A $100 Wheel Rim Can Fool Licence Plate Readers — and May Be Perfectly Legal

A team of researchers has built a wheel rim costing less than $100 that cuts the accuracy of automatic licence plate recognition systems by 60% — and argues the device is street-legal.

The paper, published on ArXiv in April 2025, introduces the Street-legal Physical Adversarial Rim (SPAR), a white-box attack targeting fast-alpr, a widely used open-source ALPR system. The work is notable not only for its technical results but for its explicit focus on two questions that most adversarial-ML research sidesteps: can an attack be built cheaply by a low-resourced actor, and is it actually legal to deploy?

How SPAR Disrupts Plate Readers Without Touching the Plate

ALPR systems work by photographing passing vehicles and running the images through optical character recognition to extract licence plate numbers. Most previous adversarial attacks on these systems involved modifying the plate itself — adding stickers, printed patterns, or infrared LEDs. That approach carries an obvious legal problem: deliberately obscuring or altering a licence plate is illegal in virtually every jurisdiction.

SPAR takes a different route. The adversarial pattern is applied to the wheel rim, which sits adjacent to the plate in a vehicle's camera profile. The researchers argue that because the rim itself is not a licence plate, Texas law — which the paper analyses in detail — does not prohibit mounting a custom-patterned rim, even one designed to confuse machine-vision systems.

Under optimal conditions, SPAR reduces ALPR accuracy by 60% and achieves an 18% targeted impersonation rate — at a materials cost of under $100.

The attack is classified as a white-box method, meaning the researchers had full access to the target model's architecture and weights during the design phase. However, critically, SPAR requires no access to ALPR infrastructure at the time of deployment — the attacker simply drives past a camera with the rim fitted. This lowers the operational barrier considerably compared with attacks that require jamming hardware or network access.

Built Entirely by AI Coding Assistants

One of the more striking details in the paper is its disclosure that SPAR was implemented entirely by commercial agentic coding assistants — AI tools that can write, test, and iterate on code autonomously. The researchers frame this as evidence that the barrier to mounting sophisticated adversarial attacks is falling. An actor without deep expertise in computer vision or machine learning can, according to the paper, outsource much of the technical implementation to off-the-shelf AI tools.

This finding sits alongside a growing body of work documenting how generative AI is compressing the skill gap in offensive security research. The authors do not name which coding assistants were used.

What the 60% Figure Actually Means

The headline accuracy reduction of 60% is reported under what the authors describe as "optimal conditions" — the precise meaning of which is not fully elaborated in the abstract. Readers should note that these results are self-reported by the research team and have not yet undergone peer review, as is standard for ArXiv preprints. Real-world performance is likely to vary based on camera angle, vehicle speed, lighting, and the specific ALPR deployment.

The 18% targeted impersonation rate is arguably the more significant number. It means that in roughly one in five attempts under favourable conditions, the system misreads the vehicle's plate as a specific other plate chosen by the attacker — enabling, in theory, a vehicle to be misidentified as belonging to a different registered owner.

Fast-alpr, the targeted system, is open-source and widely deployed. The researchers note that attacking a closed, proprietary ALPR system — such as those operated by law enforcement agencies — would require a black-box approach, which is generally harder. The paper's scope is therefore limited to open-source systems, though the authors suggest the findings point toward broader vulnerabilities.

The Legal Argument and Its Limits

The paper's legal analysis focuses specifically on Texas state law, examining prior legislation and case law to argue that a custom rim — even a deliberately adversarial one — does not constitute an illegal modification to a licence plate. The authors are careful to frame this as an argument, not a legal guarantee. The analysis has not been tested in court, and laws governing vehicle appearance vary significantly across US states and internationally.

The legal question matters for threat modelling. If SPAR or a similar device were ruled street-legal, it would mean low-cost evasion of ALPR surveillance is available to anyone willing to fit a custom rim — no criminal modification required. That changes the risk calculus for both law enforcement agencies and the operators of private ALPR networks, which are used extensively in parking enforcement, toll collection, and retail loss prevention.

What This Means

Automated licence plate recognition is foundational infrastructure for vehicle tracking in both public and private contexts, and SPAR demonstrates that a sub-$100 component — assembled with AI tools and potentially legal to use — can meaningfully degrade its reliability, pressuring operators to rethink how resilient their systems truly are.