Street-Legal Physical-World Adversarial Rim for License Plates

TL;DR

This paper presents SPAR, a physically realizable, street-legal adversarial attack on ALPR systems that significantly reduces accuracy and enables targeted impersonation, highlighting practical vulnerabilities.

Contribution

Introduces SPAR, a novel physical-world adversarial attack on ALPR that is street-legal, cost-effective, and does not require infrastructure access.

Findings

SPAR reduces ALPR accuracy by 60% under optimal conditions.

SPAR achieves an 18% targeted impersonation rate.

SPAR can be produced for under $100.

Abstract

Automatic license plate reader (ALPR) systems are widely deployed to identify and track vehicles. While prior work has demonstrated vulnerabilities in ALPR systems, far less attention has been paid to their legality and physical-world practicality. We investigate whether low-resourced threat actors can engineer a successful adversarial attack against a modern open-source ALPR system. We introduce the Street-legal Physical Adversarial Rim (SPAR), a physically realizable white-box attack against the popular ALPR system fast-alpr. SPAR requires no access to ALPR infrastructure during attack deployment and does not alter or obscure the attacker's license plate. Based on prior legislation and case law, we argue that SPAR is street-legal in the state of Texas. Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate. SPAR can be produced for under $100, and it was implemented entirely by commercial agentic coding assistants. These results highlight practical vulnerabilities in modern ALPR systems under realistic physical-world conditions and suggest new directions for both attack and defense.