pith. sign in

arxiv: 2606.30153 · v1 · pith:QG4ZDZLYnew · submitted 2026-06-29 · 💻 cs.CR

The Spectrum Strikes Back: Infrared POV Attacks on Traffic Sign Classification

Michael K\"uhr , Mevl\"ut Yildirim , Maximilian Luedecke , Mohammad Hamad , Sebastian Steinhorst This is my paper

Pith reviewed 2026-06-30 05:29 UTC · model grok-4.3

classification 💻 cs.CR
keywords adversarial attackstraffic sign recognitionnear-infraredpersistence of visionphysical securityautonomous vehiclesmachine learning robustness
0
0 comments X

The pith

A persistence-of-vision attack in near-infrared light can stealthily disrupt traffic sign classification at real-world distances.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The authors introduce a method for attacking traffic sign classification systems used in autonomous vehicles by projecting dynamic adversarial patterns using a persistence-of-vision device in the near-infrared spectrum. This attack is designed to be invisible to human observers while still being captured by vehicle cameras and fooling the machine learning models. Through simulation to find optimal positions and then real-world tests with two signs, twelve models, distances up to 20 meters, and different lighting, they report high success rates. They also suggest defenses and build a visible-light prototype to overcome display constraints.

Core claim

Our persistence-of-vision-based attack operating in the near-infrared light spectrum enables a stealthy physical adversarial attack against traffic sign classification by showing dynamic, remotely triggered content. By identifying optimal positions through digital simulation, we achieve high attack success rates in extensive real-world evaluations involving two traffic signs, 12 machine learning models, multiple distances up to 20 meters, and varying illumination conditions.

What carries the argument

A near-infrared persistence-of-vision display for projecting dynamic adversarial perturbations onto traffic signs.

If this is right

  • The attack achieves high success rates across tested scenarios.
  • It operates effectively at distances up to 20 meters.
  • Near-infrared cutoff filters and software-based detection serve as effective defenses.
  • A human-visible RGB prototype addresses the display's limitations in the near-infrared version.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • This approach could be adapted to target other camera-dependent systems in vehicles, such as lane detection.
  • Remote triggering allows the attack to be activated only when a specific vehicle is approaching, conserving resources.
  • Vehicle manufacturers might need to incorporate hardware filters for near-infrared light to prevent such attacks.

Load-bearing premise

The digital simulation used to identify optimal attack positions accurately reflects real-world performance under the tested conditions.

What would settle it

An experiment where the attack is deployed at the simulated positions but fails to achieve high success rates when the distance reaches 20 meters or illumination changes significantly.

Figures

Figures reproduced from arXiv: 2606.30153 by Maximilian Luedecke, Mevl\"ut Yildirim, Michael K\"uhr, Mohammad Hamad, Sebastian Steinhorst.

