{"id":"a46375ef-fc32-4923-ad2d-b043022ef437","arxiv_id":"2502.05208","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"Hand-edited stop sign textures in CARLA reduced traffic sign detection enough to delay automatic braking, and distance-aware braking or a side camera restored stopping.","lead":"This paper edits stop sign textures inside the CARLA driving simulator and reports that the changes delay an autonomous vehicle's automatic braking, then tests two defensive fixes. It is a simulation case study of known attack techniques, not a new attack algorithm or a production-ready defense.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section IV-A hand-draws textures 'inspired by' adversarial papers with no optimization or perturbation constraints; the claimed attack is indistinguishable from ordinary camouflage unless a controlled comparison shows otherwise.","rationale":"The reader's REJECT verdict is appropriate. I agree with the core of the reader's weakest assumption: the hand-edited GIMP textures are never shown to be adversarial examples, and without an optimization procedure or a perturbation constraint the observed detector failure could be trivial appearance change. I do not weigh the CARLA-as-real-AV proxy as load-bearing, because the paper explicitly positions itself as a CARLA simulator case study; the external-validity issue is secondary. The decisive problem is internal to the methodology: the threat model says the attacker generates an adversarial patch via existing adversarial image generation techniques, but Section IV-A substitutes manual GIMP editing, so the central mechanism promised by the title is missing. The defense evaluation is also only meaningful against an attack that has not been validated. The empirical evidence is too sparse: an unnamed detector, no thresholds, no error bars, and single runs. These issues jointly support rejection, and my analysis does not change the reader's verdict.","tokens_in":6511,"tokens_out":5546,"duration_ms":53925,"concrete_test":"Run a controlled CARLA experiment on the Lu v2 texture: (i) measure detector class and confidence for original, GIMP-textured, random-pattern control with matched pixel perturbation, and a genuinely optimized adversarial patch (e.g., Eykholt-style EOT/PGD against the same detector); (ii) repeat for at least 20 runs per condition and report per-image detection scores and braking distances. If random controls reproduce the GIMP texture's detection drop and braking delay, the attack is ordinary appearance change; if only the optimized patch causes high-confidence misclassification, the adversarial claim stands. Also report the detector name and confidence threshold used for braking.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section IV-A's entire attack construction is editing in GIMP to the desired adversarial attack, with unique patterns generated as inspired by research papers [13]-[16]. The cited attacks are all optimization-based in the original literature, but the paper reports no optimization procedure, no perturbation budget, no attack-success metric, and no per-image confidence or class outputs. Consequently, the observed reduction in detection score and the delayed braking in Sec. V are equally consistent with the texture simply destroying prototypical stop-sign appearance, producing an ordinary detector false negative rather than an adversarial example. This distinction is load-bearing: the abstract claims the attack fools the AV's object detection system; if a random or arbitrary repaint of the sign suppresses detection just as well, the paper has shown camouflage, not the adversarial ML phenomenon the title and claims invoke. The lack of any control texture, named detector, or detection threshold makes the single-run braking result in Table I insufficient to establish even the empirical delay robustly. A real defense can still work against camouflage, but the attack side of the central claim is unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper describes an empirical study using the CARLA simulator and ROS to modify the texture of a stop sign with patterns 'inspired by' existing adversarial attacks, then measures the effect on the AV's object detection and auto-braking. It reports that the modified sign reduces detection confidence and delays braking, and it proposes two defenses--adjusted braking and side-camera fusion--which it claims restore stopping performance across several CARLA towns.","tokens_in":6697,"tokens_out":4493,"duration_ms":37696,"significance":"If substantiated, a camera-camouflaged attack that transfers to end-to-end AV actuators would be a valuable contribution to AV security testing. The use of a full simulator with ROS and the evaluation of defenses across multiple towns and placements are strengths. However, as the manuscript stands, the central attack claim is not established: the attack textures are not generated by any adversarial optimization, the detector is not named, and the empirical results are single runs with no error bars. The work is therefore mainly a case study of detector failure under modified sign appearance, not an adversarial attack study.","major_comments":[{"comment":"The attack construction is the load-bearing element of the paper, but Section IV-A describes only editing the stop-sign texture in GIMP with patterns 'inspired by research papers [13]-[16]'. None of the cited attacks are implemented or optimized; no perturbation budget, no attack-success metric, and no per-image confidence values are reported. The cited attacks ([13]-[16]) are all optimization-based in the original literature. Therefore, the