Title: The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition
Venue: NeurIPS 2025
Accepted: yes
Keywords: Physical adversarial patch; Traffic sign recognition; Fluorescent ink.
Abstract: Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel adversarial attack method for TSR systems using fluorescent ink as the attack medium. The perturbation remains invisible under normal lighting conditions and only becomes active under invisible UV light. Both digital and physical experiments are conducted, including tests on real vehicles, to verify the effectiveness and robustness of FIPatch. Additionally, the paper evaluates the proposed method against existing defense mechanisms.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The use of fluorescent materials as an adversarial medium is both novel and practical.\n2. The methodology is well-motivated and technically sound.\n3. The experiments include both digital and physical results. The use of real vehicles enhances the credibility of the method's applicability and effectiveness in the physical world.\n\nWeaknesses:\n1. The use of UV lamps may be detectable depending on the deployment environment.\n2. The paper could further discuss potential defenses.\n\nQUESTIONS:\nThis work discovers a novel attack medium (fluorescent ink) to misclassify TSR while being unnoticed. The problem is not new, and previous work has shown how to perform physical attacks. Nonetheless, the paper discovers how fluorescent ink patches can be designed to further advance the field. Experiments in the physical world confirm the effectiveness of the attack. Also, the use of real vehicle cameras and machine models enhances the credibility and practicality of the attack. \n\nThe writing of the paper is logically clear and easy to follow. I really appreciated the explanation of fluorescence, even though it is placed in the appendix. I also found the simulation results, especially the ablation studies, very helpful for understanding the experimental setup. The authors might consider moving part of this content into the main body of the paper. Still, I have concerns about FIPatch.\n\nUV light is invisible, using a UV lamp may be visible. How can the attacker ensure that the UV lamp remains covert? Moreover, in some scenarios, such as highways, where traffic signs are usually placed high, can the attack still be successful at this point? It would be helpful if this aspect could be explained to alleviate the concerns about the stealthiness.\n\nThe paper should further discuss the feasibility of defenses, e.g., could a UV filter defend against the attacks in this paper? Relying solely on high-definition maps may not be sufficient, especially in cases where traffic signs have been replaced by workers but the maps are not yet updated.\n\nAlthough physical experiments are thorough, the impact is only measured at the AI component level (classification/detection), not on full AV systems (e.g., driving decisions).\n\nLIMITATIONS:\nYes, the authors have explicitly discussed limitations and societal impacts in Section 7. They acknowledge that (1) the attack was not evaluated in full driving systems, and (2) ambient light significantly affects performance. The ethical section appropriately addresses safety and IRB compliance, showing responsible disclosure.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a new physical attack vector that leverages fluorescent ink to craft adversarial patches targeting traffic sign recognition models. The physical realization involves the use of invisible UV lighting, which activates the otherwise invisible fluorescent ink, rendering the attack patch visible only under specific conditions. This enables attackers to dynamically control the activation of the patch, offering a significant advantage over traditional passive sticker-based attacks. The effectiveness of the proposed method is evaluated across multiple datasets and model architectures.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The idea of leveraging fluorescent ink for physical adversarial attacks is quite interesting and plausible.\n- The paper includes various evaluations and ablation analyses.\n\nWeaknesses\n- The paper shows solid engineering work in using fluorescent ink for physical adversarial patches, but it lacks new methodological contributions. It mainly applies existing physical attack techniques to a new material.\n- The methodology section needs more detail and clearer justification, especially for the physical implementation.\n- The fluorescent patch is too visible, which may reduce its practicality in real-world scenarios.\n- The evaluation uses outdated CNN models. It should include newer models like vision transformers.\n- The high attack success rates (98.31% and 96.72%) suggest the evaluation doesn't consider real-world challenges like out-of-distribution data or adverse weather.\n- The paper only tests defenses designed for digital attacks. It should include evaluations with more advanced physical defenses.\n- The writing needs improvement for clarity and readability.\n\nTypos\n- L27: focue -> focus\n- L35: Sato et al. (Redundant)\n- L38: Zhu et al. (Redundant)\n- L118: Zhu et al. (Redundant)\n\nQUESTIONS:\nQuestions\n1. This work seems more focused on engineering. Aside from the patch fabrication, what are the new technical or methodological contributions?