arxiv: 2604.02457 · v1 · submitted 2026-04-02 · 💻 cs.CV · cs.CR

Recognition: no theorem link

Street-Legal Physical-World Adversarial Rim for License Plates

Nikhil Kalidasu , Sahana Ganapathy

Authors on Pith no claims yet

Pith reviewed 2026-05-13 21:15 UTC · model grok-4.3

classification 💻 cs.CV cs.CR

keywords adversarial attacksautomatic license plate recognitionphysical world attackslicense platesALPR vulnerabilitieswhite-box attacksstreet-legal modifications

0 comments

The pith

A physical rim around a license plate can cut ALPR accuracy by 60 percent and enable targeted impersonation while staying street-legal in Texas.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that low-resourced attackers can build a simple physical attachment that fools automatic license plate readers without touching the plate or accessing any system. SPAR reduces recognition accuracy by 60 percent and reaches an 18 percent success rate for making one plate look like another under favorable conditions. The device costs less than 100 dollars to make and draws on existing Texas legislation to claim it does not violate street-legal rules. This work focuses on real-world practicality rather than purely digital attacks. It points to ongoing gaps between deployed ALPR systems and physical-world threats that anyone with basic fabrication tools could exploit.

Core claim

SPAR is a white-box physical adversarial rim that perturbs the input to the fast-alpr system, lowering its accuracy by 60 percent and producing an 18 percent targeted impersonation rate while requiring no infrastructure access and leaving the original plate unchanged.

What carries the argument

The Street-legal Physical Adversarial Rim (SPAR), a physical border placed around the license plate that generates adversarial visual patterns for ALPR cameras while satisfying legal appearance standards.

If this is right

ALPR accuracy falls by 60 percent under optimal physical conditions.
Targeted impersonation reaches 18 percent success without plate alteration.
The entire attack can be built for under 100 dollars with no system access required.
The rim stays within Texas legal bounds according to the cited legislation and case law.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same rim concept could extend to other vehicle tracking cameras beyond standard ALPR.
Legal arguments based on one state's case law may fail in places with stricter rules on vehicle modifications.
Use of commercial coding tools to build the attack suggests non-experts could replicate it quickly.

Load-bearing premise

The rim will keep working and remain legal when lighting, angles, weather, and camera models change in ways not covered by the cited Texas case law.

What would settle it

Field tests of the rim on multiple ALPR cameras across rain, night, and side-angle conditions that show whether the 60 percent accuracy drop and 18 percent impersonation rate hold.

Figures

Figures reproduced from arXiv: 2604.02457 by Nikhil Kalidasu, Sahana Ganapathy.

**Figure 1.** Figure 1: Sample images from each lighting condition. Digital World: We evaluated further in the digital world to benchmark bestcase performance and understand the specific roles of our contributions via an ablation test. We used the control images of our horizontal viewing angle test, with no patch applied, as our test set, totaling 358 images at known grid coordinates. We manually labeled the corners of the lice… view at source ↗

**Figure 2.** Figure 2: Final adversarial rims for disruption and impersonation objectives. The final trained patches ( [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

**Figure 3.** Figure 3: fast-alpr output on horizontal viewing angle test. Pdisrupt achieves optimal performance in full sunlight, inducing a 60.0% reduction in correct reads. Pimpersonate achieves optimal performance in dusk lighting, inducing fast-alpr to output the impersonation target 17.8% of the time. Both attacks greatly struggled on the dark flash case because of the license plate’s retroreflectivity. Although we could … view at source ↗

**Figure 4.** Figure 4: Detection model’s confidence distributions under various lighting conditions [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗

**Figure 5.** Figure 5: Horizontal viewing-angle test results (metrics averaged over all lighting conditions). dCor(EDT , d), but marginally increased dCor(EDT , θ). Additionally, Pimpersonate’s correlations with viewing angle are all below the significance threshold δα, and Pdisrupt’s correlations with the same are either below or slightly above, so we conclude that SPAR has succeeded in its attack with negligible dependence on… view at source ↗

