You turn an inspection line's input-cleaning stage up until an attacker's perturbations stop landing - what did that buy?

## The dial and its two ends An input-cleaning stage has a strength parameter: how much smoothing, how few bits, how aggressive the re-encode. Turning it up is the obvious response to "the perturbations still get through". It is worth being precise about what each direction of that dial does. **Turning it up destroys structure at a scale.** An adversarial change is bounded by a norm and a radius - say, every pixel may move by a small amount. To reliably destroy such a change, the transform must remove or randomise structure at roughly that amplitude. It has no way to remove only *adversarial* structure of that amplitude, because there is no test it applies to decide what is adversarial; it removes everything at that scale. **Turning it down preserves the signal.** The decision the model makes depends on structure in the input. On an industrial inspection line - pass, reject, re-image - a great deal of the decision-relevant structure is exactly the small, low-contrast kind: a hairline crack, a faint void, a slight discolouration at the edge of tolerance. Those two statements collide. The window in which the transform removes an attacker's change while preserving the defect signal is narrow, and on some parts of your input distribution it does not exist at all. ## Where the bill lands This is the part people miss when they read a single aggregate number. Aggregate accuracy is dominated by clear cases: obviously good parts and obvious defects. A stronger cleaning stage barely touches those, so the headline figure may drop a point or two and look affordable. The loss concentrates on the marginal cases - which are, on an inspection line, precisely the ones the model exists to catch. Two failure directions matter and they are not symmetric: - **defects passing** - a subtle defect smoothed into a good part; the cost is downstream, delayed and expensive; - **good parts re-imaged or rejected** - the cost is throughput, and it is visible immediately, which is why it is the one that gets escalated first. So the honest measurement is per-slice: accuracy by defect type and severity, plus the re-image rate, not one aggregate number. A defence whose cost is invisible in aggregate and concentrated on the rare classes is a defence whose cost you have not measured. ## What it buys against the adversary Something, but less than the dial suggests. A stronger transform does raise the cost of an adaptive attack: the attacker's change must now survive a harsher function, which narrows the set of changes that work and lengthens the search. That is a genuine, reportable cost multiple. What it never becomes is a boundary, and the reason is structural rather than empirical. Whatever content survives the transform is, by definition, the content the model still reads - and the content the model reads is the only content an attacker ever needed to influence. Strengthening the transform shrinks the channel for both parties at once. You cannot shrink it to nothing, because at nothing the model has no signal either. ## How to present it to the people who own the line Not as a setting, as a curve. On one axis, the operational cost you are choosing: re-image rate, and accuracy on the defect classes that matter. On the other, attack success at a fixed norm and radius, measured with the transform *inside* the attacker's optimisation - a number measured against an attacker who ignored the stage tells you nothing about the setting you are choosing. Plot both against strength and let the owner pick a point, having seen that no point has zero of either. The framing that survives scrutiny is: the cleaning stage is a cost control, not a control. It removes attacks that were not built for this pipeline, it charges an adaptive attacker a measured multiple, and it charges you a permanent rate on your hardest parts. If someone wants the worst case changed rather than priced, this dial is not the instrument, and no setting of it will be. ## A trap worth naming If a strengthened stage is validated with a fixed set of adversarial inputs generated once, before the strengthening, it will look excellent - those inputs were fitted to the old pipeline. That evaluation measures the change you made to your own function, not the security of the result. Regenerate the attack against the current pipeline every time you move the dial.