The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition
Authors: Shuai Yuan
Xingshuo Han
Hongwei Li
Guowen Xu
Wenbo Jiang
Tao Ni
Qingchuan Zhao
Yuguang Fang
Venue: NeurIPS 2025 poster ()
Keywords: Physical adversarial patch; Traffic sign recognition; Fluorescent ink.
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.

The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition
Shuai Yuan', Xingshuo Han', Hongwei Li!, Guowen Xu';
Wenbo Jiang', Tao N Qingehuan Zhao², Yuguang Fang)
University of Electronic Science and Technology of China, Chengdu, China 2 Nanjing University of Aeronautics and Astronautics, Nanjing, China City University of Hong Kong, Hong Kong, China
King Abdullah University of Science and Technology. Thuwal, Saudi Arabia mk2456mk0gmail. com, xingshuo.. han@nuaa, edu. cn, tao. .inkkust edu. sa, fhongweili, guowen. xu, wenbo venbo_jiangl jingt)usstt. wtbuetc..eu..coom cn, {cs.qczhar qczhao, my ww..aaa@@ittty edu. hk,
Abstract
Recently, traffic sign recognition (TSR) systems have become prominent target for physical adversarial attacks. These attacks typically rely conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. this paper, we introduce a novel attack medium, i.e., fluoresent ink, to design stealthy and effective physical adversarial patch, namely FlPatch, to advance the state-of-the-are Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real- world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FlPatch, which shows a success rate of 98.31 in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96. 72%
Introduction
Traffic sign recognition (TSR) plays a pivotal role in autonomous driving by visually detecting and classifying traffic signs to ensure driving safety under various road situations. However, most TSR systems were built atop machine-learning models that are inherently suspected and also shown be subject to adversarial attacks Ilyas et al. [2019], Zhang et al. [2020], making TSR systems work in- correctly. particular, these attacks were launched by using adversarial examples (AEs) introduce subtle perturbations to normal images, and these perturbations could deceive the underlying machine- learning model into making incorrect detection and classification. Numerous efforts have been devoted to investigating AEs in TSR systems, and recent focus has shifted from the digital domain Goodfellow al. [2014], Carlini and Wagner [2017], J, Su et [2019] to the physical domain Tu et al. [2020], Sayles et al. [2021], Yan et al. [2022], Wang et al. [2023], Sato et al. [2024]. These adversarial attacks target either cameras or traffic signs. Since attacks on cameras involove the impractical requirement of physically accessing the target vehicle, we focuse on adversarial attacks targeting traffic signs.
Existing physical AEs against TSR exploits stickers, light and acoustic signals. Specifically, extensive studies have been conducted on sticker-based adversarial attacks Eykholt et al. [2018], Song et al.
"Corresponding author. E-mail: guowen. wwwpaaa.uuuuueeeemem edu.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Traffic Sign
Invisibble Light
P
P
Recognition
P
UV
STOP
Fluerescent Ink
Attacker
Victim's Vehicle
Attacker
Victim's Vehicle
Correct Classification
Misclassificattion
An example of FIPatch attack. The attacker first applies carefully crafted fluorescent ink to a traffic sign. When the attack is not triggered, the TSR system correctly classifies the sign. However, the attacker can uses a UV lamp from the side of the road to launch the attack against the victim's vehicle, causing it to misrecognize no-parking sign as STOP sign, which leads to the vehicle suddenly stopping.
Figure 1:
[2018], Liu et al. [2019], which are easy to deploy with low cost. Note that we consider printed perturbations Ye et al. [2021], Jia et al. [2022], Wei et al. [2022] as stickers as well. However, these adversarial stickers are visually suspicious and attack all vehicles indiscriminately once deployed. Furthermore, some works used visible light, such projections Lovisotto et al. [2021] and lasers Duan al. [2021], to construct physical AES capable of flexibly triggering attacks. Unfortunately, such visible light can be easily tracked, revealing the location of the attacker. Recently, Sato et al. Sato al. [2024] constructed physical AEs mislead TSR an infrared (IR) laser, which invisible to human eyes. However, IR- basedsed attacks vulnerable to simple physical defenses such as IR filters. Unlike others. Zhu et al. Zhu et al. [2023] designed adversarial patches triggered by acoustic signals, which can be casily blocked by physical signal protection mechanisms Sharma et al. [2017], Lou et al. [2021]. Overall, existing physical AEs are either poorly stealthy or easily countered.
In this work, surprisingly, we discovered new attack vector, i.e., fuorescent ink, that can significantly address the aforementioned issues and advance the state-of-the off-the-art. art. Specifically, fluorescent ink is transparent in normal environments, making them "unnoticeable". On the other hand, fluorescent ink exhibits fluorescent effects after absorbing specific wavelengths of light, e.g., invisible ultraviolet (UV) light, which allows adversarial attacks to not only be flexibly triggered but also to bypass any filters. This is because the light emitted by fluorescent materials falls within the visible light spectrum NASA, meaning only ligitte-light filters could potentially block it. Nonetheless, no cameras in current AVs use visible-light filters, as such filters would significantly damage the camera's 's utility. Moreover, filtering single color does not prevent the effectiveness of fluorescent ink in other colors. Although fluorescent ink demonstrates strong stealthiness and resistance to filters, designing an effective and robust physical adversarial patch using fluorescent ink remains non-trivial with the following challenges. First, it is challenging to simulate fluorescent effects and determine the optimal choices of massive factors in fluorescent ink, e.g., color, transparency, and size, for achieving high attack effectiveness. Second, fluorescent effects are easily influenced by real-world environments, including surroundings, ambient light, vehicle distance, and speed. Feasibility study is provided in Appendix A.
To address the above challenges, we design a stcalthy and effective physical adversarial patch with fluorescent ink (FIPatch²), which leverages the aforementioned fluorescent properties. At high level, an attacker applies carefully designed fluorescent ink to a target sign and later triggers a fluorescent effect using invisible UV light. The resulting fluorescent perturbations cause the TSR system to misclassify the sign, which could potentially lead to traffic accidents. Figure shows an example of our FlPatch. In more detail, our methodology consists of four key modules. First, develop a color-edge fusion method to automatically locate traffic signs, enabling precise application of fluorescent ink the signs themselves, rather than invalid backgrounds. Second, to effectively simulate fluorescent effects, we model fluorescent perturbations on traffic signs by defining the various critical parameters of fluorescent ink, including colors, intensities. and perturbation sizes. Third, we design goal-based and patch-aware loss functions to achieve high attack success rates with minimal perturbations, supporting three attack goals: hiding attack, generative attack, and
'Our demonstration videos of FIPatch can be found at attps://sites: http://sittssogggeee.e... com/ view/ Hipatch-attack/ben attack/home/.

---

misrecognition attack. Finally, to improve the robustness of FIPatch in the physical world, we present several fluorescence-specffe transformation methods that simulate fluorescence perturbations for real-world attacks.
We perform extensive experiments using 10 TSR models validate our attacks in both digital and physical settings. The evaluation results show that under low-light conditions, the success rates for both generative and misrecognition attacks are above 88.31%, while the success rate for hiding attacks is at least 87.8) 87.81%. Additionally, we conduct ablation studies to examine the impact of various factors, such as color, size, and shape, and test how real-world environments e.g.. distance, ambient light, and vehicle speed affect the robustness of FlPatch. We further evaluate the effectiveness of FIPatch in two specific attack scenarios. It is worth noting that we test common defenses and find that FlPatch can achieve an attack success rate of at least 96.72%.
Our contributions are summarized follows.
We are the first to introduce fluorescent ink to construct physical adversarial patches. We design FIPatch, systematic attack optimization framework tailored to the physical properties of fluorescent ink that achieves high stealthiness, effectiveness, robustness with low-cost.
We extensively evaluate FIPatch for three attack goals in both digital and physical worlds against five popular defenses.
2 Background and Related Works
2.1 Traffic sign recognition
Generally, the TSR system divided into two main steps: detection and classification. We briefly describe the popular detectors and classifiers. First, Yolov3 Redmon and Farhadi [2018] and Yolov5 Redmon et [2016] are classical one-stage detectors that achieve accurate object detection by dividing the image into grids and predicting both bounding boxes and categories. Other popular one-stage detectors include SSD Liu al. [2016], RetinaNet Lin et al. [2017], and EfficientNet Tan and Le [2019]. In contrast, Faster R-CNN Ren et al. [2015] is one of the most popular two-stage detectors. Faster R-CNN first screens high-quality candidate target regions using a region proposition network, and then performs target classification and localization via a convolutional neural network. Some recent works such as HyperNet Kong et al. [2016), R-FCN Dai al. [2016), Mask R-CNN He al. [2017], and Cascade R-CNN Cai and Vasconcelos [2018] 88 have also improved the performance of Faster R-CNN. Second, the classifiers usually receive images and a series of bounding boxes of traffic signs input and then output the classification results of these traffic signs. Models such as VGG Simonyan and Zisserman [2014], GoogleNet Szegedy et al. [2015], ResNet He et al. [2016], and MobileNet Howard et al. [2017] are widely used classifiers in TSR systems.
2.2 Physical adversarial examples
Physical AEs designed to deceive machine learning models by introducing perceptible perturbations to physical systems. In TSR, such attacks mainly target traffic signs or cameras, though camera-based based attacks typically involve color or translucent films Li et al. [2019], Zolfi et al. [2021], Hu and Shi [2022]. Following most prior work, we focus on attacks against traffic signs.
The current attack mediums for traffic signs can be categorized into stickers, light signals, and acoustic signals. Specifically, some researchers Eykholt et al. [2018], Song et al. [2018], Liu et al. [2019], Wei et al. [2022] have used stickers create physical AEs on traffic signs. Other studies Chen et al. [2019], Yang et al. [2020] designed full-size printable adversarial signs, which we also classify as stickers. However, once deployed, these stickers launch attacks continuously and indiscriminately.
To address this issue, some studies have explored the light to deceive TSR systems. The first type utilizes visible light (wavelengths from 400 nm to 800 nm). implemented via projectors Lovisotto et al. [2021] or lasers Duan et al. [2021]. However, these light sources are easily tracked, which exposes the attacker. Moreover, the projector used in Lovisotto et al. [2021] is expensive, costing between $1 $1500 and $44379. Recently, Sato et al. [2024] proposed an IR laser reflection (II.R attack to mislead AV perception modules, which is invisible to human eyes. However, as highlighted by Sato
3

