Slightly perturbed images cause a municipal license-plate camera model to miss vehicles on a watch list even though humans can still read the plates. What AI-enhanced attack technique is indicated?

Adversarial examples are carefully perturbed inputs—here, slightly altered images—that cause a municipal license-plate computer-vision model to miss watch-list vehicles while humans can still read the plates. The technique targets model decision boundaries at inference time rather than poisoned training data crafted to evade a civic computer-vision model, hidden backdoor trigger crafted to evade a civic computer-vision model, or extracted model copy crafted to evade a civic computer-vision model, so detection fails even when the visual content remains intelligible to people. Poisoned training data crafted to evade a civic computer-vision model is a training-time compromise that alters model weights, not a crafted inference-time perturbation optimized against the model's learned features. Hidden backdoor trigger crafted to evade a civic computer-vision model relies on a secret pattern planted during training that only causes a miss when that trigger appears, not a subtle inference-time perturbation optimized to make known plates miss. Extracted model copy crafted to evade a civic computer-vision model steals functionality to build a replica for offline study and does not itself fool a camera model's inference to miss watch-list vehicles. Exam caveat: when humans can still perceive the object but the model fails due to subtle input tweaks, choose adversarial examples crafted to evade a civic computer-vision model—not poisoned training data crafted to evade a civic computer-vision model, hidden backdoor trigger crafted to evade a civic computer-vision model, or extracted model copy crafted to evade a civic computer-vision model. Operational check: monitor model false-negative rates on known plates, consider secondary sensors or human review for high-risk watch lists, restrict physical access to cameras, and treat sudden unexplained miss spikes as possible adversarial activity worth IR and model-hardening follow-up.