Your printed patch suppressed the checkout detector at 1 of 12 approach angles — is that a finding, and what do you report?
answer
- the number is not what decides it
- who gets to choose the condition?
- an adversary does not average over poses
- go back and repeat at that pose
- the denominator and the control are the result
basics
~20 sIt depends on whether the adversary can choose that angle. If they control how the item is presented, one repeatable pose is a real finding. Report covered area, every condition tested, trials per condition, and control runs.
solid answer
~50 sThe number alone does not decide it — who picks the condition does. A shoplifter or an insider controls how they present an item to a fixed camera, so one angle that works **repeatably** is a capability, not a fluke, and 1 in 12 conditions is a normal shape for a physical result. What would make it noise is irreproducibility: one success in twelve single trials, never recovered at that same pose. So before reporting, run that condition many times and see whether it holds. Then report the artefact's covered area as a fraction of the item's face, every distance and angle tested with trials and successes per cell, unmodified control passes at the same poses, and the camera configuration you tested against — including that you tested a unit you bought rather than the deployed one, whose mount height, resolution and threshold may differ. A single photograph proves the pose, not the deployment.
code
text · 9 linesapproach angle standoff trials suppressed covered area
head-on 1.2 m 12 0/12 18% of face
left 30 deg 1.2 m 12 1/12 18% of face
left 30 deg 0.8 m 12 9/12 18% of face
right 30 deg 1.2 m 12 0/12 18% of face
... (8 further angle/distance conditions, 0/12 each)
control, unmodified item, all conditions: 0/60 suppressed
camera under test: equivalent unit, bench mount (deployed mount height not matched)go deeper
Understand that a physical attack result describes the exact conditions it was run under, and that a single successful photograph is not evidence about a whole deployment.
Be able to say what a comparable physical report contains: covered area, every distance and angle tested, trials and successes per condition, and control passes without the artefact.
Show the triage judgment — ask whether the adversary chooses the condition, repeat at the working pose, subtract the baseline miss rate, and state that the tested camera is not the deployed configuration.
The call to own is what your organisation accepts as a physical-evasion finding at all: set the evidence bar once, so a reproducible single-pose result is not dismissed and a lucky frame is not funded.
## What one success actually proves A physical evasion result is a statement about a **condition**, not about a system. A patch that suppressed the report once at one angle establishes that at that pose, that distance, that lighting, with that camera, the object was not reported. Everything beyond that is inference, and the inference cuts both ways: it is neither proof of a blind deployment nor proof that the attack is unreal. So the triage question is not "is 1 in 12 a big number". It is two narrower questions. ## Question one: can the adversary choose the condition? This is the one people miss. A defence evaluated over random conditions gets to average over them. An **adversary does not have to average** — they pick. In a checkout lane the person controls how the item is oriented, how close they hold it, how fast it moves. If your one working angle is one a human can adopt without looking strange, then the effective success rate is not 1 in 12; it is whatever the rate is *at that pose*, which is what you must go and measure. Conversely, if the working condition is a pose nobody can produce naturally — an odd tilt at an unusual height — the attacker's real constraint is now plausibility, and that belongs in the report as prominently as the success rate. ## Question two: does it reproduce at that pose? One success out of twelve one-shot conditions can easily be a coincidence, especially against a payoff that is a *miss* — detectors already miss things. The cheap discriminator is repetition: go back to the working condition and run many trials there. This is also why the **control run** is not optional for a suppression finding. If the unmodified item is reported on only some passes at that pose, part of your success is the baseline miss rate, and subtracting it may leave nothing. A finding whose effect size is inside the baseline is not a finding. ## What the report has to contain A physical evasion result is comparable only when it carries its conditions: - **Covered area** as a fraction of the item's visible face, with the standoff distance it was measured at. - **Every condition tested** — distances and approach angles — not only the ones that worked. The denominator is part of the result. - **Trials and successes per condition**, so a reader can see how thin each cell is. - **Control passes** with the unmodified item at the same conditions. - **The camera configuration** you tested: mount height and angle, resolution, and the fact that you tested an identical unit you obtained yourself rather than the deployed one. The deployed configuration may differ in mount, resolution or reporting threshold, and that is a stated limitation, not a footnote. Without the denominator and the control, a reader cannot tell a capability from a lucky frame — and neither can you. ## The verdict you write Something like: at one approach angle, reproducibly, an artefact covering a modest fraction of the item's face prevented the object from being reported, while unmodified passes at the same pose were reported reliably; the remaining eleven conditions showed no effect; the tested camera was an equivalent unit, not the deployed one. That is honest, actionable, and it does not overclaim. What you must not write is "the detector can be defeated by a printed patch", supported by one photograph. The direction of that claim is wrong: a single success bounds what happened at a pose, and everything else is a question you did not test.
- Why does it matter that you tested a unit you bought rather than the deployed one?Because the thing you measured is that configuration. Mount height and angle, sensor resolution and the reporting threshold all shift which poses are in range, and any of them can move a working condition out of reach or bring a new one in. Report it as a stated limitation so nobody reads your per-angle table as the deployment's numbers.
- How would you present this so it is not either dismissed or overclaimed?Lead with the condition and the effect size at that condition, not the headline. State the covered area, the pose, trials and successes there, the control result at the same pose, and the conditions that showed nothing. A reader can then decide whether an adversary could adopt that pose, which is the real risk question.
- The one success never reproduced at the same pose. What now?Then you do not have a finding yet, and saying so is the right call. Report it as an unreproduced observation with the trials behind it, and note the baseline miss rate at that pose — if the detector drops that item occasionally on its own, a single miss with the artefact present is fully explained without the artefact.
saying these in an interview costs you the question
- Averages over poses the adversary gets to choose
- Reports the working condition without the ones that failed
- Skips control passes on the unmodified item
- Treats one photograph as proof the deployment is evadable
- Omits that the tested camera is not the deployed configuration