**Figure 6.** Figure 6: All final patches used in ablation study. We found that both TV loss and homography-aware training are critical for SPAR’s performance. Removing TV loss causes a 98.7% increase in correct reads on the disruption attack and near complete failure at the impersonation attack. Removing homography-based patch application during training causes a 107% increase in correct reads and a 70.4% reduction in successful… view at source ↗

**Figure 8.** Figure 8: Training and validation loss curves during ablation testing for the disruption objective. Removing both results in near-identical performance to removing TV loss alone on the impersonation attack, and slightly better performance than removing TV loss alone on the disruption attack ( [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗

read the original abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

SPAR shows a cheap physical rim that can drop ALPR accuracy by 60% while staying legal in Texas, but the experiments give no trial counts or robustness data so the numbers are hard to trust.

read the letter

SPAR is a physical rim you bolt onto a license plate to attack open-source ALPR like fast-alpr. The authors say it needs no system access, leaves the plate readable to humans, costs under $100, and is street-legal in Texas under existing rules. They report a 60% accuracy drop and 18% targeted impersonation under optimal conditions, and they built the whole thing with commercial AI coding tools. That combination of physical realizability, explicit legality argument, and AI-assisted implementation is the genuinely new part relative to earlier ALPR adversarial papers. The work does a clean job showing how low-resource attackers could actually deploy something like this without obvious legal red flags or infrastructure hacks. The legal section is straightforward and ties directly to the Texas case law they cite, which is useful for anyone thinking about real-world deployment. The main weakness is the experimental reporting. The abstract states the headline numbers but gives no count of trials, no description of lighting or angle ranges, no error bars, and no curves showing how performance falls off outside the best case. That leaves the physical transfer and real-world invariance unproven, exactly as the stress-test note flags. Without those details the 60% and 18% figures are hard to interpret or replicate. This paper is for people working on physical adversarial examples or ALPR security and privacy. A reader who wants concrete low-cost attack ideas plus the legal angle will find it worth reading. I would bring it to a reading group to talk through what additional tests would be needed. I would not cite it yet because the results are not yet solid enough to build on. It deserves peer review so the authors can supply the missing trial data and variability analysis.

Referee Report

1 major / 1 minor

Summary. The paper introduces the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box adversarial attachment for license plates targeting open-source ALPR systems such as fast-alpr. SPAR requires no infrastructure access, does not alter or obscure the plate, is argued to be street-legal in Texas based on legislation and case law, can be fabricated for under $100, and under optimal conditions reduces ALPR accuracy by 60% while achieving an 18% targeted impersonation rate. The work emphasizes physical-world practicality and low-resource feasibility.

Significance. If the physical transfer and robustness results hold, the work shows that low-cost, street-legal adversarial attacks on deployed ALPR systems are achievable without specialized access, highlighting concrete vulnerabilities in real-world surveillance. The integration of legal analysis with physical fabrication is a distinguishing contribution that could inform both technical defenses and policy discussions around ALPR deployment.

major comments (1)

[Abstract] Abstract: The central empirical claims (60% accuracy reduction and 18% targeted impersonation under optimal conditions) are presented without any description of the number of trials, error bars, specific test conditions (lighting, viewing angles, distances, weather, or camera models), or the procedure for selecting optimal conditions. These details are load-bearing for the practicality and street-deployment conclusions.

minor comments (1)

[Abstract] Abstract: The claim that SPAR 'was implemented entirely by commercial agentic coding assistants' is stated without elaboration on verification, human oversight, or reproducibility steps; this should be expanded in the methods or appendix if retained.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the constructive feedback on the abstract. We agree that the central empirical claims require supporting details on experimental scale and conditions to substantiate the practicality conclusions, and we will revise accordingly.

read point-by-point responses

Referee: [Abstract] Abstract: The central empirical claims (60% accuracy reduction and 18% targeted impersonation under optimal conditions) are presented without any description of the number of trials, error bars, specific test conditions (lighting, viewing angles, distances, weather, or camera models), or the procedure for selecting optimal conditions. These details are load-bearing for the practicality and street-deployment conclusions.

