Researchers in South Korea have built an AI framework that mimics natural wear and tear on traffic signs to test whether everyday damage, such as fading, cracks and corrosion, can trick computer-vision systems into misreading them.

Upgrading Automotive Safety Equipment

The framework, called Adversarial Wear and Tear (AdvWT), comes from a team led by Associate Professor Seong Tae Kim at Kyung Hee University and Assistant Professor Hong Joo Lee at Seoul National University of  Science and Technology. Their findings, published in May in IEEE Transactions on Dependable and Secure Computing, do not show that a deployed self-driving car has actually been fooled by a naturally damaged sign in the real world. Instead, the study demonstrates the vulnerability under controlled digital and physical tests, at a time when automakers and technology companies are working to validate automated-driving systems in increasingly complex conditions.

“We focused on traffic signs because they are exposed to weather and environmental damage,” Lee said, noting that unlike a temporary sticker-based attack, natural deterioration persists until the physical sign is repaired or replaced.

To build AdvWT, the team trained a generative image-to-image model, based on StarGAN-v2, to learn the visual patterns of damaged and undamaged signs. By adjusting the model’s internal representation of “damage style,” the researchers could generate signs that looked naturally worn but were more likely to be misread by AI systems. In a survey of 32 people, the generated images were rated as similarly natural-looking to real damaged signs. Tested against two traffic-sign datasets and eight recognition architectures, AdvWT achieved near-perfect success in fooling lightweight models such as ResNet-18 and MobileNet, remained effective against transformer-based models, and showed the strongest ability among the methods tested to transfer its effect across different AI architectures. When the researchers printed and photographed the altered signs under varying distances, angles and lighting, the effect held up outside the digital environment as well.

Implementing Enterprise AI And Machine Learning Tools

The work builds on earlier research showing computer vision can be vulnerable to physical changes people would barely notice. A 2018 study found that stickers placed on a real stop sign caused a deep-learning system to misclassify it in all captured lab images and in 84.8 percent of frames during a moving-vehicle field test. A separate USENIX study found a detector failed to recognize altered stop signs in more than 85 percent of lab frames, and in 63.5 to 72.5 percent of frames in outdoor tests using posters and stickers.

Researchers caution that a vulnerability found in one vision model does not mean a real autonomous  vehicle would make the same error, since commercial systems typically combine multiple cameras and sensors, maps and other redundancies. Waymo, for instance, says its driverless system has logged more than 220 million fully autonomous miles through March 2026, with far fewer serious-injury and airbag-deployment crashes than human drivers over the same routes, though those figures are company-reported and don’t rule out individual perception weaknesses. The U.S. National Transportation Safety Board has separately warned that developmental automated-driving systems can have limitations detecting hazards and predicting how other road users will move.

Exploring Educational Science Kits

The researchers say AdvWT also has a defensive use: the same model can restore naturally damaged signs, and training recognition systems on AdvWT-generated damage improved their ability to handle real-world wear. Kim said building reliable AI requires continuously finding where systems fail and using that insight to make them more robust, adding that such work could matter for other high-stakes fields such as healthcare and finance over the next five to ten years. The findings add to a broader case that autonomous-vehicle developers should test perception systems against imperfect, real-world conditions rather than relying only on clean benchmark images, since road signs routinely fade, crack, corrode or become obscured well before anyone deliberately tampers with them.