Pith. sign in

REVIEW 4 major objections 5 minor 71 references

Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A printed patch placed under a traffic light can flip its detected label from red to green, and in real autonomous driving tests the vehicle kept moving instead of stopping.

desk verdict First printed-patch attack on traffic light detectors with a full-pipeline real-world demo; the central claim is plausible but under-quantified and rests on an unmeasured HD-map association tolerance. read the letter →

arxiv 2506.04823 v1 pith:JOJJSG5Z submitted 2025-06-05 cs.CV cs.LG

Svetlana Pavlitska , Jamie Robb , Nikolai Polley , Melih Yazgan , J. Marius Zöllner This is my paper
classification cs.CVcs.LG
keywords adversarialpatchestrafficlightdetectionlabelflippingattacksYOLOobjectautonomousdrivingsafetyred-to-greenattackphysicaluniversalperturbations
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a physically printed adversarial patch, mounted on the pole directly below a traffic light, can make convolutional traffic-light detectors keep the bounding box where it is but change the detected state, most importantly from red to green. The authors propose this as a realistic threat model: an attacker has white-box access to the detector and physical access to the light, and the same universal patch works across many scenes. They demonstrate targeted label-flipping attacks on four benchmark datasets with YOLOv7 and YOLOv8, then evaluate printed patches on a mobile construction-site traffic light and, in a restricted test area, on a fully autonomous vehicle running a complete perception pipeline. In the real-world pipeline test, red-to-green flips were reliably achieved at medium distances, causing the vehicle to continue with its current speed and no deceleration. This matters because it shows that the risk is not confined to isolated neural networks but can propagate to an actual driving decision.

What carries the argument

The load-bearing mechanism is the patch application operator $A(p, x, l, t)$, which applies a transformation $t$ to a patch $p$ and places it in image $x$ at location $l$ directly below each ground-truth traffic-light box. Patch training minimizes $$L_{\text{base}} = \$\alpha$ L_{\text{cls}} + \$\beta$ L_{\text{bbox}} + \gamma L_{\text{tv}} + \delta L_{\text{green sup}},$$ where $L_{\text{cls}}$ and $L_{\text{bbox}}$ are the detector's classification and localization losses, $L_{\text{tv}}$ enforces smooth pixel transitions, and $L_{\text{green sup}}$ penalizes large green areas to suppress object fabrication; PGD-10 updates are performed for each relevant box. For physical deployment, expectation over transformations is applied so the patch survives rotations, brightness changes, and translations. The paper additionally relies on the property of the ATLAS perception pipeline that a misclassified but properly localized bounding box, within tolerance of the HD-map coordinates, is accepted as relevant and fed into the driving decision, which is what turns a label flip into a wrong driving action.

What would settle it

Run the same ATLAS pipeline on the test-area traffic light with the printed patch while adding a temporal-consistency rule: require several consecutive frames with the same green label before the driving decision changes, or require agreement between the front-medium and wide/tele camera streams. If red-to-green flips no longer produce a proceed decision, the paper's pipeline-level claim fails; conversely, recording a successful flip at medium distance over repeated trials would confirm it.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that adversarial patches do not need to be placed on the traffic light itself to be effective; a patch placed underneath, scaled to two or three times the width of the light housing, is enough to shift a CNN's classification from red to green while leaving localization intact. The attack is trained in a universal, white-box setting with PGD-10 updates using the detector's own classification and localization losses, smoothed with a total-variation term and penalized for large green areas. The paper reports that on digital test sets the patch transfers across all four datasets, that arrow-class patches also misclassify other arrow types, and that physically printed versions cause label flips on a mobile traffic light. The strongest real-world result is in the test area: during fully autonomous driving, the patch produced successful red-to-green label flips at medium distances, so the vehicle continued with its current speed and no deceleration; at shorter distances the pipeline oscillated or recovered the true red state. The authors conclude that attacking the full modularized pipeline is harder than attacking a single CNN, but that successful attacks are possible.

Load-bearing premise

The real-world result rests on the perception pipeline accepting a misclassified but well-localized detection as a genuine traffic light relevant to the ego vehicle; if the pipeline required a stricter bounding-box match, cross-checked the color between camera streams, or rejected single-frame label flips, the patch would not change the driving decision.

