A model that reads cameras, microphones or other sensors can be attacked by anyone who can change what those sensors see, without touching a single server. MITRE ATLAS AML.T0041 Physical Environment Access covers adversaries who influence a model through access to wherever its real-world data is collected, so that attacks designed for digital inputs can be carried out in modified form in the physical world. ATLAS places it in the AI Model Access tactic (AML.TA0000), rates it Demonstrated, and lists it for predictive, generative and agentic AI. This page is for owners of vision, biometric, robotics, vehicle and industrial AI systems. It covers the physical access path itself: where the collection points are, which ATLAS cases show the pattern, and the site, sensor and model controls that reduce exposure. How adversarial perturbations are crafted, and model-side robustness in depth, are covered in the Adversarial Examples and Evasion Attacks Guide.
Key takeaways
- The scene is an input channel. Anything in a camera's field of view, or in range of a microphone or lidar, is untrusted input to the model, just like an API request.
- Physical attacks have been shown to work outside the lab. Researchers reported stickers on a real stop sign causing targeted misclassification in 84.8% of video frames captured from a moving vehicle.
- Physical access often completes a digital attack. In ATLAS AML.CS0013, a backdoor placed in mobile app models needed only a visual trigger in front of the phone camera at inference time.
- One sensor is one point of failure. ATLAS AML.M0009 Predictive AI Multi-Sensor Fusion recommends independent sensors across modalities so manipulating one cannot steer the decision.
- Physical security controls apply to AI too. NIST SP 800-53 PE-3, PE-6 and PE-18 and ISO/IEC 27001:2022 Annex A.7 cover access to and placement of the sensing equipment.
What ATLAS says, and where the access sits
ATLAS describes the technique simply: if the model interacts with data collected from the real world, the adversary can influence it through access to wherever that data is collected, and by modifying data in the collection process can carry out modified versions of digital attacks. In practice AML.T0041 is the delivery step. The attacker usually prepares something first, typically with AML.T0043 Craft Adversarial Data or the physical artefacts in AML.T0008.003 Physical Countermeasures (ATLAS names printed stickers or T-shirts, disguises, decoys, and tools such as laser pointers or light bulbs that disrupt sensors), then uses physical access to put it in front of the sensor. The usual goal is AML.T0015 Evade AI Model.
| Collection point | Example AI systems | What an attacker with physical access can change |
|---|---|---|
| Scene in front of a camera | Face identification, access control, retail and safety analytics | Worn or held patterns, disguises, objects placed in view |
| Road and roadside | Driver assistance, autonomous vehicles, traffic cameras | Stickers on signs, markings on the road surface, displays in view of a camera |
| Sensor itself | Cameras, lidar, microphones on robots, drones and vehicles | Light or laser directed at the sensor, obstruction, re-aiming, physical tampering |
| Capture device used for identity checks | Biometric enrolment and liveness checks | Presentation of masks, prints or screens to the camera |
| Industrial and environmental sensors | Predictive maintenance, quality inspection, process control models | Altered conditions around the sensor, substituted parts or samples |
Two adjacent cases are not AML.T0041. Feeding synthetic frames into the video pipeline in software (camera hijacking or virtual cameras) is an injection attack on the capture path; see the Biometric Injection Attacks guide. Presentation attacks on biometrics are covered in the Biometric Liveness and Presentation Attack Detection Guide.
Cases and research
- Face Identification System Evasion via Physical Countermeasures (AML.CS0012): MITRE's AI Red Team gathered open data, built a proxy model, optimised an adversarial patch against it using expectation over transformation, printed the patch and placed it in the physical environment. Using a valid account on the commercial service's inference API, the team confirmed targeted misclassifications. The exercise shows the full chain: digital preparation, then physical delivery.
- Backdoor Attack on Deep Learning Models in Mobile Apps (AML.CS0013): Microsoft Research's DeepPayload work injected a trigger detector and conditional logic into compiled models taken from Android apps. The paper reports 54 vulnerable apps on Google Play, including cash recognition, parental control, face authentication and financial apps, a 93.5% trigger success rate, under 2 ms added latency and no more than a 1.4% accuracy drop. Once the tampered model is installed, ATLAS notes that only physical environment access is needed to fire the backdoor.
