FIGhost: Fluorescent Ink-based Stealthy and Flexible Backdoor Attacks on Physical Traffic Sign Recognition

2025-05-17

AI Summary

Traffic sign recognition (TSR) systems are vulnerable to physical-world backdoor attacks that suffer from poor stealth, limited controllability, and incompatibility with vision-language models (VLMs). Method: This paper proposes the first fluorescent-ink-based physical backdoor attack. It employs ultraviolet (UV)-activated, human-invisible fluorescent triggers, integrated with graffiti-inspired trigger shapes, interpolation-based fluorescence simulation, and an automated sample generation framework to enable multi-target attacks. Contribution/Results: By incorporating fluorescent imaging modeling, physical robustness enhancement, and VLM-adaptive strategies, our approach achieves >92% attack success rate in real-world traffic scenarios. It effectively evades state-of-the-art backdoor detectors and VLM-based defenses while ensuring high stealth, strong environmental robustness (e.g., under varying illumination, weather, and viewing angles), and forensic untraceability.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Calibration & Uncertainty Quantification
• Intelligent Robots: Multimodal Perception & Sensor Fusion

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Traffic sign recognition (TSR) systems are crucial for autonomous driving but are vulnerable to backdoor attacks. Existing physical backdoor attacks either lack stealth, provide inflexible attack control, or ignore emerging Vision-Large-Language-Models (VLMs). In this paper, we introduce FIGhost, the first physical-world backdoor attack leveraging fluorescent ink as triggers. Fluorescent triggers are invisible under normal conditions and activated stealthily by ultraviolet light, providing superior stealthiness, flexibility, and untraceability. Inspired by real-world graffiti, we derive realistic trigger shapes and enhance their robustness via an interpolation-based fluorescence simulation algorithm. Furthermore, we develop an automated backdoor sample generation method to support three attack objectives. Extensive evaluations in the physical world demonstrate FIGhost's effectiveness against state-of-the-art detectors and VLMs, maintaining robustness under environmental variations and effectively evading existing defenses.

Problem

• Stealthy backdoor attacks on traffic sign recognition systems
• Flexible attack control using fluorescent ink triggers
• Robustness against environmental variations and existing defenses

Innovation

• Uses fluorescent ink as invisible triggers
• Employs interpolation-based fluorescence simulation
• Automates backdoor sample generation for attacks