Abstract:Traffic Sign Recognition (TSR) is crucial for safe and correct driving automation. Recent works revealed a general vulnerability of TSR models to physical-world adversarial attacks, which can be low-cost, highly deployable, and capable of causing severe attack effects such as hiding a critical traffic sign or spoofing a fake one. However, so far existing works generally only considered evaluating the attack effects on academic TSR models, leaving the impacts of such attacks on real-world commercial TSR systems largely unclear. In this paper, we conduct the first large-scale measurement of physical-world adversarial attacks against commercial TSR systems. Our testing results reveal that it is possible for existing attack works from academia to have highly reliable (100\%) attack success against certain commercial TSR system functionality, but such attack capabilities are not generalizable, leading to much lower-than-expected attack success rates overall. We find that one potential major factor is a spatial memorization design that commonly exists in today's commercial TSR systems. We design new attack success metrics that can mathematically model the impacts of such design on the TSR system-level attack success, and use them to revisit existing attacks. Through these efforts, we uncover 7 novel observations, some of which directly challenge the observations or claims in prior works due to the introduction of the new metrics.

What problem does this paper attempt to address?

### What problem does this paper attempt to solve? This paper aims to systematically answer a key research question: Can the existing traffic sign recognition (TSR) adversarial attacks in the physical world have a general impact on commercial TSR systems? Specifically, the paper reveals the effectiveness and limitations of these attacks in practical applications by conducting large - scale tests on the performance of existing adversarial attacks on commercial TSR systems. #### Specific problem description 1. **Limitations of existing research**: - Existing work mainly evaluates the effectiveness of adversarial attacks on academic models, ignoring the impact on commercial TSR systems in the real world. - Although some studies show that these attacks can achieve a high success rate on academic models, their effectiveness on commercial systems is still unclear. 2. **Unique challenges of commercial systems**: - Commercial TSR systems usually have more complex designs and higher robustness, which may cause the attack methods on academic models to fail on commercial systems. - Commercial systems may adopt some specific designs, such as spatial memorization, which further affects the success rate of attacks. 3. **Differences in evaluation metrics**: - Existing attack success rate evaluation metrics are mainly based on the model - level effect, ignoring the actual impact at the system level. - The spatial memorization design in commercial systems may lead to significant differences in attack effectiveness between the model level and the system level. #### Main contributions of the paper 1. **First large - scale commercial system measurement**: - The paper conducts the first large - scale physical - world adversarial attack test, covering four different brands of commercial vehicles, ensuring the representativeness of the test results. - The test results show that although some attacks can achieve a 100% success rate in specific functions, these attack capabilities are not universal, and the overall black - box transfer attack success rate is far lower than expected. 2. **Discover and analyze spatial memorization design**: - Discover a spatial memorization design that is commonly found in commercial TSR systems. This design will continuously remember the position and type of traffic signs after detection until the corresponding reaction tasks are completed. - This finding reveals how the spatial memorization design significantly affects the success rate of adversarial attacks and explains why the attack effects on academic models are difficult to directly apply to commercial systems. 3. **New attack success rate metric design**: - Propose a new attack success rate metric method that can systematically consider the spatial memorization effect, thereby more accurately evaluating the success rates of hidden attacks and emerging attacks. - Re - evaluate existing attacks using these new metric methods and discover 7 new observations, some of which directly challenge the conclusions of previous work. 4. **New observations and insights**: - Through commercial TSR system measurement, new metric design and analysis, the paper reveals many new observations, including a significant drop in the success rate of some attacks after considering spatial memorization. - The new metric method shows that some previously considered effective attacks are actually almost ineffective on commercial systems, which provides an important reference for future attack design and defense strategies. In summary, this paper reveals the limitations of existing physical - world TSR adversarial attacks on commercial systems through systematic experiments and analysis, and proposes new ideas for improving evaluation methods.

Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective

Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack

Adversarial Robustness Analysis of LiDAR-included Models in Autonomous Driving

Adversarial Attacks on Traffic Sign Recognition: A Survey

Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition

Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

Stealthy and Effective Physical Adversarial Attacks in Autonomous Driving

Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

Physical Adversarial Attacks on Deep Neural Networks for Traffic Sign Recognition: A Feasibility Study

Practical black-box adversarial attack on open-set recognition: Towards robust autonomous driving

Targeted Attention Attack on Deep Learning Models in Road Sign Recognition

ITPatch: An Invisible and Triggered Physical Adversarial Patch against Traffic Sign Recognition

Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles

Exploring the Physical World Adversarial Robustness of Vehicle Detection

SITAR: Evaluating the Adversarial Robustness of Traffic Light Recognition in Level-4 Autonomous Driving

Physical Adversarial Attacks for Surveillance: A Survey

Dynamic Adversarial Attacks on Autonomous Driving Systems

A Reliable Approach for Generating Realistic Adversarial Attack via Trust Region-Based Optimization

ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving

Detection of Adversarial Physical Attacks in Time-Series Image Data