[hooloovoo_zoo]

It suffers from the same weakness as most of the other papers I've seen about physical attacks where they interpret a change in most likely class as evidence that this will work for a real classifier. They say "We observe that all such baseline images lead to correct classification in all experiments." and then state that the average predicted target class probability was 0.8 +- 0.1 which suggests to me that they are taking a network which doesn't really know whether the sign is a stop sign but guesses that it is and tricking it into not really knowing what the sign is but guessing that it is a speed limit sign. Presumably a real world system would have much more confidence in the true class for the clean images.