Figure 1
Figure 1. Figure 1: Infrared-based persistence of vision displays are a [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: A two-blade POV display in front of a stop sign, visualizing the exposure time constraint when showing a full circle. If texp < 1 frot , the pattern cannot be captured completely, if texp = 1 frot , the pattern is captured fully, and if texp > 1 frot , artifacts such as brighter areas due to overlaps can occur. A. Attack Goal and Requirements The goal of our attack are misclassifications of ML-based image … view at source ↗
Figure 3
Figure 3. Figure 3: Overview of our POV display-based attack. The complete process consists of three steps: The data captured in the ⃝I digital simulation ground truth serves as input to identify the optimal placement of the POV display in a ⃝II digital simulation. By ⃝III deploying the identified position in the real-world, and activating the infrared POV display, ML-based image classification models can be tricked while bei… view at source ↗
Figure 4
Figure 4. Figure 4: Example images from the digital simulation. All images [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Prototypical hardware setups of a near-infrared [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Heatmaps for the stop sign (upper row), and the 30km/h [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 8
Figure 8. Figure 8: Example images of the 30cm POV display for the physical tests. The positions are derived from [PITH_FULL_IMAGE:figures/full_fig_p008_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Example images of smaller POV displays for the physical tests, each with two different shapes. The positions are derived from Figure 6c. The differently perceived brightness levels result from the exposure control algorithm of the camera to compensate for the increased brightness of the larger POV display. shows low ASRs for the 5m distance, while it is more successful at distances of 10m to 20m. The miscl… view at source ↗
Figure 10
Figure 10. Figure 10: Example images of our POV display in front of a stop sign for evaluating the impact of illumination. The effect of the near-infrared LEDs is more noticeable, as the camera adjusts its exposure settings to the darker environment. compared to the indoor day tests of [PITH_FULL_IMAGE:figures/full_fig_p009_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Example images of the POV display arbitrarily placed outside the heatmaps of Figure 6a. TABLE VIII: Overview of the ASR for the POV display placed outside the heatmaps positions, in front of a stop sign. The ASR is significantly lower compared to the recommended placement at the heatmap positions in Table V. Model Shape ASR at a distance of 5m 10m 15m 20m ResNet-50 1.45% 5.26% 85.80% 100% GTSRB 0.45% 2.93… view at source ↗
Figure 12
Figure 12. Figure 12: Test setup of the dynamic tests. The portable [PITH_FULL_IMAGE:figures/full_fig_p011_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Comparison of a POV display showing two sectors, captured with the same cameras, only adding a near-infrared cutoff filter. Although the identical image sensor is used, the infrared POV display is not visible anymore. 0 50 100 150 200 250 0 500 1,000 1,500 2,000 2,500 Pixel value in DN Amount of pixels Red Green Blue 250 255 0 500 1,000 1,500 2,000 2,500 [PITH_FULL_IMAGE:figures/full_fig_p012_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Histogram of Figure 13a. For values >250, the number [PITH_FULL_IMAGE:figures/full_fig_p012_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Example images from the RGB POV display with different-colored full circles. The images have been captured at a distance of 5m with the POV display at full brightness. blue, cyan, or magenta circles, while red, green, and yellow show a lower ASR. Example images captured at 5m are shown in [PITH_FULL_IMAGE:figures/full_fig_p013_15.png] view at source ↗
read the original abstract

Traffic sign classification is a crucial task for autonomous vehicles, and numerous attacks against it have been identified. A majority of physical adversarial attacks involve attaching patches to traffic signs or projecting perturbations on them. While they demonstrate high effectiveness, they are perceptible to humans. At the same time, light-based attacks outside the human visible spectrum are known but have limitations in their dynamic adaptability. We propose a persistence-of-vision-based attack that operates in the near-infrared light spectrum. With the possibility of showing dynamic, remotely triggered content, this allows a stealthy physical adversarial attack against traffic sign classification. By identifying the optimal position through digital simulation, we conduct extensive real-world evaluations using two different traffic signs, 12 machine learning models from different families, multiple distances up to 20 meters, and varying illumination conditions. Our evaluation shows high attack success rates across our test scenarios. We propose near-infrared cutoff filters and a software-based detection mechanism as defenses, and tackle limitations of the near-infrared persistence of vision display by prototyping a human-visible RGB version of it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper proposes a persistence-of-vision (POV) attack in the near-infrared (NIR) spectrum as a stealthy, dynamic physical adversarial attack on traffic sign classification for autonomous vehicles. Optimal attack positions are identified via digital simulation; real-world evaluations then use two traffic signs, 12 models from different families, distances up to 20 m, and varying illumination conditions. The manuscript reports high attack success rates, proposes NIR cutoff filters and a software detector as defenses, and prototypes a human-visible RGB version of the display to address POV limitations.

Significance. If the empirical results hold after addressing validation gaps, the work demonstrates a new class of remotely triggerable, human-invisible physical attacks that exploit NIR sensitivity in camera-based perception systems. This could inform both attack surface analysis and defense design for AVs. The inclusion of multiple models, distances, illumination conditions, and explicit defense proposals strengthens the practical relevance; the simulation-guided position selection and RGB prototype are positive elements that could be strengthened by quantitative transfer validation.

major comments (2)
  1. [Abstract and Evaluation section] Abstract and Evaluation section: The central claim of 'high attack success rates across our test scenarios' is stated without any quantitative metrics, error bars, per-model/per-distance breakdowns, or exclusion criteria. This directly affects assessment of whether the reported real-world performance supports the claim that the attack 'operates' effectively under the tested conditions.
  2. [Simulation-to-real transfer paragraph (likely §4 or §5)] Simulation-to-real transfer paragraph (likely §4 or §5): Positions are selected via digital simulation before physical experiments, yet no quantitative validation is supplied (e.g., comparison of simulated vs. measured camera response curves in the 700–1000 nm band, or ablation of position choice). Without this, it is unclear whether the high real-world ASR reflects predictive power of the simulator or post-hoc selection of favorable locations, undermining the claim that the method reliably transfers under the stated distances and illumination.
minor comments (2)
  1. [Abstract] The abstract mentions 'extensive real-world evaluations' but supplies no table or figure reference for the quantitative results; adding a summary table of ASR by sign/model/distance would improve clarity.
  2. [Methods] Notation for the POV display parameters (e.g., rotation speed, LED timing) should be defined consistently when first introduced.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments. We address each major point below and will revise the manuscript to strengthen quantitative reporting and clarify the role of simulation.

read point-by-point responses

  1. Referee: [Abstract and Evaluation section] Abstract and Evaluation section: The central claim of 'high attack success rates across our test scenarios' is stated without any quantitative metrics, error bars, per-model/per-distance breakdowns, or exclusion criteria. This directly affects assessment of whether the reported real-world performance supports the claim that the attack 'operates' effectively under the tested conditions.

    Authors: We agree the abstract would benefit from quantitative support. The evaluation section already contains tables with per-model, per-distance, and per-illumination ASR values. We will update the abstract to report specific metrics (e.g., mean ASR and standard deviation across the 12 models), add error bars where applicable, and explicitly state any exclusion criteria used in the reported scenarios. revision: yes

  2. Referee: [Simulation-to-real transfer paragraph (likely §4 or §5)] Simulation-to-real transfer paragraph (likely §4 or §5): Positions are selected via digital simulation before physical experiments, yet no quantitative validation is supplied (e.g., comparison of simulated vs. measured camera response curves in the 700–1000 nm band, or ablation of position choice). Without this, it is unclear whether the high real-world ASR reflects predictive power of the simulator or post-hoc selection of favorable locations, undermining the claim that the method reliably transfers under the stated distances and illumination.

    Authors: The simulation served to efficiently identify candidate positions before committing to physical trials. While we did not include a direct quantitative comparison of simulated versus measured NIR camera response curves, the real-world results demonstrate consistent performance across distances up to 20 m and varying illumination. We will add a dedicated paragraph discussing the simulation's purpose, include an ablation on position sensitivity where data exists, and note the absence of full spectral response validation as a limitation. revision: partial

Circularity Check

0 steps flagged

No circularity: empirical attack demonstration with no derivation chain

full rationale

The paper is an empirical study reporting attack success rates from physical experiments on traffic sign classifiers. It uses simulation only to select attack positions before real-world testing and presents no equations, fitted parameters, or mathematical derivations. No self-citations are invoked as load-bearing uniqueness theorems or ansatzes. The central claims rest on measured ASR values across signs, models, distances, and illumination rather than any reduction of outputs to inputs by construction. This is a standard non-circular empirical evaluation.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

No mathematical derivations, fitted parameters, or postulated entities appear in the abstract; the contribution is an empirical attack demonstration.

pith-pipeline@v0.9.1-grok · 5725 in / 988 out tokens · 31664 ms · 2026-06-30T05:29:46.615391+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

62 extracted references · 4 canonical work pages · 2 internal anchors

  1. [1]

    Mercedes-Benz world’s first automotive company to certify SAE Level 3 system for U.S. market | Mercedes-Benz Group > Innovations > Product innovation > Autonomous driving,

    Mercedes-Benz Group AG, “Mercedes-Benz world’s first automotive company to certify SAE Level 3 system for U.S. market | Mercedes-Benz Group > Innovations > Product innovation > Autonomous driving,” January 2023. [Online]. Avail- able: https://group.mercedes-benz.com/innovation/product-innovation/ autonomous-driving/drive-pilot-nevada.html 13

    2023

  2. [2]

    Self-Driving Car Technology for a Reliable Ride - Waymo Driver,

    Waymo LLC, “Self-Driving Car Technology for a Reliable Ride - Waymo Driver,” July 2024. [Online]. Available: https://waymo.com/ waymo-driver/

    2024

  3. [3]

    SoK: A Minimalist Approach to Formalizing Analog Sensor Security,

    C. Yan, H. Shin, C. Bolton, W. Xu, Y . Kim, and K. Fu, “SoK: A Minimalist Approach to Formalizing Analog Sensor Security,” in2020 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE, May 2020, pp. 233–248

    2020

  4. [4]

    Autonomous Driving Security: State of the Art and Challenges,

    C. Gao, G. Wang, W. Shi, Z. Wang, and Y . Chen, “Autonomous Driving Security: State of the Art and Challenges,”IEEE Internet of Things Journal, vol. 9, no. 10, pp. 7572–7595, May 2022

    2022

  5. [5]

    Cybersecurity Attacks in Vehicular Sensors,

    Z. El-Rewini, K. Sadatsharan, N. Sugunaraj, D. F. Selvaraj, S. J. Plathottam, and P. Ranganathan, “Cybersecurity Attacks in Vehicular Sensors,”IEEE Sensors Journal, vol. 20, no. 22, pp. 13 752–13 767, November 2020

    2020

  6. [6]

    LiDAR and cameras in autonomous driving,

    J. Ibanez-Guzman and Y . Li, “LiDAR and cameras in autonomous driving,” Nature Reviews Electrical Engineering, May 2025

    2025

  7. [7]

    Physical Adversarial Attacks for Camera-Based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook,

    A. Guesmi, M. A. Hanif, B. Ouni, and M. Shafique, “Physical Adversarial Attacks for Camera-Based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook,”IEEE Access, vol. 11, pp. 109 617–109 668, 2023

    2023

  8. [8]

    Physical Adversarial Attack Meets Computer Vision: A Decade Survey,

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang, “Physical Adversarial Attack Meets Computer Vision: A Decade Survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 12, pp. 9797–9817, December 2024

    2024

  9. [9]

    Adversarial Attacks and Countermeasures on Image Classification-based Deep Learning Models in Autonomous Driving Systems: A Systematic Review,

    B. Badjie, J. Cecílio, and A. Casimiro, “Adversarial Attacks and Countermeasures on Image Classification-based Deep Learning Models in Autonomous Driving Systems: A Systematic Review,”ACM Computing Surveys, vol. 57, no. 1, pp. 1–52, January 2025

    2025

  10. [10]

    SoK: Security of the Image Processing Pipeline for Camera-based Sensing in Autonomous Vehicles,

    M. Kühr, M. Hamad, P. MohajerAnsari, M. D. Pesé, and S. Steinhorst, “SoK: Security of the Image Processing Pipeline for Camera-based Sensing in Autonomous Vehicles,” January 2026, arXiv:2409.01234 [cs]. [Online]. Available: http://arxiv.org/abs/2409.01234

    work page arXiv 2026

  11. [11]

    Robust Physical-World Attacks on Deep Learning Visual Classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust Physical-World Attacks on Deep Learning Visual Classification,” in2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Salt Lake City, UT, USA: IEEE, June 2018, pp. 1625–1634

