The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition

Hongwei Li (University of Electronic Science and Technology of China, Tsinghua University) · Yuguang Fang (City University of Hong Kong) · Shuai Yuan (The University of Hong Kong) · Xingshuo Han · Guowen Xu (University of Electronic Science and Technology of China) · Wenbo Jiang (University of Electronic Science and Technology of China) · Tao Ni (King Abdullah University of Science and Technology) · Qingchuan Zhao (City University of Hong Kong)

adversarial patchcomprehensive evaluationdefense bypassingdigital domain modelingfluorescence effectfluorescence parametersfluorescent inklow-light conditionsmisclassificationoptimal attack settingsperturbation designphysical adversarial attackstraffic accidentstraffic sign recognitionultraviolet light

Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.