Through the Lens

## The thing the attacker actually built An adversarial perturbation is a **direction**, not noise. It is computed from the gradient of a loss with respect to the *input* (not the weights), and it works because a trained classifier's decision surface is extremely sensitive along a few particular directions and almost insensitive along most others. That is why a structured change far too small to see can flip a confident prediction while **random** noise of the same magnitude essentially never does. The whole effect lives in the precision: which pixels moved, by how much, in which direction, relative to each other. That precision is exactly what a camera does not preserve. ## What sits between the attacker's artefact and the model When the sensor is the only way in — a printed marking presented to a gate reader, a sticker in a scene, a sheet held up to a kiosk — the model never sees the attacker's file. It sees the output of a chain, and every stage is a transformation applied *before* inference: - **Reproduction.** A printer has a limited gamut and prints with halftone dots on a substrate with its own texture and gloss. Values outside the gamut are clipped; sub-dot detail does not exist at all. - **Geometry.** Angle, distance and lens focus rescale, skew and blur the surface. A pattern designed at one pixel scale arrives at another, resampled. - **Illumination.** Colour temperature, shadow, specular highlight and glare shift and locally destroy contrast, differently at each hour of the day. - **Sensor and exposure.** Photon and read noise, auto-exposure, auto white balance and sharpening all alter values before anything is stored. - **Pipeline.** The frame is resized to the model's input resolution and, in most deployed chains, passes through at least one lossy encode/decode step. A resize and a lossy re-encode by themselves act as a low-pass filter with quantisation. A perturbation whose effect is carried by high-frequency, sub-pixel-scale structure is largely gone by the time the tensor exists. ## Why turning the amplitude up is not the answer The intuitive fix — make the perturbation bigger — helps a little and fails for two reasons. First, amplitude does not buy you back structure: blur and resampling remove *spatial detail* regardless of how strong it was, and printing cannot reproduce values it cannot mix. Second, magnitude is bounded by the attack being usable at all — a marking that has been visibly destroyed gets rejected by a human, and on a physical artefact the real constraint was never a small distance budget anyway; it is how much area and viewpoint the attacker controls, and what a person looking at it will accept. The workable approach is different in kind: optimise the artefact so that it works **in expectation over the transformations a real capture applies**, sampling angle, lighting, print reproduction, resize and re-encode during the search rather than solving for one clean tensor. That changes what the artefact looks like — larger, lower-frequency, higher-contrast, spatially redundant — and it changes what you can achieve, because you are now asking one artefact to satisfy many conditions at once. ## The number that matters, and the one that does not This is why "99% success" from a digital evaluation is not evidence about a camera. Those are two different experiments over two different input distributions. Physical results are reported as a **rate over presentations under a named set of conditions** — angles, distances, illumination, camera, capture settings — and they are routinely far below the digital figure for the same attack idea. Each additional condition the artefact must survive costs some of that rate. For a candidate, the takeaway is a habit rather than a fact: when someone shows you a physical evasion result, ask what the model actually received. If the answer is "the perturbed file", the capture chain was never in the experiment, and the claim is about a file, not about a gate.