Robust Physical Perturbations on Stop-Sign Classifiers
Carefully computed sticker patterns applied to a physical stop sign cause road-sign classifiers to misread it as a speed-limit sign across viewing angles and distances — a durable, real-world evasion attack.
What happened
Eykholt et al. introduced Robust Physical Perturbations (RP2), an optimization method that produces adversarial patterns which survive the physical world — variable distance, angle, and lighting. Applied as unremarkable black-and-white stickers on a real stop sign, the perturbation caused deep-learning classifiers to label it a “Speed Limit 45” sign in the large majority of drive-by video frames.
Unlike digital adversarial examples, RP2 attacks persist on a physical object an attacker can place in the environment, making them a credible threat to camera-based perception in autonomous systems.
Why it maps to ATLAS
- AML.T0043 — Craft Adversarial Data: the sticker pattern is an optimized adversarial input engineered to force a misclassification.
- AML.T0041 — Physical Environment Access: the perturbation is delivered by modifying a physical object in the model’s operating environment.
- AML.T0015 — Evade AI Model: the end effect is evasion — the classifier produces the attacker’s chosen wrong label.
Detection notes
Single-frame confidence is unreliable under this attack. Defenders lean on redundancy: sensor fusion (LiDAR, radar), HD-map priors that say “a stop sign belongs here”, and temporal consistency across frames. A camera-only pipeline has little to fall back on.
Detection
Log sources
- Model confidence telemetry
- Multi-sensor agreement logs (camera vs LiDAR/map priors)
Signals
- High-confidence class flips across consecutive frames of the same object
- Perception disagreeing with map/HD-prior expectations for a location
Mitigations
- Sensor fusion and map priors to cross-check vision output
- Adversarial training and input transformation/randomization
- Temporal consistency checks across frames