@inproceedings{onadaptiveattackstoadversarialexample,
  title = {On Adaptive Attacks to Adversarial Example Defenses},
  author = {Florian Tramer and Nicholas Carlini and Wieland Brendel and Aleksander Madry},
  year = {2020},
  booktitle = {NeurIPS 2020 12},
  eprint = {2002.08347},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2002.08347v2},
}