Expectation over Transformation
EOT (Expectation Over Transformation) is a technique for attacking models that use stochastic defenses (randomized preprocessing, random dropout, random resizing) — computing the adversarial gradient as the expectation over the random transformation, averaging gradients from multiple random draws.
How EOT Works
- Stochastic Defense: The defense applies a random transformation $T$ at inference: $f(T(x))$ where $T$ is random.
- Attack Gradient: $\nabla_x mathbb{E}_T[L(f(T(x+delta)), y)] approx frac{1}{N}sum_{i=1}^N \nabla_x L(f(T_i(x+delta)), y)$.
- Average: Average the gradient over $N$ random draws of the transformation.
- PGD + EOT: Use the averaged gradient in each PGD step for a robust attack against stochastic defenses.
Why It Matters
- Breaks Randomized Defenses: Most randomized defenses are broken by EOT with sufficient samples ($N = 20-100$).
- Physical World: EOT is essential for physical adversarial examples (patches, glasses) that must work under varying conditions.
- Standard Tool: EOT is a standard component of adaptive attacks against stochastic defenses.
EOT is averaging over randomness — attacking stochastic defenses by computing expected gradients over the random defense transformations.