observed drop in detection score and the delayed braking in Sections IV-B and V are equally consistent with the texture simply making the sign unrecognizable to the detector, i.e., ordinary camouflage, rather than with the adversarial misclassification claimed in the title and abstract. A control condition using random or arbitrary texture changes, plus a named detector with a fixed confidence threshold, is required to distinguish these cases.","section":"IV-A"},{"comment":"The braking test in Section V-A and Table I reports results from what appears to be a single run per scenario, with no error bars or repeated trials. The entire quantitative support for the attack is the difference between two stopping coordinates, (-5.4, -46.2) for the normal sign and (-5.4, -60.8) for the Lu version-2 sign, at a speed of 85 km/h. Because the attack textures were not generated with any optimization or success criterion (see major comment above), and because the detection threshold that triggers braking is never specified, this single-run result does not establish that the delay is caused by an adversarial perturbation rather than by a generic reduction in detection confidence. At minimum, repeated trials, a threshold sweep, and a control texture are needed.","section":"V-A"},{"comment":"The selection of the Lu version-2 attack as the focus of the braking tests is post hoc. Section IV-B states that 'Lu version-2 exhibiting the lowest detection score among all tested attacks,' and Section V says 'we focus on the Lu adversarial attack, as it results in the most significant decline in object detection performance.' Since only one or a few runs were used to rank the attacks, and since no standard errors are reported, it is possible that the ranking is noise; moreover, cherry-picking the best-performing attack from the same test set biases the subsequent single-run braking result. The paper should either test all attack variants in the braking scenario or justify a priori the choice of Lu version-2.","section":"IV-B, V"},{"comment":"The defense evaluation in Section V-B compares the attacked case with the attacked case plus defenses, but it does not compare the defended attacked case against the normal-sign baseline under the same detection and braking code. Without that baseline, one cannot tell whether the adjusted-braking defense simply brakes earlier and harder for any sign, and whether the side-camera defense is merely an alternate sensor path that sees the sign later. Table II and Table III report distances to the stop sign when braking is applied, but no detection confidence values or threshold settings are given, and the times to complete stop are all within 2.55-2.75 s across very different stopping distances, which is suspicious and suggests a fixed braking trajectory rather than a distance-adaptive response. Error bars and statistical tests are absent.","section":"V-B"}],"minor_comments":[{"comment":"The abstract contains a sentence fragment: 'Specifically, if the attack is initiated by modifying the texture of a stop sign to fool the AV's object detection system, thereby affecting the AV actuators.' This should be rewritten as a complete sentence.","section":"Abstract"},{"comment":"In the Introduction, 'affect' is used where 'effect' is intended: 'explored the affect of adversarial attacks on the machine learning model capability.' Please correct this and similar occurrences.","section":"I"},{"comment":"The subsection title 'Sensor Fusing Using a Side Camera' should be 'Sensor Fusion Using a Side Camera.'","section":"IV-C2"},{"comment":"Reference [10] contains a typo: 'Porc. of ISOC Symposium' should be 'Proc. of ISOC Symposium.'","section":"References"},{"comment":"The paper does not state the CARLA version, ROS version, or the specific object detector and confidence threshold used, which are essential for reproducibility.","section":"II"}],"recommendation":"reject","confidential_remarks":"The paper reads as an extended abstract rather than a full journal article. The central experimental design does not generate adversarial examples in the sense of the cited literature, and the empirical evaluation has no error bars or control conditions. Even with substantial revision, the work would need to be reframed as a study of sign-detection robustness in CARLA rather than as an adversarial attack and defense study."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Good to talk. I read the CARLA stop-sign paper. Short version: the braking-delay demonstration is probably real, but the paper doesn't earn the word \"adversarial.\" The textures were hand-edited in GIMP, \"inspired by\" the cited papers, with no optimization, no perturbation budget, and no control texture. So the observed detection drop is equally consistent with the signs just looking unfamiliar. That's a load-bearing gap, because the abstract claims the attack fools the object detection system. The stress-test note gets this right.\n\nWhat the paper does well: it sets up a clean CARLA/ROS testbed, modifies the stop-sign asset texture, and shows a concrete effect—an attacked sign moves the braking point about 10 m past the stop sign, while two simple defenses, distance-aware braking and a side camera, bring the stop back. The simulator integration is useful for people who want to test perception attacks end-to-end, and the defense formulas are standard but correctly applied.