Mitigation of Camouflaged Adversarial Attacks in Autonomous Vehicles--A Case Study Using CARLA Simulator

Abhijeet Solanki; Brady Carter; Syed Rafay Hasan; Terry N. Guo; Wesam Al Amiri; Yago Romano Martinez

REVIEW 4 major objections 5 minor 20 references

Mitigation of Camouflaged Adversarial Attacks in Autonomous Vehicles--A Case Study Using CARLA Simulator

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A stop sign with an edited texture delays an autonomous vehicle's auto-braking in the CARLA simulator, and two defenses restore safe stopping.

desk verdict A useful CARLA/ROS braking case study, but the 'adversarial' label is not earned—the hand-edited textures could just be ordinary camouflage. read the letter →

arxiv 2502.05208 v1 pith:5N6ATST5 submitted 2025-02-03 cs.CR cs.AIcs.LG

Yago Romano Martinez , Brady Carter , Abhijeet Solanki , Wesam Al Amiri , Syed Rafay Hasan , Terry N. Guo This is my paper · ORCID

classification cs.CRcs.AIcs.LG

keywords autonomousvehiclestrafficsignrecognitioncamouflagedadversarialattackCARLAsimulatorauto-brakingsensorfusiondefenseobjectdetectiontexture

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a camera-only autonomous vehicle can be made to miss a stop sign by changing only the sign's visual texture, and that the resulting delay in braking is a safety consequence of a perception attack, not just a classification error. The authors alter a stop sign's bitmap texture in the CARLA driving simulator, re-import it into the scene, and observe that the vehicle's object detector loses confidence and the auto-braking response arrives too late, so the vehicle passes the sign. They then test two countermeasures: a braking controller that computes stopping distance from the detected sign's bounding box and vehicle speed, and a side camera that triggers full braking when the sign is detected. In their runs, both countermeasures bring the vehicle to a stop before the sign across several simulator towns and sign placements. If correct, the work is a demonstration that perception-layer texture attacks can propagate to vehicle actuators, and that simple defensive redundancy can restore stopping performance.

What carries the argument

The machinery is texture substitution inside the simulator's asset pipeline: the stop sign's material instance references a bitmap that is exported, edited in an image manipulation program, and re-imported, so the detector sees a differently textured sign without any change to the scene geometry. On the defense side, the paper uses a geometric braking controller: it converts the detected bounding-box height into a distance estimate using the camera focal length and the known real height of a stop sign, computes the needed deceleration from current speed, and maps that to a brake command; the second defense adds a side camera that applies full braking when it detects the stop sign. The attacks are not generated by an optimization loop; they are hand-selected patterns inspired by the cited adversarial-example papers.

What would settle it

Run a control experiment in the same CARLA setup: replace the stop sign texture with several arbitrary textures that are not derived from adversarial-example research, and compare detection confidence and braking position. If the arbitrary textures produce a similar or larger braking delay, then the paper's central attack mechanism is not adversarial perturbation but general texture novelty, and its central claim would fail.

Watch

Extended reading notes

Core claim

The central claim is that a camouflaged stop sign, produced by replacing its texture with a pattern inspired by published adversarial-attack images, degrades object detection enough to delay auto-braking and make the vehicle cross the stop line. The paper reports that an unmodified sign is detected with roughly 75% confidence, while each of the five edited textures lowers that score, with the texture labeled Lu version-2 dropping it the most. In the driving test, the vehicle stops near (-5.4, -46.2) with a clean sign but ends near (-5.4, -60.8) under attack, about ten meters past the sign at (-9.3, -50.5). The paper then claims its adjusted-braking defense stops the vehicle at (-5.4, -43.5) and the side-camera defense at (-5.4, -47.5), and that both defenses keep working for attacked signs in Towns 03, 07, and 10 with signs placed near, far, or at the standard distance.

Load-bearing premise

The attack claim rests on the assumption that the hand-edited textures are true adversarial examples rather than merely unfamiliar images; if the detector simply fails on any novel texture, the proposed attack is indistinguishable from a routine perception failure.

