I don't want to totally brush off the security implications, but I think focusing on ways to mitigate this exact "attack" is almost missing the point. You coul

I don't want to totally brush off the security implications, but I think focusing on ways to mitigate this exact "attack" is almost missing the point. You could trivially thwart this attack by rate-limiting--it needs many passes through the network to evolve an image--or by caching the classifier's output and returning it for all similar (e.g., by hamming distance) images. Instead, I think this work is interesting because it shows the limits of the network's generalization abilities.