Stop sign stickers and physical adversarial examples explained

A 2018 research paper showed that stickers on a real stop sign could make a road sign classifier misread it, in 100 percent of lab images and 84.8 percent of video frames from a moving vehicle. That is a result against one classifier, not proof that production driving systems fail the same way.

What the study did

The paper by Eykholt and colleagues, on physical-world attacks on deep learning visual classification introduced an algorithm called RP2. It generates visual perturbations designed to survive changes in viewpoint and physical conditions, so the change still works when the camera moves.

They applied stickers to a real stop sign and tested two ways: images taken in a lab setting and frames from a moving vehicle in field tests. The reported rates of targeted misclassification were 100 percent for the lab images and 84.8 percent for the video frames. Because no standard test for this kind of attack existed, the authors also proposed a two stage evaluation.

What the result does not say

Be careful here, because this topic attracts overstatement.

• The result is against the specific classifier they tested. It is not a statement about every driving system.
• A road sign classifier is one component. A real vehicle combines other signals, such as maps and other sensors, and the paper does not claim to defeat those.
• Other summaries of the field note that small rotations or slight changes in lighting can destroy an adversarial image's effect, and that removing a stop sign is far easier than crafting a precise sticker.

So the finding is a demonstration that a model can be wrong in a targeted, controllable way. It is not a recipe that works everywhere.

Why it still matters

The deeper lesson is about trust in a single perception model. A neural network classifier returns an answer with no built-in sense of whether the input was tampered with. If the downstream system treats that answer as truth, then changing the input changes the behavior.

This applies to robots, drones and inspection systems too. Anything that reads the physical world through a learned model can be given a misleading world.

Defenses builders use

The literature lists several mechanisms against evasion attacks. Adversarial training is the best known: training the model on examples that include perturbed inputs. Others include secure learning algorithms and using multiple classifiers together. Hiding gradients is described as unreliable, since models can still be attacked by black-box methods.

In practice, the engineering response is layered:

1. Cross check perception against independent signals, such as map data or a second sensor.
2. Treat low confidence or disagreement as a reason to slow down or hand over, not to guess.
3. Include physical perturbation tests in your evaluation set, not only clean images.
4. Log inputs that triggered unusual outputs, so you can study them later.

Where software supply chain comes in

The model, its training data and its libraries are part of your supply chain. A tampered model file or a poisoned dataset is a different route to the same outcome. Keep an inventory of the model artifacts and libraries each release uses, as you would for any other dependency. Safeguard's SBOM and dependency scanning cover the library side for software you build.

Quick check

Sources

• Physical-world attacks on deep learning visual classification, Eykholt et al. (arXiv)
• Adversarial machine learning (Wikipedia)

Last reviewed: 19 October 2026.