Street-Legal Physical-World Adversarial Rim for License Plates
Not on the map. Why?
Abstract (arXiv)
Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under 100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 17 of its 42 references that are in the map. First posted on arXiv 2 Apr 2026.
Builds on
17 of 42 references.
References · 17
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Adversarial examples in the physical worldcited by 1,762
- 2017Adversarial Patchcited by 514
- 2024YOLOv9: Learning What You Want to Learn Using Programmable Gradient Informationcited by 422
- 2021Escaping the Big Data Paradigm with Compact Transformerscited by 261
- 2019Kornia: an Open Source Differentiable Computer Vision Library for PyTorchcited by 231
- 2016UnitBox: An Advanced Object Detection Networkcited by 205
- 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
- 2017Robust Physical-World Attacks on Deep Learning Modelscited by 70
- 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
- 2016Reading Car License Plates Using Deep Convolutional Neural Networks and LSTMscited by 9
5 more
- 2017License Plate Detection and Recognition Using Deeply Learned Convolutional Neural Networkscited by 6
- 2024Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detectioncited by 4
- 2019Spot Evasion Attacks: Adversarial Examples for License Plate Recognition Systems with Convolutional Neural Networkscited by 3
- 2023On the feasibility of attacking Thai LPR systems with adversarial examplescited by 1
- 2023Adversarial sample generation and training using geometric masks for accurate and resilient license plate character recognitioncited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026AD2: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systems
- 2025Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
- 2026AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving
- 2024Towards Transferable Attacks Against Vision-LLMs in Autonomous Driving with Typography
- 2025Mitigation of Camouflaged Adversarial Attacks in Autonomous Vehicles--A Case Study Using CARLA Simulator
- 2025PhysPatch: A Physically Realizable and Transferable Adversarial Patch Attack for Multimodal Large Language Models-based Autonomous Driving Systems
- 2024Searching Realistic-Looking Adversarial Objects For Autonomous Driving Systems
- 2022Evaluating Automated Driving Planner Robustness against Adversarial Influence