Traces for Automatic Exploitation of Adversarial Example Defenses

[Paper on arXiv] [Code on GitHub]

Defense No Attack GPT-4o o1 Sonnet 3.5 + o3 Sonnet 3.5 Sonnet 3.7 (thinking) Sonnet 3.7 Attacked?