Editorial extensions

If this is right

If the texture attack works as described, a fully camera-based traffic sign recognition system can be pushed from correct detection to a late or missing brake response without any physical access to the vehicle.
The adjusted-braking formula implies that braking can begin earlier when distance is computed from the sign's bounding box and velocity, rather than from a fixed trigger threshold.
The side-camera defense implies that redundant viewing angles can compensate for a compromised primary camera, at least when the side camera's view of the sign is unobstructed.
The reported consistency across Towns 03, 07, and 10 implies the attack and defenses are not tied to a single simulator map asset.
The authors generalize the method to other end-to-end trained autonomous cyber-physical systems, meaning the attack and defense pattern could transfer beyond road sign recognition.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because the paper never measures an adversarial perturbation budget or an attack success rate, the edited textures may simply be out-of-distribution images; an arbitrary novel texture could produce the same detection drop, which would make the adversarial label overstate what the experiment shows.
Editorial inference: the two defenses do not authenticate the sign; they brake whenever the detector sees it. A future attack that also degrades the side camera's view or makes the detector report a high-confidence false negative at longer range would likely bypass both countermeasures.
Editorial inference: a testable extension would replace the hand-edited textures with optimized adversarial patches from the cited methods and measure whether the same braking delay appears under the same conditions, separating adversarial perturbation effects from simple visual novelty.
Editorial inference: the distance-based braking formula assumes the detector's bounding-box height is reliable; if an attacker can shrink the bounding box or otherwise inflate the distance estimate, braking could still be delayed even with the defense.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Good to talk. I read the CARLA stop-sign paper. Short version: the braking-delay demonstration is probably real, but the paper doesn't earn the word "adversarial." The textures were hand-edited in GIMP, "inspired by" the cited papers, with no optimization, no perturbation budget, and no control texture. So the observed detection drop is equally consistent with the signs just looking unfamiliar. That's a load-bearing gap, because the abstract claims the attack fools the object detection system. The stress-test note gets this right.

What the paper does well: it sets up a clean CARLA/ROS testbed, modifies the stop-sign asset texture, and shows a concrete effect—an attacked sign moves the braking point about 10 m past the stop sign, while two simple defenses, distance-aware braking and a side camera, bring the stop back. The simulator integration is useful for people who want to test perception attacks end-to-end, and the defense formulas are standard but correctly applied.

Soft spots, in order of severity. First, the attack construction is the whole ballgame, and it's unsupported as an adversarial example. The paper itself admits the patterns were "inspired by research papers" (Sec. IV-A). The original attacks are optimization-based; this paper just repaints textures. Second, the empirical base is thin: one unreported detector, one run per scenario in Table I, no error bars, no threshold stated. The claim that the attack is "robust" across towns rests on Tables II-III, but those are only for the combined defenses, not for the attack alone. Third, the novelty is incremental: the transfer of known patch attacks into a simulator is an application, not a new attack class.

Is the central argument salvageable? The defense part holds up as a demonstration, and the attack part could be repaired by generating an actual adversarial patch with a defined perturbation constraint and an untampered control texture. As written, the title and abstract overreach.

Who's this for? A reader working on CARLA-based AV security testing might get a useful data point. It is not a contribution to adversarial ML. I wouldn't cite it for the attack claim. But I would send it to a serious referee at an appropriate workshop/short-paper venue, because the problem is fixable and the empirical setup is reproducible. The editor should ask for a control texture, a named detector with thresholds, and error bars before accepting.

Referee Report

4 major / 5 minor

Summary. The paper describes an empirical study using the CARLA simulator and ROS to modify the texture of a stop sign with patterns 'inspired by' existing adversarial attacks, then measures the effect on the AV's object detection and auto-braking. It reports that the modified sign reduces detection confidence and delays braking, and it proposes two defenses--adjusted braking and side-camera fusion--which it claims restore stopping performance across several CARLA towns.

