T2I physical-world appearance attacks against traffic sign recognition systems in autonomous driving

DiffSign is a physical-world appearance attack framework based on T2I diffusion models, targeting traffic sign recognition systems in autonomous driving, with an average physical attack success rate of 83.3%. The framework combines a CLIP loss with masked prompts and designs two style customization methods to improve attack focus, controllability, generalization to out-of-domain traffic signs and stealthiness. The evaluation covers different distances, angles, lighting conditions and sign categories, and the paper states that this result benefits from its strong attack transferability.