---

Input
Output
Robustnesa Improveman
Eexal
Daladion
Expeciatio Over Transforraion
40
Speed limit
40
Floorsscence Modeling
Uninggered
Traffic Sign Recognition System
H Rlaasorre
Perk cation
Brg
Retadi
Original imge
Parpectee
Motion
40
Flusroscense Oydimization
Transparorcy Tranzfomration
Triggene
Optinall 1o0
Aned LM
Gottnoatioon
Aftichar
Figure 2: The workflow of our FlPatch.
et al. [2024], this attack only affects sensors without IR filters, indicating that IR filters can effectively block ILR attacks. dditionally, Zhu al. Zhu al. [2023] designed physical adversarial patch triggered by acoustic signals. However, this method is impractical due to the challenges of using ultrasonic devices and can be easily countered by physical signal protection mechanisms Sharma al. [2017], Lou et al. [2021]. In this paper, introduce novel attack medium that addresses the limitations of the aforementioned methods and may pose a significant threat to TSR systems.
Threat Model
3.1 Attack goals
We analyze TSR outputs and propose three attacks: hiding and generative attacks for detection, and a misrecognition attack for classification, defined follows.
Hiding attack. An attacker hides traffic sign from the TSR system to cause detection failure.
Generative attack. An attacker causes a TSR system to detect forged traffic sign.
Misrecognition attack. An attacker causes TSR system to misclassify traffic sign.
3.2 Attacker capabilities
In this work, assume that the attack is black-box based, i.e., the attacker does not have direct access to the internal details of the target model, such as its architecture, parameters, or gradients. We assume the attacker has the following capabilities.
Direct access to traffic signs. An attacker can physically access traffic signs.
No direct access to victim's vehicle. An attacker does not have digital or physical access the
victim's vehicle before or during any phase of an attack.
Launching an attack. An attacker can launch an attack by either placing a UV lamp by the roadside and controlling it remotely to target the traffic sign, by driving close to the victim's vehicle and using a UV lamp to target traffic sign.
4 Methodology
To implement FIPatch in the physical world, is essential to overcome the following challenges:
Challenge 1: How to accurately model fluorescent ink and determine the most effective attack parameters for FIPatch?
Challenge 2: How to enhance the robustness of FIPatch by leveraging the properties of fluorescent ink, making more viable for real-world application?
To address these challenges, we propose module FIPatch attack framework, as illustrated in Figure 2. The Automatic Traffic Sign Localization module automatically detects the valid region on traffic sign to ensure consistency between the location the perturbation in the digital and physical environments. The Fluorescence Modeling module defines and systematically models several key parameters related fluorescent ink, including position, radius, color, and intensity. To the best of our knowledge, this is the first attempt to parameterize fluorescent perturbations for attack

---

optimization. The Fluorescence Optimization module optimizes these parameters using goal-based and patch-aware loss functions and employs particle swarm optimization algorithm identify the most effective attack configuration. These three modules collectively address Challenge 1.
To tackle Challenge 2, the Robustness Improvement module customizes multiple transformation distributions based on the properties of fluorescent materials to enhance the real-world robustness of FIPatch. The following subsections provide detailed explanation of each step.
4.1 Automatic traffic sign localization
Since fluorescent ink can only be applied to the actual surface of the traffic signs, we propose three steps automatically identify the regions of traffic signs for precise placement of perturbations. This masking mechanism ensures that the perturbation fully complies with the shape and placement constraints of the real-world scenario. As result, the perturbation remains effective and consistent across both digital and physical environments.
Histogram equalization. The histogram equalization Pizer et al. [1987] is used if the input image satisfies the following condition:
(t)(((((t,))) - (i(t(o(t, Th
(1)
max(((x((. ()) ((n(((((())))))
where t(x(i.j)) represents the pixel intensity at coordinates and j in the image æ. Here, Po and Pt the 99th and 1st percentile of pixel values, respectively, and Th is threshold fraction.
Canny edge detection. We use the canny edge detector Canny [1986] with a selected threshold to detect the edge in image With customized high and low thresholds, we filter out non-edge information and highlight the edges traffic signs the image.
Color-based detection. We propose a color-based detection algorithm as follows.
We define HSV Smith [1978] ranges for each color in Table I. Voxels falling inside these boxes are assigned value of "255" in the output array, while those outside are assigned "0". The four color masks are merged via bitwise OR, followed by morphological opening and closing to reduce noise and fill gaps. Finally, we compare the areas identified by the is selected as the region A of the traffic sign, and the mask matrix M. A is determined accordingly.
Color
lower range
upper range
Yellow
(20,
(35, 210)
Blue
(90, 40, 50)
(120, 255, 210)
Red,
(0, 40, 50)
(10, 210)
Reda
(165, 40, 50)
(179, 255, 210)
Black
(0, 40, 50)
(10, 255, 210)
detectors. The larger area
Table 1: HSV color ranges
4.2 Fluorescence modeling
After identifying the legal area for perturbation, we aim to simulate the effect of fluorescent ink on a traffic sign, particularly under UV light.
Fluorescence definition. First, we assume that the fluorescent ink is used to draw a circle, then the parameters of circle Co are defined as follows:
Og ((1o, ro, 70, ax))
corresponding to the following aspects the circle Co:
(av, Mo) E [W, H
C R2: Coordinates of the circle in an image with width W and height H.
To E [Fmin= Tmax] C IR: Radius of the circle relative to the patch size.
To [Ro, Go, Bol C R RGB color triplet the circle.
au [0.1] C R: Opacity level of the circle.
Perturbation function. Let x be 2D image where x).. denotes the pixel at the (i,j) location. We define the perturbation function for a single circle in the image, (x; fo), as follows:
(x; (i, x(i.)) oi., a(i,)) ((
Intuitively, each pixel <<;; (i. in the perturbed image linear combination of the original pixel and the color yo. weighted by the position-dependee alpha mask ag. To create our perturbed
5

---

image, we combine K single-cirele (Co. ... Cx-1) 1) as follows:
<1; 0) = T(; 0o) x 01) ................................ (1;;;;0-1))
(4)
where the parameters = (fo. ................................ -1) are the concatenation of the parameters for each circle.
Fluorescence intensity. In this study, UV light intensity primarily affects the illumination of the traffic sign area A, while other components remain unchanged. Starting with clean image x in RGB color space, we first convert x to LAB color space:
LAB(x) = [La, A., Ba]
(5)
Given masks MA and Mr, the value of pixel (i.j) in the adversarial image Tedv is:
LAB(xade (i [ A
Anndut B
LAB(z) 1,,1, (i, E A
A(t,))
(6)
LAB(e) [2,,,, (4.5) F
LAB(e)(i.)) [1,1,1]", (i.j) &
Finally, convert Fadv back to RGB color space. We refer to the entire AE generation process
Fadv LAB(F(E; 0)) LAB((T(;; 0o) 0x))
(7)
4.3 Fluorescence optimization
In this section, we consider two customized loss functions:
min Eu-x, [Egout + Xfarea]
(8)
where 0 is the attack parameters and denotes random transformation. X and T correspond to their respective distributions, denotes the expectation, and X a weighting factor used to balance the different components of the loss function.
Goal-based loss. The goal- loss lgont tied the attack objectives, allowing the attacker to apply different Egont depending the specific attack goals.
For hiding attack, attacker attempts to eliminate the detection results:
Egoat Pr(object) Pr(class) Bl Bloutra
Aruth prodected
(9)
where Pr(object) and Pr(class) correspond to the detector's outputs, which respectively represent: (1) the confidence that an object exists in a given cell, and (2) the classification confidence for specific class in that cell. Additionally, the attacker minimizes the "intersection over union" (IoU) score between the predicted bounding box and the ground truth bounding box. 3 is manually set penalty term. This strategy forces the detector to inaccurately predict the bounding box location, resulting in the incorrect detection of the object's 's position.
For generative attack, an attacker aims to improve the confidence by minimizing Equation 10:
Lynat Pr(object) Pr(class)
(10)
The attacker focuses on increasing the detector's confidence in its output and does not need to minimize the IoU score.
For misrecognition attack, an attacker attempts to reduce the original category's score:
goout = log(p.)
(1I)
where Py denotes the probability of the original category y. As Py decreases, the probabilities of other categories increase, which can lead to a change the model's predicted category.
Area-based loss. To introduce the smallest perturbation possible, we minimize the loss:
Laren
min rElrminn Fmar)
Σ mr
(12)
1

---

where K is the number of circles and r is the radius of each circle. The goal is to make the perturbation subtle enough that the driver does not notice any anomaly, while the TSR system led make an incorrect decision.
Particle swarm optimization. In the black-box setting with discrete coordinate values in θ use particle swarm optimization (PSO) Kennedy and Eberhart [1995]. PSO is robust to the initial settings, aligning with our use of random initialization for parameters like perturbation position and color. To enhance success rates, we employ the re-randomrrestarts strategy, allowing us to reinitialize and rerun the PSO up to n 1 times if the attack fails.
4.4 Robustness improvement
In this section, we propose two methods to improve the robustness of FIPatch in the real world.
Expectation over transformation. EOT Athalye et al. [2018] is an effective method for addressing discrepancies between digital and real-world scenarios. this paper, we extend EOT's transformation distributions T to accommodate variations in fluorescent materials across different physical environments. This includes accounting for perspective, brightness, and other environmental factors previously overlooked, detailed in Appendix B.
Transparency transformation. To simulate the transparency of fluorescent ink when not triggered. we apply a specific alpha value. Over time, environmental factors reduce the ink's 's transparency, impacting stealthiness. We model this over 5 days, with transparency ranging from [0, 0.1]. Despite this, the effect remains invisible to passing vehicles in Appendix Figure 12.
5 Evaluation
In this section, we evaluate the attack's performance in the physical world and provide the results in the digital world in Appendix C.
5.1 Experimental setup
Datasets. We select two datasets of traffic signs captured in real driving conditions: the German Traffic Sign Recognition Benchmark (GTSRB) Stallkamp et al. [2012] and the Chinese Traffic Sign Recognition Database (CTSRD) Huang. These datasets are widely used in current research Liu et al. [2019] Li et al. [2020] Ye et al. [2021].
Models. We evaluate 10 different models. For traffic sign detection, we use Yolov3 and Faster R-CNN, both pre-trained on the COCO dataset Microsoft [2018]. We set the input size for the traffic sign detection models to 416 416 and the confidence threshold for the output boxes 0.5. For traffic sign classification, we train CNN, Inception v3, MobileNet v2, and GoogleNet on the GTSRB dataset. Additionally, we use ResNet50. ResNet101, VGG13, and VGG16 for the CTSRD dataset. We set the input size to 32 x 32 for all classifiers, except Inception v3, which uses an input size of 299 x 299. The number of queries required to perform the attack is 1500.
Metries We define the attack success rate (ASR)
Equation 13 to evaluate FIPatch attacks.
40%
Comera
ASR N Σ T (.G.sande)) (13)
Sign
where N is the total number of frames or in- put images, I is the indicator, F represents the model's prediction function, and y is the origi- nal prediction label. The indicator / (xx equals 1 if the model's prediction is y when the attack is not triggered, and if the model misclassifies when the attack is triggered.
Todis
Y
Figure 3: Experimental setup in real-world environ- ments. (A) A traffic sign in front of a Tesla Model with a UV lamp. The Tesla's front cameras cap- ture videos sent to the TSR system. (B) Sixteen fluorescent material colors. (C) Equipment: stand, Tesla USB, photometer, and 3 UV lamps.
Devices. As shown in Figure 3, we employ Tesla Model Y as the victim's 's vehicle, equipped with dashcam recording videos at 30 fps.
7

