Research question
Why do so many published defences fail under adaptive attack?
Key findings
- Seven of nine ICLR 2018 defences relied on gradient masking and were fully broken - BPDA and EOT techniques recover usable gradients through obfuscation
Obfuscated Gradients Give a False Sense of Security
Broke most of a year's published defences by showing they merely obscured gradients, establishing adaptive evaluation as the discipline's central methodological requirement.
Contribute
Spot an error, or know a record we should add? Members can propose additions and submit corrections.