Skip to main content
SpringerLink
Log in

RoLMA: A Practical Adversarial Attack Against Deep Learning-Based LPR Systems

  • Conference paper
  • First Online:
Information Security and Cryptology (Inscrypt 2019)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12020))

Included in the following conference series:

Abstract

With the advances of deep learning, license plate recognition (LPR) based on deep learning has been widely used in public transport such as electronic toll collection, car parking management and law enforcement. Deep neural networks are proverbially vulnerable to crafted adversarial examples, which has been proved in many applications like object recognition, malware detection, etc. However, it is more challenging to launch a practical adversarial attack against LPR systems as any covering or scrawling to license plate is prohibited by law. On the other hand, the created perturbations are susceptible to the surrounding environment including illumination conditions, shooting distances and angles of LPR systems. To this end, we propose the first practical adversarial attack, named as RoLMA, against deep learning-based LPR systems. We adopt illumination technologies to create a number of light spots as noises on the license plate, and design targeted and non-targeted strategies to find out the optimal adversarial example against HyperLPR, a state-of-the-art LPR system. We physicalize these perturbations on a real license plate by virtue of generated adversarial examples. Extensive experiments demonstrate that RoLMA can effectively deceive HyperLPR with an 89.15% success rate in targeted attacks and 97.3% in non-targeted attacks. Moreover, our experiments also prove its high practicality with a 91.43% success rate towards physical license plates, and imperceptibility with around 93.56% of investigated participants being able to correctly recognize license plates.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://sites.google.com/view/rolma-adversarial-attack/responses.

  2. 2.

    https://sites.google.com/view/rolma-adversarial-attack.

  3. 3.

    https://sites.google.com/view/rolma-adversarial-attack/practicability.

  4. 4.

    https://sites.google.com/view/rolma-adversarial-attack/imperceptibility.

  5. 5.

    https://www.wjx.cn/.

References

  1. License Plate Recognition (2018). https://parking.ku.edu/license-plate-recognition

  2. Vehicle registration numbers and number plates. Technical report, INF104 (2018)

    Google Scholar 

  3. Carlini, N., Wagner, D.A.: Audio adversarial examples: Targeted attacks on speech-to-text. In: 2018 IEEE Security and Privacy Workshops, pp. 1–7 (2018). https://doi.org/10.1109/SPW.2018.00009

  4. Evtimov, I., et al.: Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 (2017)

  5. Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. CoRR abs/1412.6572 (2014)

    Google Scholar 

  6. Gravelle, K.: Video tolling system with error checking (2011)

    Google Scholar 

  7. Guo, C., Rana, M., Cissé, M., van der Maaten, L.: Countering adversarial images using input transformations. CoRR abs/1711.00117 (2017). http://arxiv.org/abs/1711.00117

  8. Jain, V., Sasindran, Z., Rajagopal, A.K., Biswas, S., Bharadwaj, H.S., Ramakrishnan, K.R.: Deep automatic license plate recognition system. In: Proceedings of the Tenth Indian Conference on Computer Vision, Graphics and Image Processing (ICVGIP), pp. 6:1–6:8 (2016)

    Google Scholar 

  9. Li, H., Shen, C.: Reading car license plates using deep convolutional neural networks and LSTMs. CoRR abs/1601.05610 (2016). http://arxiv.org/abs/1601.05610

  10. Lu, J., Sibai, H., Fabry, E., Forsyth, D.A.: NO need to worry about adversarial examples in object detection in autonomous vehicles. CoRR abs/1707.03501 (2017). http://arxiv.org/abs/1707.03501

  11. Nomura, S., Yamanaka, K., Katai, O., Kawakami, H., Shiose, T.: A novel adaptive morphological approach for degraded character image segmentation. Pattern Recogn. 38(11), 1961–1975 (2005)

    Article  Google Scholar 

  12. Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372–387. IEEE (2016)

    Google Scholar 

  13. Rosenblatt, S., Cipriani, J.: Two-factor authentication: what you need to know (FAQ), June 2015. https://www.cnet.com/news/two-factor-authentication-what-you-need-to-know-faq/

