Gradient Confusion Defense

A defense against black-box score-based query attacks. At test time it rewrites the model's output probability vector, using the model Jacobian as an optimization constraint so that the exposed logit gradient direction is misaligned with the true adversarial loss gradient. This deterministically confuses the attacker's gradient estimation without retraining.