---

Table 2: The ASR of FIPatch on various models in the physical world.
Ambient
Frames
Generative Attack
Hiding Attack
Misrecognition Attack
Light (Lux)
Yolov3 Faster R-CNN] Yolov3
Faster R-CNN ResNer50 VGG13 MobileNet v2 GoogleNet
200
4374
98.31%
98.66%
99.55%
87.81%
100%
99.82%
98.93%
100%
500
3655
98.72%
93.41%
83.64%
80.09%
99.35%
98.01%
95.38%
97.52%
1000
4163
95. 25.22%
88.31%
69.19%
64.91%
94.26%
92.58%
92.15%
93.66%
2000
3719
94.06%
86.10%
53.81%
48.43%
90.59%
86.37%
85.92%
84.03%
3000
3924
89.63%
83.39%
31.48%
25.92%
84.12%
79.55%
74.59%
76.15%
angle
angle
si. 16"
15"
Sor 15
corl REN par 95%
30
77% 8t%s 87% 92% 03%
30
ABBICK BAR00800 1070
00%
45'
Attack a4000e
80"
701s/
60
20
20
8
dietance (m)
15
dislance (m)
15
Rastleto Rudleenon vala
180
UV lamp power
CNN
Inception v3
CTSRD
GTSRB
Figure 5: Impact of the distance & angle between vehicle and traffic sign on ASRs.
Figure 6: Impact of the UV lamp power on ASRs.
These videos are transmitted computer to simulate the TSR system. Fluorescent ink ap- plied to a traffic sign positioned 1.5 meters high, and a UV lamp is mounted on stand 2.0 meters away, All models are deployed on an Apple M2 Pro GPU.
5.2 Overall performance
In this section, we present examples and exper- imental results of FlPatch in the physical world. In Figure 4, examples of three different attacks illustrated. Specifically, when the attack is untriggered, the model performs detection and recognition normally. For example, it recog- nizes a blank sign as empty; it correctly recog- nizes various traffic signs such as stop signs and turn right ahead. When an attacker triggers an attack, the generative attack allows the model to incorrectly detect the stop sign by drawing simple border. The hiding attack makes the model fail to detect the sign without affecting the naked eye's recognition. The misrecognition attack induces the model misclassify the traffic signs. We emphasize that in the physical world, the perturbation only needs to be active for short time. When a self-driving car approaches the stop sign, even it fails to recognize the stop sign for merely a short time window, it can lead to a fatal accident.
STEP
Flip dig.
Generative
Hiding
Misrecognition
Figure Untriggered (top) and triggered (bottom)
attack examples in real-world environments.
We measure the ambient light intensity on traffic signs using photometer and analyze the ASRs of FIPatch under various light conditions. As shown in Table 2, Yolov3 exhibits higher ASR compared Faster R-CNN for both generative and hiding attacks, suggesting that Faster R-CNN more robust against FIPatch. Generative attacks are more effective than hiding attacks at all ambient light levels while hiding attacks maintain ASRs above 80% only when the light below 500 lux. At 3000 lux, the ASR for hiding attacks drops to below 32%. This drop is likely because detectors are more sensitive to perturbations on blank signs, such as contours, but more resilient when predicting existing traffic signs. All four classification models are highly vulnerable to attacks, with ASRs above 93% when light is below 1000 lux. Overall, the ASRs decreases with increasing ambient light because the fluorescent effect diminishes, reducing its impact the models.

---

5.2.1 Impact of FIPatch in real-world enviroments
Impact of distance & angle. We place traffic signs at various locations and record around 3000 frames of video with dashcam. The setup includes traffic sign of size 60 cm x 60 cm, ambient brightness of approximately 200 lux, and a fluorescent perturbation radius of 14 cm. The distance between the camera and the traffic sign ranges from 0 m to 20 m, and angles follow the perspective described in Appendix B. As shown in Figure 5, CNN models achieve an ASR of over 91% across all distances, although ASR decreases with distance and is less affected by angle variations. In contrast, Inception v3 experiences a significant drop in ASR, achieving only 70% or 77% at the furthest distances, indicating higher sensitivity to angle changes at greater distances. Overall, while increasing distance reduces ASR for all models, angle variations have less impact except at extreme angles (60" -30%). Additional results on other models can be found in Appendix Figure 16.
Impact of UV lamp power. To examine the effect of UV lamp power on ASRs, we test three types of UV lamps: 40 Watts (W), 60W, and three levels of 80W, 100W, and 120W. As shown in Figure 6, VGG13 shows the greatest sensitivity to changes in UV lamp power. When using a 40W UV lamp, Inception v3 achieves the lowest ASR of 77%. In contrast, with a 120W UV lamp, all models achieve ASR above 97%. Overall, the ASR increases with UV lamp power because higher power results in brighter fluorescent effect, leading to stronger interference with the models.
Impact of vehicle speed. For detection, we per- form generative attacks on Yolov3 and Faster R-CNN. For classification, we apply misrecog- nition attacks to four classification models. As shown in Figure 3, Yolov3 consistently shows higher ASRs than Faster R-CNN across all ve- hicle speeds. At a speed of 15 km/h, Faster R-CNN achieves only 77% ASR. For classi- fiers, the ASRs for all four models remains above 93% when the vehicle speed is below 10 km/h. Notably, ResNet50 and CNN maintain stable ASRs, while other models experience significant drop in ASRs when the speed exceeds 10 km/h. This decline is attributed to rapid changes in the angle of the traffic sign and reflections from the fluorescent material, which make it more challenging for the models to maintain accurate detection as speed increases.
Table 3: Impact of the vehicle speed on ASRs.
Speed
Model
(km/h) Yolov3 Faster R-CNN ResNer50
VGG13
CNN GoogleNet
98% 96%
91%
99%
98%
100%
100%
5
98%
96%
92%
91%
96%
95%
87%
83%
83%
We also evaluate the impact of distance between UV lamp and traffic sign in Appendix D and find that there is an ASR of at least 81% 31% at a distance of meters. This distance is sufficient for an attacker to place the UV lamp in the bushes near the traffic sign. In addition, since the UV light is invisible to the naked eye, the victim cannot locate the light source, and the attack device is in the bushes, further increasing the stealthiness of the attack. For clevated traffic signs commonly found on highways, attackers can leverage drones to carry out the attack. By equipping a drone with UV lamp and hovering it at a specific position, the attacker can activate the perturbation without physical access to the sign. The drone only needs to remain in position for a few seconds during the attack and can quickly leave the area afterward, making the attack highly stealthy and flexible. Other factors, e.g., radius, colors, position, and shape, are evaluated in Appendix C.I.I.
6 Defenses
Since defenses against object detectors are not well-explored, we focus on misrecognition attacks, as detailed in Table 4. The image smoothing Cohen et al. [2019] shows minimal impact on the ASRs, with a slight increase observed for some models. The feature compression Jia et al. [2019] offers slight benefits for ResNet50, CNN, and GoogleNet, reducing the ASRs by 1 ~ 2%. The input randomization Xie et al. [2017] does not effectively mitigate fluorescent perturbations, thus having little impact across all models. The adversarial training Madry et al. [2017], known to be effective in other scenarios, does not significantly defend against our scheme. This is because attackers can vary colors and perturbation positions, preventing models from effectively learning our attack patterns. The defensive dropout Wang et al. [2018] enhances model robustness by reducing network complexity. As seen in Table 4, this method provides the most effective defense against our attacks compared to other techniques. In summary, current popular defense methods are ineffective against FlPatch attacks, presenting new challenges to driving safety and security. For more details, refer to Appendix E.
9

---

Table 4: The ASR of FIPatch across various defenses.
Model
W/o defense
Image Smarohing
Feature Compression
Randonizzation
Adversarial Training
Defensive
Dropout
RoaNer50
99. 19.47%
98 50%55%5--0 93%)
97.8 07.82%6611 (65%)
99. 18% 29%
98 63.63%6--0 84%)
07.17% 30%
ResNet101 101
99. 30%
99,46fet 16%)
98 98.47%((0.832)
98. 08.3554--0 95%
99. 20.2%-000034
27.55%1--
755%
VOG13
99.11% 18%8
99.04%5-00225
98 (8.60%/--000
98.75%8 (-554%)
97.92%
VGG16
.07%)
99.228%(-0.5 -0.59%)
98.92%
09.04%. 0.77%%
18.335i-115
CNN
100%
09.87%%
98.61%((1.29%%
99.28%(-- 72%)
99 99,84% 16%)
99.34 90.34%(-0.66%%
Inception v.
98.75%
98.36121 0.39%)
18.5446(-002211
99.1758 (7.44)))))))
96.72%
MobdeNot v2
99.325
98.72%%(-06608888
98.45%/-0
59.04%(-002280
98. 66 0.66%%
98. 98177%(-1115%)
GoogleNet
99.68%
99. 99.54%((-0.14%)
97.55%
98.26% 42%)
98.52% (.16%)
97.24%% 2.444))
Due to the vulnerability of the TSR system, we propose two potential defenses against our FlPatch attack. One defense strategy is using high-definition maps, which provide stable, accurate traffic sign information unaffected by FTPatch. These maps, regularly updated by providers based on official traffic authority announcements, allow vehicles to make informed decisions even if signs are altered. However, they don't replace the need for sensors in case of unexpected conditions or map delays. Another promising defense is collaborative perception among multiple vehicles. If one vehicle is attacked by fluorescent ink, nearby vehicles can share their recognition results, enabling the affected vehicle to correct its prediction, enhancing overall system robustness.
7 Discussions
Limitations. Our FIPatch has two limitations. First, our outdoor experiments mainly assess the effects at the AI component level rather than the autonomous vehicle system level. Second, ambient light impacts different attack goals in varying ways.
Future work. In our future work, we plan to focus on two main directions. First, we intend to investigate the use of fluorescent materials to challenge object detection systems. Specifically, adding suitable perturbations using fluorescent materials on curved surfaces presents significant challenge. Second, we aim to develop effective defenses against FIPatch. This includes exploring multi- collaboration and leveraging deep learning models to enhance security. Determining how to imple- ment these defenses effectively remains a challenge and will be key focus of our future research.
Societal impacts. The proposed FIPatch attack has important societal implications. On the positive side, it exposes a previously overlooked vulnerability in TSR systems, thereby encouraging the development of more robust models and defenses. However, due to its stealthiness and physical feasibility, FIPatch also poses potential risks if maliciously exploited to disrupt traffic environments or compromise public safety. We emphasize that our study serves as an effective approach to identifying security issues, encouraging researchers to focus more on the robustness of models.
Ethics statements. The closed roads used for physical world experiments have obtained IRB approval from our institution for data collection. All images and videos used in physical world attacks legally obtained from vehicle owners and do not contain any personal information. We ensure that there are pedestrians during the experiments while the vehicle is operated by the driver without any safety incidents.
8 Conclusion
In this paper, we propose FIPatch, a stealthy and effective adversarial attack that leverages fluorescent ink to create adversarial examples in the physical world. We focus on the context of traffic sign recog- nition, where the goal of the attack is alter the appearance of a traffic sign using specially crafted flu- orescent ink, causing the traffic sign recognition system to either fail to detect or misclassify the sign.
Considering the physical constraints of applying fluorescent ink to multiple traffic signs under various conditions, we develop a tailored approach to create robust black- adversarial examples. We evaluate our proposed attack method against 10 state-of-the oft detectors and classifiers in both the digital and physical worlds. Our investigation into various factors affecting the success rate of FIPatch attacks demonstrates its robustness in real-world scenarios. Finally, our analysis of existing defenses shows that current methods against adversarial examples are ineffective against FlPatch, highlighting the need for further research into this potent new attack vector.
10

---

Acknowledgements
This work is supported by the National Key R&D Program of China under Grant 2022YFB3103500, the National Natural Science Foundation of China under Grant 62020106013, the National Natural Science Foundation of China under Grant 62502075, the Sichuan Science and Technology Program under Grant 2024ZHCG0188, the Chengdu Science and Technology Program under Grant 2023- XTO0-00002-GX.
References
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. NeurlPS, 2019.
Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In So Kweon. Understanding adversarial examples from the mutual influence of images and perturbations. In CVPR, pages 14521-14530, 2020.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, 2014.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE SP, 2017.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE TEC, 2019.
James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. Physically realizable adversarial examples for lidar object detection. In CVPR, 2020.
Athena Sayles, Ashish Hooda, Mohit Gupta, Rahul Chatterjee, and Earlence Fernandes. Invisible perturbations: Physical adversarial examples exploiting the rolling shutter effect. In CVPR, 2021.
Chen Yan, Zhijian Xu, Zhanyuan Yin, Stefan Mangard, Xiaoyu Ji, Wenyuan Xu, Kaifa Zhao, Yajin Zhou, Ting Wang. Guofei Gu, al. Rolling colors: Adversarial laser exploits against traffic light recognition. In USENIX Security, 2022.
Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, and Qi Alfred Chen. Does physical adversarial example really matter autonomous driving? towards system-level effect of adversarial object evasion attack. In ICCV, 2023.
Takami Sato, Sri Hrushikesh Varma Bhupathiraju. Michael Clifford, Takeshi Sugawara, Qi Alfred Chen, and Sara Rampazzi. Invisible reflections: Leveraging infrared laser reflections target traffic sign perception. NDSS, 2024.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-wond world attacks deep learning visual classification. In CVPR, 2018.
Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In WOOT; 2018.
Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuging Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In AAAI, 2019.
Bin Ye, Huilin Yin, Jun Yan, and Wanchen Ge. Patch-based attack on traffic sign recognition. In IEEE ITSC, 2021.
Wei Jia, Zhaojun Lu, Haichun Zhang, Zhenglin Liu, Jie Wang, and Gang Qu Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems. NDSS, 2022.
Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: stealthy attack method in the physical world. IEEE TPAMI, 2022.

---

Giulio Lovisotto, Henry Turnrr Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. {SLAP}: Improving physical adversarial examples with {Short-Lived) adversarial perturbations. USENIX Security, 2021.
Ranjie Duan, Xiaofeng Mao, A Kai Qin, Yuefeng Chen, Shaokai Ye, Yuan He, and Yun Yang. Adversarial laser beam: Effective physical world attack to dnns in blink. CVPR, 2021.
Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: triggered physical adversarial patch. In USENIX Security, 2023.
Ramesh C Sharma, Subodh Kumar, Surya Kumar Gautam, Saurabh Gupta, Deepak Kumar, and Hari Srivastava. Detection of ultrasonic waves using resonant cylindrical cavity for defense application. IEEE Sensors Journal, 2017.
Jianzhi Lou, Qiben Yan, Qing Hui, and Huacheng Zeng. Soundfence: Securing ultrasonic sensors in vehicles using physical-layee defense. In IEEE SECON, 2021.
NASA. Visible light. https://sciie
nasa www.gggo////eeee http://mm//9vvviiiiiie 10timm/0vviilllliggh..
Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. CoRR. 2018.
Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. In CVPR, 2016.
Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yare Fu, and Alexander C Berg. Ssd: Single shot multibox detector. ECCV, 2016.
Tsung-Yi Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár, Focal loss for dense object detection. In ICCV, 2017.
Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML, 2019.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. NeurIPS, 2015.
Tao Kong, Anbang Yao, Yurong Chen, and Fuchun Sun. Hypernet: Towards accurate region proposal generation and joint object detection. In CVPR, 2016.
Jifeng Dai, Yi Li, Kaiming He, and Jian Sun. R-fen: Object detection via region- based fully convolutional networks. NeurlPS, 2016.
Kaiming Hc, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In ICCV, 2017.
Zhaowei Cai and Nuno Vasconcelos. Cascade r-cnn: Delving into high quality object detection. In CVPR, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. CoRR, 2014.
Christian Szegedy, Wei Liu, Yangging Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In CVPR, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. CoRR, 2017.
Juncheng Li, Frank Schmidt, and Zico Kolter. Adversarial camera stickers: A physical camera-based attack on deep learning systems. In /CML, 2019.
Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai. The translucent patch: universal attack on object detectors. In CVPR, 2021.
physical and
12

---

Chengyin Hu and Weiwen Shi. Adversarial color film: Effective physical-world attack to dnns, CoRR, 2022.
Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In ECML PKDD, 2019.
Xinghao Yang, Weifeng Liu, Shengli Zhang, Wei Liu, and Dacheng Tao. Targeted attention attack on deep learning models in road sign recognition. IEEE loT, 2020.
Stephen M Pizer, Philip Amburn, John Austin, Robert Cromartie, Ari Geselowitz, Trey Greer, Bart ter Haar Romeny, John B Zimmerman, and Karel Zuiderveld. Adaptive histogram equalization and its variations. Computer vision, graphics, and image processing, 1987.
John Canny, computational approach to edge detection. IEEE TPAMI, 1986.
Alvy Ray Smith. Color gamut transform pairs. ACM Siggraph Computer Graphics, 1978.
James Kennedy and Russell Eberhart. Particle swarm optimization. ICNN, 1995.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In ICML, 2018.
Johannes Stallkamp, Mare Schlipsing, Jan Salmen, and Christian lgel. Man computer: Bench- marking machine learning algorithms for traffic sign recognition. Neural networks, 2012.
LinLin Huang. Chinese traffic sign recognition database. https://nlpr aa.ac. cn/pal/
crafficdata/recoguii
html.
Yujie Li, Xing Xu, Jinhui Xiao, Siyuan Li, and Heng Tao Shen. Adaptive square attack: Fooling autonomous cars with adversarial traffic signs. IEEE loT, 2020.
Microsoft. Common objects in context (coco) dataset, 2018.
org/
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized
smoothing. In ICMI,, 2019.
Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In CVPR, pages 6084-6092, 2019.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. CoRR, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. CoRR, 2017.
Siyue Wang, Xiao Wang, Pu Zhao, Wujie Wen, David Kaeli, Peter Chin, and Xue Lin. Defensive dropout for hardening deep neural networks under adversarial attacks. In ICCAD, 2018.
Aleksander Jablonski. Efficiency of anti-stokes fluorescence in dyes. Nature, 1933.
George Gabriel Stokes. Xxx. on the change of refrangibility of light. Philosophical transactions of the Royal Society of London, 1852.
Frederick O Bartell, Eustace L Dereniak, and William L Wolfe. The theory and measurement of bidirectional reflectance distribution function (brdf) and bidirectional transmittance distribution function (btdf). In Radiation scattering in optical systems, 1981.
Eclat Digital. Ocean light simulator. https://eclat-digeet
com/software/.
Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen. Seeing isn believing: Towards more robust adversarial attack against real world object detectors. CCS, 2019.
Manual on Uniform Traffic Control Devices. Manual on uniform traffic control devices for streets and highways, 2023.12 12. https://muted: www..dot..a......ooooooooooo aot.goo//ddfs/1ehh Editiin/ matod11thedia ieniditiio.poe
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The paper discuss the limitations of the work.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
14

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper fully disclose all the information needed reproduce the main experimental results of the paper.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
15

---

Answer: [Yes]
Justification: https:/ /ttp:////noommuuuuumm 4open. /ct.cc/ccc////PPaaccc....////
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.. cc/
Ceciiic/gudess/Coeeee wtwpemmssssooooooioooooooooooooo for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / //iips.coo. wttpccccppppcpeeeececccccccccctc /tte:////igiieeeeeeuuuuuiiiiii
cetpsummmsssoonnii wswsnnolll. onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: /ann:y///noommuuss http:ymoussssopp... 4open. hwtp://s.....pp...eeneeeeeeeeeee /cc.enncc////IPPcccc-////// Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Section 5.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
16

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
show in tables or
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The paper provide sufficient information on the computer resources.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: http:::///euuure htt///eeuriisccoooo http://s.e..ppbblcchhhccccciieee
Answer: [Yes]
Justification:
The research conducted in this paper fully complies with the NeurIPS Code of
Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
Justification; The paper discuss both potential positive societal impacts and negative societal impacts.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The assets used in the paper properly credited and respected.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
The new assets introduced in the paper are well documented.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
19

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: : http://rpss.c/oooeeeeeeeeeeeeeee cc///oofferennce//22//1111 for what should or should be described.
20

---

A Feasibility Study
In this section, we explore the feasibility of using fluorescent ink to attack a TSR system. We introduce the fundamental concepts of fluorescent materials. Following this, render the fluorescent effect and apply it to traffic signs, which are then analyzed by a TSR system.
A.1 Fluorescent materials
Fluorescence occurs in certain molecules, called fluorophores (typically polyaromatic hydrocarbons or heterocycles), through a three-stage process illustrated in the jablonski energy diagram Jablonski [1933] (Figure 7).
First ()), photon with energy heEx from external source with wavelength AÆx (like an incandescent lamp or laser) absorbed by the fluorophore, creating an excited singlet state Sj.
(Excited electronic singlet state)
Excited-State Lifetime
(Relaxed singlet excited state)
Second (2), during its excited state, which lasts a few nanoseconds, the fluorophore undergoes conformational changes and interacts with its vironment. These interactions cause energy dis- sipation, resulting in relaxed singlet state S2, from which fluorescence emission occurs. Not all molecules return to the ground state So via fluorescence. Some molecules are depopulated through processes like collisional quenching and intersystem crossing.
S
Energy
Excitation
bc
hwp
Agx
hPSp
AsM
3
Emission
(Ground state)
Figure 7: The jablonski energy diagram Jablonski [1933] illustrating the fluorescence process.
Finally ()), photon with energy hUEM is emitted, returning the fluorophore to its ground state Sg. Due to energy dissipation, the emitted photon has lower energy and longer wavelength than the excitation photon hugz- The difference, (hoEr hegM), ), is called the stokes shift Stokes [1852].
Fluorescent materials can be either solid or liquid. Solid materials like phosphors are difficult to attach to targets and lack stealthiness. This paper focuses on fluorescent ink, which is transparent when not triggered, hard to detect, and easy to apply to targets.
A.2 Fluorescent materials rendering
In this section, we introduce the main parameters of fluorescent materials and how they render fluorescent effects the surfaces of objects. The key parameters are fluorescence quantum yield, fluorescence excitation spectrum, and fluorescence emission spectrum. The fluorescence quantum
Excitation
A
Emission
Intensity
250
300
350
400
450
500
550
600
Wavelength of light (nm)
Figure 8: The effect of excitation (blue) at different wavelengths on the fluorophore emission (red) at various excitation wavelengths is as follows: (A) Excitation at the fluorophore's excitation maximum yields maximum emission. (B-E) Excitation at suboptimal wavelengths leads decreased emission intensity, proportional to the reduced amount of excitation input.
21

---

Visible light
(b) UV light
(c) UV Visible light
Figure 9: Examples of simulated renderings include (a) BSDF rendering in visible light. (b)
fluorescent BSDF rendering in UV light, and (c) fluorescent BSDF rendering in UV and visible light.
Relative Intersity (%)
450
610
Wavelength light (nm)
(a) The fluorescence excitation and emission spectra with three different fluorescent materials.
Confidence score
Green material
350
400
600
Wavelength of light (nm)
(b) The confidence score for STOP sign with three different fluorescent materials.
The feasibility experiments involve (a) obtaining fluorescence spectra of fluorescent materials at various wavelengths, and (b) assessing the confidence scores of the TSR system regarding the STOP sign at different wavelengths for three fluorescent materials applied on its surface.
Figure 10:
yield is the ratio of the number of fluorescence photons emitted to the number of photons absorbed. It measures the efficiency of the fluorescence process. A fluorescence excitation spectrum obtained by fixing the emission wavelength (typically the maximum emission intensity) and scanning the excitation wavelength. Since excitation leads to the molecule reaching the excited state upon absorption, the excitation spectrum effectively represents the absorption characteristics. A fluores- cence emission spectrum obtained by fixing the excitation wavelength and scanning the emission fix the
wavelength produce a plot of intensity versus emission wavelength. For instance, excitation at wavelength B (350 nm) in Figure 8 and scan the emission spectrum between 430 nm and 580 nm, we obtain the emission spectrum corresponding to wavelength It important to note that illuminating fluorophore at its excitation maximum produces the greatest fluorescence output. However, illuminating at other wavelengths only affects the intensity of the emitted light, without changing the range or overall shape of the emission profile.
To render fluorescent effects the surface of objects, function (BSDF) Bartell et al. [1981], general representation of the optical properties of surface reflection and transmission. Utilizing the Ocean light simulator Digital, incorporate the specific parameters mentioned above into the fluorescence BSDF model. Figure 9 shows multiple examples of rendering. The left ball control sample without fluorescence, while the right ball represents fluorophore. Note that this fluorophore is hypothetical and created solely for demonstration purposes.
the bidirectional scattering distribution
A.3 TSR with fluorescent materials
To investigate the feasibility of fooling a TSR system, separately render three common colors, i.e. red, green, and blue, of fluorescent materials onto the surface traffic sign and feed the resulting images into the TSR system. The excitation and emission spectra of the fluorescent materials are
22

---

depicted in Figure 10 (a). The optimal trigger wavelengths for red, blue, and green fluorescent materials are 348 nm, 360 nm, and 430 nm, respectively.
In this section, we use standard stop signs and manually annotate their locations in images. We then render different fluorescent materials to these signs in the digital world and submit the modified images to the Yolov3 model for recognition. The model's confidence scores for detecting stop signs are shown in Figure 10 (b). The results show that fluorescent materials can effectively lower the model's confidence in recognizing stop signs, confirming the feasibility of this attack. Red fluorescent material significantly reduces the confidence score more than green and blue, likely due to the model's sensitivity to longer wavelengths. Green fluorescent material also lowers the confidence score over a wider wavelength range, thanks its broad excitation spectrum.
From the above experiments, we can draw the following conclusions: First, a TSR system can be successfully attacked using fluorescent materials. However, the success of such attack is not guaranteed, as the confidence scores are highly sensitive to the wavelength used. Second, various factors-such as fluorescence intensity, perturbation placement, and ambient sight-iinificantly affect the attack's effectiveness. Therefore, the same set of fluorescence parameters cannot be universally applied to different traffic signs.
B Different Settings for EOT
We present the transformation methods used in EOT.
(1) Background. We select various backgrounds, including highways, viaducts, city lanes, and country roads, and carefully position traffic signs at the road edges. Following the approach of using Google Images suggested in Zhao et al. [2019], we gather diverse set of road backgrounds to further expand the transformation set.
(2) Brightness. To simulate varying ambient brightness, we capture images of traffic signs under different weather conditions and times of day, including sunny, cloudy, rainy, evening, night, and dawn. Additionally, the intensity of headlights affects the visibility of traffic signs. We convert the traffic sign image to LAB color space, adjust the L channel values within the range [0, 50], and then convert the image back to RGB.
(3) Perspective. As shown in Figure 11, we apply perspec- tive transformations based on real-world environments in two ways. First, traffic signs are typically positioned on the right side or above the road (in right-driving countries), so they are rarely seen on the right side of the screen. Therefore, we set the horizontal field of view to range from 30 left to 60% right, with 0% directly in front.
Astensssoo Vetick
Antonsmeen Vakide
Second, On-board cameras are usually installed at specific heights (e.g., the forward-looking camera on a Tesla Model Y is positioned 1.4 to 1.5 meters above the ground). Traffic sign heights also have specific requirements (e.g., 4 to 17 feet in the U.S. on Uniform Traffic Control Devices (2023.12). typically aligning with the camera height. Thus, we set the vertical field of view to range from 0 to 60%.
Figure 11: Horizontal (left) and vertical (right) viewing angles.
(4) Distance. As an autonomous vehicle approaches a traffic sign, the size of the sign in the camera's view increases progressively. We account for the size of traffic signs at varying distances during the optimization process. Specifically, we set the maximum distance between the vehicle and the traffic sign 20 meters and record the sign's size different distances.
(5) Rotation. Traffic signs are not always directly in front of the vehicle's cameras and may be slightly offset. These slight rotations can cause misrecognition by the model, so account for rotations of plus or minus 10 degrees during the optimization process.
(6) Motion. During vehicle travel, images captured by the camera may suffer from motion blur caused by road bumps and other factors. To enhance the model's robustness, we simulate motion blur at various angles and directions.
23

---

Original Images
Triggered AEs
Untriggered AEs
40
40
40
40
40
40
40
40
40
40
5h
15h
1d
2d
4d
5d
Figure 12: Transparency of fluorescent ink at different placement times when no attack is triggered.
Table 5: The ASR of FIPatch on various models in simulation.
Overall Performance
Target Model
Transferability
ReaNer50
ResNet101
VGG13
VGG16]
CNN
Inception v3
MobileNet v2 GoogleNet
ResNer50
100%
95%
89%
91%
CNN
100%
76%
79%
80%
Source Model
R0
93%
100%
92%
94%
v3
92%
100%
69%
81%
VGG13
83%
99%
92%
MobileNet
92%
83%
99%
87%
VGG16
95%
93%
88%
GoogleNet
91%
81%
100%
Original Accuracy
99.27%
99.11%
98.70%
99.19%
99.27%
99.33%
99.61%
C Digital-world attacks
C.1 Overall performance
We conduct misrecognition attacks on various classifiers in the digital domain. Specifically, we configure the PSO search color space from (0, O, 0) to (255, 255, 255). The setup includes a single circle with a radius ranging from ( to 15 and fluorescent effect transparency set between 0.7 and 0.9. We perform random restarts and run 30 iterations per PSO.
We present the experimental results in Table 5 in two parts. First, the underlined results show the ASRs of our method in black-box setting. By using optimal attack parameters for each traffic sign, we achieve nearly 100% ASRs on several high-precision models, with VGGI3 and MobileNet v2 having slightly lower ASRs of 99%. Second, we evaluate the transferability of our attack. In this context, the source model is the attacker's 's shadow model, and the target model is the one intended for attack. As shown Table 5, the ASRs are above 85% for ResNet50, 1051 VGG13, and VGG16. The lowest ASR of 69% is observed when transferring from Inception v3 to MobileNet v2. Models with similar architectures, such as ResNet50 ResNet101, achieve high ASRs, reaching up to 93%. These results demonstrate the effectiveness of our attack across various models.
C.1.1 Impact of FIPatch in simulation
12.%
CNN
SELLIN
nentec)
CTSRD
GTSRB
ResNet50
Impact of the radius on ASRs for models trained on CTSRD and GTSRB.
Figure 13:
Figure 14: Impact of the colors C(r, g. b) ASRs.
Impact of radius. To investigate the effect of the fluorescent ink radius, we vary it from 1 to 15 pixels relative to the image height. As shown in Figure 13, there is strong corrllation between the perturbation radius and the ASR: a larger radius generally leads to a higher ASR. Additionally, smaller radii have less impact on more complex models.
24

---

Table 6: Impact of the number of circles on ASRs.
The number
Model
of circle
ResNNe55
R0sNet101
VGG13
VGG16
CNN
Inception v3
MobileNet v2 GoogleNet
88.42%
89.74%
84.18%
84.31%
96. 11%
49.26%
95.60%
98.32%
2
95.24%
97. 97.86%
94.79%
93.82%
94.19%
75.57%
89.10%
95.28%
96.41%
100%
97.36%
95.43%
98.23%
76.91%
92.15%
96.28%
96.41%
100%
96.75%
95.38%
97.83%
80.17%
97.88%
96.42%
98.27%
100%
98.65%
97.53%
97.14%
78.26%
95.70%
97.49%
Count en rnceren nuttre
Comatol cencheee
Doadd mendsuee
CNN
ResNet50
VGG16
GoogleNet
Figure 15: Impact of the positions on ASRs.
Impact colors. To analyze the impact of color on the attack's effectiveness, we test 27 different colors. As shown in Figure 14, black color results in the lowest ASR for both models and fluorescent materials that emit black are not found reality. For the CNN model, the color C(127, 127, 257,255) yields the highest ASR, while for ResNet50, the color C255,, 255, 0) achieves the highest ASR.
Impact of number of circles. We next examine how the number of circles affects the ASR. As shown in Table 6, while adding more circles generally improves the ASRs, the effect varies across different models. This because increasing the number of circles does not necessarily enlarge the perturbation area, and some circles may overlap.
Impact of positions. To explore how perturbation positions affect the ASRs, we divide the 32 x 32 pixel image into 64 blocks of 8 x 8 pixels each. As shown in Figure 15, the central region of the image has the highest percentage of successful attacks. This is because the traffic signs in the dataset are centered, making attacks on the edges less effective. Consequently, the center of the sign is the most vulnerable and prone to successful attacks.
Impact of shapes. In this section, we analyze the impact of different perturbation shapes on the ASRs. As shown in Figure 17, circles achieve much higher ASRs compared to straight and curved lines. This is because circles cover a larger area and have a more significant impact on misclassifying models. In contrast, straight lines and curves result in ASRs below 60% on Inception v3, indicating that these simple linear perturbations are less effective in causing misclassification.
D Impact of distance between UV lamp and traffic sign
We place traffic signs at 30 to the right of the vehicle distance of m0 The ambient light intensity is 150 lux, the radius of the patch re- mains 14 em and the UV lamp is po- sitioned directly in front of the traf- fie sign. We adjust the distance be- tween UV lamp and traffic sign to test its impact on the ASR of each model. As shown in Table all four models achieve 100% ASR when the dis- tance is less than 1 m. As the distance increases, the ASR gradually decreases, as the fluorescence effect triggered by the UV light weakens with greater distance. ResNet50, VGG13, and CNN show
Table 7: Impact of the distance between UV lamp and traffic sign on ASRs.
Model
lm
2m
4m
6m
8m
ResNet50
100%
98%
96%
90%
87%
VGG13 CNN
100%
97%
96%
89%
84%
100%
100%
98%
93%
90%
GoogleNet
100%
93%
89%
87%
81%
25

