Robust Physical-World Attacks on Deep Learning Visual Classification
Date: 2017-07
Affected: Road sign classifiers, LISA-CNN, GTSRB
Attack vector: adversarial-input
Category: research
Severity: Critical

Eykholt et al. (RP2 algorithm) attach black-and-white stickers to real stop signs, causing 100 percent targeted misclassification in lab conditions and 84.8 percent in moving-vehicle video. Canonical physical adversarial attack. CVPR 2018.


Mitigations:

Architectural layers (MAESTRO):