We lifted 4 functions out of this paper's own repositories and ran 1 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.
| Repository | Role | Ran |
|---|---|---|
| wi-pi/stochastic-preprocessing-defenses | canonical | 1 of 4 |
| Function | Status | Where it lives |
|---|---|---|
| SparseResNet50 | Ran | wi-pi/stochastic-preprocessing-defenses/src/non_preprocessing/kwta/resnet.py code served (permissive licence) · get_code("25de3285000a1e0d") |
| SparseResNet18 | Not yet run | wi-pi/stochastic-preprocessing-defenses/src/non_preprocessing/kwta/resnet.py code served (permissive licence) · get_code("b78cfacf94944d0d") |
| SparseResNet34 | Not yet run | wi-pi/stochastic-preprocessing-defenses/src/non_preprocessing/kwta/resnet.py code served (permissive licence) · get_code("93f87efea5dcca9e") |
| load | Not yet run | wi-pi/stochastic-preprocessing-defenses/src/non_preprocessing/kwta/visualize.py code served (permissive licence) · get_code("cb5de70d03d67420") |
Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.
Defending against adversarial examples remains an open problem. A common belief is that randomness at inference increases the cost of finding adversarial inputs. An example of such a defense is to apply a random transformation to inputs prior to feeding them to the model. In this paper, we empirically and theoretically investigate such stochastic pre-processing defenses and demonstrate that they are flawed. First, we show that most stochastic defenses are weaker than previously thought; they lack sufficient randomness to withstand even standard attacks like projected gradient descent. This casts doubt on a long-held assumption that stochastic defenses invalidate attacks designed to evade deterministic defenses and force attackers to integrate the Expectation over Transformation (EOT) concept. Second, we show that stochastic defenses confront a trade-off between adversarial robustness and model invariance; they become less effective as the defended model acquires more invariance to their randomization. Future work will need to decouple these two effects. We also discuss implications and guidance for future research.
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2206.09491")
get_code_for_paper("2206.09491")
have("2206.09491")
Connect an agent — have() is free.