Research question
Can a standardised attack suite give reliable robustness numbers without tuning?
Key findings
- AutoAttack, an ensemble of four parameter-free attacks, lowered reported robustness of most defences - Became the standard evaluation behind RobustBench