Adversarial Lens Flares: A Threat to Camera-Based Systems in Smart Devices

Evaluating the potential risks posed by adversarial examples is crucial for securely deploying deep neural network (DNN)-based Internet of Things (IoT) devices. Although adversarial patches are considered a primary physical attack strategy, recent studies suggest their real-world impact may be less significant. Research has explored using optical tools like lasers or projectors to create perturbations, but these methods are uncommon in natural settings. Given the visual challenges inherent in natural environments, the prevalent occurrence of lens flare is noteworthy. This phenomenon can obstruct human vision and may also be exploited maliciously. In this article, we emphasize for the first time that lens flares produced by light sources exhibit strong adversarial characteristics. In the physical world, lens flare that occurs around and directly impacts the target object can easily deceive advanced models in various real-world scenarios. We show that merely using a regular flashlight to generate adversarial flare is sufficient to easily deceive well-trained models during both day and night in typical traffic situations, with an average attack success rate (ASR) of over 90%. Furthermore, by utilizing real lens flares as perturbations, we introduce a novel digital-domain closed-box adversarial attack method, primarily designed for extensive experimental validation of adversarial lens flare attacks in the physical world. Experimental results demonstrate that adversarial lens flare attacks effectively deceive state-of-the-art models, including YoloV8, DinoV2, and other three baseline models, achieving average ASRs as high as 95.4% on GTSRB and 82.8% on MTSD. We also discuss the limitations and defense mechanisms against this attack.