Authors: We agree with the referee that the abstract, in its current concise form, does not include these experimental details. The full manuscript already reports the number of trials, error bars where applicable, test conditions (including lighting, angles, distances, weather, and camera models), and the grid-search procedure used to identify optimal conditions in the Experiments section. In the revised manuscript we will expand the abstract to incorporate a concise summary of these elements (e.g., trial count, condition ranges, and selection method) while remaining within length limits. This change directly addresses the concern without altering the reported results. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical physical results independent of inputs

full rationale

The paper presents SPAR as a fabricated physical object whose effectiveness is measured through direct real-world experiments on an open-source ALPR system. No equations, fitted parameters, or derivation steps are described that would reduce reported metrics (60% accuracy drop, 18% impersonation) to self-definitions or self-citations. Legality claims rest on external Texas legislation and case law rather than author prior work. Performance numbers are framed as outcomes of physical testing, not predictions forced by construction from any model inputs. The work is self-contained against external benchmarks of fabrication and deployment.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 1 invented entities

The central claim rests on the existence of a physical pattern that reliably fools fast-alpr under real-world conditions and on the interpretation of Texas statutes and case law as permitting the rim. No free parameters are described. The only invented entity is the SPAR rim itself.

axioms (2)

domain assumption fast-alpr is a representative modern open-source ALPR system whose vulnerabilities generalize to deployed commercial systems.
The abstract tests only fast-alpr and extrapolates to 'modern ALPR systems' without additional validation.
domain assumption Texas legislation and case law permit the described rim without constituting plate alteration or obscuration.
The legal argument is presented as settled based on 'prior legislation and case law' but no specific statutes are quoted in the abstract.

invented entities (1)

Street-legal Physical Adversarial Rim (SPAR) no independent evidence
purpose: Physical object that induces misclassification in ALPR while remaining legal and non-obscuring.
SPAR is introduced as a new construct; no independent evidence (e.g., predicted failure modes in other models) is provided beyond the reported experiments.

pith-pipeline@v0.9.0 · 5485 in / 1546 out tokens · 30351 ms · 2026-05-13T21:15:33.662215+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

44 extracted references · 44 canonical work pages · 3 internal anchors

[1]

https://github.com/ankandrew/fast-plate-ocr (Sep 2025), gitHub repository, last accessed 2025/12/02, Version 1.0.1

Ankandrew: Fast & Lightweight License Plate OCR. https://github.com/ankandrew/fast-plate-ocr (Sep 2025), gitHub repository, last accessed 2025/12/02, Version 1.0.1

work page 2025
[2]

https://github.com/ankandrew/fast-alpr (Dec 2025)

Ankandrew: Fastalpr. https://github.com/ankandrew/fast-alpr (Dec 2025)

work page 2025
[3]

https://github.com/ankandrew/open-image- models (Sep 2025), version 0.4.0

Ankandrew: Open Image Models. https://github.com/ankandrew/open-image- models (Sep 2025), version 0.4.0

work page 2025
[4]

Anthropic: Threat intelligence report: August 2025. Tech. rep., Anthropic (Aug 2025), https://www- cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf, last accessed 2026/03/20

work page 2025
[5]

https://doi.org/10.48550/arXiv.1712.09665

Brown, T.B., Mané, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial Patch (May 2018). https://doi.org/10.48550/arXiv.1712.09665

work page doi:10.48550/arxiv.1712.09665 2018
[6]

Robust physical-world attacks on machine learning models,

Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., Song, D.: Robust Physical-World Attacks on Deep Learning Models (Apr 2018). https://doi.org/10.48550/arXiv.1707.08945

work page doi:10.48550/arxiv.1707.08945 2018
[7]

In: Cryptog- raphy Engineering: Design Principles and Practical Applications, chap

Ferguson, N., Schneier, B., Kohno, T.: The context of cryptography. In: Cryptog- raphy Engineering: Design Principles and Practical Applications, chap. 1. Wiley, Indianapolis, IN (2010)

work page 2010
[8]

Finklea, K.: Law Enforcement and Technology: Use of Automated License Plate Readers.Tech.Rep.CRSReportNo.R48160,CongressionalResearchService(Aug 2024), https://www.congress.gov/crs-product/R48160

work page 2024
[9]

Journal of Machine Learning Research - Proceedings Track9(01 2010)

Glorot, X.: Understanding the difficulty of training deep feedforward neural net- works. Journal of Machine Learning Research - Proceedings Track9(01 2010)

work page 2010
[10]

Explaining and Harnessing Adversarial Examples

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples (Mar 2015). https://doi.org/10.48550/arXiv.1412.6572

work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1412.6572 2015
[11]

Computers, Materials & Continua 65(2), 1437–1452 (Aug 2020)

Gu, Z., Su, Y., Liu, C., Lyu, Y., Jian, Y., Li, H., Cao, Z., Wang, L.: Adversarial Attacks on License Plate Recognition Systems. Computers, Materials & Continua 65(2), 1437–1452 (Aug 2020). https://doi.org/10.32604/cmc.2020.011834

work page doi:10.32604/cmc.2020.011834 2020
[12]

arXiv preprint arXiv:2104.05704 , year=

Hassani, A., Walton, S., Shah, N., Abuduweili, A., Li, J., Shi, H.: Escaping the big data paradigm with compact transformers (2021). https://doi.org/10.48550/arXiv.2104.05704 Street-Legal Physical-World Adversarial Rim for License Plates 19

work page doi:10.48550/arxiv.2104.05704 2021
[13]

https://doi.org/10.48550/arXiv.2301.05506

Jiamsuchon, C., Suaboot, J., Rattanavipanon, N.: On the feasibility of attacking Thai LPR systems with adversarial examples (Jan 2023). https://doi.org/10.48550/arXiv.2301.05506

work page doi:10.48550/arxiv.2301.05506 2023
[14]

Journal des sciences militaires (1883)

Kerckhoffs, A.: La cryptographie militaire. Journal des sciences militaires (1883)

work page
[15]

Procedia CS3, 1033–1037 (Dec 2011)

Kocer, H.E., Çevik, K.: Artificial neural networks based vehicle li- cense plate recognition. Procedia CS3, 1033–1037 (Dec 2011). https://doi.org/10.1016/j.procs.2010.12.169

work page doi:10.1016/j.procs.2010.12.169 2011
[16]

In: Yampolskiy, R.V

Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial Examples in the Phys- ical World. In: Yampolskiy, R.V. (ed.) Artificial Intelligence Safety and Secu- rity, pp. 99–112. Chapman and Hall/CRC, First edition. \textbar Boca Ra- ton, FL : CRC Press/Taylor & Francis Group, 2018., 1 edn. (Jul 2018). https://doi.org/10.1201/9781351251389-8

work page doi:10.1201/9781351251389-8 2018
[17]

Journal of Sensors2021(1), 6473833 (2021)

Kwon, H., Baek, J.W.: Adv-Plate Attack: Adversarially Perturbed Plate for Li- cense Plate Recognition System. Journal of Sensors2021(1), 6473833 (2021). https://doi.org/10.1155/2021/6473833

work page doi:10.1155/2021/6473833 2021
[18]

https://doi.org/10.48550/arXiv.1601.05610

Li, H., Shen, C.: Reading Car License Plates Using Deep Convolutional Neural Networks and LSTMs (Jan 2016). https://doi.org/10.48550/arXiv.1601.05610

work page doi:10.48550/arxiv.1601.05610 2016
[19]

Focal Loss for Dense Object Detection

Lin, T.Y., Goyal, P., Girshick, R., He, K., Dollár, P.: Focal Loss for Dense Object Detection (Feb 2018). https://doi.org/10.48550/arXiv.1708.02002

work page Pith review doi:10.48550/arxiv.1708.02002 2018
[20]

In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.M

Liu, A., Wang, J., Liu, X., Cao, B., Zhang, C., Yu, H.: Bias-Based Universal Adver- sarial Patch Attack for Automatic Check-Out. In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.M. (eds.) Computer Vision – ECCV 2020. pp. 395–410. Springer International Publishing, Cham (2020). https://doi.org/10.1007/978-3-030-58601- 0_24

work page doi:10.1007/978-3-030-58601- 2020
[21]

https://doi.org/10.48550/arXiv.1806.02299

Liu, X., Yang, H., Liu, Z., Song, L., Li, H., Chen, Y.: DPatch: An Adversarial Patch Attack on Object Detectors (Apr 2019). https://doi.org/10.48550/arXiv.1806.02299

work page doi:10.48550/arxiv.1806.02299 2019
[22]

