Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detection

Brianna D'Urso; Tahmid Hasan Sakib; Syed Rafay Hasan; Terry N. Guo

cs.CVFeb 27, 2026

Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detection

Authors: Brianna D'Urso, Tahmid Hasan Sakib, Syed Rafay Hasan, Terry N. Guo

Organizations: Department of Computing Sciences, University of Hartford, West Hartford, CT, USA · Department of Electrical and Computer Engineering, Tennessee Technological University, Cookeville, TN, USA · Center for Manufacturing Research, Tennessee Technological University, Cookeville, TN, USA

Abstract

This paper studies how well Naturalistic Adversarial Patches (NAPs) transfer to a physical traffic sign setting when the detector is trained on a customized dataset for an autonomous vehicle (AV) environment. We construct a composite dataset, CompGTSRB (which is customized dataset for AV environment), by pasting traffic sign instances from the German Traffic Sign Recognition Benchmark (GTSRB) onto undistorted backgrounds captured from the target platform. CompGTSRB is used to train a YOLOv5 model and generate patches using a Generative Adversarial Network (GAN) with latent space optimization, following existing NAP methods. We carried out a series of experiments on our Quanser QCar testbed utilizing the front CSI camera provided in QCar. Across configurations, NAPs reduce the detector's STOP class confidence. Different configurations include distance, patch sizes, and patch placement. These results along with a detailed step-by-step methodology indicate the utility of CompGTSRB dataset and the proposed systematic physical protocols for credible patch evaluation. The research further motivate researching the defenses that address localized patch corruption in embedded perception pipelines.

Figures & tables

Fig. 1 : Background capture and composite dataset (CompGTSRB) generation, followed by YOLOv5 training for attack and deployment models using the same composite data.

Fig. 2 : GTSRB dataset statistics. (a) Class instance counts indicate imbalance. (b) maRGB distribution shows illumination skew that motivates brightness matching in CompGTSRB.

Fig. 3 : NAP generation following Hu et al. [ 4 ] . A GAN latent vector is optimized to produce a printable patch that lowers detector confidence.

Size	Distance $d$ (m)	Clean $C$	White $\Delta C$	Black $\Delta C$	NAP-Peacock $\Delta C$	NAP-Dog $\Delta C$	NAP-Bear $\Delta C$
Small	0.30	0.7788	+0.022	+0.001	-0.178	-0.128	-0.223
	0.38	0.7105	+0.021	-0.005	+0.006	-0.036	-0.008
	0.45	0.8506	-0.005	-0.018	+0.005	-0.004	+0.006
	0.60	0.7862	+0.004	+0.005	+0.014	+0.015	+0.017
	0.90	0.8993	-0.028	-0.009	-0.014	-0.007	-0.020
Medium	0.30	0.7788	-0.197	-0.199	-0.279	-0.288	-0.342

TABLE I : STOP-class confidence for clean signs (

C

) and change under printed patches (

\Delta C=C_{\text{patch}}-C_{\text{clean}}

), averaged over three placements, stratified by patch size and distance

d

. The final block reports the mean over sizes.

Fig. 4 : Physical setup on the Quanser QCar. Front CSI camera observes a printed stop sign with a mounted patch. Distance d is varied; YOLOv5n runs onboard..

Fig. 5 : Mean YOLOv5n STOP confidence versus distance for clean and patched signs. Results include patch type, size, and placement combinations. Each point is a 15 s mean.

Traffic Sign Detection

See all 10 papers

Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving
Apr 25, 2026Zihui Zhu, Ziqi Zhou, Yichen Wang +3Adversarial Patch Attacks Autonomous Driving Perception
Huazhong University of Science and Technology
Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles
Aug 9, 2026Pedram MohajerAnsari, Amir Salarpour, Mert D. PeséAdversarial Robustness VLM Distillation
Clemson University, Clemson, SC, USA
Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks
Jul 23, 2026Yuanhao Huang, Yilong Ren, Jinlei Wang +3Adversarial Training Adversarial Robustness
School of Transportation Science and Engineering, Beihang University, 100191, Beijing, P.R China · Zhongguancun Laboratory, 100191, Beijing, P.R China · School of Systems Science and Engineering, Sun Yat-Sen University, 510006, Guangzhou, P.R China +2

Apr 25, 2026J/K move · Enter open · S save

Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving

Zihui Zhu, Ziqi Zhou, Yichen Wang, Lulu Xue+2

Huazhong University of Science and Technology

Adversarial Patch Attacks Autonomous Driving Perception Transfer-Based Adversarial Attacks Adversarial Transferability Physical Adversarial Attacks

Open paper AskPDF arXiv

Deep learning drives major advances in autonomous driving (AD), where object detectors are central to perception. However, adversarial attacks pose significant threats to the reliability and safety of these systems, with physical adversarial patches representing a particularly potent form of attack. Physical adversarial patch attacks pose severe risks but are usually crafted for a single model, yielding poor transferability to unseen detectors. We propose AdvAD, a transfer-based physical attack against object detection in autonomous driving. Instead of targeting a specific detector, AdvAD optimizes adversarial patches over multiple detection models in a unified framework, encouraging the learned perturbations to capture shared vulnerabilities across architectures. The optimization process adaptively balances model contributions and enforces robustness to physical variations. It further employs data augmentation and geometric transformations to maintain patch effectiveness under diverse physical conditions. Experiments in both digital and real-world settings show that AdvAD consistently outperforms state-of-the-art (SOTA) attacks in performance and transferability.

Abstract

Traffic Sign Detection

Explore similar work

Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving

Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles

Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks