Street-Legal Physical-World Adversarial Rim for License Plates

Nikhil Kalidasu; Sahana Ganapathy

cs.CVApr 2, 2026

Street-Legal Physical-World Adversarial Rim for License Plates

Authors: Nikhil Kalidasu, Sahana Ganapathy

Organizations: The University of Texas at Austin, Austin TX 78705, USA

Abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.

Figures & tables

Approach	Attack Type	Stage	Targeted	Physical World	Legal (Texas)	Perspective- Robust	Access Model
Zha et al. [ 43 ]	Spot	OCR	✓	✓	×	✓	White-box
Gu et al. [ 11 ]	Perturbation	OCR	×	×	×	×	System-level
Qian et al. [ 26 ]	Spot	OCR	✓	×	×	×	Black-box
Kwon & Baek [ 17 ]	Perturbation	OCR	✓	×	×	×	System-level
Jiamsuchon et al. [ 13 ]	Perturbation	OCR	×	×	×	×	System-level
Zhang et al. [ 44 ]	Rim	Detection	×	✓	✓	×	White-box

Table 1: Comparison with prior adversarial attacks on ALPR systems. We strictly define "system-level access" as requiring digital alterations after image capture but before model submission, with no potential for extension to the physical world.

Figure 1: Sample images from each lighting condition.

Figure 2: Final adversarial rims for disruption and impersonation objectives.

Figure 3: fast-alpr output on horizontal viewing angle test.

Figure 4: Detection model’s confidence distributions under various lighting conditions.

Figure 5: Horizontal viewing-angle test results (metrics averaged over all lighting conditions).

$X$	$Y$	dCor	$\delta_{\alpha}$	$R_{\alpha}$
$C_{D}$	$d$	0.5342	0.1314	4.07
$C_{D}$	$\theta$	0.1350	0.1286	1.05
$ED_{T}$	$d$	0.5434	0.1297	4.19
$ED_{T}$	$\theta$	0.1378	0.1300	1.06
$ED_{I}$	$d$	0.5314	0.1312	4.05
$ED_{I}$	$\theta$	0.1321	0.1278	1.03

Table 2: Dependence between performance metrics and camera parameters with no patch applied.

R_{\alpha}

denotes distance correlation normalized by the permutation-derived independence bound. Vertical viewing-angle test data included.

$X$	$Y$	$\mathrm{dCor}$	$R_{\alpha}$	$\Delta\mathrm{dCor}$	$\Delta R_{\alpha}$
$C_{D}$	$d$	0.5185	3.58	$-0.1084$	$-0.82$
$C_{D}$	$\theta$	0.1206	0.84	$-0.0053$	$-0.08$
$ED_{T}$	$d$	0.4754	3.33	$-0.1525$	$-1.24$
$ED_{T}$	$\theta$	0.1109	0.76	$+0.0147$	$+0.08$
$ED_{I}$	$d$	0.4567	3.13	$-0.1678$	$-1.30$
$ED_{I}$	$\theta$	0.1172	0.82	$+0.0125$	$+0.05$

Table 3: Attack-induced changes in dependence relative to no patch applied.

\Delta\mathrm{dCor}

and

\Delta R_{\alpha}

are computed as (attack

-

control) for each metric–camera parameter pair.

Figure 6: All final patches used in ablation study.

Removed	$X$	$Y$	$R_{\alpha}$	$\Delta R_{\alpha}$
Homography	$C_{D}$	$d$	3.90	${\color[rgb]{0,0.48,0}+0.32}$
Homography	$C_{D}$	$\theta$	1.17	${\color[rgb]{0,0.49,0}+0.33}$
Homography	$ED_{T}$	$d$	4.14	${\color[rgb]{0,0.77,0}+0.81}$
Homography	$ED_{T}$	$\theta$	1.17	${\color[rgb]{0,0.54,0}+0.41}$
Homography	$ED_{I}$	$d$	3.94	${\color[rgb]{0,0.77,0}+0.81}$
Homography	$ED_{I}$	$\theta$	1.20	${\color[rgb]{0,0.52,0}+0.38}$

Table 4: Ablation-induced changes in normalized dependence relative to the full attack.

\Delta R_{\alpha}

is computed as (ablation

-

original SPAR) for each metric–parameter pair.

Approach	Disrupt (Digital)	Impers. (Digital)	Disrupt (Physical)	Impers. (Physical)
Zha et al.	97.3%	89.5%	N/A	91.4%
Gu et al.	N/A	N/A	N/A	N/A
Qian et al.	N/A	93.3%	N/A	N/A
Kwon & Baek	85.0%	N/A	N/A	N/A
Jiamsuchon et al.	91.0%	70.0%	N/A	N/A
Zhang et al.	95.6%	N/A	N/A	N/A

Table 5: Comparison of attack success rates (ASR) reported in prior ALPR attacks. For SPAR’s

P_{\text{disrupt}}

, reduction in correct reads is reported instead of ASR.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 432 papers

Apr 9, 2026

LPLCv2: An Expanded Dataset for Fine-Grained License Plate Legibility Classification

Modern Automatic License Plate Recognition (ALPR) systems achieve outstanding performance in controlled, well-defined scenarios. However, large-scale real-world usage remains challenging due to low-quality imaging devices, compression artifacts, and suboptimal camera installation. Identifying illegible license plates (LPs) has recently become feasible through a dedicated benchmark; however, its impact has been limited by its small size and annotation errors. In this work, we expand the original benchmark to over three times the size with two extra capture days, revise its annotations and introduce novel labels. LP-level annotations include bounding boxes, text, and legibility level, while vehicle-level annotations comprise make, model, type, and color. Image-level annotations feature camera identity, capture conditions (e.g., rain and faulty cameras), acquisition time, and day ID. We present a novel training procedure featuring an Exponential Moving Average-based loss function and a refined learning rate scheduler, addressing common mistakes in testing. These improvements enable a baseline model to achieve an 89.5% F1-score on the test set, considerably surpassing the previous state of the art. We further introduce a novel protocol to explicitly addresses camera contamination between training and evaluation splits, where results show a small impact. Dataset and code are publicly available at https://github.com/lmlwojcik/LPLCv2-Dataset.

Lucas Wojcik, Eduardo A. F. Machoski, Eduil Nascimento +2

Federal University of Paran´a, Curitiba, Brazil · Department of Technological Development and Quality, Paran´a Military Police, Curitiba, Brazil · Pontifical Catholic University of Paran´a, Curitiba, Brazil

Automatic License Plate Recognition

Ask PDF

Apr 24, 2026

ICPR 2026 Competition on Low-Resolution License Plate Recognition

Low-Resolution License Plate Recognition (LRLPR) remains a challenging problem in real-world surveillance scenarios, where long capture distances, compression artifacts, and adverse imaging conditions can severely degrade license plate legibility. To promote progress in this area, we organized the ICPR 2026 Competition on Low-Resolution License Plate Recognition, the first competition specifically dedicated to LRLPR using real low-quality data collected under operationally relevant conditions. The competition was based on the LRLPR-26 dataset, which comprises 20,000 training tracks and 3,000 test tracks; each training track contains five low-resolution and five high-resolution images of the same license plate. Notably, a total of 269 teams from 41 countries registered for the competition, and 99 teams submitted valid entries in the Blind Test Phase. The winning team achieved a Recognition Rate of 82.13%, and four teams surpassed the 80% mark, highlighting both the high level of competition at the top of the leaderboard and the continued difficulty of the task. In addition to presenting the competition design, evaluation protocol, and main results, this paper summarizes the methods adopted by the top-5 teams and discusses current trends and promising directions for future research on LRLPR. The competition webpage is available at https://icpr26lrlpr.github.io/

Rayson Laroca, Valfride Nascimento, Donggun Kim +19

Federal University of Paraná, Brazil · Pontifical Catholic University of Paraná, Brazil · Korea University, Republic of Korea +6

Automatic License Plate Recognition

Ask PDF

Mar 30, 2026

From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera

This demonstration presents Digital-Physical Adversarial Attacks (DiPA), a new class of practical adversarial attacks against pervasive camera-based authentication systems, where an attacker displays an adversarial patch directly on a smartphone screen instead of relying on printed artifacts. This digital-only physical presentation enables rapid deployment, removes the need for total-variation regularization, and improves patch transferability in black-box conditions. DiPA leverages an ensemble of state-of-the-art face-recognition models (ArcFace, MagFace, CosFace) to enhance transfer across unseen commercial systems. Our interactive demo shows a real-time dodging attack against a deployed face-recognition camera, preventing authorized users from being recognized while participants dynamically adjust patch patterns and observe immediate effects on the sensing pipeline. We further demonstrate DiPA's superiority over existing physical attacks in terms of success rate, feature-space distortion, and reductions in detection confidence, highlighting critical vulnerabilities at the intersection of mobile devices, pervasive vision, and sensor-driven authentication infrastructures.

Victoria Leonenkova, Ekaterina Shumitskaya, Dmitriy Vatolin +1

Lomonosov MSU, Moscow, Russia · AI Center, Lomonosov MSU, IAI MSU, Moscow, Russia

Adversarial Attacks Adversarial Patch Attacks Physical Adversarial Attacks Black-Box Adversarial Attacks Transfer-Based Adversarial Attacks Face Recognition

Ask PDF

Abstract

Adversarial Attacks

Explore similar work

LPLCv2: An Expanded Dataset for Fine-Grained License Plate Legibility Classification

ICPR 2026 Competition on Low-Resolution License Plate Recognition

From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera