UC Irvine Study Shines Headlights on Consumer Driverless Vehicle Safety Deficiencies
Project demonstrates the low cost and ease of carrying out "sticker attacks."
Irvine, Calif., March 4, 2025 — For the first time, researchers at the University of California, Irvine have demonstrated that multicolored stickers applied to stop or speed limit signs on the roadside can confuse self-driving vehicles, causing unpredictable and possibly hazardous operations.
In a presentation at the recent Network and Distributed System Security Symposium in San Diego, researchers from UC Irvine’s Donald Bren School of Information & Computer Sciences described the real-world implications of what previously was only theorized: that low-cost and highly deployable malicious attacks can make traffic signs undetectable to artificial intelligence algorithms in some autonomous vehicles while making nonexistent signs appear out of nowhere to others. Both types of assaults can result in cars ignoring road commands, triggering unintended emergency braking, speeding and other violations.
The scientists said that their study, which involved the three most representative AI attack designs, was the first large-scale evaluation of traffic sign recognition systems in top-selling consumer vehicle brands.
“Waymo has been delivering more than 150,000 autonomous rides per week, and there are millions of Autopilot-equipped Tesla vehicles on the road, which demonstrates that autonomous vehicle technology is becoming an integral part of daily life in America and around the world,” said co-author Alfred Chen, UC Irvine assistant professor of computer science. “This fact spotlights the importance of security, since vulnerabilities in these systems, once exploited, can lead to safety hazards that become a matter of life and death.”
The lead author of the study, Ningfei Wang, a research scientist at Meta who performed this work as a Ph.D. student in computer science at UC Irvine, said that his team’s attack vectors of choice were stickers that had swirling, multicolored designs that confuse AI algorithms used for traffic sign recognition in driverless vehicles.
“These stickers can be cheaply and easily produced by anyone with access to an open-source programming language such as Python and image processing libraries,” Wang said. “Those tools combined with a computer with a graphics card and a color printer are all someone would need to foil TSR systems in autonomous vehicles.”
He added that an interesting discovery made during the project relates to the spatial memorization design common to many of today’s commercial TSR systems. While this feature makes a disappearing attack (seeming to remove a sign from the vehicle’s view) more difficult, Wang said, it makes spoofing a fake stop sign “much easier than we expected.”
Read the full story in UCI News.