Editorial extensions

If this is right

  • Red-to-green label flips can propagate to the driving decision in real-world autonomous operation, at least at medium distances, so the vehicle can run a red light.
  • Attacking a full perception pipeline with map-based association and temporal filtering is much harder than attacking a single detector; object fabrication is filtered out and attacks on one light among several are overridden.
  • Larger patches, around 80 by 80 centimeters, performed best in the stationary-light evaluation, while small patches lose effectiveness with distance.
  • The green-suppression and bounding-box losses reduce unintended object fabrication but do not prevent the initial red suppression that makes the attack work.
  • Detector training choices affect vulnerability: YOLOv8 proved more resilient than YOLOv7, consistent with its stronger augmentation and regularization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the dependence on ATLAS's bounding-box tolerance suggests a cheap defense: require the detected color to be cross-checked against a second camera stream or a temporal majority vote before it reaches the driving decision; the paper did not test such cross-checks.
  • The observed distance dependence implies a testable extension: measure the attack's success envelope across continuous distances and lighting conditions to define precisely when the patch is a threat, rather than relying on qualitative distance bands.
  • Because arrow pictograms are mutually confused by a single red-arrow-to-green-arrow patch, similar attacks could plausibly target turn-signal misinterpretation, such as red-arrow-to-straight, without retraining per arrow type; this is an inference, not a result reported in the paper.
  • The tension between the green-suppression loss and attack strength suggests a stealth-effectiveness trade-off; an attacker could optimize for a patch resembling a legitimate pole-mounted poster, a direction the authors mention as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a white-box universal adversarial patch attack on CNN-based traffic light detectors. The patch is placed under a traffic light, rescaled relative to the detected bounding box, and trained with PGD using a weighted combination of classification, bounding-box, total variation, and green-suppression losses. The authors evaluate the attack digitally on four traffic light datasets with YOLOv7 and YOLOv8, in a lab setting with a mobile construction-site traffic light, and in a restricted test area with the full ATLAS perception pipeline in an automated vehicle. They report successful red-to-green label flips in the digital and real-world settings, including a claim that the attacked pipeline caused the vehicle to continue through a red light at medium distances.

Significance. If the results hold, the paper demonstrates a physically realizable adversarial-patch attack on traffic light detectors, including an effect on a full modular perception pipeline rather than only on a single CNN. This is a relevant and timely contribution to the adversarial-autonomy literature. The paper's strengths include the release of code, evaluation across four datasets and two YOLO architectures, the explicit treatment of localization loss and green-fabrication suppression, and a real-world evaluation with an actual automated vehicle. The main limitation is quantitative under-reporting: the digital results are described verbally rather than with attack success rates, and the real-world pipeline results depend on an unmeasured association-tolerance property of ATLAS.

