Adversarial Examples (AEs) can deceive Deep Neural Networks (DNNs) and have received
a lot of attention recently. However, majority of the research on AEs is in the digital domain
and the adversarial patches are static, which is very different from many real-world DNN
applications such as Traffic Sign Recognition (TSR) systems in autonomous vehicles. In
TSR systems, object detectors use DNNs to process streaming video in real time. From the
view of object detectors, the traffic signs position and quality of the video are continuously …