NDSS Symposium 2027
Clemson University
TL;DR A few small scratches on a camera's protective cover can make AI models misjudge how far away a car is. The scratches barely matter until a headlight or a glint of sunlight shines through them.
Physical adversarial attacks on vision systems are typically studied via scene manipulation, such as adversarial patches or projections, where the adversary controls what the camera observes at capture time. A smaller body of work has examined camera-side manipulations, such as camera stickers and auxiliary optics, which introduce consistent artifacts in the captured image. However, these approaches treat the attack as an image-space perturbation produced by designed transmissive patterns, without explicitly modeling how physical imperfections interact with scene-dependent lighting and optics. In contrast, we identify a distinct and underexplored threat: passive lens-side damage that is persistent yet trigger-conditioned, producing scene-dependent optical artifacts that bias geometric inference.
We instantiate this threat through Scratch-induced Lens Adversarial Streak Hijacking (SLASH), a physical-world attack caused by small scratches on a camera lens or protective cover. These scratches interact with bright point-like light sources and specular reflections to generate structured optical artifacts that systematically distort depth cues. Crucially, the perturbation is fixed in the optical path but conditionally triggered by the scene, making it both persistent and selective. To capture this behavior, we formulate the attack in optical space rather than pixel space, modeling the scratch pattern as a trigger-conditioned optical channel, and using the same scratch pattern across diverse viewing conditions. We evaluate SLASH in both digital and real-world settings on monocular depth estimation and monocular 3D object detection. On the nuScenes dataset, SLASH causes monocular depth models to estimate target vehicles as up to 32% closer to the camera or 36% farther away, with consistent effects extending to monocular 3D object detection. Physical experiments with both acrylic and glass covers confirm that the attack produces substantial depth errors on real camera inputs. These findings reveal a new attack surface in which benign-looking hardware imperfections act as latent, scene-triggered adversarial mechanisms, challenging existing assumptions about physical robustness and highlighting the need to account for optical-path perturbations in secure vision system design.
We put two identical cameras on top of each other, one behind a clean cover and one behind a scratched cover, and filmed a car driving toward them. Drag either slider to compare the two cameras. The camera image and the depth map predicted by the md4all model move together.
Camera image
Predicted depth
Real frames captured at the same moment by the two cameras, which sit about 3 cm apart, so their views differ slightly. The streaks around the headlights (night) and the sunlit car body (day) come from the scratches, and the predicted depth around the car changes with them.
The attacker only needs brief, unsupervised access to the camera, for example while the car is parked or being serviced. After that, the attacker never has to come back.
On a computer, the attacker works out where to put a couple of straight scratches so that their streaks will fool the depth model.
The attacker scratches the camera lens or its protective cover.
The scratch stays in place. The attacker never comes back and never touches the car's software or AI model.
When light from another car, such as its headlights or sunlight reflecting off its body, hits the scratch from the right angle and distance, a streak can land on that car and change how far away the model thinks it is.
Most physical attacks change what the camera sees: a patch placed in the scene, a projector, or a laser. A few recent attacks change the camera itself by putting a printed sticker or an extra piece of optics on the lens, but these alter every image the camera takes. Among these kinds of attacks, SLASH is the only one that sits on the camera, needs no attacker afterward, lasts, and only acts when light in the scene sets it off. A scratch looks like ordinary wear, and the streak can pass for ordinary lens flare.
The attacker cannot edit the image directly; they can only choose where to scratch. SLASH therefore searches over scratch placements and uses a model of the camera optics to predict what each placement does to the image.
Each straight scratch is described by two numbers: its angle and its position on the cover. A simple lens model then predicts, for each bright light in the scene, where the streak appears in the image, which way it points, and how long it is.
A lightweight renderer paints a soft streak that brightens the image the way stray light does. Depth models mainly react to where the streak is, which way it points, how big it is, and how much it stands out, so a full physics simulation is not needed.
A scratch cannot be changed once it is made, so SLASH searches for one scratch pattern that works best on average across all frames while the target car moves. The search simply tries candidate scratches and checks the model's predictions.
Judging distance from a single photo is hard, so depth models rely on visual hints such as edges, highlights, shading, and where an object touches the road. A streak lands right on these hints, next to the car whose light caused it. The model cannot tell that the streak comes from the lens rather than the scene, so the streak can sway its judgment of the car's shape and distance.
We tested three models that estimate depth from a single camera (MonoDepth2, md4all, DCPI-Depth) and three that detect cars in 3D from a single camera (FCOS3D, PGD, OVM3D). The attacker chooses whether to make the target car look closer or farther.
nuScenes is a public dataset of real driving recordings. We cannot scratch the cameras that recorded it, so we add simulated streaks to its frames. One scratch pattern shifts the target car's estimated depth across a whole sequence of frames, by day and at night. Random scratches shift it less than optimized ones in every setting. 3D detectors are harder to fool (up to about 9%), but their distance estimates still move in the chosen direction.
The scratch has to be made before the attacker knows which car it will meet. On scenes and cars not used to design the scratch, at a similar distance and angle, it keeps more than half of its effect in 8 of 12 settings, and up to about 90%.
We engraved scratch patterns designed on nuScenes onto acrylic and glass covers, without adjusting them for our test site. The scratched camera's estimate of the car's distance differed from the clean camera's by about 4.7 m by day and 7.0 m at night, roughly the same meter-level range as earlier real-world attacks on depth estimation (a rough comparison, not a head-to-head test). At night with the car's lights off, the same scratched cover changed the estimate by less than 2% on average.
We tried three kinds of defense. None of them stops SLASH in our tests.
Existing networks that remove lens flare from images cut the daytime effect by more than half, but barely weaken it at night (a 23% shift only drops to about 20%). One of them also erases real headlights and a nearby lamp.
Common image enhancement that a driving system might already use does not remove the effect and can even make it stronger.
Even after the model is retrained on images with simulated streaks, the attacker can design a new scratch that fools it again.
A real fix likely needs to check the camera's lens and cover themselves, not just the images or depth estimates they lead to.
@inproceedings{he2027slash,
title = {Scratched Lenses, Shifted Depth: Passive Camera-Side Optical Attacks},
author = {He, Qinlin and Zhuang, Zeming and Wu, Yongji and Zhang, Lan and Yuan, Xiaoyong},
booktitle = {Network and Distributed System Security (NDSS) Symposium},
year = {2027},
doi = {10.14722/ndss.2027.231849}
}