{"id":"707992a5-94ec-4dae-a5c6-fcdeafd12383","arxiv_id":"2501.14496","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"An implementation bug in Zhang et al.'s adaptive attack accumulated L-infinity perturbations up to 160/255, and with correct 8/255 bounds the multi-resolution self-ensemble defense retains non-trivial robustness.","lead":"A short technical note documents an implementation bug in a published adaptive attack that let perturbations grow up to 20 times beyond the allowed bound, invalidating the claim that a multi-resolution self-ensemble defense has near-zero robustness. When attacks are properly bounded, the defense keeps non-trivial accuracy, and some successful attacks appear to change human perception as well.","discovery_kind":"replication","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attribution of Zhang et al.'s near-zero robustness to the accumulation bug is plausible but not yet proven: no commit hash or release ties the inspected code to the published runs, and the properly bounded robustness number was obtained with a stronger model than the one attacked.","rationale":"The reader's weakest assumption identifies exactly the link that carries the paper's central claim: the inspected private code must be the code that produced Zhang et al.'s published numbers. I agree that this is the most load-bearing point. The note has independent support for the existence of an accumulation bug in the attack loop, so the report is not baseless, but the causal attribution to the specific near-zero results requires more than a plausible mechanism. The missing commit hash and the absence of released corrected code prevent an independent check of that link. I also raise a secondary verification gap: the 'properly bounded' robustness result was measured on a different, stronger defense instance than the one Zhang et al. attacked, so even a successful patch of the attack code would not, by itself, prove that the exact published result was bug-induced. The human-perception discussion in Section 3 is anecdotal (an EPFL lecture demonstration) and should not affect the central verdict; it is a separate claim requiring controlled psychophysical testing. These are verification gaps rather than demonstrated contradictions, so the appropriate disposition remains the same conditional acceptance recommended by the reader.","tokens_in":3709,"tokens_out":5113,"duration_ms":52534,"concrete_test":"Obtain the exact commit of the private repository referenced in the note, rerun the published attack script with per-round effective L_infinity logging, then patch the adaptive_attack loop to re-baseline from the original image each round and rerun with the same model checkpoint and hyperparameters used in Zhang et al.'s reported tables. If adversarial accuracy is still near zero after the patch, the bug is real but the central claim fails; if accuracy rises to the claimed >20% regime, the claim is confirmed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central causal claim in Sections 2 and 4 is that Zhang et al.'s near-zero adversarial accuracy was caused by an accumulation bug in the adaptive attack loop: each round re-baselines from the previous perturbed image, so effective L_infinity grows roughly as 8*n/255. The code listing in Section 2.2 makes the bug mechanism clear, and the author email and public tweet are useful external corroboration. However, the note does not establish that the inspected private repository code is the exact code path that produced the published tables, and it provides no commit hash, repository snapshot, release tag, or run logs. If the published experiments used a different save step, a different number of rounds, or a different target model configuration, the bug could be real without explaining the near-zero result. The 'properly bounded' counter-evidence is also not a same-setup replication: the note reports >20% CIFAR-100 adversarial accuracy using a full 54-layer ResNet152 multi-resolution self-ensemble, which it explicitly calls 'significantly stronger' than the demonstration Colab architecture attacked by Zhang et al. Thus the inference from 'the attack code accumulates perturbations' to 'the published near-zero robustness result is invalid' is not fully verified, even though the code-level finding is credible.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This note documents an implementation error in the adaptive attacks of Zhang et al. (2024) against the multi-resolution self-ensemble defense of Fort and Lakshminarayanan (2024). The paper claims that the attack code re-baselines from the previously perturbed image in each of up to 20 rounds, so that the effective L-infinity perturbation grows approximately as 8n/255, reaching up to 160/255. The authors argue that when properly constrained to L-infinity <= 8/255, the defense retains non-trivial robustness (preliminary >20% CIFAR-100 adversarial accuracy) and that successful bounded attacks sometimes align with human perception. The note includes code listings, a timeline of discovery, and external acknowledgments