Controllable morphing spoiler concept is designed and fabricated using flexible matrix composite (FMC) actuators. In the FMC actuated spoiler concept, extensional actuators are embedded under top surface and contracting actuators are integrated under bottom surface to bend the spoiler tip downward. Both FMC actuators are fabricated using a custom designed filament winding system and also with braided sleeves to find appropriate actuator types for the spoiler concept. Three different spoiler prototypes with two actuators are fabricated and tested under different loading conditions to examine their performance capabilities. After analyzing the test results for these prototypes, a final spoiler model with ten FMC actuators is design, fabricated, and evaluated under various testing conditions. The test results show that the final spoiler model performs well under various pseudo aerodynamic loading conditions.

The ability to transfer adversarial attacks from one model (the surrogate) to another model (the victim) has been an issue of concern within the machine learning (ML) community. The ability to successfully evade unseen models represents an uncomfortable level of ease toward implementing attacks. In this work we note that as studied, current transfer attack research has an unrealistic advantage for the attacker: the attacker has the exact same training data as the victim. We present the first study of transferring adversarial attacks focusing on the data available to attacker and victim under imperfect settings without querying the victim, where there is some variable level of overlap in the exact data used or in the classes learned by each model. This threat model is relevant to applications in medicine, malware, and others. Under this new threat model attack success rate is not correlated with data or class overlap in the way one would expect, and varies with dataset. This makes it difficult for attacker and defender to reason about each other and contributes to the broader study of model robustness and security. We remedy this by developing a masked version of Projected Gradient Descent that simulates class disparity, which enables the attacker to reliably estimate a lower-bound on their attack's success.