Paper accepted at NDSS 2027: “Hidden in Plain Signs”
Traffic Sign Recognition (TSR) is a safety-critical component widely deployed in modern cars to provide driver assistance and, increasingly, to support automated driving. In parallel, urban environments have normalized the presence of stickers and other artistic modifications on traffic signs, making them commonplace and rarely perceived as suspicious. This coexistence creates a realistic attack surface. Existing adversarial attacks against TSR are rarely validated on production vehicles, often require expensive or conspicuous equipment, are frequently inconsistent with realistic perturbations, and typically target a narrow range of sign categories.
This work proposes a black-box adversarial pipeline that leverages realistic urban sticker designs to induce misclassification and disappearance in neural network-based TSR systems. The method identifies sensitive regions on a target sign, selects stickers from a pre-defined pool, and iteratively optimizes their placement using an ensemble of state-of-the-art surrogate detectors within a high-fidelity rendering engine that simulates diverse driving conditions. The approach is evaluated on two distinct training datasets targeting 11 sign categories, and validated through extensive real-world experiments on five commercial vehicles equipped with TSR systems. Across these vehicles, the proposed approach induces incorrect detections in 62% of cases on average, significantly outperforming state-of-the-art baselines, which reach only 19%. A human perception survey with over 100 participants further suggests that the perturbations are perceived as plausible urban artifacts, ensuring operational stealth. These findings demonstrate that adversarial examples extend beyond controlled laboratory settings and pose a credible, concrete, low-cost threat to real-world driving safety. This work is an international collaboration with Politecnico di Milano; the research theme was conceived during the sabbatical stay of Prof. Mori at Politecnico di Milano in 2024. The paper will be presented at NDSS 2027 in Seoul in March 2027.
[Paper]
Luigi Bruzzese, Francesco Panebianco, Tatsuya Mori, Michele Carminati, Stefano Zanero, Stefano Longari, “Hidden in Plain Signs: Realistic Sticker Attacks on Production Traffic Sign Recognition Systems,” Proceedings of the Network and Distributed System Security Symposium (NDSS 2027), Seoul, Republic of Korea, March 2027.