ITPatch: An Invisible and Triggered Physical Adversarial Patch against Traffic Sign Recognition

2024-09-19

arXiv.org

AI Summary

Existing traffic sign recognition (TSR) systems are vulnerable to physical adversarial attacks, yet mainstream approaches—such as visible stickers, projected patterns, or invisible optical/acoustic signals—suffer from poor stealth, being easily detectable or obstructed. Method: We propose Fluorescent Invisible Patch (FIPatch), a physically realizable adversarial patch leveraging UV-excitable fluorescent ink to implement a trigger-based perturbation: fully invisible under ambient lighting, yet selectively activated under specific UV illumination to induce targeted misclassification. Contribution/Results: FIPatch introduces the first spatiotemporally controllable invisibility-trigger mechanism, overcoming the limitations of conventional persistent and indiscriminate adversarial patches. Through fluorescent material modeling, physical realizability optimization, multi-illumination robust training, and cross-model transfer strategies, FIPatch achieves a 98.31% attack success rate under low-light conditions and an average 96.72% evasion rate against five state-of-the-art defenses, demonstrating strong physical robustness and practical deployability.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Physical adversarial patches have emerged as a key adversarial attack to cause misclassification of traffic sign recognition (TSR) systems in the real world. However, existing adversarial patches have poor stealthiness and attack all vehicles indiscriminately once deployed. In this paper, we introduce an invisible and triggered physical adversarial patch (ITPatch) with a novel attack vector, i.e., fluorescent ink, to advance the state-of-the-art. It applies carefully designed fluorescent perturbations to a target sign, an attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially resulting in traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of ITPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.

Problem

• Developing stealthy adversarial patches using fluorescent ink to attack traffic sign recognition systems
• Modeling fluorescence effects to create misclassification under ultraviolet light triggers
• Achieving high attack success rates while bypassing multiple existing defense mechanisms

Innovation

• Uses fluorescent ink for stealthy adversarial patches
• Models fluorescence effect to guide real-world parameters
• Triggers misclassification with invisible ultraviolet light