Update README.md

README.md

@@ -36,26 +36,8 @@ NULA explicitly targets robustness to operators that change the sampling structu
 
 ## Problem
 
-Downsampling operations are linear maps from a high-dimensional space to a lower-dimensional one.
-
-By the Rank-Nullity theorem, this matrix has a massive NULL space.
-
-An attacker can exploit this: they utilize the discarded samples of these downsampling operations as extra degrees of freedom. 
-
-By sculpting perturbations with components in the null space of the downsampling operator, they spread energy across frequencies that are discarded during striding.
-
-The result is an image perceptually identical to the original, with a manipulated activation pattern.
-
-We introduce three augmentations.
-
-<div align="center">
-  <img src="https://cdn-uploads.huggingface.co/production/uploads/6921e98c32171f09bfa0329a/ALG2BPCYeXIxeTjYfcIsl.png" alt="perturbation examples" width="800">
-  <p style="max-width: 600px; margin: 10px auto 0; line-height: 1.6;">
-    <em><b>Fig 1. STOCHASTIC RESOLUTION-DEGRADING TRANSFORMATIONS</b><br>
-    From left to right: <b>Clean</b> (32x32), <b>Bilinear Resize</b> (8x8), <b>Hard Decimation</b> (stride-2), and <b>Checkerboard Aliasing</b> (high-freq injection).<br>
-    These operations expose the vulnerabilities in standard feature extractors.</em>
-  </p>
-</div>
+Downsampling operations are linear maps that perform a many-to-one mapping. Information is destroyed, and the 
+### Checkerboard Attack
 
 <div align="center">
   <img src="https://cdn-uploads.huggingface.co/production/uploads/6921e98c32171f09bfa0329a/yd6VfVPW9e1Hqj7LRWTwU.png" alt="nula adversarial analysis" width="800">
@@ -65,6 +47,20 @@ We introduce three augmentations.
   </p>
 </div>
 
+  δ[i, j] = ε · (-1)^(i+j)
+
+This is a Nyquist injection — the highest spatial frequency representable on a discrete grid. Under stride-2 subsampling S_2:
+
+  (S₂ δ)[i, j] = δ[2i, 2j] = ε · (-1)^(2i+2j) = ε · 1 = ε
+
+The subsampled result is a constant.
+
+the checkerboard pattern is completely collapsed to a DC offset and loses all adversarial structure. 
+This proves δ ∈ ker(S₂ - εI), meaning the perturbation lies in the null space of the centered stride-2 operator. 
+Modern convolutional networks would never even see the attack.
+
+The result is an image perceptually identical to the original, with a manipulated activation pattern upstream of the first downsampling operation.
+
 ## Approach
 
 ### Anti-aliased Downsampling (BlurPool)