Trapped by Their Own Light: Deployable and Stealth Retroreflective Patch Attacks on Traffic Sign Recognition Systems

2025-11-13

AI Summary

Traffic sign recognition (TSR) systems are vulnerable to physical adversarial attacks; however, existing sticker-based attacks suffer from high visibility, while laser-based attacks face practical deployment challenges. This paper proposes the Retroreflective Adversarial Patch (ARP), which exploits the selective activation of retroreflective materials under vehicle headlight illumination—thereby unifying the deployability of stickers with the stealthiness of laser attacks and opening a novel physical-layer attack surface. We develop a retroreflection-aware simulation model and employ black-box optimization to generate robust patches, and further propose DPR Shield, a defense mechanism based on polarization filtering. Experiments demonstrate an attack success rate exceeding 93.4% in dynamic scenarios at 35 meters, and over 60% on commercial TSR systems. User studies confirm ARP’s significantly enhanced stealth compared to conventional sticker attacks. This work uncovers a previously unrecognized vulnerability in TSR systems’ photometric response mechanisms and provides a rigorously validated attack-defense framework.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents
• Search and Optimization: Adversarial Search

Application Category

• Search and Retrieval-Augmented AI: Ad search and search for Web retail
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

Traffic sign recognition plays a critical role in ensuring safe and efficient transportation of autonomous vehicles but remain vulnerable to adversarial attacks using stickers or laser projections. While existing attack vectors demonstrate security concerns, they suffer from visual detectability or implementation constraints, suggesting unexplored vulnerability surfaces in TSR systems. We introduce the Adversarial Retroreflective Patch (ARP), a novel attack vector that combines the high deployability of patch attacks with the stealthiness of laser projections by utilizing retroreflective materials activated only under victim headlight illumination. We develop a retroreflection simulation method and employ black-box optimization to maximize attack effectiveness. ARP achieves $geq$93.4% success rate in dynamic scenarios at 35 meters and $geq$60% success rate against commercial TSR systems in real-world conditions. Our user study demonstrates that ARP attacks maintain near-identical stealthiness to benign signs while achieving $geq$1.9% higher stealthiness scores than previous patch attacks. We propose the DPR Shield defense, employing strategically placed polarized filters, which achieves $geq$75% defense success rates for stop signs and speed limit signs against micro-prism patches.

Problem

• Developing stealthy adversarial attacks on traffic sign recognition systems
• Creating deployable retroreflective patches activated by vehicle headlights
• Addressing vulnerabilities in autonomous vehicle safety systems

Innovation

• Retroreflective materials activated by headlight illumination
• Black-box optimization for maximizing attack effectiveness
• Polarized filters as strategic defense against patches