Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors

2025/06/05 by Svetlana Pavlitska, Pavlitska, Svetlana, Nikolai Polley +6
Computer Science · #Adversarial Robustness in Machine Learning #Advanced Neural Network Applications #Physical Unclonable Functions (PUFs) and Hardware Security

paper · pdf · doi:10.48550/arxiv.2506.04823

Abstract

Realistic adversarial attacks on various camera-based perception tasks of autonomous vehicles have been successfully demonstrated so far. However, only a few works considered attacks on traffic light detectors. This work shows how CNNs for traffic light detection can be attacked with printed patches. We propose a threat model, where each instance of a traffic light is attacked with a patch placed under it, and describe a training strategy. We demonstrate successful adversarial patch attacks in universal settings. Our experiments show realistic targeted red-to-green label-flipping attacks and attacks on pictogram classification. Finally, we perform a real-world evaluation with printed patches and demonstrate attacks in the lab settings with a mobile traffic light for construction sites and in a test area with stationary traffic lights. Our code is available at https://github.com/KASTEL-MobilityLab/attacks-on-traffic-light-detection.

Citations

• The ATLAS of Traffic Lights
• CoCar NextGen: a Multi-Purpose Platform for Connected Autonomous Driving Research
• Traffic Light Recognition using Convolutional Neural Networks: A Survey
• Adversarial Vulnerability of Temporal Feature Networks for Object Detection
• Feasibility of Inconspicuous GAN-generated Adversarial Patches against Object Detection
• YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors
• YOLOv7: Trainable Bag-of-Freebies Sets New State-of-the-Art for Real-Time Object Detectors
• Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition
• Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks
• Adversarial Sticker: A Stealthy Attack Method in the Physical World
• TOG: Targeted Adversarial Objectness Gradient Attacks on Real-time Object Detection Systems
• Secure Traffic Lights: Replay Attack Detection for Model-based Smart Traffic Controllers
• On Physical Adversarial Patches for Object Detection
• DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems
• BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning
• BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning
• A Hierarchical Deep Architecture and Mini-Batch Selection Method For Joint Traffic Sign and Light Detection
• Detecting Traffic Lights by Single Shot Detection
• LaVAN: Localized and Visible Adversarial Noise
• Adversarial Patch
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Exploring the Landscape of Spatial Robustness
• One Pixel Attack for Fooling Deep Neural Networks
• CARLA: An Open Urban Driving Simulator
• Towards Deep Learning Models Resistant to Adversarial Attacks
• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• Universal adversarial perturbations
• Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
• Towards Evaluating the Robustness of Neural Networks
• Rethinking the Inception Architecture for Computer Vision
• You Only Look Once: Unified, Real-Time Object Detection
• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Intriguing properties of neural networks

Related

• Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems
• SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations
• One Patch to Rule Them All: Transforming Static Patches into Dynamic Attacks in the Physical World
• TPatch: A Triggered Physical Adversarial Patch
• STOP! Camera Spoofing via the in-Vehicle IP Network