expectation over transformation

**EOT** (Expectation Over Transformation) is a **technique for attacking models that use stochastic defenses (randomized preprocessing, random dropout, random resizing)** — computing the adversarial gradient as the expectation over the random transformation, averaging gradients from multiple random draws. **How EOT Works** - **Stochastic Defense**: The defense applies a random transformation $T$ at inference: $f(T(x))$ where $T$ is random. - **Attack Gradient**: $ abla_x mathbb{E}_T[L(f(T(x+delta)), y)] approx frac{1}{N}sum_{i=1}^N abla_x L(f(T_i(x+delta)), y)$. - **Average**: Average the gradient over $N$ random draws of the transformation. - **PGD + EOT**: Use the averaged gradient in each PGD step for a robust attack against stochastic defenses. **Why It Matters** - **Breaks Randomized Defenses**: Most randomized defenses are broken by EOT with sufficient samples ($N = 20-100$). - **Physical World**: EOT is essential for physical adversarial examples (patches, glasses) that must work under varying conditions. - **Standard Tool**: EOT is a standard component of adaptive attacks against stochastic defenses. **EOT** is **averaging over randomness** — attacking stochastic defenses by computing expected gradients over the random defense transformations.