Practicability

Experiment Setup We set up a physical experiment using the equipments in Figure 4. Figure 4 demonstrates the key electronic devices including lenses, slide rheostats and LED lamps. In particular, we select 6 types LED lamps in different colors to simulate the created light spots on the license plate. In order to fit the brightness, we utilize \emph{slide rheostats} of the maximal resistance 50 ohm in series with LED lamps. They can control the supply current by adjusting their resistance. Lenses are used together with LED lamps to control the size of a light spot. As LED lamps are a type of single point light, we need to attach lenses to create a spotlight. Different angles of a lens can configure spots into different sizes. Additionally, we also have several strings of cables to connect these devices, and a power bank to supply power of which the voltage is 3.7V, the capacity is 10,000mAh and outputs a 2.4A current.

We show six images recorded in this physical attack and the recognition results in Table 2. These images are captured with varying distances and shooting angles. In particular, the first image is shot with the original license plate and the camera is 2 meters away behind. HyperLPR can output "_8BM7_'' correctly with a conference of 98.06%. To protect privacy, we use "_'' to cover specific characters in both the images and recognized text. The other six images, shot from the decorated license plate, can all make HyperLPR output "_82M7_''. As shown in Table 2, "Distance'' denotes the distance of the camera to the license plate, "Depress.'' means the depression angle of photographing, "Horizon.'' means the horizontal angle of photographing, and "Conf.'' denotes the confidence of HyperLPR with regard to recognition results. Noted that "-30'' indicates the camera is at the left side of the license plate while "+30'' means the right side. These decorated license plates are all recognized wrongly, according to our computation in the experiments. It shows that \tool is very effective in generating adversarial examples, and these adversarial examples are very robust in the physical world.

Original

This picture is shoot with the original license plate and the camera is 2 meters away behind.

Distance: 2 meters

Filming Angle: 0^o 0^o

Result: The HyperLPR output "__8BM7_" with a confidence of 98.06% .

Case 1

This picture is shoot with the license plate with light spots and the camera is 2 meters away behind.

Distance: 2 meters

Filming Angle: 0^o 0^o

Result: The HyperLPR output "__82M7_" with a confidence of 86.93%.

Case 2

This picture is shoot with the license plate with light spots and the camera is 5 meters away behind, with 30^o filming angle.

Distance: 3 meters

Filming Angle: 0^o 30^o

Result：The HyperLPR output "__82M7_" with a confidence of 85.91%.

Case 3

This picture is shoot with the license plate with light spots and the camera is 3 meters away behind, with 30^o filming angle.

Distance: 3 meters

Filming Angle: 0^o 30^o

Result: The HyperLPR output "__82M7_" with a confidence of 86.35%.

Case 4

This picture is shoot with the license plate with light spots and the camera is 1 meters away behind, with 15^o filming angle.

Distance: 2 meters

Filming Angle: 45^o 15^o

Result: The HyperLPR output "__82M7_" with a confidence of 90.92%.

Case 5

This picture is shoot with the license plate with light spots and the camera is 1 meters away behind, with 0^o filming angle.

Distance: 2 meters

Filming Angle: 45^o 0^o

Result: The HyperLPR output "__82M7_" with a confidence of 91.40%.

Case 6

This picture is shoot with the license plate with light spots and the camera is 1 meters away behind, with 15^o filming angle.

Distance: 2 meters

Filming Angle: 45^o 15^o

Result: The HyperLPR output "__82M7_" with a confidence of 87.64%.