A new version of the article in question is out!
Link: Adversarial Policies in Go - Game Viewer
First updated version:
We hardcode a defense for KataGo by making the victim not pass until it has no more legal moves outside its territory. With more training, we are able to find another attack against the victim, achieving a win rate of 99.8%. The adversary gets the victim to form a circular structure and then kills it.
Second updated version:
With 2048 visits, KataGo’s Latest network plays at a superhuman level, but our adversary still achieves a 72.6% win rate.