- Road sign stickers (research, 2018): Eykholt and colleagues' Robust Physical Perturbations (RP2) used black and white stickers on a real stop sign and reported targeted misclassification in 100% of lab images and 84.8% of frames from a moving vehicle.
- Driver assistance (Tencent Keen Security Lab, March 2019): small stickers on the ground at an intersection were read by a production car's lane recognition as a continuation of its lane, and in Autosteer mode the car followed the false lane towards the opposing lane. An image shown on a display in view of the fisheye camera triggered the automatic wipers. The researchers concluded the steering decision relied only on camera-based lane recognition.
- Laser light (research, 2021): the Adversarial Laser Beam (AdvLB) work used a handheld 5 mW laser pointer on target objects and reported 100% success indoors and 77.43% outdoors against an image classifier, with training augmentation only partly reducing it.
Controls
ATLAS maps one mitigation directly to AML.T0041: AML.M0009 Predictive AI Multi-Sensor Fusion, which recommends independent sensors, ideally across multiple modalities or perspectives (visible and infrared cameras, depth sensors, radar, lidar, microphones), with observations corroborated so manipulation of one source does not dominate the prediction. The practical controls fall into four layers.
| Layer | Control | Notes |
|---|---|---|
| Site | Restrict and monitor physical access to sensors and the area they observe where you own it | NIST SP 800-53 PE-3 and PE-6; not possible on public roads, so other layers carry more weight there |
| Sensor placement | Mount sensors out of reach, use tamper-evident housings, record expected position and field of view | PE-18 Location of System Components; ISO/IEC 27001:2022 A.7.8 Equipment siting and protection |
| Sensor health | Detect obstruction, glare, re-aiming, sudden scene change and out-of-range readings; fail safe when a sensor is degraded | Treat a blinded or saturated sensor as a security event, not only a fault |
| Redundancy | Multi-sensor fusion across modalities and viewpoints; cross-check against maps, prior state or a second system | AML.M0009; the Keen Lab finding shows the risk of a single camera driving a decision |
| Model | Robustness training with physical transformations, adversarial input detection | AML.M0003 Predictive AI Model Hardening, AML.M0015 Predictive AI Adversarial Input Detection; details in the evasion guide |
| Model integrity on device | Verify model files on edge and mobile devices before load | Stops the AML.CS0013 pattern where a tampered model waits for a physical trigger; AML.M0014 Verify AI Artifacts, SI-7 |
| Decision design | Human confirmation or a second factor for high-impact decisions made on sensor input | For example, door release on face match plus badge |
Choosing controls by deployment
- Controlled sites (offices, plants, warehouses): physical access control and camera placement do most of the work. Add sensor health monitoring and a second factor for access decisions.
- Public spaces and roads: you cannot control the scene. Invest in multi-sensor fusion, plausibility checks against maps or prior state, and safe degradation when inputs disagree.
- Consumer and mobile devices: the attacker may own the device. Protect model integrity on the device and keep high-impact decisions server-side where possible.
- Robots and agents acting in the world: a misread scene becomes a physical action. Limit what the system can do on perception alone, require confirmation for irreversible actions, and give the robot's identity and permissions the same scrutiny as any agent; see the Embodied AI Agent Identity guide.
What to detect and where
| Signal | Source | Why it matters |
|---|---|---|
| Sensor obstruction, saturation, glare or loss of focus | Device diagnostics, image quality metrics | Laser or light attacks and blinding |
| Field of view or mounting change | Scene baseline comparison, tamper switches | Re-aimed or replaced sensors |
| Disagreement between sensors or modalities | Fusion layer logs | One input being manipulated |
| Confident predictions on unusual inputs, or repeated near-threshold results at one location | Model inference logs with location and time | Probing with physical patterns |
| Unexpected model file hash on an edge or mobile device | Device attestation, integrity checks | Tampered model waiting for a trigger |
| Physical access events near sensors | Access control logs, CCTV | Placement of patches, stickers or devices |
How to test
- Map collection points: list every sensor feeding a model, who can physically reach it and the scene it observes, and what decision the model drives.