---

angle 16"
angle
amgle (*)
angle (")
-15"
16
-15"
0"
30
85% eats 90% 90% DErs 822
30
94% 80% 90% 84%
10%% 94% 88% 92%
30"
77% Bots 57% 8o% B3% mp
pers a maaee satriirnete
87%
45"
eg eorsiss peruass aerraeararrdee
60-
6g
20
20
20
20
distance (m)
15
distlice (m)
15
distance (m)
distance (m)
R1
VGG16
CNN
Inception v3
Figure 16: Impact of the distance angle between vehicle and traffic sign ASRs.
the most significant decrease in ASR when the distance increases from m to 6m. In contrast, GoogleNet experiences the largest drop in ASR between 2 m and m. To achieve optimal attack results, we recommend placing the UV lamps in bushes within 4m of the traffic signs. Notably, all models maintain an ASR of at least 81 even at a distance of 8 m.
E
Defenses
Typically, AE defenses are designed for digital domains to detect small perturbations. In physical AEs, attackers cannot precisely control inputs and are constrained by real-world conditions. Since defenses for physical AEs are less well-studied compared those for digital AEs, and many existing approaches simply apply general AE defenses the physical world, we select three popular AE defense classes evaluate our FIPatch.
100
Attack success rate
Shapes
Straight
Small circle
Large circle
The first category is input preprocessing, which includes image smoothing Cohen et al. [2019], feature compression Jia et al. [2019], and input randomization Xie al. [2017]. Specifically, image smoothing Cohen et al. [2019] involves training a neural network f with Gaussian data augmentation (variance o and using / to cre- ate new "smoothing classifier." In this paper, we set to 0.5. Feature compression Jia et al. [2019] leverages redundant information images to defend against AEs. We use the same network structure as in Jia et al. [2019] and apply it to AES generated by our FIPatch. Input randomization Xie et [2017] uses random resizing or padding reduce adversarial effects. We resize the input image from 32 x 32 to 36 x 36. For Inception v3, we first shrink the image to 290 x 290 and then pad to 299 299.
50-
Rowterto
Resteetss vo013
ChN
Models
Figure 17: Impact of the shapes on ASRs.
The second category is adversarial training Madry et al. [2017], a widely used defense method that aims help the model learn to recognize and counteract attacks. We set the perturbation radius in FiPatch to 7, with Particle Swarm Optimization (PSO) exploring various locations and colors. Each model generates AEs that successfully perform an attack, representing 10% of the initial training set, and records the original correct labels of these AEs. Each model then continues training for 10 epochs on its own set of generated AEs.
The third category is structural modifications, with defensive dropout Wang et al. [2018] being a notable example. This method improves upon random activation pruning. We implement dropout during both training and testing, setting the dropout rate to 0.3 to achieve robust defense.
Due to the vulnerability of the TSR system, we propose potential defense against our FlPatch attack: high definition maps. Traffic signs are typically fixed, unlike changeable traffic lights, which means their information remains stable over time. High definition maps, which contain accurate
26

---

traffic sign information, are not affected by FlPatch attacks. Vehicles equipped with such maps can make informed decisions based on the traffic sign data provided, independent of potential perturbations caused by attacks. Furthermore, changes to traffic signs generally require approval from the traffic department. High definition map providers can update the map information real-time based on official announcements from traffic authorities, ensuring that the data remains current and reliable. However, using high definition maps does not eliminate the need for sensing system. In cases of unexpected road conditions delays in map updates, sensors are crucial for ensuring safe driving. Therefore, combining high-definition maps with robust sensor systems improves the safety of autonomous vehicles against AEs.
27


