# Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

arXiv: https://arxiv.org/abs/2407.07510 · HTML: https://mlsanity.com/paper/2407.07510/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 54 references that are in the map.
- First posted on arXiv 10 Jul 2024.

## Builds on (most cited first, 14 of 14)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [You Only Look Once: Unified, Real-Time Object Detection](https://mlsanity.com/paper/1506.02640/) (2015)
- [ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models](https://mlsanity.com/paper/1708.03999/) (2017)
- [Delving into Transferable Adversarial Examples and Black-box Attacks](https://mlsanity.com/paper/1611.02770/) (2016)
- [Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks](https://mlsanity.com/paper/1904.02884/) (2019)
- [AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks](https://mlsanity.com/paper/1805.11770/) (2018)
- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack](https://mlsanity.com/paper/2009.06701/) (2020)
- [DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems](https://mlsanity.com/paper/1812.10812/) (2018)
- [SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations](https://mlsanity.com/paper/2007.04137/) (2020)
- [Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect](https://mlsanity.com/paper/2011.13375/) (2020)
- [They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors](https://mlsanity.com/paper/2101.10011/) (2021)
- [Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems](https://mlsanity.com/paper/2009.06996/) (2020)
- [Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception](https://mlsanity.com/paper/2401.03582/) (2024)

## Built on by (most cited first, 5 of 5)

- [Temperature Scaling Attack Disrupting Model Confidence in Federated Learning](https://mlsanity.com/paper/2602.06638/) (2026)
- [Robust Vision Systems for Connected and Autonomous Vehicles: Security Challenges and Attack Vectors](https://mlsanity.com/paper/2602.09740/) (2026)
- [Physically Real-time Infrared Attack against Optical Flow Estimation Networks](https://mlsanity.com/paper/2607.26651/) (2026)
- [AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving](https://mlsanity.com/paper/2608.16031/) (2026)
- [Adversarial Calibration Attack on Autonomous Vehicles](https://mlsanity.com/paper/2608.28778/) (2026)

## Abstract (arXiv)

Camera-based computer vision is essential to autonomous vehicle's perception. This paper presents an attack that uses light-emitting diodes and exploits the camera's rolling shutter effect to create adversarial stripes in the captured images to mislead traffic sign recognition. The attack is stealthy because the stripes on the traffic sign are invisible to human. For the attack to be threatening, the recognition results need to be stable over consecutive image frames. To achieve this, we design and implement GhostStripe, an attack system that controls the timing of the modulated light emission to adapt to camera operations and victim vehicle movements. Evaluated on real testbeds, GhostStripe can stably spoof the traffic sign recognition results for up to 94% of frames to a wrong class when the victim vehicle passes the road section. In reality, such attack effect may fool victim vehicles into life-threatening incidents. We discuss the countermeasures at the levels of camera sensor, perception model, and autonomous driving system.