from the attacked paper's authors.","tokens_in":4090,"tokens_out":2481,"duration_ms":24292,"significance":"The code-level analysis in Section 2 is concrete, and the external acknowledgment from Zhang et al. lends credibility to the error documentation. If the causal attribution is correct, the paper would invalidate a widely publicized near-zero robustness result and underscore the need for careful perturbation tracking in adaptive attack evaluations. The attempt to connect bounded adversarial perturbations to human perception is intriguing but is supported only by two examples and an informal lecture poll, so it currently stands as a motivating observation rather than a substantiated claim. The paper's central value is the error documentation; the broader robustness and perception claims need substantial additional evidence before they can be accepted.","major_comments":[{"comment":"The causal claim that Zhang et al.'s near-zero adversarial accuracy was caused by the accumulation bug is not fully verified because the note does not establish that the code in the private repository, or the quoted snippets, is exactly the code path that produced the published attack tables. No commit hash, repository release tag, snapshot, or run logs are provided. Please supply a versioned reference to the inspected code, ideally with the exact configuration used in the published experiments, or otherwise reproduce the published near-zero results using the identified code path. Without this, the bug mechanism is credible but the attribution to the published result remains an inference.","section":"Section 2.2, Listings 1-2"},{"comment":"The properly bounded counter-evidence is not a same-setup replication of the attacked system. The note reports >20% CIFAR-100 adversarial accuracy using a multi-resolution self-ensemble based on all 54 layers of ResNet152, which it explicitly calls 'significantly stronger' than the demonstration Colab architecture used by Zhang et al. Under a stronger model, higher robustness is expected even with a correct attack, so this result does not directly show that the original attacked model is non-trivially robust under proper bounds. Please report results on the exact model configuration targeted in the published attack, or clearly scope the robustness claim to the stronger model and avoid implying that the original near-zero result is refuted by this experiment alone.","section":"Section 3, 'Properly Bounded Adaptive Attacks'"},{"comment":"The human-perception claim rests on two attacked images and an informal audience poll during a lecture. The manuscript uses this to 'challenge a fundamental assumption' and to suggest that 'we need to reconsider how we measure adversarial robustness.' This is not supported by the presented evidence: two examples are anecdotal, and the audience response format (limited class choices, no controls, no systematic protocol) does not establish a reliable human-model alignment. Either add a controlled human-subject experiment with appropriate statistical analysis, or substantially temper the conclusions to note that this is a preliminary anecdotal observation.","section":"Section 3, Figure 2 and 'Human Perception'"}],"minor_comments":[{"comment":"The phrase 'up to a factor of 20x' is stated, but the paper later clarifies that the observed growth is approximately linear in the number of rounds. Consider rewording to avoid implying a fixed multiplier across all iterations; the current wording is fine if the maximum number of rounds is explicitly tied to the factor.","section":"Abstract and Section 1"},{"comment":"There is a typo in 'CIF AR-100' (should be 'CIFAR-100').","section":"Section 3"},{"comment":"The reference to Tramer's tweet uses a backtick in 'Tram` er' and is formatted inconsistently with the other references. Also, the footnote containing the Colab GitHub URL would be better placed as a formal reference.","section":"References"},{"comment":"The sentence 'we found that in the first iteration, the L∞ ≤ 8/255 as expected' is grammatically incomplete; it appears to be missing a word such as 'is'.","section":"Section 2.2"},{"comment":"The caption states 'L∞ = 83/255' for the right panel, while the introductory text says the code can reach up to 160/255. Clarify whether 83/255 is from a particular run or a representative example, to avoid confusion with the maximum bound.","section":"Section 1, Figure 1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is written by the author of the defense being attacked, which is a clear conflict of interest. The conflict is not explicitly disclosed in the note, although the author's identity is apparent from the references and the lecture citation. I would advise the editor to require a disclosure statement and to emphasize that the attribution claim needs a reproducibility artifact (e.g., commit hash) to be considered definitive. The core bug documentation appears credible and is externally acknowledged, but the manuscript currently overreaches in its robustness and human-perception claims relative to the evidence provided."