Soft Computing22(Apr 2018)

Liu, Y., Huang, H., Cao, J., Huang, T.: Convolutional neural networks-based in- telligent recognition of Chinese license plates. Soft Computing22(Apr 2018). https://doi.org/10.1007/s00500-017-2503-0

work page doi:10.1007/s00500-017-2503-0 2018
[23]

Decoupled Weight Decay Regularization

Loshchilov, I., Hutter, F.: Decoupled Weight Decay Regularization (Jan 2019). https://doi.org/10.48550/arXiv.1711.05101

work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1711.05101 2019
[24]

https://doi.org/10.48550/arXiv.1703.07330

Masood, S.Z., Shu, G., Dehghan, A., Ortiz, E.G.: License Plate Detection and Recognition Using Deeply Learned Convolutional Neural Networks (Mar 2017). https://doi.org/10.48550/arXiv.1703.07330

work page doi:10.48550/arxiv.1703.07330 2017
[25]

https://doi.org/10.48550/arXiv.2305.01074

Nguyen, K., Fernando, T., Fookes, C., Sridharan, S.: Physical Adversarial Attacks for Surveillance: A Survey (May 2023). https://doi.org/10.48550/arXiv.2305.01074

work page doi:10.48550/arxiv.2305.01074 2023
[26]

Computers & Security95, 101826 (Aug 2020)

Qian, Y., Ma, D., Wang, B., Pan, J., Wang, J., Gu, Z., Chen, J., Zhou, W., Lei, J.: Spot evasion attacks: Adversarial examples for license plate recognition systems with convolutional neural networks. Computers & Security95, 101826 (Aug 2020). https://doi.org/10.1016/j.cose.2020.101826

work page doi:10.1016/j.cose.2020.101826 2020
[27]

& Bradski, G

Riba, E., Mishkin, D., Ponsa, D., Rublee, E., Bradski, G.: Kornia: An Open Source Differentiable Computer Vision Library for PyTorch (Oct 2019). https://doi.org/10.48550/arXiv.1910.02190

work page doi:10.48550/arxiv.1910.02190 2019
[28]

1992 , issn =

Rudin, L.I., Osher, S., Fatemi, E.: Nonlinear total variation based noise re- moval algorithms. Physica D: Nonlinear Phenomena60(1-4), 259–268 (1992). https://doi.org/10.1016/0167-2789(92)90242-F

work page doi:10.1016/0167-2789(92)90242-f 1992
[29]

https://doi.org/10.48550/arXiv.2410.19863 20 Nikhil Kalidasu and Sahana Ganapathy

Shack, J., Petrovic, K., Saukh, O.: Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detection (Nov 2024). https://doi.org/10.48550/arXiv.2410.19863 20 Nikhil Kalidasu and Sahana Ganapathy

work page doi:10.48550/arxiv.2410.19863 2024
[30]

https://doi.org/10.48550/arXiv.2311.12857, http://arxiv.org/abs/2311.12857

Shrestha, B., Khakurel, G., Simkhada, K., Adhikari, B.: Adversarial sam- ple generation and training using geometric masks for accurate and resilient license plate character recognition. https://doi.org/10.48550/arXiv.2311.12857, http://arxiv.org/abs/2311.12857

work page doi:10.48550/arxiv.2311.12857
[31]

Stein, N.: Automated License Plate Readers: Legal and Policy Evalua- tion. Tech. rep., Science, Technology and Public Policy Program, Univer- sity of Michigan (Jan 2023), https://stpp.fordschool.umich.edu/research/policy- brief/automated-license-plate-readers-legal-and-policy-evaluation, policy brief, last accessed 2026/03/20

work page 2023
[32]

Intriguing properties of neural networks

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfel- low, I., Fergus, R.: Intriguing properties of neural networks (Feb 2014). https://doi.org/10.48550/arXiv.1312.6199

work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1312.6199 2014
[33]

