Scratched Lenses, Shifted Depth: Passive Camera-Side Optical Attacks

A team of researchers has detailed a new class of physical adversarial attack on camera-based vision systems, showing that small scratches on a lens can be weaponized to distort depth perception and mislead 3D object detectors under specific lighting conditions [1]. The attack, termed Scratch-induced Lens Adversarial Streak Hijacking (SLASH), exploits passive, persistent damage on a camera lens or its protective cover. Unlike prior attacks that manipulate the scene with adversarial patches or projections, SLASH relies on the interaction between a fixed scratch pattern and bright light sources or specular reflections in the environment to create structured streak artifacts that corrupt geometric inference [1][2]. The researchers describe the threat as “persistent yet trigger-conditioned,” meaning the optical flaw remains dormant until activated by a specific visual scenario [2]. In their evaluation, the team tested SLASH against monocular depth estimation and monocular 3D object detection models in both simulated and physical environments. Under a fixed-scratch constraint, the attack induced directional depth shifts reaching a 32% relative error in monocular depth estimation tasks [1][2]. The effects also transferred consistently to monocular 3D object detection, with physical experiments confirming that the induced depth errors exceeded the models’ natural prediction baselines [2]. The work, posted on the arXiv preprint server, broadens the known attack surface for vision systems. Traditional physical adversarial research has focused on scene-side manipulations, such as stickers or auxiliary optics placed in front of the camera, which are treated as image-space perturbations [2]. The SLASH method instead models the scratch as a trigger-conditioned optical channel, optimizing a single fixed configuration to operate across diverse viewing conditions [2]. This approach reveals how benign-looking hardware imperfections can function as latent, scene-triggered adversarial mechanisms [1][2]. Modern smartphones, which integrate multiple cameras and depth sensors for tasks ranging from facial authentication to augmented reality, represent a broad deployment surface for such vulnerabilities [3]. The findings challenge prevailing assumptions about the physical robustness of vision pipelines and underscore the need for defenses that account for optical-path imperfections, not just digital or scene-level manipulations [1][2]. The paper is available through arXiv, an open-access repository that hosts over two million e-prints across physics, computer science, and related fields [9].