major comments (4)
  1. [§IV.B] The digital evaluation is entirely qualitative. Statements such as 'images from the BSTLD dataset were the easiest to attack' and 'YOLOv7 models have demonstrated a slightly larger vulnerability' are not backed by any reported attack success rate, per-class confusion matrix, or confidence interval for any dataset or model. Because the universal-setting claim is the paper's core quantitative claim, the authors should provide a table with attack success rates, target-class flip rates, and BBox preservation metrics, together with error bars or per-image variation.
  2. [§VI.A–VI.B] The real-world red-to-green claim depends on the ATLAS HD-map association tolerance, but that tolerance is only asserted and never measured. The same subsection states that patches trained with Lbbox 'have not resulted in successful attacks,' which implies that the successful patches may not have preserved the traffic light's bounding box; they may have fabricated a green detection near the patch that ATLAS accepted through its permissive association. The paper should report BBox center offsets, IoU with the ground-truth traffic light, the actual association tolerance value, and the number of consecutive frames and camera streams that had to show green before the planner acted. Without this information, the central safety claim cannot be distinguished from a pipeline-association artifact.
  3. [§VI.A] The physical transfer evaluation is performed on the same three Campus East traffic lights whose images were used to train the patches. If the patches are instance-specific, this is not a test of universal physical transfer; if they are intended to be universal, the evaluation should include at least one unseen traffic light. The paper should state explicitly whether the physical test lights were seen during patch training and, if so, either provide a held-out physical test or reframe the claim as an instance-specific attack.
  4. [§VI.B] The central safety outcome, that the vehicle 'continue[s] with its current speed and no deceleration,' is reported without quantitative support. The text itself acknowledges inconsistent label flips, rapid red-green oscillations below 7 m, and full recovery below 2 m. The authors should report the number of runs, per-distance success rates, vehicle speed traces, and the criteria used to classify a run as a successful attack, so that the reliability of the claimed driving-level effect can be assessed.
minor comments (5)
  1. [§III.A] The sentence 'we focus on the latter as we rate it's attack criticality higher' contains a typo ('it's' should be 'its'), and the stated preference for green-to-red attacks over red-to-green attacks is not obvious; a brief justification would help.
  2. [§IV.B] The statement that for HDTLR and LISA 'object vanishing and detection of non-existent objects on the patch were observed' is not quantified; adding a small table or per-dataset examples would make the vulnerability comparison more concrete.
  3. [§V.A] Table II reports mAP50 and AP for red and green classes, but the mobile traffic light also has a yellow state; it would be helpful to state whether yellow was excluded from evaluation and why.
  4. [§VI.A] The description of the ATLAS pipeline mentions two parallel camera streams but does not explain how a single-stream label flip is aggregated across streams and frames; a short description or diagram would improve reproducibility.
  5. [Figures 6–8] The BBox color coding is described in the captions, but the distinction between blue, teal, and green boxes may be difficult to see in black-and-white printing; adding textual labels to the boxes would improve clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper reports an empirical patch-optimization study with held-out test evaluation; the real-world dependence on ATLAS's association tolerance is a stated premise, not a circular derivation.

full rationale

The paper does not claim a theoretical derivation from first principles. Adversarial patches are explicitly optimized with PGD against the target detector using a loss that combines classification, localization, total variation, and green-suppression terms, and success is then measured on test images and in physical settings. This is a standard empirical generalization evaluation, not a fitted parameter renamed as a prediction. The per-instance threat model means that training and evaluating a patch on the same Campus East traffic lights is consistent with the stated attack goal rather than a hidden circularity. The paper also openly reports that Lbbox-trained patches 'have not resulted in successful attacks', so the successful patches may not have preserved localization, and the ATLAS pipeline's tolerance for BBox discrepancies is a premise about the downstream system rather than an equation that reduces to the paper's own inputs. Self-citations to prior detector and ATLAS work provide external tools and baselines, not an unverified uniqueness argument that forces the conclusion. No equation is self-definitional, and no result is equivalent to its inputs by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The attack rests on strong attacker capabilities (white-box access, physical installation of large patches), on a particular pipeline association tolerance, and on hand-tuned patch scales and loss weights. These are load-bearing but not hidden: the paper states them. No new entities are introduced.

free parameters (5)
  • Patch scaling factor relative to BBox width = 2 to 3 times BBox width
    Section III.B: "This scaling factor for a patch was determined experimentally." The value directly affects physical attack success.
  • Digital loss weights = alpha=1, gamma=0.8
    Section IV.B states these values made Lcls and Ltv sufficient; no sensitivity analysis is given.
  • Mobile light loss weights = alpha=1, beta=2, gamma=5, delta=0.0002
    Section V.A sets these for the mobile traffic light experiments; they differ from digital settings and were chosen by hand.
  • Physical patch size = 45, 60, 75 cm (mobile); 40, 60, 80 cm (stationary)
    Section V.B and VI.B evaluate multiple sizes and select the best; the attack result depends on the tuned size.
  • Initial patch size in pixels = 50x50 to 100x100 depending on dataset
    Section IV.A: patch is initialized per dataset; this affects optimization but is a hand-chosen detail.
assumptions (5)
  • domain assumption White-box access to model architecture, weights, and data
    Section III.A: threat model assumes attacker has network architecture, weights, and data. This excludes black-box attackers.
  • domain assumption Physical installation of large printed patches under target traffic lights is feasible
    Sections V and VI use patches up to 80x80 cm; the attack assumes the attacker can place and maintain them unnoticed.
  • domain assumption Expectation over transformations transfers from digital to physical
    Section III.C applies rotations and brightness augmentation from Athalye et al.; real-world results show partial and weather-dependent transfer, so the assumption is only partially met.
  • domain assumption ATLAS pipeline allows detections with BBox minor discrepancies within tolerance of the HD map
    Section VI.A states this tolerance explicitly; it is what lets a label-flipped but localized detection reach the driving decision.
  • standard math Standard differentiability and gradient-based optimization of YOLO losses
    Section III.B uses PGD-10 and Adam; this relies on standard backpropagation assumptions, which hold for the YOLO architectures used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors." pith.science (2026). https://pith.science/paper/JOJJSG5Z

