Benchmarking Recovery Methods for Adversarial Traffic Signs in Autonomous Driving
Doreen Sebastian Sarwatt, Frank Kulwa, Huansheng Ning, Adamu Gaston Philipo, Xuanxia Yao, Jianguo Ding · IET Intelligent Transport Systems · 2025
ABSTRACT Autonomous vehicles (AVs) depend critically on vision‐based perception systems, with traffic sign classification (TSC) playing a crucial role in interpreting regulatory and warning signs for safe navigation. However, these systems are highly vulnerable to adversarial attacks, subtle input perturbations that deceive deep learning models while appearing benign to human drivers. While detection has been the primary focus of defense, recovery of adversarial perturbed signs remains significantly underexplored, despite its importance for maintaining real‐time decision‐making and operational safety. To bridge this gap, we present the first comprehensive benchmarking of state‐of‐the‐art image classification recovery methods adapted to the traffic sign domain. We address three domain‐specific challenges for autonomous driving: (1) robustness to real‐world conditions (e.g., weather, occlusion), (2) latency compatible with real‐time pipelines (100 ms), and (3) preservation of geometric/structural integrity. Our adaptations combine weather‐resilient preprocessing, shape‐preserving restoration, and latency‐aware implementation. Under unified white‐box attacks, we evaluate across TSRD, BTSC, and GTSRB using recovery rate (RR), structural similarity (SSIM), and recovery time (RT). To connect latency to function, we introduce the recovery‐induced distance (RID), which maps recovery time (RT) to added travel distance. PuVAE, VAE, c‐GAN, and CD‐GAN achieve subfewmillisecond RT with of the nominal braking distance; DIR remains within 0.3% at , CSC is 1.9%–3.3%, and DiffPure incurs 150–165 ms latency, yielding 8%–10% at (multi‐meter delay), thus violating real‐time constraints ()). Cross‐dataset transfer on shared classes shows that VAE‐based method generalizes better than GAN‐based while maintaining timing safety. Overall, PuVAE offers the best accuracy–latency trade‐off. These findings provide practical guidance for deploying recovery as a real‐time, safety‐aligned complement to detection in AV perception.