Street-Legal Physical-World Adversarial Rim for License Plates

Nikhil Kalidasu; Sahana Ganapathy

cs.CVApr 2, 2026

Street-Legal Physical-World Adversarial Rim for License Plates

Authors: Nikhil Kalidasu, Sahana Ganapathy

Organizations: The University of Texas at Austin, Austin TX 78705, USA

Abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.

Figures & tables

Approach	Attack Type	Stage	Targeted	Physical World	Legal (Texas)	Perspective- Robust	Access Model
Zha et al. [ 43 ]	Spot	OCR	✓	✓	×	✓	White-box
Gu et al. [ 11 ]	Perturbation	OCR	×	×	×	×	System-level
Qian et al. [ 26 ]	Spot	OCR	✓	×	×	×	Black-box
Kwon & Baek [ 17 ]	Perturbation	OCR	✓	×	×	×	System-level
Jiamsuchon et al. [ 13 ]	Perturbation	OCR	×	×	×	×	System-level
Zhang et al. [ 44 ]	Rim	Detection	×	✓	✓	×	White-box

Table 1: Comparison with prior adversarial attacks on ALPR systems. We strictly define "system-level access" as requiring digital alterations after image capture but before model submission, with no potential for extension to the physical world.

Figure 1: Sample images from each lighting condition.

Figure 2: Final adversarial rims for disruption and impersonation objectives.

Figure 3: fast-alpr output on horizontal viewing angle test.

Figure 4: Detection model’s confidence distributions under various lighting conditions.

Figure 5: Horizontal viewing-angle test results (metrics averaged over all lighting conditions).

$X$	$Y$	dCor	$\delta_{\alpha}$	$R_{\alpha}$
$C_{D}$	$d$	0.5342	0.1314	4.07
$C_{D}$	$\theta$	0.1350	0.1286	1.05
$ED_{T}$	$d$	0.5434	0.1297	4.19
$ED_{T}$	$\theta$	0.1378	0.1300	1.06
$ED_{I}$	$d$	0.5314	0.1312	4.05
$ED_{I}$	$\theta$	0.1321	0.1278	1.03

Table 2: Dependence between performance metrics and camera parameters with no patch applied.

R_{\alpha}

denotes distance correlation normalized by the permutation-derived independence bound. Vertical viewing-angle test data included.

$X$	$Y$	$\mathrm{dCor}$	$R_{\alpha}$	$\Delta\mathrm{dCor}$	$\Delta R_{\alpha}$
$C_{D}$	$d$	0.5185	3.58	$-0.1084$	$-0.82$
$C_{D}$	$\theta$	0.1206	0.84	$-0.0053$	$-0.08$
$ED_{T}$	$d$	0.4754	3.33	$-0.1525$	$-1.24$
$ED_{T}$	$\theta$	0.1109	0.76	$+0.0147$	$+0.08$
$ED_{I}$	$d$	0.4567	3.13	$-0.1678$	$-1.30$
$ED_{I}$	$\theta$	0.1172	0.82	$+0.0125$	$+0.05$

Table 3: Attack-induced changes in dependence relative to no patch applied.

\Delta\mathrm{dCor}

and

\Delta R_{\alpha}

are computed as (attack

-

control) for each metric–camera parameter pair.

Figure 6: All final patches used in ablation study.

Removed	$X$	$Y$	$R_{\alpha}$	$\Delta R_{\alpha}$
Homography	$C_{D}$	$d$	3.90	${\color[rgb]{0,0.48,0}+0.32}$
Homography	$C_{D}$	$\theta$	1.17	${\color[rgb]{0,0.49,0}+0.33}$
Homography	$ED_{T}$	$d$	4.14	${\color[rgb]{0,0.77,0}+0.81}$
Homography	$ED_{T}$	$\theta$	1.17	${\color[rgb]{0,0.54,0}+0.41}$
Homography	$ED_{I}$	$d$	3.94	${\color[rgb]{0,0.77,0}+0.81}$
Homography	$ED_{I}$	$\theta$	1.20	${\color[rgb]{0,0.52,0}+0.38}$

Table 4: Ablation-induced changes in normalized dependence relative to the full attack.