@misc{pith2026250604823,
  author       = {Pith},
  title        = {Pith review of: Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JOJJSG5Z}},
  note         = {Machine review of arXiv:2506.04823}
}
read the original abstract

Realistic adversarial attacks on various camera-based perception tasks of autonomous vehicles have been successfully demonstrated so far. However, only a few works considered attacks on traffic light detectors. This work shows how CNNs for traffic light detection can be attacked with printed patches. We propose a threat model, where each instance of a traffic light is attacked with a patch placed under it, and describe a training strategy. We demonstrate successful adversarial patch attacks in universal settings. Our experiments show realistic targeted red-to-green label-flipping attacks and attacks on pictogram classification. Finally, we perform a real-world evaluation with printed patches and demonstrate attacks in the lab settings with a mobile traffic light for construction sites and in a test area with stationary traffic lights. Our code is available at https://github.com/KASTEL-MobilityLab/attacks-on-traffic-light-detection.

Figures

Figures reproduced from arXiv: 2506.04823 by the authors.

Figure 1
Figure 1. Examples of proposed attacks with an adversarial [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Different attack types, exemplary for an image from [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Universal attacks, predictions by YOLOv7x. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (4 more)
Figure 3
Figure 3. Figure 3: Examples of generated patches for states and arrows. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 6
Figure 6. Figure 6: Experiments with a mobile traffic light system. The [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: Examples of patches generated for real-world exper [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: Experiments with a stationary traffic light, front [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

71 extracted references · 68 canonical work pages

  1. [1]

    Traffic light mapping and detection,

    N. Fairfield and C. Urmson, “Traffic light mapping and detection,” in International Conference on Robotics and Automation (ICRA) , 2011

    work page 2011

  2. [2]

    Traffic light recognition using deep learning and prior maps for autonomous cars,

    L. C. Possatti, R. Guidolini, V . B. Cardoso, R. F. Berriel, T. M. Paix˜ao, C. Badue, A. F. De Souza, and T. Oliveira-Santos, “Traffic light recognition using deep learning and prior maps for autonomous cars,” in International Joint Conference on Neural Networks (IJCNN) , 2019

    work page 2019

  3. [3]

    Intriguing Properties of Neural Networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing Properties of Neural Networks,” International Conference on Learning Representations (ICLR) , 2014

    work page 2014

  4. [4]

    Explaining and Harness- ing Adversarial Examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harness- ing Adversarial Examples,” in International Conference on Learning Representations (ICLR), 2015

    work page 2015

  5. [5]

    Adversarial Patch,

    T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial Patch,” in Advances in Neural Information Processing Systems (NIPS) - Workshops, 2017

    work page 2017

  6. [6]

    Evalu- ating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks,

    F. Nesti, G. Rossolini, S. Nair, A. Biondi, and G. C. Buttazzo, “Evalu- ating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks,” in Winter Conference on Applications of Computer Vision (WACV) , 2022

    work page 2022

  7. [7]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2018

    work page 2018

  8. [8]

    Adversarial sticker: A stealthy attack method in the physical world,

    X. Wei, Y . Guo, and J. Yu, “Adversarial sticker: A stealthy attack method in the physical world,” IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023

    work page 2023

Show all 71 references
  1. [9]

    Feasibility and sup- pression of adversarial patch attacks on end-to-end vehicle control,

    S. Pavlitskaya, S. ¨Unver, and J. M. Z ¨ollner, “Feasibility and sup- pression of adversarial patch attacks on end-to-end vehicle control,” in International Conference on Intelligent Transportation Systems (ITSC), 2020

    2020

  2. [10]

    Effects of and defenses against adversarial attacks on a traffic light classification cnn,

    M. Wan, M. Han, L. Li, Z. Li, and S. He, “Effects of and defenses against adversarial attacks on a traffic light classification cnn,” in ACM Southeast Conference, 2020

    2020

  3. [11]

    SITAR: evaluating the adversarial robustness of traffic light recognition in level-4 autonomous driving,

    B. Yang and J. Yang, “SITAR: evaluating the adversarial robustness of traffic light recognition in level-4 autonomous driving,” in Intelligent Vehicles Symposium (IV), 2024

    2024

  4. [12]

    Rolling colors: Adversarial laser exploits against traffic light recognition,

    C. Yan, Z. Xu, Z. Yin, X. Ji, and W. Xu, “Rolling colors: Adversarial laser exploits against traffic light recognition,” in USENIX Security Symposium, 2022

    2022

  5. [13]

    On the vulnerability of traffic light recognition systems to laser illumination attacks,

    S. H. V . Bhupathiraju, T. Sugawara, T. Sato, Q. A. Chen, M. Clifford, and S. Rampazzi, “On the vulnerability of traffic light recognition systems to laser illumination attacks,” ISOC Symposium on Vehicle Security and Privacy (VehicleSec) , 2024

    2024

  6. [14]

    Deepbillboard: Systematic physical-world testing of autonomous driving systems,

    H. Zhou, W. Li, Z. Kong, J. Guo, Y . Zhang, B. Yu, L. Zhang, and C. Liu, “Deepbillboard: Systematic physical-world testing of autonomous driving systems,” in International Conference on Software Engineering, 2020

    2020

  7. [15]

    TLD-READY: traffic light detection - relevance estimation and deployment analysis,

    N. Polley, S. Pavlitska, Y . Boualili, P. Rohrbeck, P. Stiller, A. K. Bangaru, and J. M. Z ¨ollner, “TLD-READY: traffic light detection - relevance estimation and deployment analysis,” in International Conference on Intelligent Transportation Systems (ITSC) , 2024

    2024

  8. [16]

    From door to door—principles and applications of computer vision for driver assistant systems,

    U. Franke, D. Gavrila, A. Gern, S. G ¨orzig, R. Janssen, F. Paetzold, and C. W ¨ohler, “From door to door—principles and applications of computer vision for driver assistant systems,” in Intelligent Vehicle Technologies, 2001

    2001

  9. [17]

    A vision-based traffic light detection system at intersections,

    Y .-C. Chung, J.-M. Wang, and S.-W. Chen, “A vision-based traffic light detection system at intersections,” Journal of Taiwan Normal University: Mathematics, Science and Technology , 2002

    2002

  10. [18]

    Robust recognition of traffic signals,

    F. Lindner, U. Kressel, and S. Kaelberer, “Robust recognition of traffic signals,” in Intelligent Vehicles Symposium (IV) , 2004

    2004

  11. [19]

    Visual state estima- tion of traffic lights using hidden markov models,

    D. Nienh ¨user, M. Drescher, and J. M. Z ¨ollner, “Visual state estima- tion of traffic lights using hidden markov models,” in International Conference on Intelligent Transportation Systems (ITSC) , 2010

    2010

  12. [20]

    Traffic light recognition using convolutional neural networks: A survey,

    S. Pavlitska, N. Lambing, A. Kimar Bangaru, and J. M. Z ¨ollner, “Traffic light recognition using convolutional neural networks: A survey,” in International Conference on Intelligent Transportation Systems (ITSC), 2023

    2023

  13. [21]

    You only look once: Unified, real-time object detection,

    J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, “You only look once: Unified, real-time object detection,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    2016

  14. [22]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” in European Conference on Computer Vision (ECCV) , 2016

    2016

  15. [23]

    Vision for looking at traffic lights: Issues, survey, and perspectives,

    M. B. Jensen, M. P. Philipsen, A. Møgelmose, T. B. Moeslund, and M. M. Trivedi, “Vision for looking at traffic lights: Issues, survey, and perspectives,” IEEE transactions on intelligent transportation systems, 2016

    2016

  16. [24]

    Detecting traffic lights by single shot detection,

    J. M ¨uller and K. Dietmayer, “Detecting traffic lights by single shot detection,” in International Conference on Intelligent Transportation Systems (ITSC), 2018

    2018

  17. [25]

    A hierarchical deep architecture and mini-batch selection method for joint traffic sign and light detection,

    A. Pon, O. Adrienko, A. Harakeh, and S. L. Waslander, “A hierarchical deep architecture and mini-batch selection method for joint traffic sign and light detection,” in Conference on Computer and Robot Vision (CRV), 2018

    2018

  18. [26]

    Deep convolutional traffic light recognition for automated driving,

    M. Bach, D. Stumper, and K. Dietmayer, “Deep convolutional traffic light recognition for automated driving,” in International Conference on Intelligent Transportation Systems (ITSC) , 2018

    2018

  19. [27]

    Real-time traffic light detection and recognition based on deep retinanet for self driving cars,

    A. Aneesh, L. Shine, R. Pradeep, and V . Sajith, “Real-time traffic light detection and recognition based on deep retinanet for self driving cars,” in International Conference on Intelligent Computing, Instrumentation and Control Technologies (ICICICT) , 2019

    2019

  20. [28]

    A comparative study between state-of-the-art object detectors for traffic light detection,

    R. Gokul, A. Nirmal, K. Bharath, M. Pranesh, and R. Karthika, “A comparative study between state-of-the-art object detectors for traffic light detection,” in International Conference on Emerging Trends in Information Technology and Engineering (ic-ETITE) , 2020

    2020

  21. [29]

    An end-to-end traffic light detection algorithm based on deep learning,

    S. Yan, X. Liu, W. Qian, and Q. Chen, “An end-to-end traffic light detection algorithm based on deep learning,” in International conference on security, pattern analysis, and cybernetics (SPAC) , 2021

    2021

  22. [30]

    Traffic light detection based on depth improved yolov5,

    P. Liu and T. Li, “Traffic light detection based on depth improved yolov5,” in International Conference on Neural Networks, Information and Communication Engineering (NNICE) , 2023

    2023

  23. [31]

    Real-time small traffic sign detection with revised faster-rcnn,

    C. Han, G. Gao, and Y . Zhang, “Real-time small traffic sign detection with revised faster-rcnn,” Multimedia Tools and Applications , 2019

    2019

  24. [32]

    Traffic lights detection and recognition method based on the improved yolov4 algorithm,

    Q. Wang, Q. Zhang, X. Liang, Y . Wang, C. Zhou, and V . I. Mikulovich, “Traffic lights detection and recognition method based on the improved yolov4 algorithm,” Sensors, 2022

    2022

  25. [33]

    Fast traffic sign and light detection using deep learning for automotive applications,

    H. Naimi, T. Akilan, and M. A. Khalid, “Fast traffic sign and light detection using deep learning for automotive applications,” in IEEE Western New York Image and Signal Processing Workshop (WNYISPW), 2021

    2021

  26. [34]

    Deeptlr: A single deep convolutional network for detection and classification of traffic lights,

    M. Weber, P. Wolf, and J. M. Z ¨ollner, “Deeptlr: A single deep convolutional network for detection and classification of traffic lights,” in Intelligent Vehicles Symposium (IV) , 2016

    2016

  27. [35]

    Hdtlr: A cnn based hierarchical detector for traffic lights,

    M. Weber, M. Huber, and J. M. Z ¨ollner, “Hdtlr: A cnn based hierarchical detector for traffic lights,” in International Conference on Intelligent Transportation Systems (ITSC) , 2018

    2018

  28. [36]

    Traffic light recog- nition in varying illumination using deep learning and saliency map,

    V . John, K. Yoneda, B. Qi, Z. Liu, and S. Mita, “Traffic light recog- nition in varying illumination using deep learning and saliency map,” in International Conference on Intelligent Transportation Systems (ITSC), 2014

    2014

  29. [37]

    Saliency map generation by the convolutional neural network for real-time traffic light detection using template matching,

