{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/darts-deceiving-autonomous-cars-with-toxic","title":"DARTS: Deceiving Autonomous Cars with Toxic Signs","arxiv_id":"1802.06430","date":"2018-02-18","proceeding":null,"authors":["Chawin Sitawarin","Arjun Nitin Bhagoji","Arsalan Mosenia","Mung Chiang","Prateek Mittal"],"abstract":"Sign recognition is an integral part of autonomous cars. Any\nmisclassification of traffic signs can potentially lead to a multitude of\ndisastrous consequences, ranging from a life-threatening accident to even a\nlarge-scale interruption of transportation services relying on autonomous cars.\nIn this paper, we propose and examine security attacks against sign recognition\nsystems for Deceiving Autonomous caRs with Toxic Signs (we call the proposed\nattacks DARTS). In particular, we introduce two novel methods to create these\ntoxic signs. First, we propose Out-of-Distribution attacks, which expand the\nscope of adversarial examples by enabling the adversary to generate these\nstarting from an arbitrary point in the image space compared to prior attacks\nwhich are restricted to existing training/test data (In-Distribution). Second,\nwe present the Lenticular Printing attack, which relies on an optical\nphenomenon to deceive the traffic sign recognition system. We extensively\nevaluate the effectiveness of the proposed attacks in both virtual and\nreal-world settings and consider both white-box and black-box threat models.\nOur results demonstrate that the proposed attacks are successful under both\nsettings and threat models. We further show that Out-of-Distribution attacks\ncan outperform In-Distribution attacks on classifiers defended using the\nadversarial training defense, exposing a new attack vector for these defenses.","url_abs":"http://arxiv.org/abs/1802.06430v3","url_pdf":"http://arxiv.org/pdf/1802.06430v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"darts-deceiving-autonomous-cars-with-toxic","repo_url":"https://github.com/inspire-group/advml-traffic-sign","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"traffic-sign-recognition","task_name":"Traffic Sign Recognition"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1802.06430","atlas_url":"https://app.syntology.ai/?focus=1802.06430","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1802.06430"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/inspire-group/advml-traffic-sign","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":11},"by_repo_kind":{"listed":{"samples":11,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"80ca270a177b2a57","entry":"bb_iou","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/detector_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/detector_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"80ca270a177b2a57"}},{"code_sha256_prefix":"8faa83f81cb4c3e6","entry":"error_rate","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/tf_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/tf_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8faa83f81cb4c3e6"}},{"code_sha256_prefix":"162c53ddcf7aa350","entry":"fg","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/attacks.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"162c53ddcf7aa350"}},{"code_sha256_prefix":"c5f93b102a16935d","entry":"find_circles","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/detector_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/detector_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c5f93b102a16935d"}},{"code_sha256_prefix":"4f29c71c0bd12657","entry":"gradient_fn","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/keras_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/keras_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4f29c71c0bd12657"}},{"code_sha256_prefix":"d4cc996eeea5bcc0","entry":"gradient_model","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/keras_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/keras_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d4cc996eeea5bcc0"}},{"code_sha256_prefix":"74d9a97000951671","entry":"iterative","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/attacks.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"74d9a97000951671"}},{"code_sha256_prefix":"215dd352688c6d02","entry":"output_fn","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/keras_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/keras_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"215dd352688c6d02"}},{"code_sha256_prefix":"077c9725ee37bfa5","entry":"read_bb","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/detector_utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/detector_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"077c9725ee37bfa5"}},{"code_sha256_prefix":"f7c51343819bf34f","entry":"read_image","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f7c51343819bf34f"}},{"code_sha256_prefix":"ed8e524e657c33b4","entry":"rgb2gray","repo":"inspire-group/advml-traffic-sign","repo_kind":"listed","path":"lib/utils.py","file_url":"https://github.com/inspire-group/advml-traffic-sign/blob/HEAD/lib/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ed8e524e657c33b4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}