Common modifications include:(i)tuning attack parameters (e.g., number ofsteps),(ii)replacing network components to simplify the attack (e.g., removing randomization or non-differentiable components), and(iii) replacing the loss function optimized by the attack.

Deep learning sometimes appears to work in unexpected ways.

In many scenarios, this failure can be attributed to obscuring the crucial interplay between the training algorithm and the underlying data distribution.