Before revision:  Meanwhile, the normal performance of  target DNN model has not been affected . This paper is the first work on the robustness of physical backdoor attacks, and is hopeful for providing guideline for the subsequent physical backdoor works .
After revision:  Meanwhile, the normal performance of target DNN model has not been affected .