Physical-World Attacks on Vision
Print the attack, stick it on a sign, photograph it in sun and rain, and the model still misreads it across angles and distances.
Why Does This Exist?
Digital attacks assume the pixels reach the model exactly, but streets add printing, sun, angles, motion blur, and cheap lenses. Most pixel perturbations die at the printer. Physical-world attacks optimize through simulated cameras: render the patch onto signs across viewpoints and lighting during training, print it, and photograph it. What survives is a real hazard for driving and access control, not a file curiosity. Digital parent: patch attacks, under adversarial attacks.
Threat model: the attacker can place printed material in the scene and photograph conditions vary uncontrollably. No incident claims are made here; numbers come from controlled capture rigs described below, and defenses state their own capture conditions before any comparison.
Think of It Like This
A billboard readable from every lane
Advertisers test billboards from near and far lanes, in noon glare and dusk, before paying for print. Attackers test patches across renders of the same variations, then pay for one print that works from many lanes. The analogy stops at intent: billboards seek legibility to everyone, patches seek misreading by one model while staying dull to people.
How It Actually Works
Compose the patch onto scene images with random perspective warps, brightness shifts, blur, and print-color limits during every optimization step, a routine called expectation over transformation. Constrain colors to a printable gamut and add smoothness penalties so ink survives. Evaluate by photographing the print at fixed angle and distance grids, not by screenshots.
Worked example with recomputed numbers
Stop-sign target with a 5 percent patch. Digital-only optimization flips 88 of 100 screenshots but 31 of 100 photos. Retrain with viewpoint plus lighting plus print-color simulation: screenshots read 84, photos read 71 across a grid of 5 angles, 3 distances, and 2 lighting setups, 30 captures per patch. Remove the print-color constraint and photo flips fall to 52 while screenshots stay 84, naming fabrication modeling as the largest single contributor here.
Condition and limit
Requires scene access to place the print and tolerance for a visible artifact: stealth ends where print begins. Weather, dirt, and lens differences remain unmodeled, so reported 71 holds only inside the tested capture grid.
Watch Out For
Reporting screenshot flips as physical results
Screenshot numbers near 88 travel into headlines while photo numbers near 31 stay in appendices, and buyers compare across incomparable rigs. The symptom is two papers claiming opposite strength on the same patch. Demand the capture grid with angles, distances, lighting, and print specs beside every physical claim, per adversarial defenses.
The Quick Version
- Physical attacks optimize through simulated cameras, printers, and viewpoints.
- Photo-accurate training lifts photo flips from 31 to 71 of 100 here.
- Print-color modeling is the biggest contributor in this setup.
- Results hold only inside the tested capture grid of angles and lighting.
- Every claim ships with its rig specs or it is not comparable.