Some of the sibling comments had questions around purposefully releasing defenses which don’t work. I think Carlini’s (one of the paper authors) post can add some important context: https://nicholas.carlini.com/writing/2024/why-i-attack.html.

TLDR: Once these defenses are broken, all previously protected work is perpetually unprotected, so they are flawed at a foundational level.

Ignoring these arguments and pretending they don’t exist is pretty unethical.