\Delta R_{\alpha}

is computed as (ablation

-

original SPAR) for each metric–parameter pair.

Approach	Disrupt (Digital)	Impers. (Digital)	Disrupt (Physical)	Impers. (Physical)
Zha et al.	97.3%	89.5%	N/A	91.4%
Gu et al.	N/A	N/A	N/A	N/A
Qian et al.	N/A	93.3%	N/A	N/A
Kwon & Baek	85.0%	N/A	N/A	N/A
Jiamsuchon et al.	91.0%	70.0%	N/A	N/A
Zhang et al.	95.6%	N/A	N/A	N/A

Table 5: Comparison of attack success rates (ASR) reported in prior ALPR attacks. For SPAR’s

P_{\text{disrupt}}

, reduction in correct reads is reported instead of ASR.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 436 papers

LPLCv2: An Expanded Dataset for Fine-Grained License Plate Legibility Classification
Apr 9, 2026Lucas Wojcik, Eduardo A. F. Machoski, Eduil Nascimento +2Automatic License Plate Recognition
Federal University of Paran´a, Curitiba, Brazil · Department of Technological Development and Quality, Paran´a Military Police, Curitiba, Brazil · Pontifical Catholic University of Paran´a, Curitiba, Brazil
ICPR 2026 Competition on Low-Resolution License Plate Recognition
Apr 24, 2026Rayson Laroca, Valfride Nascimento, Donggun Kim +19Automatic License Plate Recognition
Federal University of Paraná, Brazil · Pontifical Catholic University of Paraná, Brazil · Korea University, Republic of Korea +6
From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera
Mar 30, 2026Victoria Leonenkova, Ekaterina Shumitskaya, Dmitriy Vatolin +1Adversarial Attacks Adversarial Patch Attacks
Lomonosov MSU, Moscow, Russia · AI Center, Lomonosov MSU, IAI MSU, Moscow, Russia

Apr 9, 2026J/K move · Enter open · S save

LPLCv2: An Expanded Dataset for Fine-Grained License Plate Legibility Classification

Lucas Wojcik, Eduardo A. F. Machoski, Eduil Nascimento, Rayson Laroca+1

Federal University of Paran´a, Curitiba, Brazil · Department of Technological Development and Quality, Paran´a Military Police, Curitiba, Brazil · Pontifical Catholic University of Paran´a, Curitiba, Brazil

Automatic License Plate Recognition

Open paper AskPDF arXiv

Modern Automatic License Plate Recognition (ALPR) systems achieve outstanding performance in controlled, well-defined scenarios. However, large-scale real-world usage remains challenging due to low-quality imaging devices, compression artifacts, and suboptimal camera installation. Identifying illegible license plates (LPs) has recently become feasible through a dedicated benchmark; however, its impact has been limited by its small size and annotation errors. In this work, we expand the original benchmark to over three times the size with two extra capture days, revise its annotations and introduce novel labels. LP-level annotations include bounding boxes, text, and legibility level, while vehicle-level annotations comprise make, model, type, and color. Image-level annotations feature camera identity, capture conditions (e.g., rain and faulty cameras), acquisition time, and day ID. We present a novel training procedure featuring an Exponential Moving Average-based loss function and a refined learning rate scheduler, addressing common mistakes in testing. These improvements enable a baseline model to achieve an 89.5% F1-score on the test set, considerably surpassing the previous state of the art. We further introduce a novel protocol to explicitly addresses camera contamination between training and evaluation splits, where results show a small impact. Dataset and code are publicly available at https://github.com/lmlwojcik/LPLCv2-Dataset.

Abstract

Adversarial Attacks

Explore similar work

LPLCv2: An Expanded Dataset for Fine-Grained License Plate Legibility Classification

ICPR 2026 Competition on Low-Resolution License Plate Recognition

From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera