When Worn Traffic Signs Become an AI Problem

When Worn Traffic Signs Become an AI Problem

A faded speed-limit sign is normally an asset-maintenance problem. For a vehicle relying on machine vision, it can also become something rather more complicated.

Researchers from Seoul National University of Science and Technology, Kyung Hee University and the Technical University of Munich have developed an artificial intelligence framework that examines how ordinary-looking deterioration can cause traffic-sign recognition systems to make mistakes. Called Adversarial Wear and Tear, or AdvWT, the approach generates realistic forms of damage and then searches for variations capable of misleading deep neural networks.

The work moves an established problem in AI research into territory familiar to road authorities. Traffic signs spend years exposed to sunlight, rain, dirt, corrosion, impacts and physical deterioration. Their condition changes gradually, and a sign can remain understandable to a human driver long after it has ceased to resemble the clean examples on which an automated recognition system may have been trained. Human and machine readability are related, but they are not necessarily identical.

The research was published in IEEE Transactions on Dependable and Secure Computing in 2026. Rather than attaching conspicuous stickers or projecting carefully engineered patterns onto signs, the researchers modelled deterioration resembling damage encountered naturally in the physical world.

Maintaining a sign may eventually involve understanding its readability to machines as well as people.

Briefing

• AdvWT generates realistic-looking deterioration on traffic signs and tests whether the resulting images cause AI recognition systems to make errors.
• The framework uses a GAN-based image-to-image translation model to learn a latent representation of natural sign damage.
• Researchers evaluated the method using two traffic-sign datasets and eight recognition architectures.
• Printed adversarial speed-limit signs continued to affect classification when photographed at different distances and viewing angles and under indoor and outdoor conditions.
• Training recognition models with AdvWT-generated images improved their generalisation to naturally damaged signs.

Teaching AI How Signs Deteriorate

Adversarial examples have been studied extensively because neural networks can sometimes be fooled by surprisingly small changes to an input. In physical-world experiments, researchers have demonstrated attacks involving stickers, patches, shadows, projected light and other deliberately introduced modifications. AdvWT takes a different approach by modelling wear and tear that can occur through normal exposure and ageing, without anybody deliberately interfering with the sign.

The researchers trained an unsupervised image-to-image translation network based on StarGAN-v2 to learn characteristics associated with clean and damaged signs. The model encodes deterioration into what the researchers describe as a latent “damage style code”, allowing different types and degrees of apparent damage to be generated while retaining the underlying identity of the sign.

AdvWT then progressively adjusts that damage representation towards versions more likely to produce an incorrect classification. To a human observer, the generated sign should still resemble something that has naturally faded or deteriorated beside a road, while particular variations can become much more troublesome for the recognition model.

A study involving 32 participants assessed the perceived naturalness of the generated images. According to the researchers, the synthetic deterioration received high naturalness ratings close to those given to images of genuinely damaged signs.

Testing Different Recognition Models

The researchers tested AdvWT across two traffic-sign datasets and eight recognition architectures rather than limiting the experiment to a single classifier. The results showed high attack success against lightweight convolutional neural networks including ResNet-18 and MobileNet, while transformer-based recognition models were also affected.

They also examined transferability, testing whether examples developed against one architecture remained effective against another. A weakness confined to one laboratory model says relatively little about an operational vision system built around a different architecture. Transfer between models suggests the generated deterioration can exploit features that are not entirely peculiar to one network.

There is an important distinction between demonstrating vulnerability in traffic-sign classifiers and demonstrating unsafe behaviour by an autonomous vehicle. The experiments test recognition models under controlled conditions. They do not establish that a production vehicle would necessarily respond incorrectly to a deteriorated sign.

Modern automated-driving systems can combine cameras with mapping, localisation, other sensors and contextual information, while manufacturers can introduce their own validation and fallback mechanisms. A classification error at one point in the perception stack therefore does not automatically become an incorrect driving command. The research instead identifies a useful test case: signs that remain plausible pieces of road infrastructure while becoming difficult for machine perception.

Physical-World Testing

Digital adversarial examples can lose their effect when transferred from a computer screen to a real object. Printing changes colour and resolution, cameras introduce their own processing, and distance, perspective, illumination and background conditions alter the image again.

The AdvWT researchers therefore printed clean and adversarial speed-limit signs and photographed them under different conditions. Distance and viewing angle were varied, with tests conducted indoors and outdoors. The adversarial effect persisted after printing and recapture, and the resulting images continued to mislead the traffic-sign classifier.

Assistant Professor Hong Joo Lee of Seoul National University of Science and Technology explained why the team selected roadside signs for the work: “We focused on traffic signs because they are exposed to weather and environmental damage throughout their lifetime, and their accurate recognition is essential for safety-critical applications,” he said. “Unlike temporary optical attacks, natural deterioration can persist until a physical object is repaired or replaced.”

A shadow moves and a projected pattern disappears when its source is removed. A damaged sign can remain beside a road until somebody repairs or replaces it.

