A real-world attack on VGG16, using a physical patch generated by the white-box ensemble method described in the Adversarial Patch paper: http://arxiv.org/abs/1712.09665 Our adversarial patch is more effective than a picture of a real toaster, even when the patch is significantly smaller than the toaster.