The Spectrum Strikes Back: Infrared POV Attacks on Traffic Sign Classification

2026-06-29

AI Summary

This work proposes a novel, stealthy physical adversarial attack on traffic signs that overcomes the limitations of existing methods, which typically rely on visible perturbations that are easily detectable and lack dynamic adaptability. By leveraging near-infrared (NIR) spectral illumination and the persistence of vision effect, the approach achieves human-imperceptible, remotely controllable, and dynamically reconfigurable attacks for the first time. The system integrates an NIR LED array, persistence-of-vision display, digitally optimized simulation, NIR-cut filters, and a tailored detection algorithm. Evaluated under diverse lighting conditions within a 20-meter range, it demonstrates high attack success rates against twelve deep learning models and two types of traffic signs. Furthermore, the study validates the effectiveness of a co-designed hardware-software defense mechanism against such adversarial threats.

Abstract

Traffic sign classification is a crucial task for autonomous vehicles, and numerous attacks against it have been identified. A majority of physical adversarial attacks involve attaching patches to traffic signs or projecting perturbations on them. While they demonstrate high effectiveness, they are perceptible to humans. At the same time, light-based attacks outside the human visible spectrum are known but have limitations in their dynamic adaptability. We propose a persistence-of-vision-based attack that operates in the near-infrared light spectrum. With the possibility of showing dynamic, remotely triggered content, this allows a stealthy physical adversarial attack against traffic sign classification. By identifying the optimal position through digital simulation, we conduct extensive real-world evaluations using two different traffic signs, 12 machine learning models from different families, multiple distances up to 20 meters, and varying illumination conditions. Our evaluation shows high attack success rates across our test scenarios. We propose near-infrared cutoff filters and a software-based detection mechanism as defenses, and tackle limitations of the near-infrared persistence of vision display by prototyping a human-visible RGB version of it.

Problem

• adversarial attack
• traffic sign classification
• near-infrared
• physical attack
• stealthy

Innovation

• infrared
• persistence-of-vision
• physical adversarial attack
• traffic sign classification
• stealthy attack