The difference is that a human will know it’s been tampered with and lower their confidence: the attacks against NNs make it think with 98% certainty it’s a 60mph sign, not a stop sign. Furthermore, if a human is monitoring the system, a small well-placed sticker will not likely alert them to the fact that the car is in trouble