\n\nSoft spots, in order of severity. First, the attack construction is the whole ballgame, and it's unsupported as an adversarial example. The paper itself admits the patterns were \"inspired by research papers\" (Sec. IV-A). The original attacks are optimization-based; this paper just repaints textures. Second, the empirical base is thin: one unreported detector, one run per scenario in Table I, no error bars, no threshold stated. The claim that the attack is \"robust\" across towns rests on Tables II-III, but those are only for the combined defenses, not for the attack alone. Third, the novelty is incremental: the transfer of known patch attacks into a simulator is an application, not a new attack class.\n\nIs the central argument salvageable? The defense part holds up as a demonstration, and the attack part could be repaired by generating an actual adversarial patch with a defined perturbation constraint and an untampered control texture. As written, the title and abstract overreach.\n\nWho's this for? A reader working on CARLA-based AV security testing might get a useful data point. It is not a contribution to adversarial ML. I wouldn't cite it for the attack claim. But I would send it to a serious referee at an appropriate workshop/short-paper venue, because the problem is fixable and the empirical setup is reproducible. The editor should ask for a control texture, a named detector with thresholds, and error bars before accepting.","headline":"A useful CARLA/ROS braking case study, but the 'adversarial' label is not earned—the hand-edited textures could just be ordinary camouflage.","tokens_in":7232,"tokens_out":2586,"would_cite":false,"duration_ms":53402,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A stop sign with an edited texture delays an autonomous vehicle's auto-braking in the CARLA simulator, and two defenses restore safe stopping.","keywords":["autonomous vehicles","traffic sign recognition","camouflaged adversarial attack","CARLA simulator","auto-braking","sensor fusion defense","object detection","adversarial texture attack"],"falsifier":"Run a control experiment in the same CARLA setup: replace the stop sign texture with several arbitrary textures that are not derived from adversarial-example research, and compare detection confidence and braking position. If the arbitrary textures produce a similar or larger braking delay, then the paper's central attack mechanism is not adversarial perturbation but general texture novelty, and its central claim would fail.","tokens_in":6334,"feed_emoji":"🛑","tokens_out":7082,"duration_ms":59072,"temperature":0.7,"pith_summary":"The paper sets out to show that a camera-only autonomous vehicle can be made to miss a stop sign by changing only the sign's visual texture, and that the resulting delay in braking is a safety consequence of a perception attack, not just a classification error. The authors alter a stop sign's bitmap texture in the CARLA driving simulator, re-import it into the scene, and observe that the vehicle's object detector loses confidence and the auto-braking response arrives too late, so the vehicle passes the sign. They then test two countermeasures: a braking controller that computes stopping distance from the detected sign's bounding box and vehicle speed, and a side camera that triggers full braking when the sign is detected. In their runs, both countermeasures bring the vehicle to a stop before the sign across several simulator towns and sign placements. If correct, the work is a demonstration that perception-layer texture attacks can propagate to vehicle actuators, and that simple defensive redundancy can restore stopping performance.","feed_headline":"Camouflaged stop sign makes AV miss its stop in simulation","feed_subtitle":"Texture attack pushed a test car 10 m past a stop sign; adjusted braking and a side camera restore safe stops","key_machinery":"The machinery is texture substitution inside the simulator's asset pipeline: the stop sign's material instance references a bitmap that is exported, edited in an image manipulation program, and re-imported, so the detector sees a differently textured sign without any change to the scene geometry. On the defense side, the paper uses a geometric braking controller: it converts the detected bounding-box height into a distance estimate using the camera focal length and the known real height of a stop sign, computes the needed deceleration from current speed, and maps that to a brake command; the second defense adds a side camera that applies full braking when it detects the stop sign. The attacks are not generated by an optimization loop; they are hand-selected patterns inspired by the cited adversarial-example papers.","core_discovery":"The central claim is that a camouflaged stop sign, produced by replacing its texture with a pattern inspired by published adversarial-attack images, degrades object detection enough to delay auto-braking and make the vehicle cross the stop line. The paper reports that an unmodified sign is detected with roughly 75% confidence, while each of the five edited textures lowers that score, with the texture labeled Lu version-2 dropping it the most. In the driving test, the vehicle stops near (-5.4, -46.2) with a clean sign but ends near (-5.4, -60.8) under attack, about ten meters past the sign at (-9.3, -50.5). The paper then claims its adjusted-braking defense stops the vehicle at (-5.4, -43.5) and the side-camera defense at (-5.4, -47.5), and that both defenses keep working for attacked signs in Towns 03, 07, and 10 with signs placed near, far, or at the standard distance.","pith_inferences":["Editorial inference: because the paper never measures an adversarial perturbation budget or an attack success rate, the edited textures may simply be out-of-distribution images; an arbitrary novel texture could produce the same detection drop, which would make the