{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/on-the-limitations-of-stochastic-pre","title":"On the Limitations of Stochastic Pre-processing Defenses","arxiv_id":"2206.09491","date":"2022-06-19","proceeding":null,"authors":["Yue Gao","Ilia Shumailov","Kassem Fawaz","Nicolas Papernot"],"abstract":"Defending against adversarial examples remains an open problem. A common belief is that randomness at inference increases the cost of finding adversarial inputs. An example of such a defense is to apply a random transformation to inputs prior to feeding them to the model. In this paper, we empirically and theoretically investigate such stochastic pre-processing defenses and demonstrate that they are flawed. First, we show that most stochastic defenses are weaker than previously thought; they lack sufficient randomness to withstand even standard attacks like projected gradient descent. This casts doubt on a long-held assumption that stochastic defenses invalidate attacks designed to evade deterministic defenses and force attackers to integrate the Expectation over Transformation (EOT) concept. Second, we show that stochastic defenses confront a trade-off between adversarial robustness and model invariance; they become less effective as the defended model acquires more invariance to their randomization. Future work will need to decouple these two effects. We also discuss implications and guidance for future research.","url_abs":"https://arxiv.org/abs/2206.09491v3","url_pdf":"https://arxiv.org/pdf/2206.09491v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"on-the-limitations-of-stochastic-pre","repo_url":"https://github.com/wi-pi/stochastic-preprocessing-defenses","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2206.09491","atlas_url":"https://app.syntology.ai/?focus=2206.09491","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2206.09491"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/wi-pi/stochastic-preprocessing-defenses","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":1,"unverified":3},"by_repo_kind":{"official":{"samples":4,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"25de3285000a1e0d","entry":"SparseResNet50","repo":"wi-pi/stochastic-preprocessing-defenses","repo_kind":"official","path":"src/non_preprocessing/kwta/resnet.py","file_url":"https://github.com/wi-pi/stochastic-preprocessing-defenses/blob/HEAD/src/non_preprocessing/kwta/resnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"25de3285000a1e0d"}},{"code_sha256_prefix":"b78cfacf94944d0d","entry":"SparseResNet18","repo":"wi-pi/stochastic-preprocessing-defenses","repo_kind":"official","path":"src/non_preprocessing/kwta/resnet.py","file_url":"https://github.com/wi-pi/stochastic-preprocessing-defenses/blob/HEAD/src/non_preprocessing/kwta/resnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b78cfacf94944d0d"}},{"code_sha256_prefix":"93f87efea5dcca9e","entry":"SparseResNet34","repo":"wi-pi/stochastic-preprocessing-defenses","repo_kind":"official","path":"src/non_preprocessing/kwta/resnet.py","file_url":"https://github.com/wi-pi/stochastic-preprocessing-defenses/blob/HEAD/src/non_preprocessing/kwta/resnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"93f87efea5dcca9e"}},{"code_sha256_prefix":"cb5de70d03d67420","entry":"load","repo":"wi-pi/stochastic-preprocessing-defenses","repo_kind":"official","path":"src/non_preprocessing/kwta/visualize.py","file_url":"https://github.com/wi-pi/stochastic-preprocessing-defenses/blob/HEAD/src/non_preprocessing/kwta/visualize.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cb5de70d03d67420"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}