  14. Silva, S.M., Jung, C.R.: License plate detection and recognition in unconstrained scenarios. In: Ferrari, V., Hebert, M., Sminchisescu, C., Weiss, Y. (eds.) ECCV 2018. LNCS, vol. 11216, pp. 593–609. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-01258-8_36

    Chapter  Google Scholar 

  15. Smith, R.: An overview of the tesseract OCR engine. In: 9th International Conference on Document Analysis and Recognition (ICDAR), pp. 629–633 (2007)

    Google Scholar 

  16. Song, C., Shmatikov, V.: Fooling OCR systems with adversarial text images. CoRR abs/1802.05385 (2018)

    Google Scholar 

  17. Szegedy, C., et al.: Intriguing properties of neural networks. CoRR abs/1312.6199 (2013)

    Google Scholar 

  18. Xu, Z., et al.: Towards end-to-end license plate detection and recognition: a large dataset and baseline. In: Ferrari, V., Hebert, M., Sminchisescu, C., Weiss, Y. (eds.) ECCV 2018. LNCS, vol. 11217, pp. 261–277. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-01261-8_16

    Chapter  Google Scholar 

  19. Yuan, X., et al.: All your alexa are belong to us: a remote voice control attack against echo. In: 2018 IEEE Global Communications Conference (GLOBECOM), pp. 1–6. IEEE (2018)

    Google Scholar 

  20. Yuan, X., et al.: Commandersong: a systematic approach for practical adversarial voice recognition. In: 27th \(\{\)USENIX\(\}\) Security Symposium (\(\{\)USENIX\(\}\) Security 2018), pp. 49–64 (2018)

    Google Scholar 

  21. Zhao, Y., Zhu, H., Liang, R., Shen, Q., Zhang, S., Chen, K.: Seeing isn’t believing: towards more robust adversarial attack against real world object detectors. In: Proceedings of the 26th ACM Conference on Computer and Communications Security (CCS) (2019)

    Google Scholar 

  22. Zeusee: High Performance Chinese License Plate Recognition Framework (2018)

    Google Scholar 

  23. Zhou, Z., Tang, D., Wang, X., Han, W., Liu, X., Zhang, K.: Invisible mask: practical attacks on face recognition with infrared. CoRR abs/1803.04683 (2018). http://arxiv.org/abs/1803.04683

Download references

Acknowledgments

IIE authors are supported in part by National Key R&D Program of China (No. 2016QY04W0805), NSFC U1836211, 61728209, 61902395, National Top-notch Youth Talents Program of China, Youth Innovation Promotion Association CAS, Beijing Nova Program, Beijing Natural Science Foundation (No. JQ18011), National Frontier Science and Technology Innovation Project (No. YJKYYQ20170070) and a research grant from Huawei. Fudan university author is supported by NSFC 61802068, Shanghai Sailing Program 18YF1402200.

Author information

Authors and Affiliations

  1. State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Science, Beijing, China

    Mingming Zha, Guozhu Meng, Chaoyang Lin & Kai Chen

  2. School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

    Mingming Zha, Guozhu Meng, Chaoyang Lin & Kai Chen

  3. Fudan University, Shanghai, China

    Zhe Zhou

Authors
  1. Mingming Zha
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Guozhu Meng
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Chaoyang Lin
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Zhe Zhou
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Kai Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Guozhu Meng .

Editor information

Editors and Affiliations

  1. College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China

    Zhe Liu

  2. Computer Science Department, Columbia University, New York, NY, USA

    Moti Yung

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Zha, M., Meng, G., Lin, C., Zhou, Z., Chen, K. (2020). RoLMA: A Practical Adversarial Attack Against Deep Learning-Based LPR Systems. In: Liu, Z., Yung, M. (eds) Information Security and Cryptology. Inscrypt 2019. Lecture Notes in Computer Science(), vol 12020. Springer, Cham. https://doi.org/10.1007/978-3-030-42921-8_6

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-42921-8_6

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-42920-1

  • Online ISBN: 978-3-030-42921-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation