Adaptive defenses that use test-time optimization promise to improve robustness to adversarial examples. We categorize such adaptive test-time defenses and explain their potential benefits and drawbacks. In the process, we evaluate some of the latest proposed adaptive defenses (most of them published at peer-reviewed conferences). Unfortunately, none significantly improve upon static models when evaluated appropriately. Some even weaken the underlying static model while simultaneously increasing inference cost. While these results are disappointing, we still believe that adaptive test-time defenses are a promising avenue of research and, as such, we provide recommendations on evaluating such defenses. We go beyond the checklist provided by Carlini et al. (2019) by providing concrete steps that are specific to this type of defense.

我们对自适应防御策略进行了分类并评估了最新的代表性方法，结果表明在图像分类中这些自适应防御策略没有明显的提高静态防御的水平，同时增加了推理计算。然而，我们仍相信自适应的防御策略是一个有前途的研究方向，并提出了具体的研究建议和评估步骤扩展了Carlini等人的清单。

评估自适应测试时间防御的对抗鲁棒性