    V . John, K. Yoneda, Z. Liu, and S. Mita, “Saliency map generation by the convolutional neural network for real-time traffic light detection using template matching,” IEEE Trans. Computational Imaging, 2015

    2015

  30. [38]

    Universal adversarial perturbations,

    S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2017

    2017

  31. [39]

    Lavan: Localized and visible adversarial noise,

    D. Karmon, D. Zoran, and Y . Goldberg, “Lavan: Localized and visible adversarial noise,” in International Conference on Machine Learning (ICML), 2018

    2018

  32. [40]

    Adversarial vulnerability of temporal feature networks for object detection,

    S. Pavlitskaya, N. Polley, M. Weber, and J. M. Z ¨ollner, “Adversarial vulnerability of temporal feature networks for object detection,” in European Conference on Computer Vision (ECCV) - Workshops, 2022

    2022

  33. [41]

    Feasibility of incon- spicuous gan-generated adversarial patches against object detection,

    S. Pavlitskaya, B. Codau, and J. M. Z ¨ollner, “Feasibility of incon- spicuous gan-generated adversarial patches against object detection,” in International Joint Conference on Artificial Intelligence (IJCAI) - Workshops, 2022

    2022

  34. [42]

    Patch-based attack on traffic sign recognition,

    B. Ye, H. Yin, J. Yan, and W. Ge, “Patch-based attack on traffic sign recognition,” in International Conference on Intelligent Transportation Systems (ITSC), 2021

    2021

  35. [43]

    Cyber attacks on scada based traffic light control systems in the smart cities,

    C. ¨Ozarpa, ˙I. Avcı, B. F. Kınacı, S. Arapo ˘glu, and S. A. Kara, “Cyber attacks on scada based traffic light control systems in the smart cities,” The International Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences , 2021

    2021

  36. [44]

    Green lights forever: Analyzing the security of traffic infrastructure,

    B. Ghena, W. Beyer, A. Hillaker, J. Pevarnek, and J. A. Halderman, “Green lights forever: Analyzing the security of traffic infrastructure,” in USENIX workshop on offensive technologies (WOOT 14) , 2014

    2014

  37. [45]

    Fooling perception via location: a case of region-of-interest attacks on traffic light detection in au- tonomous driving,

    K. Tang, J. Shen, and Q. A. Chen, “Fooling perception via location: a case of region-of-interest attacks on traffic light detection in au- tonomous driving,” inNDSS Workshop on Automotive and Autonomous Vehicle Security (AutoSec), 2021

    2021

  38. [46]

    Exposing congestion attack on emerging connected vehicle based traffic signal control

    Q. A. Chen, Y . Yin, Y . Feng, Z. M. Mao, and H. X. Liu, “Exposing congestion attack on emerging connected vehicle based traffic signal control.” in NDSS, 2018

    2018

  39. [47]

    Secure traffic lights: Replay attack detection for model-based smart traffic con- trollers,

    P. Oza, M. Foruhandeh, R. Gerdes, and T. Chantem, “Secure traffic lights: Replay attack detection for model-based smart traffic con- trollers,” in ACM workshop on automotive and aerial vehicle security , 2020

    2020

  40. [48]

    I can see the light: Attacks on autonomous vehicles using invisible lights,

    W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I can see the light: Attacks on autonomous vehicles using invisible lights,” in SIGSAC Conference on Computer and Communications Security , 2021

    2021

  41. [49]

    Baidu apollo team (2017), apollo: Open source autonomous driving,

    “Baidu apollo team (2017), apollo: Open source autonomous driving,” https://github.com/ApolloAuto/apollo, accessed: 2024-03-20

    2017

  42. [50]

    BDD100K: A diverse driving dataset for heterogeneous multitask learning,

    F. Yu, H. Chen, X. Wang, W. Xian, Y . Chen, F. Liu, V . Madhavan, and T. Darrell, “BDD100K: A diverse driving dataset for heterogeneous multitask learning,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  43. [51]

    Autoware on board: Enabling autonomous vehicles with embedded systems,

    S. Kato, S. Tokunaga, Y . Maruyama, S. Maeda, M. Hirabayashi, Y . Kitsukawa, A. Monrroy, T. Ando, Y . Fujii, and T. Azumi, “Autoware on board: Enabling autonomous vehicles with embedded systems,” in International Conference on Cyber-Physical Systems (ICCPS) , 2018