Significance. If substantiated, a camera-camouflaged attack that transfers to end-to-end AV actuators would be a valuable contribution to AV security testing. The use of a full simulator with ROS and the evaluation of defenses across multiple towns and placements are strengths. However, as the manuscript stands, the central attack claim is not established: the attack textures are not generated by any adversarial optimization, the detector is not named, and the empirical results are single runs with no error bars. The work is therefore mainly a case study of detector failure under modified sign appearance, not an adversarial attack study.

major comments (4)

[IV-A] The attack construction is the load-bearing element of the paper, but Section IV-A describes only editing the stop-sign texture in GIMP with patterns 'inspired by research papers [13]-[16]'. None of the cited attacks are implemented or optimized; no perturbation budget, no attack-success metric, and no per-image confidence values are reported. The cited attacks ([13]-[16]) are all optimization-based in the original literature. Therefore, the observed drop in detection score and the delayed braking in Sections IV-B and V are equally consistent with the texture simply making the sign unrecognizable to the detector, i.e., ordinary camouflage, rather than with the adversarial misclassification claimed in the title and abstract. A control condition using random or arbitrary texture changes, plus a named detector with a fixed confidence threshold, is required to distinguish these cases.
[V-A] The braking test in Section V-A and Table I reports results from what appears to be a single run per scenario, with no error bars or repeated trials. The entire quantitative support for the attack is the difference between two stopping coordinates, (-5.4, -46.2) for the normal sign and (-5.4, -60.8) for the Lu version-2 sign, at a speed of 85 km/h. Because the attack textures were not generated with any optimization or success criterion (see major comment above), and because the detection threshold that triggers braking is never specified, this single-run result does not establish that the delay is caused by an adversarial perturbation rather than by a generic reduction in detection confidence. At minimum, repeated trials, a threshold sweep, and a control texture are needed.
[IV-B, V] The selection of the Lu version-2 attack as the focus of the braking tests is post hoc. Section IV-B states that 'Lu version-2 exhibiting the lowest detection score among all tested attacks,' and Section V says 'we focus on the Lu adversarial attack, as it results in the most significant decline in object detection performance.' Since only one or a few runs were used to rank the attacks, and since no standard errors are reported, it is possible that the ranking is noise; moreover, cherry-picking the best-performing attack from the same test set biases the subsequent single-run braking result. The paper should either test all attack variants in the braking scenario or justify a priori the choice of Lu version-2.
[V-B] The defense evaluation in Section V-B compares the attacked case with the attacked case plus defenses, but it does not compare the defended attacked case against the normal-sign baseline under the same detection and braking code. Without that baseline, one cannot tell whether the adjusted-braking defense simply brakes earlier and harder for any sign, and whether the side-camera defense is merely an alternate sensor path that sees the sign later. Table II and Table III report distances to the stop sign when braking is applied, but no detection confidence values or threshold settings are given, and the times to complete stop are all within 2.55-2.75 s across very different stopping distances, which is suspicious and suggests a fixed braking trajectory rather than a distance-adaptive response. Error bars and statistical tests are absent.

minor comments (5)

[Abstract] The abstract contains a sentence fragment: 'Specifically, if the attack is initiated by modifying the texture of a stop sign to fool the AV's object detection system, thereby affecting the AV actuators.' This should be rewritten as a complete sentence.
[I] In the Introduction, 'affect' is used where 'effect' is intended: 'explored the affect of adversarial attacks on the machine learning model capability.' Please correct this and similar occurrences.
[IV-C2] The subsection title 'Sensor Fusing Using a Side Camera' should be 'Sensor Fusion Using a Side Camera.'
[References] Reference [10] contains a typo: 'Porc. of ISOC Symposium' should be 'Proc. of ISOC Symposium.'
[II] The paper does not state the CARLA version, ROS version, or the specific object detector and confidence threshold used, which are essential for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack textures and defense formulas come from external sources, and the central results are empirical simulator outcomes, not derivations from the paper's own assumptions.

full rationale

The paper's derivation chain is not circular. The adversarial attack textures are hand-edited in GIMP with patterns 'inspired by research papers [13]–[16],' all of which are external publications; the paper does not fit any parameter to its own data and then rename that fit as a prediction. The attack-effectiveness evidence is an empirical comparison of detection scores and braking positions in the CARLA simulator, and the defense methods use textbook formulas for focal length, distance, deceleration, and braking force from references [19] and [20]. No load-bearing step is justified by a self-citation, and no equation in the paper reduces by construction to an earlier input. The closest concern is that the authors select the Lu version-2 attack for braking tests after observing that it has the lowest detection score; this is a selection choice, not a fitted parameter disguised as a prediction, and it does not mathematically force the subsequent braking outcome. Similarly, the claim that the hand-edited textures constitute 'adversarial examples' in the strict sense is an unsupported empirical assumption rather than a circular one, since the paper does not derive the attack's adversarial status from its own definitions. The central empirical content therefore stands or falls on experimental evidence, not on circular reasoning.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on unstated implementation parameters such as detection threshold, brake multiplier, and patch texture, plus domain assumptions about CARLA fidelity and side-camera visibility. No new physical entities are introduced.