adversarial label overstate what the experiment shows.","Editorial inference: the two defenses do not authenticate the sign; they brake whenever the detector sees it. A future attack that also degrades the side camera's view or makes the detector report a high-confidence false negative at longer range would likely bypass both countermeasures.","Editorial inference: a testable extension would replace the hand-edited textures with optimized adversarial patches from the cited methods and measure whether the same braking delay appears under the same conditions, separating adversarial perturbation effects from simple visual novelty.","Editorial inference: the distance-based braking formula assumes the detector's bounding-box height is reliable; if an attacker can shrink the bounding box or otherwise inflate the distance estimate, braking could still be delayed even with the defense."],"forward_implications":["If the texture attack works as described, a fully camera-based traffic sign recognition system can be pushed from correct detection to a late or missing brake response without any physical access to the vehicle.","The adjusted-braking formula implies that braking can begin earlier when distance is computed from the sign's bounding box and velocity, rather than from a fixed trigger threshold.","The side-camera defense implies that redundant viewing angles can compensate for a compromised primary camera, at least when the side camera's view of the sign is unobstructed.","The reported consistency across Towns 03, 07, and 10 implies the attack and defenses are not tied to a single simulator map asset.","The authors generalize the method to other end-to-end trained autonomous cyber-physical systems, meaning the attack and defense pattern could transfer beyond road sign recognition."],"supporting_citations":[{"why":"Supplies the CARLA driving simulator environment where the attack and defenses are tested.","marker":"[11]"},{"why":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures.","marker":"[13]"},{"why":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures.","marker":"[14]"},{"why":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures.","marker":"[15]"},{"why":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures.","marker":"[16]"},{"why":"Provides the focal-length and distance-from-bounding-box formulas used by the adjusted-braking defense.","marker":"[19]"},{"why":"Provides the deceleration and brake-command formulas used to compute stopping behavior.","marker":"[20]"}],"fun_headline_variants":["Texture attack on stop sign pushes AV 10 m past line in CARLA","Camouflaged stop sign evades AV detection; two defenses restore stops","Stop-sign texture attack delays AV braking by 10 m in simulation","Adversarial stop sign defeats AV detection; braking fix recovers","CARLA test: camouflaged stop sign makes AV overshoot; defense works"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack claim rests on the assumption that the hand-edited textures are true adversarial examples rather than merely unfamiliar images; if the detector simply fails on any novel texture, the proposed attack is indistinguishable from a routine perception failure.","fun_headline_variants_meta":{"raw":{"variants":["Texture attack on stop sign pushes AV 10 m past line in CARLA","Camouflaged stop sign evades AV detection; two defenses restore stops","Stop-sign texture attack delays AV braking by 10 m in simulation","Adversarial stop sign defeats AV detection; braking fix recovers","CARLA test: camouflaged stop sign makes AV overshoot; defense works"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000705,"raw_usage":{"total_tokens":3186,"prompt_tokens":963,"completion_tokens":2223,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":579,"completion_tokens_details":{"reasoning_tokens":2125}},"tokens_in":579,"tokens_out":2223,"duration_ms":13992,"temperature":1.0,"reasoning_tokens":2125,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T14:59:15.128470+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a control experiment in the same CARLA setup: replace the stop sign texture with several arbitrary textures that are not derived from adversarial-example research, and compare detection confidence and braking position. If the arbitrary textures produce a similar or larger braking delay, then the paper's central attack mechanism is not adversarial perturbation but general texture novelty, and its central claim would fail.","supporting_citations":[{"cited_title":"Team, “Carla,” https://carla.org/, 2023","cited_arxiv_id":null,"evidence_quote":"Supplies the CARLA driving simulator environment where the attack and defenses are tested."},{"cited_title":"Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector,","cited_arxiv_id":null,"evidence_quote":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures."},{"cited_title":"Robust physical-world attacks on deep learning visual classification,","cited_arxiv_id":null,"evidence_quote":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures."},{"cited_title":"Targeted attention attack on deep learning models in road sign recognition,","cited_arxiv_id":null,"evidence_quote":"One of the adversarial-image sources whose patterns inspired the hand-edited stop-sign textures."},{"cited_title":"Szeliski, Computer Vision: Algorithms and Applications","cited_arxiv_id":null,"evidence_quote":"Provides the focal-length and distance-from-bounding-box formulas used by the adjusted-braking defense."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the deceleration and brake-command formulas used to compute stopping behavior."}],"review_version":1}