Correctly evaluating defenses against adversarial examples has proven to be
extremely difficult. Despite the significant amount of recent work attempting
to design defenses that withstand adaptive attacks, few have succeeded; most
papers that propose defenses are quickly shown to be incorrect.
We believe a large contributing factor is the difficulty of performing
security evaluations. In this paper, we discuss the methodological foundations,
review commonly accepted best practices, and suggest new methods for evaluating
defenses to adversarial examples. We hope that both researchers developing
defenses as well as readers and reviewers who wish to understand the
completeness of an evaluation consider our advice in order to avoid common
pitfalls.

本文介绍了针对对抗样本进行防御的困难性，提出了新的方法来评估防御方法的效果并建议研究者和读者使用这些方法以避免常见陷阱。

评估对抗鲁棒性

On Evaluating Adversarial Robustness

Following the principle of to set one's own spear against one's own shield,
we study how to design adversarial CAPTCHAs in this paper. We first identify
the similarity and difference between adversarial CAPTCHA generation and
existing hot adversarial example (image) generation research. Then, we propose
a framework for text-based and image-based adversarial CAPTCHA generation on
top of state-of-the-art adversarial image generation techniques. Finally, we
design and implement an adversarial CAPTCHA generation and evaluation system,
named aCAPTCHA, which integrates 10 image preprocessing techniques, 9 CAPTCHA
attacks, 4 baseline adversarial CAPTCHA generation methods, and 8 new
adversarial CAPTCHA generation methods. To examine the performance of aCAPTCHA,
extensive security and usability evaluations are conducted. The results
demonstrate that the generated adversarial CAPTCHAs can significantly improve
the security of normal CAPTCHAs while maintaining similar usability. To
facilitate the CAPTCHA security research, we also open source the aCAPTCHA
system, including the source code, trained models, datasets, and the usability
evaluation interfaces.

本研究旨在设计对抗性 CAPTCHA，提高其安全性，同时维持相似的易用性，我们建立了对抗性 CAPTCHA 生成和验证系统，使用了 10 种图像预处理技术，9 种 CAPTCHA 攻击，4 种基线对抗性 CAPTCHA 生成方法，以及 8 种新的对抗性 CAPTCHA 生成方法，并进行扩展的安全性和易用性评估，结果表明，生成的对抗性 CAPTCHA 能够大幅提高普通 CAPTCHA 的安全性，同时保持相似的易用性，我们也开放了 aCAPTCHA 系统源代码、训练模型、数据集和可用性评估界面，以促进 CAPTCHA 安全研究。