Reviews:
[{"review_id": "4avNlNM0YC", "reviewer": "Reviewer_XS8P", "summary": "This paper proposes FIPatch, a novel physical adversarial attack against traffic sign recognition (TSR) systems using fluorescent ink. Unlike conventional attacks that rely on visible stickers, projections, or acoustic signals, FIPatch leverages the stealthy properties of fluorescent materials, which remain invisible under normal conditions but are activated by ultraviolet (UV) light. The authors design a comprehensive framework to optimize the shape, color, and placement of fluorescent perturbations digitally before physically applying them. FIPatch achieves high attack success rates—over 98% in low-light conditions—and can mislead TSR systems to hide, forge, or misclassify traffic signs. It also bypasses five popular defense mechanisms. Extensive real-world and simulation experiments demonstrate its robustness across various models, lighting conditions, distances, and vehicle speeds.", "questions": "see the weakness", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. A novel adversarial attack form in the physical world, is verified to be effective for traffic sign recognition. \n2. The writing is clear, which makes readers can easily understand the paper. \n\nWeakness:\n\n1. In section 3.2, the authors state that there is no direct access to a victim's vehicle. That means the attackers should perform physical attacks based on the transferability. However, as for the method, I find it seems a query-based attack (i.e., using the PSO algorithm). Thus, evaluating the transferability against the unknown threat models is important and necessary in this setting.\n\n2. In Table 2, the authos evalute five models, for generative attack and hiding attack, they test Yolo and faster-rcnn (object detection models), but for misrecognition attack, they test ResNet, VGG, etc (image classification models), why not test object detection models for misrecognition attack. I mean that, for three forms of attacks, all the five threat models should be test. \n\n3. This paper only verified the proposed method in traffic sign recognition task, how about other object detection tasks, like face recognition, general object detection, etc. \n\n4. The contributions should be extended, thus readers can better understand the novelty in this paper. At least the second contribution should point out what is the specific novelty for the proposed method compared with the current methods.", "was_revised": true, "final_justification": "Thank the authors for addressing my questions. I will keep my score", "rebuttal": "**We greatly appreciate your constructive suggestions, which we believe could be addressed in the next version.**\n\n**Q-1. Evaluating the transferability against the unknown threat models is important and necessary in this setting.**\n\nA-1. We agree that evaluating transferability under a black-box setting is particularly important. In our experiments, we tested the transferability of FIPatch and reported the results in **Table 5 in the Appendix**. As shown in Table 5, the attack success rates (ASRs) are above 85% when transferring to models such as ResNet50, ResNet101, VGG13, and VGG16. The lowest ASR is 69%, which occurs when transferring from Inception v3 to MobileNet v2. Notably, models with similar architectures (e.g., ResNet50 to ResNet101) exhibit high transferability, with ASRs reaching up to 95%. These results demonstrate the strong transferability of our attack across various models. In the next version, we will move these results into the main text.\n\n**Q-2. For three forms of attacks, all the five threat models should be test.**\n\nA-2. We apologize for possible misunderstanding about the experiments. As described in Section 4.3, we define goal-based loss functions according to different attack objectives. For hiding and generative attacks, the loss functions are based on the model’s outputs $Pr(object)$ and $Pr(class)$. Note that $Pr(object)$ is the confidence that an object exists in a given cell. Since image classifiers do not produce this objectness score, it is not feasible to evaluate hiding or generative attacks on classification models. Following your suggestion, we have revised Table 2 to include the ASRs of misrecognition attacks against object detectors. The updated results are shown below:\n\n**Table: The ASR of FIPatch on various models in the physical world under misrecognition attack.**\n\n| Light (Lux) | Frames | Yolov3 | Faster R-CNN | ResNet50 | VGG13  | MobileNet v2 | GoogleNet |\n| :---------: | :----: | :----: | :----------: | :------: | :----: | :----------: | :-------: |\n|     200     |  4374  |  100%  |    98.24%    |   100%   | 99.82% |    98.93%    |   100%    |\n|     500     |  3655  | 98.44% |    94.69%    |  99.35%  | 98.01% |    95.38%    |  97.52%   |\n|    1000     |  4163  | 93.27% |    89.41%    |  94.26%  | 92.58% |    92.15%    |  93.66%   |\n|    2000     |  3719  | 89.43% |    84.73%    |  90.59%  | 86.37% |    85.92%    |  84.03%   |\n|    3000     |  3924  | 85.93% |    77.57%    |  84.12%  | 79.55% |    74.59%    |  76.15%   |\n\nWe will clarify this distinction in the revised manuscript and incorporate the updated results into Table 2. Furthermore, we evaluated the performance of FIPatch across different models in our ablation study, which further highlights its effectiveness and robustness.\n\n**Q-3. This paper only verified the proposed method in traffic sign recognition task, how about other object detection tasks, like face recognition, general object detection, etc.**\n\nA-3. We chose traffic sign recognition because it is a highly representative task that involves both classification and detection. It is reasonable to extend our method to other scenarios, such as human recognition in surveillance systems, where an attacker could wear clothing with fluorescent materials. As for face recognition, it presents new challenges due to the complex 3D surface of the human face, and we consider it a promising direction for future work. We will include a discussion on the potential extension to other tasks in the next version.\n\n**Q-4. The contributions should be extended, thus readers can better understand the novelty in this paper. At least the second contribution should point out what is the specific novelty for the proposed method compared with the current methods.** \n\nA-4. We are the first to propose the use of fluorescent ink for physical adversarial attacks. Existing methods can be categorized into those using stickers, light, or acoustic signal. However, sticker-based approaches [1]\\[2][3] suffer from poor stealthiness and indiscriminately attack all vehicles once deployed. Visible light-based attacks [4]\\[5] make it easy to trace the attacker, while invisible light (e.g., infrared [6]) can be easily countered by infrared filters. In addition, acoustic signal-based attacks [7] can be easily blocked by physical signal protection mechanisms. Unlike existing methods, our approach introduces fluorescent ink as a novel attack medium, which significantly enhances stealth and poses greater challenges for defense mechanisms.\n\nAlthough fluorescent ink enables invisible and actively triggered features, designing an effective and robust physical adversarial patch remains non-trivial with the following challenges. First, it is challenging to simulate fluorescent effects and determine the optimal choices of massive factors in fluorescent ink, e.g., color, transparency, and size, for achieving high attack effectiveness. Second, fluorescent effects are easily influenced by real-world environments, including surroundings, ambient light, and vehicle distance. Existing methods do not address these challenges, and most require manual annotation of traffic sign locations.\n\nTo address the above challenges, we design the FIPatch that leverages the unique properties of fluorescent ink. In more detail, our methodology consists of four key modules. First, we develop a color-edge fusion method to automatically locate traffic signs, enabling precise application of fluorescent ink to the signs, rather than invalid backgrounds. Second, to effectively simulate fluorescent effects, we model fluorescent perturbations on traffic signs by defining the various critical parameters of fluorescent ink, including colors, intensities, and perturbation sizes. Third, we design goal-based and area-based loss functions to achieve high ASRs with minimal perturbations, supporting three attack goals: hiding attack, generative attack, and misclassification attack. Finally, to improve the robustness of FIPatch in the physical world, we present several fluorescence-specific transformation methods that simulate fluorescence perturbations for real-world attacks.\n\nThe consistency between digital and physical experimental results further validates the effectiveness of our approach. In the next version, we will extend the contributions to elaborate on our innovations and highlight the differences from existing methods.\n\n**Reference**\n\n[1] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In *CVPR*, 2018.\n\n[2] Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In *WOOT*, 2018.\n\n[3] Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In *AAAI*, 2019.\n\n[4] Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations. In *USENIX Security*, 2021.\n\n[5] Ranjie Duan, Xiaofeng Mao, A Kai Qin, Yuefeng Chen, Shaokai Ye, Yuan He, and Yun Yang. Adversarial laser beam: Effective physical-world attack to dnns in a blink. In *CVPR*, 2021.\n\n[6] Takami Sato, Sri Hrushikesh Varma Bhupathiraju, Michael Clifford, Takeshi Sugawara, Qi Alfred Chen, and Sara Rampazzi. Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception. In *NDSS*, 2024.\n\n[7] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: A triggered physical adversarial patch. In *USENIX Security*, 2023."}, {"review_id": "xNfcHnGeD0", "reviewer": "Reviewer_1t4h", "summary": "This paper introduces FIPatch, a stealthy physical-world adversarial attack that uses fluorescent ink to alter the appearance of traffic signs.", "questions": "1 As shown in Figure 15, the central region of the image exhibits the highest percentage of successful attacks, indicating that attacks targeting the center of the sign are more effective. Given that the fluorescent ink can only be applied on the traffic sign itself, I believe the objective function defined in your formulation (Eq. 8) is already capable of implicitly optimizing the patch placement toward the most effective region, typically near the center of the sign. Therefore, the method introduced in Section 4.1 for region selection feels unnecessary or redundant. If this step is essential, the paper should better justify its inclusion and clearly explain how it improves upon direct optimization via the objective function alone.\n2 In Section 5, Table 2, it’s unclear whether the attack is white-box or black-box. If it’s white-box, this may not reflect realistic real-world scenarios. Please clarify the threat model and consider evaluating the attack in a black-box transfer setting to better demonstrate its practical robustness.\n3 The authors should consider imposing a hard constraint on the attack area size to ensure the perturbation remains imperceptible to human drivers. As shown in Figure 4, the first two traffic signs are difficult to recognize even for humans. If successful attacks require such visually obtrusive modifications, similar effects could be achieved by simply occluding or blocking the sign, which weakens the motivation for an adversarial approach.", "limitations": "See questions", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "The authors conduct extensive experiments in both digital and physical environments, covering three distinct attack goals", "was_revised": true, "final_justification": "Most of the issues I raised have been adequately addressed by the authors, so I am updating my score accordingly. I suggest revising the remaining unclear part for clarity.", "rebuttal": "**Thanks for your valuable comment. We have explained your questions and modified the corresponding content in the next version according to your suggestions.**\n\n**Q-1. The method introduced in Section 4.1 for region selection feels unnecessary or redundant.**\n\nA-1. We apologize for the possible misunderstanding about Section 4.1. We would like to emphasize that Section 4.1 is indispensable for the following two reasons:\n\n- **The final perturbation may extend beyond the region of the traffic sign (TS).** For example, a real-world image captured by a camera typically includes both the TS and its background. Direct optimization in such cases may generate perturbations that spread into the background, which cannot be physically realized using fluorescent ink. Additionally, although Figure 15 shows that the central region of the TS exhibits the highest percentage of successful attacks, perturbations with a large radius may still exceed the TS boundary. Therefore, it is essential to apply the mask defined in Section 4.1 to ensure that the perturbation remains strictly within the TS area.\n- **Section 4.1 significantly benefits the optimization process.** In real-world scenarios, it is impractical to manually test a wide range of attack parameters on physical TSs. Thus, we propose a simulation-and-optimization framework to search for optimal attack parameters. The automatic localization in Section 4.1 enables a fully automated attack pipeline, ensuring that the generated perturbation is both deployable and confined to the TS region. As a result, attackers can directly apply the optimized perturbation in the physical world with high attack success rates (ASRs).\n\nWe will revise the manuscript to reduce the redundancy and better justify the necessity of Section 4.1 and clearly explain how it improves the attack pipeline.\n\n**Q-2. Please clarify the threat model and consider evaluating the attack in a black-box transfer setting to better demonstrate its practical robustness.**\n\nA-2. **We already evaluated FIPatch’s transferability in Table 5 of the Appendix**. We define our attack as a black-box setting in Section 3.2, where the attacker has no access to the internal parameters, architecture, or gradients of the target model. This black-box setting is highly practical in the physical world. As shown in Table 5, the ASRs exceed 85% when transferring to models such as ResNet50, ResNet101, VGG13, and VGG16. The lowest ASR, 69%, occurs when transferring from Inception v3 to MobileNet v2. High ASRs, such as the 95% observed when transferring from ResNet50 to ResNet101, indicate that models with similar architectures are particularly vulnerable. These experimental results demonstrate the robustness of FIPatch across different models. In the next version, we will move these transferability experiments to Section 5 and highlight the black-box setting in the threat model.\n\n**Q-3. The authors should consider imposing a hard constraint on the attack area size to ensure the perturbation remains imperceptible to human drivers. As shown in Figure 4, the first two traffic signs are difficult to recognize even for humans.**\n\nA-3. In our design (Section 4.3), we have already considered an area-based loss, which introduces the smallest perturbation, to enhance the practicality of FIPatch in the physical world. As shown in Figure 4, our generative attack can fool the TSR system even when the perturbation is only a ring, and a driver will not recognize it as a \"STOP\" sign. In both Hiding and Misrecognition attacks, the driver can still recognize the original traffic sign. Moreover, for the hiding attack, when the attacker does not trigger the perturbation, the traffic sign still appears as a normal stop sign to human drivers; however, once triggered, the TSR system fails to detect it. It is worth noting that for the Hiding Attack, the perturbation radius tends to be larger. This may be because larger perturbations are required to shift the model's attention away from the original traffic sign. We will clarify and discuss this observation in the next version."}, {"review_id": "jxV8ufk31P", "reviewer": "Reviewer_MB7X", "summary": "This paper introduces a new physical attack vector that leverages fluorescent ink to craft adversarial patches targeting traffic sign recognition models. The physical realization involves the use of invisible UV lighting, which activates the otherwise invisible fluorescent ink, rendering the attack patch visible only under specific conditions. This enables attackers to dynamically control the activation of the patch, offering a significant advantage over traditional passive sticker-based attacks. The effectiveness of the proposed method is evaluated across multiple datasets and model architectures.", "questions": "Questions\n1. This work seems more focused on engineering. Aside from the patch fabrication, what are the new technical or methodological contributions?\n2. There are existing physical attack baselines (e.g., sticker, projector). Can the authors include these for a fair comparison?\n3. The attack success rates are very high on the authors' own setting, which suggests possible overfitting. It's unclear how well the method generalizes to different conditions (e.g., new environments, bad weather).\n4. The supplementary images are low resolution (32×32). Was the patch really designed at this size and used directly in the physical setup? If so, more explanation is needed.\n\nSuggestions\n1. Moving the method details (L60–70) from the Introduction to the Methods section would improve the structure and clarity of the paper.\n2. The citation style should be revised to follow a standard academic formatting convention.", "limitations": "The fluorescent patch is too visible, which may limit its practicality in real-world use. It also requires an additional UV lamp, adding extra cost and complexity.", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 1, "clarity": 2, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Strengths\n- The idea of leveraging fluorescent ink for physical adversarial attacks is quite interesting and plausible.\n- The paper includes various evaluations and ablation analyses.\n\nWeaknesses\n- The paper shows solid engineering work in using fluorescent ink for physical adversarial patches, but it lacks new methodological contributions. It mainly applies existing physical attack techniques to a new material.\n- The methodology section needs more detail and clearer justification, especially for the physical implementation.