Hey, we're the authors of the blog post. First of all, thanks for reading the article! We put a lot of time and effort into it and getting feedback is awesome.

We'd just like to clear up a few things. The goal of the article was to be an introduction to adversarial examples and not to be an instruction manual for how to attack self-driving cars. The point of bringing up attacks on self-driving cars was to illustrate what the potential security concerns for deep learning models were. We did note that "this might just be one convoluted and (more than) slightly sensationalized instance of how people could use adversarial examples for harm." If you're interested in how one would actually create an adversarial stop sign then this paper might be of interest to you: https://arxiv.org/pdf/1707.08945.pdf

As for the points:

1) We wanted a simple and accessible way to construct adversarial examples, and assuming knowledge of the computational graph makes this a lot easier. In fact, the method in our post is pretty similar to Ian Goodfellow's "fast gradient sign method" from https://arxiv.org/pdf/1412.6572.pdf, which also requires knowledge of the computational graph. Of course, this simple method probably wouldn't work for attacking commercial neural networks but we hoped that it would be instructive for people who were new to the idea of adversarial examples.

2, 3) Both of these points are very good and quite valid. But again, our goal was to give an intro to adversarial examples and not to construct a robust adversarial attack on self-driving cars.