Department of Computer Science, University of California, Berkeley, USA. Work partially done while the author was at Google.; ETH Zürich, Zürich, Switzerland.; Google DeepMind, Mountain View, USA.
Chawin Sitawarin, Florian Tramèr, Nicholas Carlini
Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems