#gradient-masking

Evaluating Adversarial Robustness Without Fooling Yourself

Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was.