free parameters (3)

Detection confidence threshold = Not reported
Braking is triggered only when detection confidence passes a threshold, but the threshold value is not stated, and it controls both attack and defense outcomes.
Brake multiplier M = Not reported (Eq. 4, described as typically 0.6 to 1)
Brake force depends on M, and the value used in the reported stopping distances is not given, so the defense results are not reproducible.
Adversarial patch texture = Unspecified pattern
The texture is hand-drawn in GIMP and is not derived from an optimization procedure; the detection drop and braking delay depend on this ad hoc choice, and the pattern is not described precisely enough to reproduce.

assumptions (4)

domain assumption CARLA's object detection pipeline is representative of AV perception.
The paper generalizes simulator braking results to autonomous vehicle safety without validating the detector against real TSR models. This assumption is central to the abstract's conclusions.
domain assumption The side camera has line-of-sight to the stop sign when needed.
Defense-2 is only tested in scenarios where the side camera can see the sign; this is not guaranteed for a stop sign directly ahead of the vehicle.
standard math The pinhole camera distance model relates bounding box height to physical distance.
Eq. (2) from Szeliski is a standard model, but the camera intrinsics in CARLA are not reported, so the distance estimates used by Defense-1 are not independently checkable.
domain assumption Constant deceleration with amax equal to 9.81 m/s squared is a valid braking model.
Eqs. (3) and (4) ignore tire-road friction, slope, and actuator delays, so the claimed stopping distances are idealized.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Mitigation of Camouflaged Adversarial Attacks in Autonomous Vehicles--A Case Study Using CARLA Simulator." pith.science (2026). https://pith.science/paper/5N6ATST5

@misc{pith2026250205208,
  author       = {Pith},
  title        = {Pith review of: Mitigation of Camouflaged Adversarial Attacks in Autonomous Vehicles--A Case Study Using CARLA Simulator},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5N6ATST5}},
  note         = {Machine review of arXiv:2502.05208}
}

read the original abstract

Autonomous vehicles (AVs) rely heavily on cameras and artificial intelligence (AI) to make safe and accurate driving decisions. However, since AI is the core enabling technology, this raises serious cyber threats that hinder the large-scale adoption of AVs. Therefore, it becomes crucial to analyze the resilience of AV security systems against sophisticated attacks that manipulate camera inputs, deceiving AI models. In this paper, we develop camera-camouflaged adversarial attacks targeting traffic sign recognition (TSR) in AVs. Specifically, if the attack is initiated by modifying the texture of a stop sign to fool the AV's object detection system, thereby affecting the AV actuators. The attack's effectiveness is tested using the CARLA AV simulator and the results show that such an attack can delay the auto-braking response to the stop sign, resulting in potential safety issues. We conduct extensive experiments under various conditions, confirming that our new attack is effective and robust. Additionally, we address the attack by presenting mitigation strategies. The proposed attack and defense methods are applicable to other end-to-end trained autonomous cyber-physical systems.

Figures

Figures reproduced from arXiv: 2502.05208 by the authors.

**Figure 2.** Methodology flow of image modification process. attacker aims to deceive the traffic sign detection model on AVs to disrupt their actuators, potentially causing safety issues. Specifically, the attacker generates an adversarial patch via existing adversarial image generation techniques [13]–[16], applying it to a traffic sign to mislead the object detection model used by the AV camera, thereby affecting the AV’s ac… view at source ↗

**Figure 3.** Stop sign detection performance with: (a) Non-attacked image, (b) Chen-modified image, (c) Eykholt-modified image, (d) Lu version-2 modified image, (e) Lu version-3 modified image, and (f) Yang-modified image. Lu version-2, Lu version-3, and Yang adversarial attacks [13]– [16]. As illustrated in Fig. 3b-3f, all of these attacks result in a noticeable drop in object detection performance compared to the non-attacked … view at source ↗