\n- The fluorescent patch is too visible, which may reduce its practicality in real-world scenarios.\n- The evaluation uses outdated CNN models. It should include newer models like vision transformers.\n- The high attack success rates (98.31% and 96.72%) suggest the evaluation doesn't consider real-world challenges like out-of-distribution data or adverse weather.\n- The paper only tests defenses designed for digital attacks. It should include evaluations with more advanced physical defenses.\n- The writing needs improvement for clarity and readability.\n\nTypos\n- L27: focue -> focus\n- L35: Sato et al. (Redundant)\n- L38: Zhu et al. (Redundant)\n- L118: Zhu et al. (Redundant)", "was_revised": true, "final_justification": "Most of my concerns have been addressed throughout the discussion. However, the current submission may still require major revisions to incorporate the provided responses and present the work more clearly. As a result, I lean toward rejecting the paper, though I believe the revised version could be acceptable for submission to a next top-tier venue.", "rebuttal": "**Q-1. Lacks new methodological contributions.**\n\nA-1. We highlight again that we explore a new adversarial attack **strategy** by using the fluorescent ink to achieve a more stealthy and effective attack in the physical world. Compared with existing methods, our FIPatch offers the following advantages:\n\n1. High effectiveness: Existing methods are often vulnerable to defense strategies, such as optical filters or physical signal protection mechanisms. In contrast, our approach cannot be easily defended against by current techniques and demonstrates strong robustness in the physical world. This is validated by both digital and physical experiments.\n\n2. Unconspicuous: Our method supports flexible triggering. It remains invisible when inactive and minimizes the perturbation area when activated. In the physical world, the perturbation only needs to be active for a short time. When a self-driving car approaches the stop sign, even if it fails to recognize the stop sign for merely a short time window, it can lead to a fatal accident.\n\nAlthough fluorescent ink enables invisible and actively triggered features, designing an effective and robust physical adversarial patch introduces **new** challenges.\n\n(1) It is challenging to simulate fluorescent effects and determine the optimal choices of massive factors in fluorescent ink, e.g., color, transparency, and size, for achieving high attack effectiveness. \n\n(2) Fluorescent effects are easily influenced by real-world environments, including surroundings, ambient light, and vehicle distance. \n\n**Existing methods do not address these challenges**, and most require manual annotation of traffic signs. To address the challenge (1), we first develop a color-edge fusion method to automatically locate traffic signs, enabling precise application of fluorescent ink to the signs, rather than invalid backgrounds. Second, to effectively simulate fluorescent effects, we model fluorescent perturbations on traffic signs by defining the various critical parameters of fluorescent ink, including colors, intensities, and perturbation sizes. Third, we design goal-based and area-based loss functions to achieve high ASRs with minimal perturbations, supporting three attack goals: hiding attack, generative attack, and misclassification attack. To solve the challenge (2), we present several fluorescence-specific transformation methods to improve the robustness of FIPatch in the physical world. The consistency between digital and physical experimental results further validates the effectiveness of our approach. \n\nWe still believe our method is novel. In the next version, we will extend the contributions to elaborate on our innovations and highlight the differences from existing methods.\n\n**Q-2. The fluorescent patch is visible.**\n\nA-2. Please refer to **Reviewer 1t4h’s Q-3**.\n\n**Q-3. The evaluation uses outdated CNN models.**\n\nA-3. We follow prior work (e.g., [1] (USENIX-2023), [2] (CVPR-2022), [3] (NDSS-2022), [4] (USENIX-2021), [5] (CVPR-2021), [6] (NDSS 2024)) by using both one-/two-stage detectors and classifiers (including CNN) for TSR.\n\n**Q-4. Can the authors include existing physical attacks (e.g., sticker, projector) for a fair comparison?**\n\nA-4. It is **unfair** to compare existing work in the experimental section. Due to the diversity of physical environments, the difficulty of acquiring attack equipment, and the unavailability of source code, most physical attacks [6] (NDSS 2024), [1] (USENIX-2023), [2] (CVPR-2022), [4] (USENIX-2021), [5] (CVPR-2021) are compared with other methods only from a theoretical perspective. In addition, sticker attacks all vehicles indiscriminately once deployed, which lacks flexibility. Although projectors can be actively triggered, the cost of attack is too high, and the price of projectors used in [4] ranges from $1,500 to $44,379. Therefore, we follow the comparison approach adopted in these works.\n\nTo address the reviewer’s concern, we establish several baselines for comparison:\n\n- For the hiding attack, we cover the entire surface of the traffic sign (TS) with fluorescent ink.\n- For the misrecognition attack, we draw a 14cm-radius fluorescent ink circle at the center of a 60 cm × 60 cm TS.\n- For the generative attack, a naive approach is to imitate a real TS. However, this compromises stealth, as humans can easily recognize the fake sign.\n\nThe ASR results are presented below:\n\n|          Scheme           | Yolov3 | Faster R-CNN | CNN  | VGG13 |\n| :-----------------------: | :----: | :----------: | :--: | :---: |\n|     Baseline (Hiding)     |   3%   |      1%      |  -   |   -   |\n|          FIPatch          |  91%   |     88%      |  -   |   -   |\n| Baseline (Misrecognition) |  17%   |     13%      | 24%  |  19%  |\n|          FIPatch          |  100%  |     98%      | 100% |  99%  |\n\nThe results show that the baseline methods yield low ASR, with none exceeding 24%. This proves that such naive approaches are invalid and validates the effectiveness of our method. In the next version, we will include the baseline comparison. If insist, we will also incorporate results from related work for further comparison.\n\n**Q-5. The high ASR suggests possible overfitting. How well the method generalizes to different conditions?**\n\nA-5. A high ASR does not imply that real-world challenges were overlooked. We conducted experiments in both digital and physical settings, along with extensive ablation studies. Especially in the physical-world experiments, FIPatch consistently achieves high ASR across varying distances, angles, UV lamp powers, and vehicle speeds. In fact, the consistency between our digital and physical experiments validates the effectiveness of our approach. Following your suggestion, we evaluated FIPatch under rainy conditions by simulating rain with a sprinkler. The ASR dropped by only 1%. Additional weather experiments will be included in the next version.\n\nMoreover, prior works have also achieved high ASR. For example, [1] (USENIX-2023) reported an ASR of 96%, and [6] (NDSS 2024) achieved 100%. Therefore, our method **does not suffer from overfitting**.\n\n**Q-6. It should include evaluations with more advanced physical defenses.**\n\nA-6. We sincerely appreciate your insightful suggestion! We consider the following physical defenses: camera-LiDAR fusion, optical filters, and multi-camera fusion.\n\n- Camera-LiDAR fusion: Since traffic signs are planar objects, LiDAR cannot capture the content of the sign. As a result, existing TSR systems primarily rely on cameras.\n\n- Optical filters: Our attack remains effective even with optical filters. Since fluorescence emits visible light, only visible-light filters could block it. However, no cameras in current AVs use visible-light filters. Moreover, filtering a single color does not prevent the effectiveness of fluorescent materials in other colors.\n\n- Multi-camera fusion: We evaluated multi-sensor fusion defenses in the physical world. Specifically, we captured the same traffic sign from five different angles (−20°, −10°, 0°, 10°, and 20°) and applied a voting-based decision strategy. The ASR results are shown below:\n\n|       Scheme        | CNN  | ResNet50 | VGG13 | GoogleNet |\n| :-----------------: | :--: | :------: | :---: | :-------: |\n|     W/o defense     | 100% |   99%    |  99%  |    99%    |\n| Multi-sensor fusion | 97%  |   94%    |  95%  |    95%    |\n\nExperimental results show that multi-sensor fusion can reduce the ASR by at most 5%, demonstrating the strong robustness of FIPatch. Moreover, as illustrated in Figure 5, ASR is less sensitive to changes in angle but is significantly affected by variations in distance. In the next version, we will evaluate additional physical-world defense strategies and provide further discussion on the results.\n\n**Q-7. The supplementary images are low resolution (32×32). Was the patch really designed at this size?**\n\nA-7. We apologize for the possible misunderstanding about the experimental setup. **Our FIPatch is designed for the physical setup.** The 32×32 size refers to the image’s resolution on the dataset. In the physical setup, the traffic sign is 60cm×60cm, and the real-world adversarial patch, typically no larger than 14cm, is resized and adjusted using EOT transformations to ensure robustness under various physical conditions. In the next version, we will provide a more detailed explanation of the settings used in the physical world.\n\n**Q-8. Moving the method details (L60–70) to the Methods section.**\n\nA-8. Thanks for your valuable suggestion! In the next version, we will move the details to the methodology section, especially for the physical implementation. \n\n**Reference**\n\n[1] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: A triggered physical adversarial patch. In *USENIX Security*, 2023.\n\n[2] Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon. In *CVPR*, 2022.\n\n[3] Wei Jia, Zhaojun Lu, Haichun Zhang, Zhenglin Liu, Jie Wang, and Gang Qu. Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems. In *NDSS*, 2022.\n\n[4] Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations. In *USENIX Security*, 2021.\n\n[5] Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai. The translucent patch: A physical and universal attack on object detectors. In *CVPR*, 2021.\n\n[6] Takami Sato, Sri Hrushikesh Varma Bhupathiraju, Michael Clifford, Takeshi Sugawara, Qi Alfred Chen, and Sara Rampazzi. Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception. In *NDSS*, 2024.\n\n[7] Eykholt K, Evtimov I, Fernandes E, et al. Robust physical-world attacks on deep learning visual classification. In *CVPR*, 2018."}, {"review_id": "DBFUsbmItz", "reviewer": "Reviewer_7D6S", "summary": "This paper proposes a novel adversarial attack method for TSR systems using fluorescent ink as the attack medium. The perturbation remains invisible under normal lighting conditions and only becomes active under invisible UV light. Both digital and physical experiments are conducted, including tests on real vehicles, to verify the effectiveness and robustness of FIPatch. Additionally, the paper evaluates the proposed method against existing defense mechanisms.", "questions": "This work discovers a novel attack medium (fluorescent ink) to misclassify TSR while being unnoticed. The problem is not new, and previous work has shown how to perform physical attacks. Nonetheless, the paper discovers how fluorescent ink patches can be designed to further advance the field. Experiments in the physical world confirm the effectiveness of the attack. Also, the use of real vehicle cameras and machine models enhances the credibility and practicality of the attack. \n\nThe writing of the paper is logically clear and easy to follow. I really appreciated the explanation of fluorescence, even though it is placed in the appendix. I also found the simulation results, especially the ablation studies, very helpful for understanding the experimental setup. The authors might consider moving part of this content into the main body of the paper. Still, I have concerns about FIPatch.\n\nUV light is invisible, using a UV lamp may be visible. How can the attacker ensure that the UV lamp remains covert? Moreover, in some scenarios, such as highways, where traffic signs are usually placed high, can the attack still be successful at this point? It would be helpful if this aspect could be explained to alleviate the concerns about the stealthiness.\n\nThe paper should further discuss the feasibility of defenses, e.g., could a UV filter defend against the attacks in this paper? Relying solely on high-definition maps may not be sufficient, especially in cases where traffic signs have been replaced by workers but the maps are not yet updated.\n\nAlthough physical experiments are thorough, the impact is only measured at the AI component level (classification/detection), not on full AV systems (e.g., driving decisions).", "limitations": "Yes, the authors have explicitly discussed limitations and societal impacts in Section 7. They acknowledge that (1) the attack was not evaluated in full driving systems, and (2) ambient light significantly affects performance. The ethical section appropriately addresses safety and IRB compliance, showing responsible disclosure.", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The use of fluorescent materials as an adversarial medium is both novel and practical.\n2. The methodology is well-motivated and technically sound.\n3. The experiments include both digital and physical results. The use of real vehicles enhances the credibility of the method's applicability and effectiveness in the physical world.\n\nWeaknesses:\n1. The use of UV lamps may be detectable depending on the deployment environment.\n2. The paper could further discuss potential defenses.", "was_revised": true, "final_justification": "Thanks for your response. I have read the authors’ rebuttal and the comments from other reviewers. I appreciate the additional experimental results and the discussion addressing my concerns so I raised my score.", "rebuttal": "**We sincerely thank you for your insightful and positive feedback!**\n\n**Q-1. UV light is invisible, using a UV lamp may be visible. How can the attacker ensure that the UV lamp remains covert? Moreover, in some scenarios, such as highways, where traffic signs are usually placed high, can the attack still be successful at this point? It would be helpful if this aspect could be explained to alleviate the concerns about the stealthiness.** \n\nA-1. We tested the impact of distance between UV lamp and traffic sign in **Appendix Section D** and found that there is still an attack success rate of at least 81% at a distance of 8 meters. This distance is sufficient for an attacker to place the UV lamp in the bushes near the traffic sign. In addition, since the UV light is invisible to the naked eye, the victim cannot locate the light source, and the attack device is in the bushes, further increasing the stealthiness of the attack. For elevated traffic signs commonly found on highways, attackers can leverage drones to carry out the attack. By equipping a drone with a UV lamp and hovering it at a specific position, the attacker can activate the perturbation without physical access to the sign. The drone only needs to remain in position for a few seconds during the attack and can quickly leave the area afterward, making the attack highly stealthy and flexible.\n\n**Q-2. The paper should further discuss the feasibility of defenses, e.g., could a UV filter defend against the attacks in this paper? Relying solely on high-definition maps may not be sufficient, especially in cases where traffic signs have been replaced by workers but the maps are not yet updated.**\n\nA-2. A UV filter **cannot defend** against FIPatch. First, they cannot stop fluorescent materials from absorbing UV light, and the emitted visible light is still captured by cameras. Second, UV filters hide the attack source by blocking UV light in images. Apart from high-definition maps, we believe that collaborative perception among multiple vehicles is also a promising defense strategy. Specifically, while an attacker may launch adversarial attacks using fluorescent ink against a specific vehicle, other unaffected vehicles are still able to recognize the traffic sign correctly. By leveraging recognition results from nearby vehicles on the same road, the victim’s vehicle can correct its prediction. This cross-vehicle information sharing mechanism can significantly enhance the system’s robustness against adversarial attacks.\n\n**Q-3. Although physical experiments are thorough, the impact is only measured at the AI component level (classification/detection), not on full AV systems (e.g., driving decisions).**\n\nA-3. Our paper has mentioned this issue in the limitation. For fairness, we followed prior studies [1]-(USENIX-2023), [2]-(NDSS-2022), [3]-(USENIX-2021), and mentioned the AD systems in limitation. If insist, we could provide results on real-AD systems.\n\n**Reference**\n\n[1] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: A triggered physical adversarial patch. In *USENIX Security*, 2023.\n\n[2] Wei Jia, Zhaojun Lu, Haichun Zhang, Zhenglin Liu, Jie Wang, and Gang Qu. Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems. *NDSS*, 2022.\n\n[3] Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations. In *USENIX Security*, 2021."}]

Author rebuttal:

Meta-review: This paper proposes a physical attack on traffic sign recognition using fluorescent ink and presents a coherent framework that models fluorescence in the digital domain and translates it into a realizable physical design; its novelty and practical stealth are highly notable. Even under a black-box setting, the work demonstrates high attack success rates in real-world conditions and evasion of multiple defenses, and—after the rebuttal—adds evaluations including ViTs and matched-condition comparisons that appropriately mitigate the main concerns. Remaining issues include streamlining the exposition, clarifying the query budget and optimization procedure, and supplementing discussion of UV operational constraints and transferability, all of which appear readily addressable in the camera-ready. Overall, the originality of the medium and the solid empirical evidence substantiate the contribution to the NeurIPS community, and I recommend acceptance at the upper end of the borderline range.
Decision: Accept (poster)