tokens: The attack evaluation using the Berkeley Deep Drive dataset shows that our attack can succeed with successful AEs on as few as one frame , and only 2 to 3 consecutive frames on average , and when 3 consecutive frames are attacked , our attack has a nearly 100 success rate while attacks that blindly target object detection only have up to 25 .