**Figure 6.** AV’s auto-braking response to non-attacked stop sign positioned: (a) near the road, (b) far from the road, in one of the provided maps of CARLA (Town 03). Notice the location of the stop sign with respect to the road. TABLE II: AV’s collected data in response to a non-attacked stop sign located in different CARLA towns after applying both proposed defense methods. Map / stop Time to complete Distance to stop sign p… view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: AV’s auto-braking response to an attacked stop sign after applying: (a) Defense-1 strategy, (b) Defense-2 strategy. TABLE I: AV’s stopping positions under different test scenarios. Scenario AV stopping coordinates (X,Y) in meters Normal Stop Sign (-5.4, -46.2) Attacked…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 17 canonical work pages

[13]

Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector,

S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector,” in Proc. of the European Conference on Machine Learning and Knowl- edge Discovery in Databases: European Conference (ECML PKDD) . Springer, 2019

work page 2019
[16]

Targeted attention attack on deep learning models in road sign recognition,

X. Yang, W. Liu, S. Zhang, W. Liu, and D. Tao, “Targeted attention attack on deep learning models in road sign recognition,” IEEE Internet of Things Journal , vol. 8, no. 6, pp. 4980–4990, 2020

work page 2020
[1]

Countering adversarial attacks on autonomous vehicles using denoising techniques: A review,

A. Kloukiniotis, A. Papandreou, A. Lalos, P. Kapsalas, D.-V . Nguyen, and K. Moustakas, “Countering adversarial attacks on autonomous vehicles using denoising techniques: A review,” IEEE Open Journal of Intelligent Transportation Systems, vol. 3, pp. 61–80, 2022

work page 2022
[2]

Toward robust 3D perception for autonomous vehicles: A review of adversarial attacks and countermeasures,

K. Y . Mahima, A. G. Perera, S. Anavatti, and M. Garratt, “Toward robust 3D perception for autonomous vehicles: A review of adversarial attacks and countermeasures,” IEEE Transactions on Intelligent Transportation Systems, 2024

work page 2024
[3]

A review on autonomous vehicles: Progress, methods and challenges,

D. Parekh, N. Poddar, A. Rajpurkar, M. Chahal, N. Kumar, G. P. Joshi, and W. Cho, “A review on autonomous vehicles: Progress, methods and challenges,” Electronics, vol. 11, no. 14, p. 2162, 2022

2022
[4]

Adapting image classification adversarial detection methods for traffic sign classification in autonomous vehicles: A comparative study,

D. S. Sarwatt, F. Kulwa, J. Ding, and H. Ning, “Adapting image classification adversarial detection methods for traffic sign classification in autonomous vehicles: A comparative study,” IEEE Transactions on Intelligent Transportation Systems, 2024

work page 2024
[5]

A real-time traffic sign recog- nition method using a new attention-based deep convolutional neural network for smart vehicles,

N. Triki, M. Karray, and M. Ksantini, “A real-time traffic sign recog- nition method using a new attention-based deep convolutional neural network for smart vehicles,” Applied Sciences, vol. 13, no. 8, p. 4793, 2023

work page 2023
[6]

Adversarial attacks on traffic sign recognition: A survey,

S. Pavlitska, N. Lambing, and J. M. Z ¨ollner, “Adversarial attacks on traffic sign recognition: A survey,” inProc. of the IEEE 3rd International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), 2023

work page 2023

Show all 20 references

[7]

A performance comparison of YOLOv8 models for traffic sign detection in the Robotaxi-full scale autonomous vehicle competition,

E. Soylu and T. Soylu, “A performance comparison of YOLOv8 models for traffic sign detection in the Robotaxi-full scale autonomous vehicle competition,” Multimedia Tools and Applications , vol. 83, no. 8, pp. 25 005–25 035, 2024

2024
[8]

Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems,

W. Jia, Z. Lu, H. Zhang, Z. Liu, J. Wang, and G. Qu, “Fooling the eyes of autonomous vehicles: Robust physical adversarial examples against traffic sign recognition systems,” arXiv preprint arXiv:2201.06192 , 2022

2022 arXiv
[9]

Shadows can be danger- ous: Stealthy and effective physical-world adversarial attack by natural phenomenon,

Y . Zhong, X. Liu, D. Zhai, J. Jiang, and X. Ji, “Shadows can be danger- ous: Stealthy and effective physical-world adversarial attack by natural phenomenon,” in Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022

2022
[10]

WIP: Infrared laser reflection attack against traffic sign recognition systems,

T. Sato, S. H. Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi, “WIP: Infrared laser reflection attack against traffic sign recognition systems,” in Porc. of ISOC Symposium on Vehicle Security and Privacy (VehicleSec), 2023

2023
[11]

Team, “Carla,” https://carla.org/, 2023

C. Team, “Carla,” https://carla.org/, 2023

2023
[12]

Robot operating system,

“Robot operating system,” https://www.ros.org/, 2019

2019
[14]

Robust physical-world attacks on deep learning visual classification,

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proc. of the IEEE conference on computer vision and pattern recognition , 2018

2018
[15]

Adversarial examples that fool detectors,

J. Lu, H. Sibai, and E. Fabry, “Adversarial examples that fool detectors,” arXiv preprint arXiv:1712.02494 , 2017

2017 arXiv
[17]

Unreal engine,

E. Games, “Unreal engine,” https://www.unrealengine.com/, 2020

2020
[18]

Team, “Gimp,” https://www.gimp.org/, 2024

G. Team, “Gimp,” https://www.gimp.org/, 2024

2024
[19]

Szeliski, Computer Vision: Algorithms and Applications

R. Szeliski, Computer Vision: Algorithms and Applications . London: Springer, 2010

2010
[20]

R. A. Serway and J. W. Jewett, Physics for Scientists and Engineers , 10th ed. Cengage Learning, 2018

2018

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [13]

Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector,

S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector,” in Proc. of the European Conference on Machine Learning and Knowl- edge Discovery in Databases: European Conference (ECML PKDD) . Springer, 2019

work page 2019

[2] [16]

Targeted attention attack on deep learning models in road sign recognition,

X. Yang, W. Liu, S. Zhang, W. Liu, and D. Tao, “Targeted attention attack on deep learning models in road sign recognition,” IEEE Internet of Things Journal , vol. 8, no. 6, pp. 4980–4990, 2020

work page 2020

[3] [1]

Countering adversarial attacks on autonomous vehicles using denoising techniques: A review,

A. Kloukiniotis, A. Papandreou, A. Lalos, P. Kapsalas, D.-V . Nguyen, and K. Moustakas, “Countering adversarial attacks on autonomous vehicles using denoising techniques: A review,” IEEE Open Journal of Intelligent Transportation Systems, vol. 3, pp. 61–80, 2022

work page 2022

[4] [2]

Toward robust 3D perception for autonomous vehicles: A review of adversarial attacks and countermeasures,

K. Y . Mahima, A. G. Perera, S. Anavatti, and M. Garratt, “Toward robust 3D perception for autonomous vehicles: A review of adversarial attacks and countermeasures,” IEEE Transactions on Intelligent Transportation Systems, 2024

work page 2024

[5] [3]

A review on autonomous vehicles: Progress, methods and challenges,

D. Parekh, N. Poddar, A. Rajpurkar, M. Chahal, N. Kumar, G. P. Joshi, and W. Cho, “A review on autonomous vehicles: Progress, methods and challenges,” Electronics, vol. 11, no. 14, p. 2162, 2022

2022

[6] [4]

Adapting image classification adversarial detection methods for traffic sign classification in autonomous vehicles: A comparative study,

D. S. Sarwatt, F. Kulwa, J. Ding, and H. Ning, “Adapting image classification adversarial detection methods for traffic sign classification in autonomous vehicles: A comparative study,” IEEE Transactions on Intelligent Transportation Systems, 2024

work page 2024

[7] [5]

A real-time traffic sign recog- nition method using a new attention-based deep convolutional neural network for smart vehicles,

N. Triki, M. Karray, and M. Ksantini, “A real-time traffic sign recog- nition method using a new attention-based deep convolutional neural network for smart vehicles,” Applied Sciences, vol. 13, no. 8, p. 4793, 2023

work page 2023

[8] [6]

Adversarial attacks on traffic sign recognition: A survey,

S. Pavlitska, N. Lambing, and J. M. Z ¨ollner, “Adversarial attacks on traffic sign recognition: A survey,” inProc. of the IEEE 3rd International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), 2023

work page 2023