- Rank by consequence: start with sensors that drive physical actions, access decisions or safety functions.
- Commission authorised physical red teaming: printed patterns, objects in the scene and light interference, under controlled conditions and with safety measures for any moving system.
- Test sensor health detection: obstruct, blind and re-aim sensors and confirm alerts fire and the system degrades safely.
- Test fusion: manipulate one modality and confirm the decision does not follow it alone.
- Retest after model updates: robustness can change with every retrain.
Metrics
- Coverage: percentage of AI-connected sensors with a recorded owner, location, field of view and physical protection level.
- Single-sensor decisions: number of high-impact decisions that depend on one sensor or modality (target: falling to zero).
- Tamper detection time: time from obstruction or re-aiming in a test to alert.
- Physical red team results: success rate of authorised physical tests per system, tracked across model versions.
- Edge model integrity: percentage of devices verifying model files at load.
Framework mapping
| Framework | Item | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0041 Physical Environment Access (AML.TA0000 AI Model Access); with AML.T0008.003, AML.T0043, AML.T0015 | The technique and its usual chain |
| MITRE ATLAS mitigations | AML.M0009, AML.M0003, AML.M0015, AML.M0014 | Sensor fusion, robustness, detection, integrity |
| NIST SP 800-53 Rev. 5 | PE-3, PE-6, PE-18, PE-20, SI-7 | Physical access, monitoring, placement, asset tracking, integrity |
| NIST CSF 2.0 | PR.AA-06, DE.CM-02 | Physical access managed; physical environment monitored |
| ISO/IEC 27001:2022 Annex A | A.7.2 Physical entry, A.7.4 Physical security monitoring, A.7.8 Equipment siting and protection | Site and equipment controls |
| ISO/IEC 30107-3:2023 | Biometric presentation attack detection testing | Where the sensor is a biometric capture device |
Common failure patterns
- Treating sensor faults as reliability issues only. A blinded camera is logged and ignored rather than investigated.
- One camera, one decision. The Keen Lab lane result shows how a single modality can steer an action.
- Testing robustness only digitally. Printing, lighting and viewing angle change results; physical tests are needed.
- Trusting on-device models without integrity checks. AML.CS0013 relies on a modified model that behaves normally until the trigger appears.
- Forgetting the observed area. Physical security covers the sensor housing but not the scene it watches.
Practitioner checklist
- Inventory every sensor that feeds a model, with location, reach and the decision it drives.
- Protect sensor mounts and housings and record expected field of view.
- Monitor sensor health and treat obstruction, glare and re-aiming as security events.
- Use multi-sensor fusion for high-impact decisions and alert on disagreement.
- Require a second factor or human confirmation where a misread input causes harm.
- Verify model files on edge and mobile devices before loading.
- Run authorised physical red team tests and repeat them after retraining.
Standards and references
- MITRE ATLAS: Physical Environment Access (AML.T0041)
- MITRE ATLAS: Face Identification System Evasion via Physical Countermeasures (AML.CS0012)
- MITRE ATLAS: Predictive AI Multi-Sensor Fusion (AML.M0009)
- NIST: AI 100-2 E2025, Adversarial Machine Learning taxonomy
- arXiv: DeepPayload, black-box backdoor attack on deep learning models
- arXiv: Robust Physical-World Attacks on Deep Learning Models
- Tencent Keen Security Lab: Experimental Security Research of Tesla Autopilot
- ISO: ISO/IEC 30107-3:2023 Biometric presentation attack detection, testing and reporting
Related NHI Mgmt Group resources: Robotics Security Guide · Connected and Autonomous Vehicle Security Guide · Physical Security Guide for Security Teams · MITRE ATLAS Guide