A note on the implementation error in recent adaptive attacks against the multi-resolution self-ensemble defense

1. 01What problem does this paper attempt to solve?

   Checked the adaptive attack results of Zhang et al. [2024] against the multi-resolution self-ensemble defense and found that their perturbation exceeds the standard upper bound due to an implementation error.

   Core question: Zhang et al. [2024] reported that an adaptive attack reduced the adversarial accuracy of the multi-resolution self-ensemble defense (Fort and Lakshminarayanan [2024]) to near zero; this technical note checks whether that conclusion holds.

   • Problem setting: Adversarial robustness evaluations typically use L∞ = 8/255 as the standard perturbation upper bound and assume that perturbations of this magnitude do not change the human eye's judgment of the class; if an attack exceeds this bound, the conclusions are no longer comparable.
   • Doubt about the existing result: Zhang et al. [2024] used an adaptive attack that progressively refines the perturbation over multiple restarts and reported near-zero adversarial accuracy for the defense; the authors' reproduction verification before NeurIPS 2024 gave inconsistent results.
   • Core observation: After examining the code repository, the authors found that single-round PGD correctly constrains the perturbation within ε, but the multi-round implementation uses the previous round's perturbation image as the new starting point, so the perturbation accumulates across rounds, reaching up to L∞ = 160/255, i.e., up to 20 times the standard upper bound.
   • Paper content: Documents this implementation error and the original authors' confirmation; re-measures under the correct constraint using a stronger 54-layer ResNet152 self-ensemble; and reports an incidental observation—the authors state that successful bounded adaptive attacks often produce perturbations consistent with human perception.
   • Threat model:
     • Attacker goal: Deceive the multi-resolution self-ensemble classifier under the L∞ threat model and reduce its adversarial accuracy.
     • Knowledge and capability: Adaptive attack, multiple restarts, continuing to apply PGD to failed samples; the paper does not state the attacker's level of knowledge of the model internals.
     • Victim system: Multi-resolution self-ensemble defense, evaluated on the CIFAR-100 dataset.

   Collapse this answer

2. 02What related research exists?

   The paper centers on only two works: the audited adaptive attack of Zhang et al. [2024] and the attacked defense of Fort and Lakshminarayanan [2024].

   This technical note has no separate Related Work section; the main text cites and discusses only a few works.

   The checked attack

   • Zhang et al. [2024] (Gradient masking all-at-once: Ensemble everything everywhere is not robust)—proposes an adaptive attack with multiple restarts and reports reducing the adversarial accuracy of the multi-resolution self-ensemble defense to near zero. The authors point out that its results come from perturbations exceeding the standard upper bound, and the original authors have acknowledged the implementation error via email and public channels.

   The attacked defense

   • Fort and Lakshminarayanan [2024] (Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness)—proposes the multi-resolution self-ensemble defense, i.e., the present authors' prior work, and is the object being attacked and re-evaluated.

   Other citations

   • Tramer [2024]—cited as evidence, a record of the senior author of Zhang et al. [2024] publicly acknowledging the error.
   • Fort [2024]—the authors' lecture at the EPFL AI Center, in which attacked images were shown to the audience, as the source of the human perception observation.

   Positioning: The authors position this paper as an implementation-level correction of the results of Zhang et al. [2024], not as a new attack or new defense; the paper sets up no comparison baseline methods or additional benchmarks.

   Collapse this answer

3. 03How does the paper address this problem?

   Reproducing the attack code located the cross-round accumulation error; under the correct L∞ = 8/255 constraint they re-measured with a stronger self-ensemble and examined human perception with two examples.

   Overall approach: first reproduce the attack of Zhang et al. [2024] and track the perturbation magnitude to locate the implementation error, then reimplement the adaptive attack under the standard L∞ = 8/255 constraint and measure the defense's adversarial accuracy, and finally examine the relationship between successful attacks and human perception through a lecture demonstration.

   Error localization and reproduction

   • Reproduction method: the authors reproduced the attack with their own implementation with strict perturbation tracking; the results were inconsistent with the original report, so they then inspected the authors' code repository.
   • Accumulation mechanism: within a single round, PGD correctly clamps the perturbation within ε (Listing 1), but the multi-round adaptive attack uses the perturbed image output by the previous round as the starting point for the next round (Listing 2), so after n rounds the actual L∞ can reach nε.
   • Reproduction values: the authors' reproduction measured L∞ ≈ 15.8/255 at round 2, ≈ 23.6/255 at round 3, and ≈ 30.54/255 at round 4, consistent with the approximate pattern L∞(n) = 8n/255; with the default n = 20 rounds, the perturbation reaches up to L∞ = 160/255.

   Re-testing under the correct constraint

   • Defense configuration: multi-resolution self-ensemble based on all 54 layers of ResNet152, implemented as described by Fort and Lakshminarayanan [2024]; the authors state that this configuration is stronger than the demo version used by Zhang et al. [2024] (based on a public Colab notebook).
   • Attack setting: adaptive attack retaining the standard L∞ = 8/255 bound; the paper does not give complete parameters such as the number of PGD steps or EOT iterations (num_eot=10 appears in Listing 2).
   • What is measured: adversarial accuracy under L∞ attack on CIFAR-100.

   Human perception examination

   • Presentation method: at a lecture at the EPFL AI Center in November 2024, two successfully attacked images (Figure 2) were shown to the audience, along with a limited set of candidate classes to choose from.
   • Observation design: compare whether the audience's class choices match the model predictions; the paper does not report the number of participants, the distribution of choices, or statistical tests.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Reproduction confirms the perturbation accumulates at about 8n/255, up to 160/255; under the correct constraint, the 54-layer ResNet152 self-ensemble achieves adversarial accuracy > 20% on CIFAR-100.

   Experimental setup

   • System under test: multi-resolution self-ensemble defense; this paper uses the version based on all 54 layers of ResNet152; Zhang et al. [2024] used a demo version based on a public Colab notebook.
   • Dataset: CIFAR-100; the paper does not report the evaluation sample size.
   • Attack: adaptive attack with multiple restarts, each round being PGD; standard bound L∞ = 8/255; the buggy implementation defaults to n = 20 rounds.
   • Metrics: adversarial accuracy and the L∞ magnitude of the perturbation.
   • Review method: the human perception part had lecture attendees choose among a limited set of candidate classes; the paper does not report the number of participants or the statistical method.
   • Number of repetitions: the paper does not report it.

   Main results

   Setting	Result	Source
   Zhang et al. [2024] buggy implementation, perturbation L∞ bound	up to 160/255 (up to 20× above the standard bound)	abstract, Section 2.2
   Authors' reproduction, perturbation L∞ at rounds 2 / 3 / 4	≈ 15.8/255, ≈ 23.6/255, ≈ 30.54/255	Section 2.2
   Correctly constrained L∞ = 8/255, 54-layer ResNet152 self-ensemble, CIFAR-100	adversarial accuracy > 20% (authors call it a preliminary result)	Section 3
   Zhang et al. [2024] original report (relies on out-of-bound perturbations)	adversarial accuracy close to zero	Section 1

   • The authors argue that the near-zero robustness in the original report comes from perturbations exceeding the standard bound, and that under the correct constraint the defense retains non-trivial robustness.
   • Figure 1 shows a real perturbation example with L∞ ≈ 83/255 generated by the authors' code; the caption states that the perturbation is clearly visible to the human eye.

   Human perception observations

   • What was measured: two successfully attacked CIFAR-100 images (Figure 2: house→road, sea→mountain) were shown at an EPFL lecture, and attendees chose from a limited set of classes.
   • Results: the authors report that attendees consistently chose the perturbed house image as road and the sea image as mountain, consistent with the model predictions; the paper gives no number of participants or proportions.
   • Authors' interpretation: the authors suggest that some attacks labeled "successful" at L∞ = 8/255 may genuinely change perceptual features shared by humans and models, and recommend reconsidering how adversarial robustness is measured.

   Other ablations and analyses

   • The paper has no other ablation experiments; Section 2.2 gives a reproduction record of the perturbation magnitude per round (see the main results table).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors suggest reconsidering how adversarial robustness is measured; > 20% is a preliminary result, and the human perception evidence comes from only two examples.

   Limitations and future directions noted by the authors

   • Preliminary results: Section 3 calls the > 20% adversarial accuracy "preliminary adversarial accuracy", i.e., a preliminary measurement.
   • Remeasuring robustness: In Sections 3 and 4, the authors suggest that the way adversarial robustness is measured may need improvement; not every prediction change under L∞ = 8/255 should be treated as a robustness failure, and whether the perturbation actually changes perception-relevant features should be considered.
   • Questioning a standard assumption: The authors believe the conventional assumption that L∞ = 8/255 perturbations never change human category judgments is challenged by their observations, and recommend more nuanced evaluation metrics.

   Scope of experiments

   • The defense tested is multi-resolution self-ensemble; the experiments in this paper use the version based on all 54 layers of ResNet152, with the CIFAR-100 dataset.
   • The attack evaluation covers only adaptive attacks under the L∞ = 8/255 bound; the paper does not report the full attack budget, such as PGD steps, restart rounds, or number of queries.
   • The paper does not report the evaluation sample size or number of repetitions for adversarial accuracy.
   • The human perception evidence comes from two example images (Figure 2) from a lecture at EPFL; the paper does not report the number of participants, selection proportions, or statistical tests.
   • The paper did not retest on datasets other than CIFAR-100 or on other defenses.

   Collapse this answer

6. 06Summarize the main content of the paper

   A technical note: the attack of Zhang et al. [2024] exceeds the perturbation bound by up to 20× due to an implementation error; under the correct constraint the defense retains non-trivial robustness.

   This is a technical note that checks and corrects the adaptive attack results of Zhang et al. [2024] against the multi-resolution self-ensemble defense (Fort and Lakshminarayanan [2024]).

   • Problem: Zhang et al. [2024] reported that an adaptive attack with multiple restarts reduced the defense's adversarial accuracy to near zero; the authors' reproduction gave inconsistent results.
   • Finding: In the attack implementation, each round of PGD individually satisfies L∞ ≤ 8/255, but the next round uses the previous round's perturbation image as its starting point, so the perturbation accumulates across rounds; the authors' reproduction measured approximately 15.8/255, 23.6/255, and 30.54/255 for rounds 2–4 respectively, consistent with a pattern of about 8n/255; with the default 20 rounds it reaches up to L∞ = 160/255, i.e., up to 20 times the standard upper bound. The original authors have acknowledged the error via email and public channels.
   • Re-measurement: Under the correct L∞ = 8/255 constraint, a stronger self-ensemble based on all 54 layers of ResNet152 measured adversarial accuracy > 20% on CIFAR-100 (the authors call this a preliminary result), in contrast to the near-zero originally reported.
   • Incidental observation: The authors state that successful bounded adaptive attacks often produce perturbations consistent with human perception—in an EPFL lecture, the audience selected the attacked house and sea images as road and mountain respectively, consistent with the model's predictions.
   • Authors' conclusion: Implementation verification is critical in adversarial machine learning research; the authors also believe the way adversarial robustness is measured should be reconsidered, because some "successful" attacks under L∞ = 8/255 may genuinely change perception-relevant features.

   Collapse this answer

Related papers