Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Athalye, Anish, Carlini, Nicholas, Wagner, David · arXiv · 2018