The problem
Deep neural networks used for traffic-sign recognition can be fooled by small, crafted perturbations or printed patches. For ADAS this is both a safety issue under ISO 21448 and a security issue under ISO/SAE 21434. Many published defences are later broken by stronger adaptive attacks. This project builds a careful, reproducible evaluation of attacks and defences with an explicit threat model.
Objectives
- Define threat models: white-box and black-box, digital perturbation and physical patch.
- Train baseline classifiers on GTSRB with documented accuracy.
- Implement FGSM, PGD and patch attacks and measure attack success.
- Implement and evaluate defences including adversarial training and input transforms.
- Evaluate defences against adaptive attacks and report robust accuracy and cost.
What you need
Tools and toolboxes
- Python with PyTorch and torchvision — Trains classifiers and implements attacks and defences.
- Adversarial Robustness Toolbox or Torchattacks — Provides reference implementations of FGSM, PGD and other attacks to check your own code.
- OpenCV — Applies physical-style transformations such as perspective, blur and lighting changes to patched signs.
- ONNX Runtime — Measures inference cost of defended models in a deployment-like runtime.
- pandas and matplotlib — Analyses results and plots robust accuracy against perturbation budget.
Software
- Python with PyTorch and torchvision
- Adversarial Robustness Toolbox or Torchattacks
- OpenCV
- ONNX Runtime
- pandas and matplotlib
Extra parts and data
- A GPU workstation or cloud GPU — Adversarial training and PGD evaluation need many forward and backward passes; a CPU is too slow for full experiments.
Key concepts
- Adversarial example
- An input changed slightly, often imperceptibly, so that a model misclassifies it, crafted using the model's gradients or queries.
- PGD attack
- Projected gradient descent takes several small gradient steps that increase the loss, projecting back into an allowed perturbation set such as an L-infinity ball of radius epsilon.
- Adversarial training
- Training on adversarial examples generated during training, which increases robustness at the cost of clean accuracy and training time.
- Adaptive attack
- An attack designed with knowledge of the defence, for example attacking through an input transform. Defences must be tested this way to avoid false robustness.
Step-by-step guide
- 1
Define the threat model and questions
Write threat models: digital white-box with an L-infinity budget, digital black-box with query access only, and physical patch confined to a region of the sign under random viewing transforms. Set research questions: which defences raise robust accuracy against adaptive attacks, at what clean-accuracy and compute cost? Define metrics: clean accuracy, robust accuracy at several budgets, attack success rate and inference time.
Checkpoint: A written threat model, research questions and metric definitions agreed with the supervisor.
- 2
Prepare GTSRB
Download the GTSRB training and test sets, crop to the provided sign regions, resize to a fixed size such as 48 by 48 pixels and normalise. Split the training data into training and validation by track, so images of the same physical sign do not appear in both, which avoids inflated validation accuracy. Record class distribution and keep the official test set untouched until final evaluation.
Checkpoint: Reproducible data loaders with a track-based split and class-distribution plots.
- 3
Train baseline classifiers
Train two architectures: a compact CNN suited to embedded deployment and a ResNet-18 adapted to the input size. Use standard augmentation such as small rotations and brightness changes, but not horizontal flips, because they change sign meaning. Train with fixed seeds and early stopping on validation accuracy. Record clean test accuracy and inference time per image. Save checkpoints and training curves so every later experiment starts from the same model.
Checkpoint: Both baselines reach high clean accuracy on the test set, with seeds and settings logged.
- 4
Implement digital attacks
Implement FGSM and PGD with L-infinity budgets from small to moderate values, with a stated number of steps and step size and random start. Check your implementation against a library implementation on the same images; results should agree closely. Run a black-box transfer attack by crafting examples on one model and testing on the other. Report attack success rate against budget.
Checkpoint: Robust accuracy against budget curves for both models, matched against a library implementation.
- 5
Implement a patch attack
Optimise a universal adversarial patch for a target misclassification, such as stop sign to speed limit, using expectation over transformation: random scale, rotation, perspective, brightness and blur applied during optimisation with OpenCV-style augmentations in PyTorch. Restrict the patch to a fixed fraction of the sign area. Evaluate on held-out transformed test signs and report targeted success rate. Print a patched image only for illustration in the report; never place one on a real sign.
Checkpoint: A patch with measured targeted success under random transforms on held-out signs.
- 6
Implement defences
Implement PGD adversarial training at a chosen budget; input transformations such as JPEG compression, bit-depth reduction and random resizing; and a simple detector trained to separate clean from adversarial inputs. For the patch threat, implement a defence such as masking regions with abnormally high gradient energy or a certified patch defence if time allows. Record training time and inference overhead for each defence.
Checkpoint: Each defence trained or configured, with clean accuracy and overhead recorded.
- 7
Evaluate with adaptive attacks
Attack each defence with an attack designed for it: backward-pass differentiable approximation through non-differentiable transforms, expectation over transformation for random transforms, and attacks that also fool the detector. Increase PGD steps until robust accuracy stops falling. A defence whose accuracy only holds against non-adaptive attacks is reported as not robust. Use the same budgets for all defences. Record attack settings for every defence in a single table for the appendix.
Checkpoint: Robust accuracy for every defence under its adaptive attack, with convergence over steps shown.
- 8
Add realistic conditions
Test whether attacks and defences hold under natural corruptions: rain, fog, motion blur and low light applied to GTSRB test images, and different capture resolutions. Also evaluate on a small set of Indian road sign images if the team can collect them legally and safely from recorded footage, noting that GTSRB is German. Report whether defended models lose more accuracy under natural corruption.
Checkpoint: A table of accuracy under natural corruptions for baseline and defended models.
- 9
Analyse trade-offs
Plot clean accuracy against robust accuracy for all models and defences, with inference time as a third dimension. Run each main experiment with three seeds and report means and spread. Test significance of the main differences. Identify which defence offers the best trade-off for an embedded traffic-sign recogniser and which threats remain unsolved, such as patch attacks under strong transforms.
Checkpoint: Trade-off plots with error bars and a written comparison of defences.
- 10
Write the thesis
Present threat models, data handling, baselines, attacks, defences, adaptive evaluation, natural-corruption results and trade-offs. Follow good practice for robustness evaluation: report attack settings in full, release code and models, and avoid claims beyond the tested threat models. Discuss how findings feed into SOTIF and cybersecurity arguments for perception. Do not test patches on real roads. Include a short summary of which defences you would recommend and under what conditions.
Checkpoint: A thesis draft with released code and complete attack settings for every result.
Testing & validation
- Attack implementations checked against library implementations.
- Robust accuracy against budget for every model and defence.
- Adaptive attacks run until convergence for every defence.
- Results averaged over three seeds with spread reported.
- Accuracy under natural corruptions for baseline and defended models.
Expected results
A reproducible evaluation of digital and patch adversarial attacks on GTSRB classifiers and of defences under adaptive attacks, with clean-versus-robust accuracy and compute trade-offs.
Research angle for your PhD
Research questions: which defences provide real robustness against adaptive digital and physically realisable attacks on traffic-sign recognition, and what do they cost in clean accuracy, natural-corruption robustness and inference time on embedded-class models? Metrics: clean and robust accuracy, attack success rate, inference time and accuracy under corruptions, with seeds and confidence intervals. Baselines: undefended models and standard adversarial training. Careful adaptive evaluation with full settings released is what reviewers expect, and it makes the work suitable for conference or journal publication.
Take it further
- Extend from classification to detection with Ultralytics YOLO on full scenes.
- Use certified robustness methods and compare guaranteed with empirical robustness.
- Combine adversarial inputs with a runtime monitor and measure detection.
- Test patch attacks in a CARLA simulation with rendered signs.
Viva and review questions
Why must defences be tested with adaptive attacks?
Many defences only hide gradients or rely on the attacker not knowing them; an attacker who adapts often breaks them, so only adaptive results show real robustness.
Why did you split GTSRB by track?
Images in a track come from the same physical sign, so splitting randomly would put near-duplicate images in training and validation and inflate accuracy.
Why use expectation over transformation for patches?
A physical patch is seen from many angles, distances and lighting conditions, so optimising over random transforms makes it work across them.
Why does adversarial training lower clean accuracy?
The model must keep decisions stable in a neighbourhood around each input, which constrains it and usually costs some accuracy on clean data.
Learn it at DIYguru
These DIYguru courses and programmes teach what this project needs.