Evasion & Adversarial Examples

Derive both from what a participant can legally post, not from convention. Restrict the coordinates to the ones they write, size the radius by the postings their own volume supports, and measure the payoff as the decision the forecast moved.

A budget-exhausted run bounds the spend, not the model: at this price per call, this sample count per direction and this many steps, no evasion was reached. It says nothing about a better-funded adversary.

It bounds failed attempts against one identity, not decisions in total. A walk that stays on the accepted side spends most of its calls on accepts, and attempts can often be spread across identities, sessions and devices, so the counter caps far less than it appears to.

It depends on whether the adversary can choose that angle. If they control how the item is presented, one repeatable pose is a real finding. Report covered area, every condition tested, trials per condition, and control runs.

It is not telling you how many of those files still worked. A benign verdict counts as evasion only if the artefact still runs, so the report also needs the functional pass rate, the test bar and the edit budget.

A matched stand-in for free. An attacker who downloads the same public base holds most of the representation your fine-tune kept, so their crafted inputs agree with your boundary far more often.

Fitting a stand-in is one up-front query cost amortised over every later attack; probing per input pays again each time. With many inputs to land, the fixed cost wins — unless the target is retrained before it pays back.

Success alone is not a finding. State the access granted, the optimisation steps and restarts per unit, the time that implies, the fixed allowance, and a same-size random-change baseline that should be near zero.

As a confirmed result against the offline weight file and a weak one against the deployed path. A minimised change sits essentially on the boundary with nothing to spare, so any resampling, codec or capture difference pushes it back - the flakiness is the formulation, not a bad test.

Ask what the 41% is over: whether the evaluated listings were held out from the fitting sample, which slice of the population they came from, the flip rate with no edit applied, and the edit's size and plausibility.

Probes whose effect falls below the rounding step return the same printed number, so the difference is zero and that paid sample bought nothing. The attacker must probe harder or buy more samples, which raises the bill.

No. A capture-setting change moved the transformation distribution the attacker fitted against; it did not change the model's behaviour. It was not chosen as a control, nobody monitors it, the fleet is not uniform, and the next vendor update can revert it.

Decide whether the ball they chose describes any attacker your deployment faces. A fully stated budget is still their assumption about who the adversary is, in their units, over coordinates your attacker may not be able to write.

Say the control is real but the claim is wrong. A bare decision removes the attacks that need numbers and multiplies the calls the rest need; it does not make an accepted adversarial input infeasible. Restate it as a cost control, name the limit that binds the survivor, and test that.