Physical Environment Access
In addition to the attacks that take place purely in the digital domain, adversaries may also exploit the physical environment for their attacks. If the model is interacting with data collected from the real world in some way, the adversary can influence the model through access to wherever the data is being collected. By modifying the data in the collection process, the adversary can perform modified versions of attacks designed for digital access.
> curated attacks (2)
Robust Physical Perturbations on Stop-Sign Classifiers
Carefully computed sticker patterns applied to a physical stop sign cause road-sign classifiers to misread it as a speed-limit sign across viewing angles and distances — a durable, real-world evasion attack.
Evading Face Recognition with Adversarial Eyeglass Frames
Printed adversarial patterns on ordinary eyeglass frames let a wearer evade or impersonate identities to a face-recognition model — a physically realizable attack that dodges or fools identification while looking unremarkable.