when they're generated digitally, it's surprisingly hard to get good robustness against adversarial examples, and people have been working on it for a while. of course you can train to stop any specific input, but then new ones can be created for the newly-trained network.
there are techniques that can prevent this, but you pay a real price in overall performance, which may or may not be worth it.
of course it's harder to make physical objects work, but if somebody did manage to make a method for physical adversarial attacks that worked reliably, I would guess you'd run into the same problems. it's not at all clear that the endgame is that we can easily stop these attacks.
there are techniques that can prevent this, but you pay a real price in overall performance, which may or may not be worth it.
of course it's harder to make physical objects work, but if somebody did manage to make a method for physical adversarial attacks that worked reliably, I would guess you'd run into the same problems. it's not at all clear that the endgame is that we can easily stop these attacks.