adaptive attacks

**Adaptive Attacks** are **adversarial attacks specifically designed to overcome a particular defense mechanism** — tailoring the attack strategy to exploit the defense's specific weaknesses, as opposed to using a generic off-the-shelf attack. **Designing Adaptive Attacks** - **Understand Defense**: Analyze exactly how the defense modifies gradients, inputs, or model behavior. - **Circumvent**: Design the attack to work around the defense mechanism (e.g., bypass gradient masking, defeat input transformations). - **EOT**: Use Expectation Over Transformation for stochastic defenses — average gradients over random defense operations. - **Surrogate Loss**: If the defense breaks gradient flow, design a differentiable surrogate loss. **Why It Matters** - **Defense Evaluation**: Many published defenses are broken by adaptive attacks — "the defense is only as strong as its evaluation." - **Trappola et al.**: Carlini et al. (2019) systematically broke 9 of 13 ICLR defenses using adaptive attacks. - **Best Practice**: All defense papers should evaluate against adaptive attacks, not just standard benchmarks. **Adaptive Attacks** are **custom-crafted attack strategies** — tailored to specific defenses to provide honest evaluation of robustness claims.