INAL, but actually putting adversarial image attacks on real roads is already illegal. If you modify a street sign, and as a result someone dies, that's a fairly easy case of Involuntary manslaughter.

At a minimum, you can't modify street signs. Eg in Washington State:

  RCW 47.36.130
  Meddling with signs prohibited.
  No person shall without lawful authority attempt to or in fact _alter_, deface, injure, knock down, or remove any official traffic control signal, _traffic device_ or railroad sign or signal, or any inscription, shield, or insignia thereon, or any other part thereof.

(Underscore emphasis added). And if you're thinking about not putting it on a sign, but putting it elsewhere visible to cars:

  RCW 46.61.075.1
  Display of unauthorized signs, signals, or markings.
  No person shall place, maintain or display upon or in view of any highway any unauthorized sign, signal, _marking or device_ which purports to be or is an imitation of or resembles an official traffic-control device or railroad sign or signal, or _which attempts to direct the movement of traffic_, or which hides from view or interferes with the effectiveness of an official traffic-control device or any railroad sign or signal.  
  

Where I'm unsure is producing these with the intent or knowledge that they will/could be used by someone to go do this. None of this makes using these for research and experimentation illegal.

Looks like it will be illegal to wear that shirt with the Obama flower image if there is an AI face recognition system installed over the highway though.

None of the things I listed would affect research. Researchers shouldn't be posting these on public highways, and researchers shouldn't be distributing them with the intent to cause harm.

This is naive.

> researchers shouldn't be distributing them with the intent to cause harm

It could be used to cause harm and publishing your work is distributing it (by definition). Similar laws have been (and are) used to target people for unjust reasons.

Defacing street signs is already illegal.

Making various abstract drawings illegal to wear on your clothing (or print on a sticker) is a terrible idea. If the algorithm used by a product can't handle a pedestrian wearing a sweatshirt with an adversarial example on it then that product simply isn't suitable for public use.

It would once the govt gets involved. It's like saying that weapons research is just a free-for-all. The amount of regulation is correlated with the potential harm to society.

Look at drug research. There is plenty of red tape that hinders it. Although, here, the "harm to society" is defined by the nation state.

However, I agree with your proposals in the top-level comment.