Road Maintenance Meets Machine Perception

Road authorities already inspect and replace signs according to condition, visibility and applicable standards. The growth of machine perception introduces another potential dimension because people and computer-vision systems do not necessarily interpret deterioration in the same way.

People recognise signs using shape, colour, symbols, language, road context and experience. Computer-vision systems derive classifications from learned visual features, some of which can respond differently when part of an image fades, cracks or becomes obscured. A sign could therefore remain apparently serviceable to an inspector or driver while becoming a poor input for a particular recognition model.

AdvWT does not establish new maintenance thresholds for traffic signs, nor does the research demonstrate that existing inspection regimes are inadequate. It provides a method for exploring the problem systematically and exposing vehicle perception systems to degradation designed to resemble years of roadside service.

That may prove particularly useful for vehicle validation and training. Real-world deterioration produces an enormous range of visual conditions, making it difficult to collect sufficiently varied datasets simply by photographing damaged assets. Generative methods can expand those conditions systematically, including combinations that may be uncommon in existing datasets.

Training for Damaged Signs

The researchers also used AdvWT-generated damaged signs during training and found that this improved the models’ ability to generalise to real damaged traffic signs. The system used to expose a vulnerability can therefore generate training material to help reduce it.

The bidirectional model produced another possibility. Researchers demonstrated that it could restore representations of naturally damaged signs, although this remains a research capability rather than a proposed substitute for physical sign maintenance.

Associate Professor Seong Tae Kim of Kyung Hee University places the work within the wider problem of dependable AI. “Building reliable AI requires more than improving average performance. It requires continuously identifying where AI systems fail, understanding why those failures occur, and using those insights to make the systems more robust. Over the next five to ten years, research in this direction could play an important role in developing AI systems that can be deployed more reliably in real-world, high-stakes domains such as healthcare and finance,” he said.

Roads provide no shortage of comparable edge cases. Signs fade unevenly, vegetation intrudes, dirt accumulates, surfaces corrode and coatings fail. Graffiti, repairs and previous impacts alter appearances further, while rain, glare, darkness and viewing angle add another layer of variability. A vision system intended to operate across large road networks cannot rely on the roadside world looking like a curated training dataset.

Roadside Infrastructure and Automated Driving

Vehicle developers have traditionally carried most of the responsibility for making perception systems cope with imperfect roads, while infrastructure owners maintain signs and markings primarily around established requirements for human road users. AdvWT provides a way of examining the interface between those two domains without assuming that responsibility must shift from one to the other.

The research makes it possible to investigate the point at which normal physical deterioration begins to challenge machine recognition. That could support vehicle validation, synthetic-data generation and further roadside asset research, while helping distinguish deterioration that is largely cosmetic from damage that produces disproportionate problems for automated perception.

A scratched or faded sign is a small piece of infrastructure. Across a road network there may be millions of them, ageing at different rates under different weather, traffic and maintenance conditions. Teaching machines to understand that imperfect world may prove more practical than expecting the world to remain perfect for the machines.

Key Industry Questions

1. What is AdvWT? Adversarial Wear and Tear is an AI framework for generating realistic-looking physical deterioration and testing whether it causes image-recognition models to misclassify objects. The published research focuses on traffic signs.
2. How is AdvWT different from conventional adversarial attacks? Many physical adversarial experiments deliberately add stickers, patches, shadows, projected light or other artificial modifications. AdvWT models deterioration resembling naturally occurring wear and tear.
3. Does the research prove that damaged signs will cause autonomous vehicles to make unsafe decisions? No. The experiments demonstrate vulnerabilities in traffic-sign recognition models. Production automated-driving systems can use additional sensors, mapping, contextual reasoning and safety mechanisms beyond an individual classifier.
4. Was AdvWT tested only digitally? No. Researchers printed adversarial speed-limit signs and photographed them under different viewing distances, angles and indoor and outdoor conditions. The adversarial effect persisted through this physical-world process.
5. Which AI architectures were tested? The study evaluated eight recognition architectures across two traffic-sign datasets, including convolutional neural networks such as ResNet-18 and MobileNet as well as transformer-based models.
6. Can the framework improve AI rather than simply attack it? Yes. Training with AdvWT-generated damaged signs improved model generalisation when recognising real-world damaged signs.
7. Could this affect road-sign maintenance standards? The research does not establish new maintenance standards or replacement thresholds. It provides a method for investigating whether particular types of deterioration affect machine readability differently from human readability.
8. Why are traffic signs useful for this type of research? They are safety-relevant visual objects that remain outdoors for long periods and naturally experience fading, corrosion, dirt, physical damage and other environmental deterioration.

Strategic Takeaways

1. Human readability and machine readability may not deteriorate at exactly the same rate as roadside assets age.
2. Generative AI can expose perception systems to a wider range of realistic deterioration than conventional datasets may contain.
3. Physical-world testing is essential because adversarial effects demonstrated digitally may not survive printing, camera capture, perspective and changing illumination.
4. AdvWT demonstrates vulnerability in traffic-sign classifiers, not unsafe behaviour by complete autonomous-driving systems.
5. Generated deterioration can be used both to identify weaknesses and to create training data that improves recognition robustness.