Robustness & Defense Techniques

Because each reading is one draw from a distribution, not the quantity being optimised. The difference an attacker measures between two nearby candidates is swamped by the defence's randomness, so the search follows noise instead of a direction - while the misclassified transactions stay reachable.

Each certified decision costs many forward passes instead of one, plus an abstention rate: calls whose vote margin is too thin to certify get no answer and route to a human agent. Both are operating costs, not evaluation details.

A price, not a wall. Inside the trained radius an attacker pays far more search and far more visible distortion for the same misread; a short step outside, that price collapses. Re-measure and report the curve.

Ask whether the cleaning stage was inside the attacker's optimisation, and what norm, radius, steps and restarts the attack used. If every row was measured against an attacker who ignored the stage, the figure describes that attacker, not the pipeline.

It removes most of the cost the detector was meant to add. Anyone can solve that half offline for free, so only the classifier still charges the attacker, and one solve serves every deployment that bought it.

Anything that adds an unattributable writer, makes the order irreversible, raises what a wrong output pays, or speeds the writer's feedback. The verdict rests on those four facts and expires when any of them changes.

That the authors attack their own defense first and publish what they tried, from what access, at what cost. The burden sits with whoever makes the claim, and the wording must carry those bounds and a date.

Not as a blocking control. With no checkpoint and no endpoint, the figure supports only that ordinary edits are filtered. Require the missing columns contractually, fund an evaluation you run yourself, or deploy it as a review signal.

Not as coverage. You can sign a scoped statement — this model resisted a named attack inside a named per-pixel budget — but you cannot sign that it withstands an attacker at the gate, whose budget is pose and occluded area. State what is unmeasured and name who owns it.

Not on accuracy points alone. Decide it as expected harm per impression, ask who absorbs the clean loss, then record the trigger that would reverse the call and a date to re-measure it.