Traffic-Sign Recognition (TSR) is a critical safety component for autonomous driving. Unfortunately, however, past work has highlighted the vulnerability of TSR models to physical-world attacks, through low-cost, easily deployable adversarial patches leading to misclassification. To mitigate these threats, most defenses focus on altering the training process or modifying the inference procedure. Still, while these approaches improve adversarial robustness, TSR remains susceptible to attacks attaining substantial success rates.
To further the adversarial robustness of TSR, this work offers a novel approach that redefines traffic-sign designs to create signs that promote robustness while remaining interpretable to humans. Our framework takes three inputs: (1) A traffic-sign standard along with modifiable features and associated constraints; (2) A state-of-the-art adversarial training method; and (3) A function for efficiently synthesizing realistic traffic-sign images. Using these user-defined inputs, the framework emits an optimized traffic-sign standard such that traffic signs generated per this standard enable training TSR models with increased adversarial robustness.
We evaluate the effectiveness of our framework via a concrete implementation, where we allow modifying the pictograms (i.e., symbols) and colors of traffic signs. The results show substantial improvements in robustness -- with gains of up to 16.33%--24.58% in robust accuracy over state-of-the-art methods -- while benign accuracy is even improved. Importantly, a user study also confirms that the redesigned traffic signs remain easily recognizable and to human observers. Overall, the results highlight that carefully redesigning traffic signs can significantly enhance TSR system robustness without compromising human interpretability.
Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors
Karlsruhe Institute of Technology (KIT)（卡尔斯鲁厄理工学院）；Department of Technical Cognitive Systems（技术认知系统系）；FZI Research Center for Information Technology（信息技术研究所以）
The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition
University of Electronic Science and Technology of China（电子科学与技术大学）；Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；City University of Hong Kong（香港城市大学）；King Abdullah University of Science and Technology（卡布斯大学）
Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detection
Department of Computing Sciences, University of Hartford（计算科学系，哈特福大学）；Department of Electrical and Computer Engineering, Tennessee Technological University（电气与计算机工程系，田纳西技术大学）；Center for Manufacturing Research, Tennessee Technological University（制造研究中心，田纳西技术大学）
Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attacks
Institute of Computing Technology, CAS（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Cambricon Technologies（寒武纪科技）；Drexel University（德雷塞尔大学）；Northeastern University（东北大学）
Beyond Crash: Hijacking Your Autonomous Vehicle for Fun and Profit
Johns Hopkins University（约翰斯·霍普金斯大学）；Johns Hopkins University Applied Physics Laboratory（约翰斯·霍普金斯大学应用物理实验室）；University of California, Santa Cruz（加州大学圣克鲁兹分校）
The Earth ain't Flat: Monocular Reconstruction of Vehicles on Steep and Graded Roads from a Moving Camera
Robotics Research Center, KCIS, IIIT Hyderabad（印度海得拉巴国际信息技术研究所 KCIS 机器人研究中心）；Montreal Institute of Learning Algorithms (MILA), Universite de Montreal（蒙特利尔大学蒙特利尔学习算法研究所）
PrismWF: A Multi-Granularity Patch-Based Transformer for Robust Website Fingerprinting Attack
Hong Kong University of Science and Technology（香港科技大学）；Xidian University（西安电子科技大学）；Southeast University（东南大学）；Huazhong University of Science and Technology（华中科技大学）
University of California, Irvine（加利福尼亚大学尔湾分校）；University of Florida（佛罗里达大学）；Toyota InfoTech Labs（丰田信息技术实验室）；The University of Electro-Communications（电气通信大学）