    2018

  12. [12]

    SLAP: Improving Physical Adversarial Examples with Short-Lived Ad- versarial Perturbations,

    G. Lovisotto, H. Turner, I. Sluganovic, M. Strohmeier, and I. Martinovic, “SLAP: Improving Physical Adversarial Examples with Short-Lived Ad- versarial Perturbations,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, August 2021, pp. 1865–1882

    2021

  13. [13]

    Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink,

    R. Duan, X. Mao, A. K. Qin, Y . Chen, S. Ye, Y . He, and Y . Yang, “Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink,” in2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Nashville, TN, USA: IEEE, June 2021, pp. 16 057–16 066

    2021

  14. [14]

    Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception,

    T. Sato, S. H. V . Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi, “Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception,” inProceedings 2024 Network and Distributed System Security Symposium, San Diego, CA, USA, February 2024

    2024

  15. [15]

    I Can See the Light: Attacks on Autonomous Vehicles Using Invisible Lights,

    W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I Can See the Light: Attacks on Autonomous Vehicles Using Invisible Lights,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. Virtual Event Republic of Korea: ACM, November 2021, pp. 1930–1944

    2021

  16. [16]

    Night-Capable Camera Systems | AUMOVIO,

    Aumovio SE, “Night-Capable Camera Systems | AUMOVIO,” 2025. [On- line]. Available: https://www.aumovio.com/en/solutions/driver-assistance/ automated-assisted-driving/night-capable-camera-systems.html

    2025

  17. [17]

    All-Weather Vision for Automotive Safety: Which Spectral Band?

    N. Pinchon, O. Cassignol, A. Nicolas, F. Bernardin, P. Leduc, J.-P. Tarel, R. Brémond, E. Bercier, and J. Brunet, “All-Weather Vision for Automotive Safety: Which Spectral Band?” inAdvanced Microsystems for Automotive Applications 2018. Cham: Springer International Publishing, 2019, pp. 3–15

    2018

  18. [18]

    WP7113SF6BT-P22 - T-1 3/4 (5mm) Infrared Emitting Diode,

    Kingbright, “WP7113SF6BT-P22 - T-1 3/4 (5mm) Infrared Emitting Diode,” November 2024. [Online]. Available: https://www.kingbrightusa. com/images/catalog/SPEC/WP7113SF6BT-P22.pdf

    2024

  19. [19]

    Synthesizing Robust Adversarial Examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing Robust Adversarial Examples,” inProceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, J. Dy and A. Krause, Eds., vol. 80. Stockholm, Sweden: PMLR, July 2018, pp. 284–293

    2018

  20. [20]

    CIE DIS 017/E:2016 - ILV: International Lighting V ocabulary,

    International Commission on Illumination, “CIE DIS 017/E:2016 - ILV: International Lighting V ocabulary,” CIE Central Bureau, Vienna, International Standard, 2016, 2nd Edition

    2016

  21. [21]

    Advances on CMOS image sensors,

    L. C. P. Gouveia and B. Choubey, “Advances on CMOS image sensors,” Sensor Review, vol. 36, no. 3, pp. 231–239, June 2016

    2016

  22. [22]

    CMOS image sensors,

    A. El Gamal and H. Eltoukhy, “CMOS image sensors,”IEEE Circuits and Devices Magazine, vol. 21, no. 3, pp. 6–20, May 2005

    2005

  23. [23]

    Invisible Mask: Practical Attacks on Face Recognition with Infrared

    Z. Zhou, D. Tang, X. Wang, W. Han, X. Liu, and K. Zhang, “Invisible Mask: Practical Attacks on Face Recognition with Infrared,” March 2018, arXiv:1803.04683 [cs]. [Online]. Available: http://arxiv.org/abs/1803.04683

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  24. [24]

