expectation over transformation

EOT (Expectation Over Transformation) is a technique for attacking models that use stochastic defenses (randomized preprocessing, random dropout, random resizing) — computing the adversarial gradient as the expectation over the random transformation, averaging gradients from multiple random draws.

How EOT Works

• Stochastic Defense: The defense applies a random transformation $T$ at inference: $f(T(x))$ where $T$ is random.
• Attack Gradient: $\nabla_x mathbb{E}_T[L(f(T(x+delta)), y)] approx frac{1}{N}sum_{i=1}^N \nabla_x L(f(T_i(x+delta)), y)$.
• Average: Average the gradient over $N$ random draws of the transformation.
• PGD + EOT: Use the averaged gradient in each PGD step for a robust attack against stochastic defenses.

Why It Matters

• Breaks Randomized Defenses: Most randomized defenses are broken by EOT with sufficient samples ($N = 20-100$).
• Physical World: EOT is essential for physical adversarial examples (patches, glasses) that must work under varying conditions.
• Standard Tool: EOT is a standard component of adaptive attacks against stochastic defenses.

EOT is averaging over randomness — attacking stochastic defenses by computing expected gradients over the random defense transformations.