One Signature, Two Threats: Grammar Scored Cross-Channel Disagreement for Robust Traffic Sign Recognition

Traffic sign recognition (TSR) sits on the critical path of advanced driver assistance and autonomous driving, yet deployed classifiers fail in two qualitatively distinct regimes that prior work has largely defended against in isolation worst case adversarial manipulation from imperceptible digital perturbations to physically realizable stickers, patches, and outline-conforming edge attacks and average case environmental degradation such as fog, glare, motion blur, fading, and occlusion. We observe that, despite their differing origins, both regimes leave the same observable signature on the over specified structure of a sign whose class is redundantly encoded by the silhouette, color scheme, and central pictogram: a spatially localized disagreement among otherwise independent cues, scored against a small, enumerable grammar of physically valid attribute tuples. Recasting robustness as detection of this signature rather than defense against any single threat, we propose SAFER-Sign, which integrates four components that each repair a documented failure mode of prior approaches: (i) class conditionally decorrelated shape, color, and glyph encoders that render over the specification genuine rather than nominal; (ii) evidential per channel uncertainty that lets a degraded cue abstain instead of voting confidently wrong; (iii) a soft, factorized, confidence gated sign grammar prior that rewards jointly consistent tuples without becoming a single attribute attack surface; and (iv) a jointly trained spatial reliability gate anchored to a parameter-free cross-channel disagreement signal, so it cannot be suppressed like a decoupled front end. Taken together, these components mean that a successful adaptive attack in our evaluated settings had to jointly address class evidence, cross channel consistency, grammar compatibility, reliability gating, and abstention. This raises the number of coupled attack objectives, but we emphasize that it does not guarantee that all three channels must be corrupted.