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Stan,\n\nYou should read this as a bug report wearing a paper's clothes. The core finding is real and important: Fort shows, with code, that Zhang et al.'s adaptive attack re-baselined from the previous perturbed image each round, so the actual L-infinity grew roughly as 8n/255, up to 160/255. The listing in Section 2.2 is clear, and the Zhang/Tramèr acknowledgments are strong external corroboration. That part is solid.\n\nWhat is not yet solid is the causal inference from 'the code has this bug' to 'the published near-zero robustness is invalid.' Fort inspected a private repo but gives no commit hash or snapshot, so we cannot be certain the exact code path that produced the published tables is the one shown. Same for the 'properly bounded' counter-result: it uses a full 54-layer ResNet152 ensemble, which he admits is significantly stronger than the Colab demo Zhang attacked. That is a different experiment, and the >20% number is preliminary, with no protocol or error bars. It is a reasonable existence proof, not a replication.\n\nThe human-perception part is the weakest. Two images shown to a lecture audience, with a limited label set, is anecdote. It might be true that some 8/255 perturbations are perceptible, but that needs a controlled study, not a slide. He does flag it as an observation, so I don't hold it against the core claim.\n\nThe conflict of interest is real—Fort is defending his own defense—but the bug report stands on code inspection and external acknowledgment, not on his equations. I wouldn't dismiss it on those grounds.\n\nMy bottom line: this deserves a serious referee. The bug documentation is reproducible in principle even without released code, and if it holds, it matters for the adversarial robustness literature. The right request is for the author to release a repository snapshot or commit hash, and to run the properly-bounded attack on the actual model Zhang used. That would close the gap between 'bug exists' and 'published result is explained.'\n\nBring it to reading group? Probably yes, as a methodology lesson. I'd cite the bug-finding if I ever cite that Zhang et al. result, but I'd be careful not to cite the >20% number as settled.","headline":"A credible, well-documented bug report that probably invalidates Zhang et al.'s near-zero robustness claim, but the replacement robustness number is not yet a same-setup replication.","tokens_in":4433,"tokens_out":1945,"would_cite":true,"duration_ms":17212,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An implementation error let adversarial attacks exceed their own 8/255 limit by 20x, so the reported defense break does not hold under the intended bound.","keywords":["adversarial robustness","adaptive attacks","multi-resolution self-ensemble","implementation error","perturbation bound","L-infinity norm","CIFAR-100","human perception"],"falsifier":"Re-run the published attack on the same defense while recording the true $L_\\infty$ norm of the final perturbation relative to the original image; if adversarial accuracy stays near zero even when every round is re-clipped to $8/255$ relative to the original, the note's central conclusion is refuted. Checking the repository state used for the published numbers to confirm that the listed multi-round loop was the actual code path would settle the attribution.","tokens_in":3510,"feed_emoji":"🐛","tokens_out":7228,"duration_ms":57388,"temperature":0.7,"pith_summary":"This note reports an implementation error in a recent adaptive-attack evaluation that claimed to break the multi-resolution self-ensemble defense. The attack code re-based each of its up to 20 rounds on the already-perturbed image, so the actual perturbation grew roughly linearly and could reach $L_\\infty = 160/255$, twenty times the intended $L_\\infty = 8/255$ limit. When the same style of attack is re-run with the perturbation correctly clipped to the original image, the defense retains non-trivial robustness, with preliminary adversarial accuracy above 20% on CIFAR-100. The note also finds that the bounded attacks that do succeed often flip human perception toward the target class, which challenges the assumption that $L_\\infty = 8/255$ perturbations are always imperceptible.","feed_headline":"Attack code broke its own 8/255 bound by 20x","feed_subtitle":"A reported defense break used perturbations up to 160/255; properly bounded attacks leave non-trivial robustness.","key_machinery":"The mechanism is a multi-round attack loop that fails to re-anchor its baseline to the original input. In the quoted code, `_pgd_attack` clamps each step relative to the `X` it receives, but `adaptive_attack` passes the previous round's adversarial image as `X_batch`, so after $n$ rounds the perturbation follows approximately $L_\\infty(n) = 8n/255$. This accumulation is what inflates an intended $8/255$ attack to $160/255$. The proper counterfactual is the same attack with every round re-clipped to the original image, which is the version whose preliminary 20%+ CIFAR-100 accuracy the note