Defending against adversarial examples remains an open problem. A common belief is that randomness at inference increases the cost of finding adversarial inputs. An example of such a defense is to apply a random transformation to inputs prior to feeding them to the model. In this paper, we empirically and theoretically investigate such stochastic pre-processing defenses and demonstrate that they are flawed. First, we show that most stochastic defenses are weaker than previously thought; they lack sufficient randomness to withstand even standard attacks like projected gradient descent. This casts doubt on a long-held assumption that stochastic defenses invalidate attacks designed to evade deterministic defenses and force attackers to integrate the Expectation over Transformation (EOT) concept. Second, we show that stochastic defenses confront a trade-off between adversarial robustness and model invariance; they become less effective as the defended model acquires more invariance to their randomization. Future work will need to decouple these two effects. We also discuss implications and guidance for future research.

翻译：对抗对抗性例子的辩护仍是一个尚未解决的问题。 常见的看法是,随机推论增加了寻找对抗性投入的成本。 这种辩护的一个例子是,在将投入输入模型之前,对投入进行随机转换。 在本文中,我们从经验上和理论上调查这种随机的处理前防御,并证明这些防御存在缺陷。 首先,我们表明,大多数随机防御比以前想象的要弱;它们缺乏足够的随机性来承受甚至像预测的梯度下降那样的标准攻击。 这使人怀疑一种长期持有的假设,即随机防御使旨在逃避确定性防御的进攻无效,并迫使攻击者纳入转型预期(EOT)概念。 其次,我们表明,随机防御在对抗性强力和模式不易变之间面临着一种权衡;随着防御性防御模式变得更弱于随机化。 未来的工作需要消除这两种影响。 我们还讨论了未来研究的影响和指导。