An attacker prints a patch to fool a fixed store camera — what replaces the perturbation radius as their budget?

## What a budget is for An attack specification exists so that two results can be compared and so that a defender knows what was and was not tested. Digitally that specification is a **norm and a radius**: which way coordinates are allowed to move and how far. An L-infinity constraint lets every coordinate move a little; a sparse constraint lets a few coordinates move a lot; an L-2 constraint bounds the total energy of the change. These describe genuinely different adversaries, and a robustness number quoted without both is quoting nothing. An attacker who prints something and puts it in a lane is outside all of that. There is no original input, so "how far did it move" has no referent. But they are not unconstrained — they are constrained differently, and naming the replacement is what this question is testing. ## The three quantities that replace it **1. Area.** The fraction of the object's visible surface the artefact may occupy, usually stated at a given viewing distance. This is the load-bearing number. A small covered fraction that suppresses or flips a model is a real result; a large one shades into simply presenting something else. Area is also what a defender can reason about — an item whose face is a third covered is an item a person could be asked to look at. **2. Viewpoint.** A range of standoff distances and approach angles, plus how the object is oriented when it enters the frame. The attacker generally does not control the pose exactly: in a checkout lane the item arrives at whatever distance and angle the person happens to use. So the honest specification is a *set* of conditions, and the honest result is a success rate **per condition**, not a single number. A camera mounted overhead sees a narrow band of poses; one mounted at eye level sees another, and a result from one does not transfer to the other. **3. Realisability.** Whatever the artefact is, it has to exist. A printer has a limited gamut and cannot produce light, only reflectance; the material has a finish; the sensor resamples the whole thing at the resolution the mount and lens give it. Patterns that require colours or fine detail outside that envelope are not attacks, they are simulations of attacks. A fourth, softer constraint sits alongside these: the artefact has to look unremarkable to whoever actually inspects the object. That is a social bound, not a measurable one, but it belongs in a report because it decides whether the attack survives contact with a human process. ## Why the substitution matters practically The two budgets are not interchangeable, and reasoning as if they are produces two common errors. The first is quoting a perturbation radius for a physical artefact, as if the printed pattern were a small edit. It is not small in any metric, and asserting a radius for it invents a number. The second is the reverse: taking a defence evaluated under a norm ball and assuming it covers a placed object. It does not, and the reason is structural — a defence tuned to bound small dense changes has no reason to constrain a large localised one. (Where that failure to carry across threat models becomes the subject in its own right, it belongs to the defence-evaluation material, not here.) ## Reading a physical claim Ask for these columns before you believe a physical evasion number: | Column | What its absence hides | |---|---| | Covered area, as a fraction of the object's face | Whether this is evasion or object replacement | | Standoff distances tested | Whether it works at the range the camera actually sees | | Approach angles tested, and trials per angle | Whether one lucky pose is being reported as a capability | | Camera configuration and mount | Whether the tested unit resembles the deployed one | | Control runs without the artefact | Whether the model was going to miss the object anyway | The last row is the one people forget. If the deployed model already misses that item some of the time, part of the reported success is baseline error, not the attack. ## Where this stops The *design* problem of making a printed artefact survive angle, lighting, printing and re-encoding is a separate concern with its own treatment. Here the point is narrower and prior to it: a physical attacker's budget is a geometry statement — area, distance, angle, realisability — and that statement is what a norm and a radius were doing in the digital case.