reports.","core_discovery":"The paper's central claim is that the near-zero adversarial accuracy reported against multi-resolution self-ensembles is an artifact of perturbation accumulation in the attacker's code, not a genuine property of the defense under the standard $L_\\infty = 8/255$ threat model. Within each PGD round the bound is enforced, but across rounds the perturbed output of the previous round becomes the new baseline, so the total deviation from the original image compounds to as much as $160/255$. Properly bounded adaptive attacks produce only partial success, leaving the defense with non-trivial robustness. A second claim is that some of these properly bounded successful attacks shift human classification toward the target label as well, so treating every label change under $8/255$ as an imperceptible robustness failure may mis-measure the defense.","pith_inferences":["The author leaves implicit that the same accumulation bug could affect other multi-round adaptive attacks; auditing published attack code for baseline re-anchoring is a direct next step.","The human-perception result suggests a testable evaluation metric: measure how often a bounded attack shifts human labels, and separate perceptible class changes from imperceptible ones; the lecture demonstration is anecdotal, so a controlled human study would be needed.","The note's conclusion depends on the private code matching the published experiments; pinning a commit hash and releasing the full attack trace would let others verify the attribution."],"forward_implications":["The near-zero robustness result reported against this defense does not characterize the defense under the standard $8/255$ bound; the defense's robustness under that bound is substantially higher.","Multi-round adaptive attacks must re-anchor each round to the original image, or the effective threat model grows with the number of rounds.","Robustness evaluations should report measured perturbation norms, not just configured epsilons, because implementation details can silently change the actual attack strength.","If $8/255$ perturbations can shift human perception toward the model's target class, then raw accuracy under $8/255$ may overstate a defense's vulnerability for perceptually aligned models."],"supporting_citations":[{"why":"Supplies the adaptive attack implementation and the near-zero robustness result whose validity this note disputes.","marker":"Zhang et al. [2024]"},{"why":"Introduces the multi-resolution self-ensemble defense and the model configuration that the bounded attacks target.","marker":"Fort and Lakshminarayanan [2024]"},{"why":"Publicly acknowledges the implementation mistake, supporting the paper's attribution of the error.","marker":"Tramer [2024]"},{"why":"Documents the lecture demonstration in which human observers agreed with the model's target labels on two bounded attacks.","marker":"Fort [2024]"}],"fun_headline_variants":["Attack bug let perturbations hit 160/255, defense survives","Adaptive attack flaw: 20x over bound, real robustness remains","Defense break traced to code bug, not model weakness","Properly bounded attacks find multi-resolution ensembles robust","Perturbation accumulation flaw: 160/255 vs intended 8/255"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim depends on the quoted code and the linked private repository being exactly the code that produced the published attack results; if the published experiments used a different code path, the conclusion that the defense is robust under proper bounds would not follow from this note.","fun_headline_variants_meta":{"raw":{"variants":["Attack bug let perturbations hit 160/255, defense survives","Adaptive attack flaw: 20x over bound, real robustness remains","Defense break traced to code bug, not model weakness","Properly bounded attacks find multi-resolution ensembles robust","Perturbation accumulation flaw: 160/255 vs intended 8/255"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000254,"raw_usage":{"total_tokens":1512,"prompt_tokens":834,"completion_tokens":678,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":450,"completion_tokens_details":{"reasoning_tokens":589}},"tokens_in":450,"tokens_out":678,"duration_ms":6675,"temperature":1.0,"reasoning_tokens":589,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:05:06.026342+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the published attack on the same defense while recording the true $L_\\infty$ norm of the final perturbation relative to the original image; if adversarial accuracy stays near zero even when every round is re-clipped to $8/255$ relative to the original, the note's central conclusion is refuted. Checking the repository state used for the published numbers to confirm that the listed multi-round loop was the actual code path would settle the attribution.","supporting_citations":[{"cited_title":"This was an unfortunate mistake, sorry about that","cited_arxiv_id":null,"evidence_quote":"Publicly acknowledges the implementation mistake, supporting the paper's attribution of the error."}],"review_version":1}