“…Since the initial discovery of this phenomenon in [SZS∗13], increasingly stronger defenses [GSS14, MMS∗18, XWM∗19, SGI19, KHM19, ZL19, HRF19, ZYJ∗19] and counterattacks [GSS14, CW17, ACW18, MMS∗18, RHO∗19, PMG∗17, CZS∗17, LLW∗19] were proposed in the literature. Adversarial attacks have also been shown to occur in tasks beyond image classification where they were first discovered: in real‐life object recognition [BMR∗17, XZL∗19, AEIK18], object detection [WLW∗19], natural language processing [GLSQ18, CKG19, JJZS19], reinforcement learning [GDK∗19], speech‐to‐text [CW18], and point cloud classification [XQL19], just to mention a few.…”