ML Security PapersTrapped by Their Own Light: Deployable and Stealth Retroreflective Patch Attacks on Traffic Sign Recognition Systems
Go Tsuruoka 1, Takami Sato 2, Qi Alfred Chen 1, Kazuki Nomoto 2, Ryunosuke Kobayashi 1, Yuna Tanaka 1, Tatsuya Mori 1,3,4
Published on arXiv
2511.10050
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
ARP achieves ≥93.4% attack success rate in dynamic scenarios at 35 meters and ≥60% success against commercial TSR systems, while user studies confirm near-identical stealthiness to benign signs and ≥1.9% higher stealthiness than prior patch attacks.
ARP (Adversarial Retroreflective Patch)
Novel technique introduced
Traffic sign recognition plays a critical role in ensuring safe and efficient transportation of autonomous vehicles but remain vulnerable to adversarial attacks using stickers or laser projections. While existing attack vectors demonstrate security concerns, they suffer from visual detectability or implementation constraints, suggesting unexplored vulnerability surfaces in TSR systems. We introduce the Adversarial Retroreflective Patch (ARP), a novel attack vector that combines the high deployability of patch attacks with the stealthiness of laser projections by utilizing retroreflective materials activated only under victim headlight illumination. We develop a retroreflection simulation method and employ black-box optimization to maximize attack effectiveness. ARP achieves $\geq$93.4\% success rate in dynamic scenarios at 35 meters and $\geq$60\% success rate against commercial TSR systems in real-world conditions. Our user study demonstrates that ARP attacks maintain near-identical stealthiness to benign signs while achieving $\geq$1.9\% higher stealthiness scores than previous patch attacks. We propose the DPR Shield defense, employing strategically placed polarized filters, which achieves $\geq$75\% defense success rates for stop signs and speed limit signs against micro-prism patches.
Key Contributions
- Adversarial Retroreflective Patch (ARP): a novel physical attack vector using retroreflective materials activated only by victim vehicle headlights, combining patch deployability with laser-projection stealthiness
- Retroreflection simulation method enabling black-box optimization of adversarial patches without physical fabrication during training
- DPR Shield defense using strategically placed polarized filters, achieving ≥75% defense success rate against micro-prism retroreflective patches on stop signs and speed limit signs
🛡️ Threat Analysis
Proposes adversarial physical patches (ARP) that cause misclassification in traffic sign recognition systems at inference time. Uses black-box optimization and a novel retroreflection simulation to craft patches activated only under headlight illumination. Physical adversarial patches are explicitly listed under ML01.