Evading adversarial example detection defenses requires finding adversarial
examples that must simultaneously (a) be misclassified by the model and (b) be
detected as non-adversarial. We find that existing attacks that attempt to
satisfy multiple simultaneous constraints often over-optimize against one
constraint at the cost of satisfying another. We introduce Orthogonal Projected
Gradient Descent, an improved attack technique to generate adversarial examples
that avoids this problem by orthogonalizing the gradients when running standard
gradient-based attacks. We use our technique to evade four state-of-the-art
detection defenses, reducing their accuracy to 0% while maintaining a 0%
detection rate.

本文介绍了一种基于 Orthogonal Projected Gradient Descent 攻击技术的方法，通过正交化梯度来生成对抗样本，以便在同时满足误分类和被检测为非对抗性之间达到更好的平衡，成功地躲避了四种先进的对抗性检测方法，降低其准确度为 0%，而维持着 0% 的检测率。