    The Invisible Polyjuice Potion: an Effective Physical Adversarial Attack against Face Recog- nition,

    Y . Wang, Z. Liu, B. Luo, R. Hui, and F. Li, “The Invisible Polyjuice Potion: an Effective Physical Adversarial Attack against Face Recog- nition,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. Salt Lake City UT USA: ACM, December 2024, pp. 3346–3360

    2024

  25. [25]

    The persistences of vision,

    M. Coltheart, “The persistences of vision,”Philosophical Transactions of the Royal Society of London. B, Biological Sciences, vol. 290, no. 1038, pp. 57–69, July 1980

    1980

  26. [26]

    Persistence of vision,

    E. S. Ferry, “Persistence of vision,”American Journal of Science, vol. 3, no. 261, pp. 192–207, 1892

  27. [27]

    TPatch: A Triggered Physical Adversarial Patch,

    W. Zhu, X. Ji, Y . Cheng, S. Zhang, and W. Xu, “TPatch: A Triggered Physical Adversarial Patch,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, August 2023, pp. 661–678

    2023

  28. [28]

    Moiré Injection Attack (MIA) : Compromising Autonomous Vehicle Safety via Exploiting Camera’s Color Filter Array (CFA) to Inject Hidden Traffic Sign,

    Q. Xia and Q. Chen, “Moiré Injection Attack (MIA) : Compromising Autonomous Vehicle Safety via Exploiting Camera’s Color Filter Array (CFA) to Inject Hidden Traffic Sign,” in2024 Annual Computer Security Applications Conference (ACSAC). Honolulu, HI, USA: IEEE, December 2024, pp. 988–1001

    2024

  29. [29]

    Remote Perception Attacks against Camera-based Object Recognition Systems and Countermeasures,

    Y . Man, M. Li, and R. Gerdes, “Remote Perception Attacks against Camera-based Object Recognition Systems and Countermeasures,”ACM Transactions on Cyber-Physical Systems, vol. 8, no. 2, pp. 1–27, April 2024

    2024

  30. [30]

    Fundamentals of Silicon-Based Phototrans- duction,

    H. Ji and P. A. Abshire, “Fundamentals of Silicon-Based Phototrans- duction,” inCMOS Imagers, O. Yadid-Pecht and R. Etienne-Cummings, Eds. Boston, MA: Springer US, 2004, pp. 1–51

    2004

  31. [31]

    Near Infrared Quantum Efficiency Simulations for CMOS Image Sensors,

    A. Perkins and S. Borthakur, “Near Infrared Quantum Efficiency Simulations for CMOS Image Sensors,”Proceedings 2023 International Image Sensor Workshop, 2023

    2023

  32. [32]

    CCD/CMOS image sensors - Image sensors for scientific measurements and industrial equipment,

    Hamamatsu Photonics K.K., “CCD/CMOS image sensors - Image sensors for scientific measurements and industrial equipment,” September 2025. [Online]. Available: https://www.hamamatsu.com/content/dam/hamamatsu-photonics/sites/ documents/99_SALES_LIBRARY/ssd/image_sensor_kmpd0002e.pdf

    2025

  33. [33]

    Alvium 1800 C-240 Alvium 1800 C-240 | 2.4 MP Sony IMX392 CMOS sensor - Allied Vision,

    Allied Vision Technologies GmbH, “Alvium 1800 C-240 Alvium 1800 C-240 | 2.4 MP Sony IMX392 CMOS sensor - Allied Vision,” October

  34. [34]

    Available: https://www.alliedvision.com/en/products/ alvium-configurator/alvium-1800-c/240/

    [Online]. Available: https://www.alliedvision.com/en/products/ alvium-configurator/alvium-1800-c/240/

  35. [35]

    775 Ball Bearing DC Motor - Data Specs,

    Handson Technology, “775 Ball Bearing DC Motor - Data Specs,” November 2025. [Online]. Available: https://www.handsontec.com/ dataspecs/motor_fan/775-Motor.pdf

    2025

  36. [36]

    FK-280SA V-19170,

    Motraxx Elektrogeräte GmbH, “FK-280SA V-19170,” 2022. [Online]. Available: https://motraxx.com/assets/229020_FK-280SA-19170.pdf

    2022

  37. [37]

    Camera - Raspberry Pi Documentation,

    Raspberry Pi Ltd., “Camera - Raspberry Pi Documentation,” July

  38. [38]

    Available: https://www.raspberrypi.com/documentation/ accessories/camera.html

    [Online]. Available: https://www.raspberrypi.com/documentation/ accessories/camera.html

  39. [39]

    Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” Neural Networks, vol. 32, pp. 323–332, August 2012

    2012

  40. [40]

    Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective,

    N. Wang, S. Xie, T. Sato, Y . Luo, K. Xu, and Q. A. Chen, “Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective,” inProceedings 2025 Network and Distributed System Security Symposium. San Diego, CA, USA: Internet Society, 2025

    2025

  41. [41]

    Deep Residual Learning for Image Recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for Image Recognition,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016

    2016

  42. [42]

    A ConvNet for the 2020s,

    Z. Liu, H. Mao, C.-Y . Wu, C. Feichtenhofer, T. Darrell, and S. Xie, “A ConvNet for the 2020s,” in2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, LA, USA: IEEE, June 2022, pp. 11 966–11 976

    2022

  43. [43]

    ImageNet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, Kai Li, and Li Fei-Fei, “ImageNet: A large-scale hierarchical image database,” in2009 IEEE Conference 14 on Computer Vision and Pattern Recognition. Miami, FL: IEEE, June 2009, pp. 248–255

    2009

  44. [44]

    Microsoft COCO: Common Objects in Context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft COCO: Common Objects in Context,” inComputer Vision – ECCV 2014, D. Fleet, T. Pajdla, B. Schiele, and T. Tuytelaars, Eds. Cham: Springer International Publishing, 2014, vol. 8693, pp. 740–755, series Title: Lecture Notes in Computer Science

    2014

  45. [45]

    Aggregated Residual Transformations for Deep Neural Networks,

    S. Xie, R. Girshick, P. Dollar, Z. Tu, and K. He, “Aggregated Residual Transformations for Deep Neural Networks,” in2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Honolulu, HI: IEEE, July 2017, pp. 5987–5995

    2017

  46. [46]

    Very Deep Convolutional Networks for Large-Scale Image Recognition

    K. Simonyan and A. Zisserman, “Very Deep Convolutional Networks for Large-Scale Image Recognition,” April 2015, arXiv:1409.1556 [cs]. [Online]. Available: http://arxiv.org/abs/1409.1556

    work page internal anchor Pith review Pith/arXiv arXiv 2015

  47. [47]

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale,” in2021 International Conference on Learning Representations, Virtual Event, May 2021

    2021

  48. [48]

    Ultralytics YOLO11,

    G. Jocher and J. Qiu, “Ultralytics YOLO11,” 2024. [Online]. Available: https://github.com/ultralytics/ultralytics

    2024

  49. [49]

    Faster R-CNN: Towards Real- Time Object Detection with Region Proposal Networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster R-CNN: Towards Real- Time Object Detection with Region Proposal Networks,” inAdvances in Neural Information Processing Systems, C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, Eds., vol. 28. Curran Associates, Inc., 2015

    2015

  50. [50]

    Night Breaker LED Vin- tage H4,

    OSRAM GmbH, “Night Breaker LED Vin- tage H4,” December 2025. [Online]. Avail- able: https://www.osram.co.uk/appsj/pdc/pdf.do?cid=GPS01_34401769& vid=MP_EUROPE_UK_eCat&lid=EN&mpid=ZMP_4069705

    2025

  51. [51]

