected and Autonomous Vehicles: Security Challenges and Attack Vectorscited by 0
  3. 2026Physically Real-time Infrared Attack against Optical Flow Estimation Networkscited by 0
  4. 2026AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Drivingcited by 0
  5. 2026Adversarial Calibration Attack on Autonomous Vehiclescited by 0