Effectiveness of the I-FGSM attack in the digital domain, reported as average ASR and PSNR over 20 test images. PSNR is computed within the license plate region using a masking approach.