As they say in the paper: &quot;it is not yet known whether adversarial example generation requires greater control over the image than can be obtained by physically altering the sign&quot; I would be more worried people wearing T-shirts with traffic sign pictures in them.<p>Image recognition might not be the best use of this kind of attack. How about financial data, profiling data etc?  It&#x27;s often possible to alter the less significant digits at will and there is no extra noise.