\n2. There are existing physical attack baselines (e.g., sticker, projector). Can the authors include these for a fair comparison?\n3. The attack success rates are very high on the authors' own setting, which suggests possible overfitting. It's unclear how well the method generalizes to different conditions (e.g., new environments, bad weather).\n4. The supplementary images are low resolution (32×32). Was the patch really designed at this size and used directly in the physical setup? If so, more explanation is needed.\n\nSuggestions\n1. Moving the method details (L60–70) from the Introduction to the Methods section would improve the structure and clarity of the paper.\n2. The citation style should be revised to follow a standard academic formatting convention.\n\nLIMITATIONS:\nThe fluorescent patch is too visible, which may limit its practicality in real-world use. It also requires an additional UV lamp, adding extra cost and complexity.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces FIPatch, a stealthy physical-world adversarial attack that uses fluorescent ink to alter the appearance of traffic signs.\n\nSTRENGTHS AND WEAKNESSES:\nThe authors conduct extensive experiments in both digital and physical environments, covering three distinct attack goals\n\nQUESTIONS:\n1 As shown in Figure 15, the central region of the image exhibits the highest percentage of successful attacks, indicating that attacks targeting the center of the sign are more effective. Given that the fluorescent ink can only be applied on the traffic sign itself, I believe the objective function defined in your formulation (Eq. 8) is already capable of implicitly optimizing the patch placement toward the most effective region, typically near the center of the sign. Therefore, the method introduced in Section 4.1 for region selection feels unnecessary or redundant. If this step is essential, the paper should better justify its inclusion and clearly explain how it improves upon direct optimization via the objective function alone.\n2 In Section 5, Table 2, it’s unclear whether the attack is white-box or black-box. If it’s white-box, this may not reflect realistic real-world scenarios. Please clarify the threat model and consider evaluating the attack in a black-box transfer setting to better demonstrate its practical robustness.\n3 The authors should consider imposing a hard constraint on the attack area size to ensure the perturbation remains imperceptible to human drivers. As shown in Figure 4, the first two traffic signs are difficult to recognize even for humans. If successful attacks require such visually obtrusive modifications, similar effects could be achieved by simply occluding or blocking the sign, which weakens the motivation for an adversarial approach.\n\nLIMITATIONS:\nSee questions", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes FIPatch, a novel physical adversarial attack against traffic sign recognition (TSR) systems using fluorescent ink. Unlike conventional attacks that rely on visible stickers, projections, or acoustic signals, FIPatch leverages the stealthy properties of fluorescent materials, which remain invisible under normal conditions but are activated by ultraviolet (UV) light. The authors design a comprehensive framework to optimize the shape, color, and placement of fluorescent perturbations digitally before physically applying them. FIPatch achieves high attack success rates—over 98% in low-light conditions—and can mislead TSR systems to hide, forge, or misclassify traffic signs. It also bypasses five popular defense mechanisms. Extensive real-world and simulation experiments demonstrate its robustness across various models, lighting conditions, distances, and vehicle speeds.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. A novel adversarial attack form in the physical world, is verified to be effective for traffic sign recognition. \n2. The writing is clear, which makes readers can easily understand the paper. \n\nWeakness:\n\n1. In section 3.2, the authors state that there is no direct access to a victim's vehicle. That means the attackers should perform physical attacks based on the transferability. However, as for the method, I find it seems a query-based attack (i.e., using the PSO algorithm). Thus, evaluating the transferability against the unknown threat models is important and necessary in this setting.\n\n2. In Table 2, the authos evalute five models, for generative attack and hiding attack, they test Yolo and faster-rcnn (object detection models), but for misrecognition attack, they test ResNet, VGG, etc (image classification models), why not test object detection models for misrecognition attack. I mean that, for three forms of attacks, all the five threat models should be test. \n\n3. This paper only verified the proposed method in traffic sign recognition task, how about other object detection tasks, like face recognition, general object detection, etc. \n\n4. The contributions should be extended, thus readers can better understand the novelty in this paper. At least the second contribution should point out what is the specific novelty for the proposed method compared with the current methods.\n\nQUESTIONS:\nsee the weakness\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}