Imperceptibility

Imperceptibility is another important feature for adversarial examples, which means the perturbations do not affect users' decision. In the field of license plate recognition, practical adversarial examples impose a new implication to this concept: the license plate is still recognized correctly, and the crafted perturbations are indistinguishable from other noises of the real world. In this experiment, we conduct a survey and it is designed with carefully-designed questions about these adversarial examples. In particular, one survey is composed of 20 generated adversarial examples, randomly selected from our data set. For each example, the participants first need to select the correct license number from four choices (the wrong license number recognized by HyperLPR is also counted in). The participants are then asked with ``whether have you noticed any abnormalities of this license plate?''. If an affirmative answer is given, another single choice will show up with five choices for asking the possible sources for light spots. More details are shown in Figure 5. We release the survey via a public survey service, and receive 121 questionnaires in total within three days. We have filtered out 20 surveys of low quality if the survey is finished too fast (less than 60s) or the answers are all pointing to a single choice.

Survey Results. Among the 101 valid surveys, the median age of the participants is 22. 66.34% of them are male and 33.66% are female. 93.07% hold a Bachelor or higher degree. From the survey, we find that 93.56% of the participants can recognize the text of license plate successfully, which means our adversarial examples does not affect users’ recognition. 8.23% of them do not notice any light spots in adversarial examples, indicating that the perturbations are inconspicuous to them. As for the remaining participants noticing the light spots, 78.32% think the light spots are caused by license plate light or other natural light as we expected, and only 21.68% consider the light spots are from artificial illumination. Thus, we can find out that our practical attack can easily pretend as some normal lighting sources, such as license plate light and other vehicles lighting from the back.