Examples of attacked images after reprinting and scanning. Each row begins with (a) the original P&S image, followed by adversarial examples generated using: (b) I-FGSM, (c) I-FGSM with EOT, (d) I-FGSM with EOT+P&S, (e) C&W, (f) C&W with EOT, and (g) C&W with EOT+P&S.