db9eeb7e678863649bce209842e0d164-Supplemental.pdf

Figure 1: The comparison oftargeted MA with other successful physical-world attacks inhuman perception. 1 Withthepurpose todisguise theattack intoanunavoidable common phenomenon -moirépattern, MA can be regarded as a combination of physical attack and digital attack. It not only has high success rate, but seems more natural compared with common physical attacks in the perspective of the probability to catch people's attention. In this view, the distortion of morié pattern is reasonable and rational for humaneyesandperception. We strictly follow the same procedure in our simulation of moiré pattern. Our generated images are also consistent with the ones in the literature [5, 3]. Step 6isthe inverse process of step 4which recovers the data toanormal image.