The Annals of Statistics35(6) (Dec 2007)

Székely, G.J., Rizzo, M.L., Bakirov, N.K.: Measuring and testing depen- dence by correlation of distances. The Annals of Statistics35(6) (Dec 2007). https://doi.org/10.1214/009053607000000505

work page doi:10.1214/009053607000000505 2007
[34]

https://doi.org/10.5555/3620237.3620277

Tao, G., An, S., Cheng, S., Shen, G., Zhang, X.: Hard-label Black-box Universal Adversarial Patch Attack . https://doi.org/10.5555/3620237.3620277

work page doi:10.5555/3620237.3620277
[35]

Texas Court of Criminal Appeals: State v. johnson. 219 S.W.3d 386 (Tex. Crim. App. 2007) (Feb 2007)

work page 2007
[36]

Texas Legislature: Texas Transportation Code § 504.945: Wrong, fictitious, altered, or obscured license plate. Tex. Transp. Code § 504.945 (2024), https://statutes.capitol.texas.gov/Docs/TN/htm/TN.504.htm

work page 2024
[37]

United States Court of Appeals, Fifth Circuit: United states v. granado. 302 F.3d 421 (5th Cir. 2002) (2002)

work page 2002
[38]

contreras-trevino

United States Court of Appeals, Fifth Circuit: United states v. contreras-trevino. 448 F.3d 821 (5th Cir. 2006) (2006)

work page 2006
[39]

Yolov9: Learning what you want to learn us- ing programmable gradient information

Wang, C.Y., Liao, H.Y.M.: YOLOv9: Learning what you want to learn using programmable gradient information (2024). https://doi.org/10.48550/arXiv.2402.13616

work page doi:10.48550/arxiv.2402.13616 2024
[40]

In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.M

Xu, K., Zhang, G., Liu, S., Fan, Q., Sun, M., Chen, H., Chen, P.Y., Wang, Y., Lin, X.: Adversarial T-Shirt! Evading Person Detectors in a Physical World. In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.M. (eds.) Computer Vision – ECCV 2020, vol. 12350, pp. 665–681. Springer International Publishing, Cham (2020). https://doi.org/10.1007/978-3-030-58558-7_39

work page doi:10.1007/978-3-030-58558-7_39 2020
[41]

Khan, and Fahad Shah- baz Khan

Yu, C., Chen, J., Xue, Y., Liu, Y., Wan, W., Bao, J., Ma, H.: Defending against Universal Adversarial Patches by Clipping Feature Norms. In: 2021 IEEE/CVF In- ternational Conference on Computer Vision (ICCV). pp. 16414–16422. IEEE, Mon- treal, QC, Canada (Oct 2021). https://doi.org/10.1109/ICCV48922.2021.01612

work page doi:10.1109/iccv48922.2021.01612 2021
[42]

In: Proceedings of the 24th ACM International Conference on Multimedia

Yu, J., Jiang, Y., Wang, Z., Cao, Z., Huang, T.: UnitBox: An Advanced Object Detection Network. In: Proceedings of the 24th ACM International Conference on Multimedia. pp. 516–520 (Oct 2016). https://doi.org/10.1145/2964284.2967274

work page doi:10.1145/2964284.2967274 2016
[43]

https://doi.org/10.1007/978-3-030-42921-8_6

Zha, M., Meng, G., Lin, C., Zhou, Z., Chen, K.: RoLMA: A Practical Adversarial Attack against Deep Learning-based LPR Systems (Oct 2019). https://doi.org/10.1007/978-3-030-42921-8_6

work page doi:10.1007/978-3-030-42921-8_6 2019
[44]

In: Zhang, W., Tung, A., Zheng, Z., Yang, Z., Wang, X., Guo, H

Zhang, K., Qin, Y., Pan, H.: LPLA : The Adversarial Attack Against License Plate Recognition Systems. In: Zhang, W., Tung, A., Zheng, Z., Yang, Z., Wang, X., Guo, H. (eds.) Web and Big Data. pp. 407–421. Springer Nature, Singapore (2024). https://doi.org/10.1007/978-981-97-7232-2_27

work page doi:10.1007/978-981-97-7232-2_27 2024