- Betghelab and Google Brain employees can participate but are ineligible for prizes
- participants are required to release the code of their submissions as open source to be eligible for the final scoring
- any legitimate input that is not classified by a model will be counted as an adversarial
- if an attack fails to produce an adversarial, we will register a worst-case adversarial instead
- all classifiers must be stateless and act on one image at a time
- the decision of each classifier must be deterministic
- attacks are allowed to query the model on self-defined inputs up to 1.000 times / sample
- each model has to process one image within 40ms on a K80 GPU (excluding initialization and setup which may take up to 100s)
- each attack has to process a batch of 10 images within 900s on a K80 GPU