Which term describes adversarial examples crafted in the physical world (printed, displayed, or worn) that survive the camera capture process and still fool a classifier?

Why A is correct

Physical adversarial examples are perturbations designed to survive real-world transformations such as printing, lighting changes, and camera angles, yet still fool a classifier. Transferability attacks exploit the fact that perturbations crafted on one model often fool another. Universal perturbations are image-agnostic perturbations that fool any input. Sponge examples are designed to maximally increase inference latency or energy consumption rather than cause misclassification.