    2018

  44. [52]

    Mobilenets: Efficient convolutional neural networks for mobile vision applications,

    A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “Mobilenets: Efficient convolutional neural networks for mobile vision applications,” CoRR, vol. abs/1704.04861, 2017

    2017 arXiv

  45. [53]

    Rethink- ing the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethink- ing the inception architecture for computer vision,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    2016

  46. [54]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” in International Conference on Learning Representations (ICLR) , 2018

    2018

  47. [55]

    A rotation and a translation suffice: Fooling cnns with simple transfor- mations,

    L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry, “A rotation and a translation suffice: Fooling cnns with simple transfor- mations,” CoRR, vol. abs/1712.02779, 2018

    2018 arXiv

  48. [56]

    One pixel attack for fooling deep neural networks,

    J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Transactions on Evolutionary Computation , 2019

    2019

  49. [57]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. A. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy , 2017

    2017

  50. [58]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in International Conference on Learning Representations (ICLR) , 2015

    2015

  51. [59]

    Carla: An open urban driving simulator,

    A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “Carla: An open urban driving simulator,” in Conference on Robot Learning (CoRL), 2017

    2017

  52. [60]

    Towards Deep Learning Models Resistant to Adversarial Attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” International Conference on Learning Representations (ICLR) , 2018

    2018

  53. [61]

    TOG: targeted adversarial objectness gradient attacks on real-time object detection systems,

    K. H. Chow, L. Liu, M. E. Gursoy, S. Truex, W. Wei, and Y . Wu, “TOG: targeted adversarial objectness gradient attacks on real-time object detection systems,” CoRR, vol. abs/2004.04320, 2020

    2004 arXiv

  54. [62]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Conference on Computer and Communications Security (CCS) , 2016

    2016

  55. [63]

    Adam: A method for stochastic opti- mization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic opti- mization,” in International Conference on Learning Representations (ICLR), 2015

    2015

  56. [64]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in International Conference on Machine Learning (ICML), 2018

    2018

  57. [65]

    On physical adversarial patches for object detection,

    M. Lee and J. Z. Kolter, “On physical adversarial patches for object detection,” CoRR, vol. abs/1906.11897, 2019

    1906 arXiv

  58. [66]

    Yolov7: Trainable bag- of-freebies sets new state-of-the-art for real-time object detectors,

    C. Wang, A. Bochkovskiy, and H. M. Liao, “Yolov7: Trainable bag- of-freebies sets new state-of-the-art for real-time object detectors,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  59. [67]

    Yolo by ultralytics (version 8.0.0) [computer software],

    G. Jocher, A. Chaurasia, and J. Qiu, “Yolo by ultralytics (version 8.0.0) [computer software],” https://github.com/ultralytics/ultralytics, 2023

    2023

  60. [68]

    A deep analysis of the existing datasets for traffic light state recognition,

    C. Fern ´andez, C. Guindel, N.-O. Salscheider, and C. Stiller, “A deep analysis of the existing datasets for traffic light state recognition,” in International Conference on Intelligent Transportation Systems (ITSC), 2018

    2018

  61. [69]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in International Conference on Computer Vision (ICCV), 2017

    2017

  62. [70]

    CoCar NextGen: a Multi-Purpose Platform for Con- nected Autonomous Driving Research,

    M. Heinrich, M. Zipfl, M. Uecker, S. Ochs, M. Gontscharow, T. Fleck, J. Doll, P. Sch ¨orner, C. Hubschneider, M. R. Zofka, A. Viehl, and J. M. Z ¨ollner, “CoCar NextGen: a Multi-Purpose Platform for Con- nected Autonomous Driving Research,” in International Conference on Intel...

    2024

  63. [71]

    The atlas of traffic lights: A reliable perception framework for autonomous driving,

    R. Polley, N. Polley, D. Heid, M. Heinrich, S. Ochs, and J. M. Z¨ollner, “The atlas of traffic lights: A reliable perception framework for autonomous driving,” in Intelligent Vehicles Symposium (IV), 2025

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.