    United Nations, “E/ECE/324/Rev.2/Add.111/Rev.4, E/ECE/- TRANS/505/Rev.2/Add.111/Rev.4: Uniform provisions concerning the approval of motor vehicle headlamps emitting an asymmetrical passing-beam or a driving-beam or both and equipped with filament light sources and/or light-emitting diode (LED) modules,” United Nations, Agreement, September 2023

    2023

  52. [52]

    DIN 67520:2025-06: Retro- reflecting materials for traffic safety - Photometric minimum requirements for retro-reflective sheetings,

    DIN Deutsches Institut für Normung e. V ., “DIN 67520:2025-06: Retro- reflecting materials for traffic safety - Photometric minimum requirements for retro-reflective sheetings,” DIN Deutsches Institut für Normung e. V ., Berlin, Deutsche Norm, June 2025

    2025

  53. [53]

    EN 12899-1:2007:E: Fixed, vertical road traffic signs – Part 1: Fixed signs,

    European Committee for Standardization, “EN 12899-1:2007:E: Fixed, vertical road traffic signs – Part 1: Fixed signs,” European Committee for Standardization, B-1050 Brussels, European Standard, November 2007

    2007

  54. [54]

    ECE/TRANS/196: Convention on Road Signs and Signals of 1968 European Agreement Sup- plementing the Convention and Protocol on Road Markings, Additional to the European Agreement,

    United Nations Economic Commission for Europe, “ECE/TRANS/196: Convention on Road Signs and Signals of 1968 European Agreement Sup- plementing the Convention and Protocol on Road Markings, Additional to the European Agreement,” United Nations Economic Commission for Europe, United Nations Publication, December 2006

    1968

  55. [55]

    Infrared-Filter (IR-Filter),

    BTE Bedampfungstechnik GmbH, “Infrared-Filter (IR-Filter),” 2025. [Online]. Available: https://www.bte-born.com/fileadmin/bte/Downloads/ Datenbl%C3%A4tter/BTE_Datenblatt_IR_ENG_29042025_fin.pdf

    2025

  56. [56]

    Coated Optics for Sensor Applications,

    Optics Balzers AG, “Coated Optics for Sensor Applications,” 2025. [Online]. Available: https: //www.materionbalzersoptics.com/de/service/datenblaetter/download/ e4554a6778fe4b4481fa970161eaef40cabf82b74bfee1f81fcc572f327ce782

    2025

  57. [57]

    Elementary Graph Algorithms,

    T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, “Elementary Graph Algorithms,” inIntroduction to Algorithms, 3rd ed. The MIT Press, 2009, pp. 589–623

    2009

  58. [58]

    Dynamic adversarial at- tacks on autonomous driving systems.arXiv preprint arXiv:2312.06701, 2023

    A. Chahe, C. Wang, A. Jeyapratap, K. Xu, and L. Zhou, “Dynamic Adversarial Attacks on Autonomous Driving Systems,” May 2024, arXiv:2312.06701 [cs]. [Online]. Available: http://arxiv.org/abs/2312. 06701

    work page arXiv 2024

  59. [59]

    Overriding Autonomous Driving Systems Using Adaptive Adversarial Billboards,

    N. Patel, P. Krishnamurthy, S. Garg, and F. Khorrami, “Overriding Autonomous Driving Systems Using Adaptive Adversarial Billboards,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 8, pp. 11 386–11 396, August 2022

    2022

  60. [60]

    Color Imaging Array,

    B. E. Bayer, “Color Imaging Array,” USA Patent United States Patent 3,971,065, Jul., 1976

    1976

  61. [61]

    ILCE-6400 Specifications | Sony USA,

    Sony Electronics Inc., “ILCE-6400 Specifications | Sony USA,” January

  62. [62]

    Available: https://www.sony.com/electronics/support/ e-mount-body-ilce-6000-series/ilce-6400/specifications 15

    [Online]. Available: https://www.sony.com/electronics/support/ e-mount-body-ilce-6000-series/ilce-6400/specifications 15