Expectation over Transformation (EOT)

Unlike standard attacks that compute a perturbation for a single image, EOT solves an optimization problem over an entire distribution of transformations T. The attacker minimizes the expected loss across sampled transformations:

• Core formula: argmin E_t~T [L(f(t(x + δ)), y)]
• The perturbation δ must fool the classifier regardless of how the input is rotated, scaled, or translated
• This makes the adversarial example robust to real-world variations like camera angle changes or sensor noise

EOT is the foundational technique that enables adversarial examples to transfer from the digital domain into the physical world. By modeling transformations that occur during printing and recapture, EOT-generated perturbations remain effective when:

• Printed on paper and photographed from different angles
• Viewed under varying lighting conditions
• Captured by different camera sensors or resolutions
• Placed on three-dimensional objects subject to viewpoint changes

EOT is the primary engine behind adversarial patch generation. A patch optimized with EOT can reliably fool object detectors regardless of its position, orientation, or scale within a scene:

• The patch is trained to survive affine transformations, color jitter, and noise
• This enables attacks like causing a stop sign to be misclassified as a speed limit sign from any viewing angle
• Defenders must consider EOT when evaluating the robustness of computer vision systems deployed in uncontrolled environments

EOT serves as a critical component in adaptive attack methodologies for rigorously evaluating defenses. When a defense employs randomized preprocessing (e.g., stochastic resizing or JPEG compression), a proper evaluation must:

• Model the defense's randomization as a transformation distribution
• Apply EOT to compute the expectation over that distribution
• Failure to use EOT against randomized defenses leads to gradient masking and a false sense of security
• Standardized benchmarks like AutoAttack incorporate EOT principles for reliable robustness measurement

In financial fraud detection, EOT principles extend to crafting transaction sequences that evade models across feature preprocessing pipelines:

• Fraudsters model the distribution of legitimate transaction timing, amounts, and merchant categories
• Adversarial transactions are optimized to remain effective despite velocity checks, geolocation transformations, or currency conversion rounding
• This connects directly to evasion attacks against real-time fraud scoring pipelines where slight input variations must not break the attack's effectiveness

EOT and randomized smoothing are mathematically dual concepts. While EOT optimizes an adversarial example to survive a distribution of transformations, randomized smoothing constructs a classifier that is provably robust within a certified radius by averaging predictions over noise:

• EOT computes the expected loss over transformations for attack generation
• Randomized smoothing computes the expected prediction over noise for certification
• Understanding this duality is essential for evaluating whether a certified robustness claim holds against an adaptive EOT adversary