adaptive attacks

A defence that breaks the attacker's tools is not a defence that stops the attacker. The scored answer explains how masking fools gradient attacks, how to spot it, and how adaptive attacks get around it.

Most broken defences were evaluated by their authors. The scored answer pins down the threat model, attacks the defence specifically, runs sanity checks, and reports robust accuracy with the conditions attached.