REVIEW 3 major objections 5 minor 1 cited by
A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles
T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read An implementation error let adversarial attacks exceed their own 8/255 limit by 20x, so the reported defense break does not hold under the intended bound.
desk verdict A credible, well-documented bug report that probably invalidates Zhang et al.'s near-zero robustness claim, but the replacement robustness number is not yet a same-setup replication. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The mechanism is a multi-round attack loop that fails to re-anchor its baseline to the original input. In the quoted code, `_pgd_attack` clamps each step relative to the `X` it receives, but `adaptive_attack` passes the previous round's adversarial image as `X_batch`, so after $n$ rounds the perturbation follows approximately $L_\infty(n) = 8n/255$. This accumulation is what inflates an intended $8/255$ attack to $160/255$. The proper counterfactual is the same attack with every round re-clipped to the original image, which is the version whose preliminary 20%+ CIFAR-100 accuracy the note reports.
What would settle it
Re-run the published attack on the same defense while recording the true $L_\infty$ norm of the final perturbation relative to the original image; if adversarial accuracy stays near zero even when every round is re-clipped to $8/255$ relative to the original, the note's central conclusion is refuted. Checking the repository state used for the published numbers to confirm that the listed multi-round loop was the actual code path would settle the attribution.
Extended reading notes
Core claim
The paper's central claim is that the near-zero adversarial accuracy reported against multi-resolution self-ensembles is an artifact of perturbation accumulation in the attacker's code, not a genuine property of the defense under the standard $L_\infty = 8/255$ threat model. Within each PGD round the bound is enforced, but across rounds the perturbed output of the previous round becomes the new baseline, so the total deviation from the original image compounds to as much as $160/255$. Properly bounded adaptive attacks produce only partial success, leaving the defense with non-trivial robustness. A second claim is that some of these properly bounded successful attacks shift human classification toward the target label as well, so treating every label change under $8/255$ as an imperceptible robustness failure may mis-measure the defense.
Load-bearing premise
The claim depends on the quoted code and the linked private repository being exactly the code that produced the published attack results; if the published experiments used a different code path, the conclusion that the defense is robust under proper bounds would not follow from this note.
Editorial extensions
If this is right
- The near-zero robustness result reported against this defense does not characterize the defense under the standard $8/255$ bound; the defense's robustness under that bound is substantially higher.
- Multi-round adaptive attacks must re-anchor each round to the original image, or the effective threat model grows with the number of rounds.
- Robustness evaluations should report measured perturbation norms, not just configured epsilons, because implementation details can silently change the actual attack strength.
- If $8/255$ perturbations can shift human perception toward the model's target class, then raw accuracy under $8/255$ may overstate a defense's vulnerability for perceptually aligned models.
Reading between the lines
- The author leaves implicit that the same accumulation bug could affect other multi-round adaptive attacks; auditing published attack code for baseline re-anchoring is a direct next step.
- The human-perception result suggests a testable evaluation metric: measure how often a bounded attack shifts human labels, and separate perceptible class changes from imperceptible ones; the lecture demonstration is anecdotal, so a controlled human study would be needed.
- The note's conclusion depends on the private code matching the published experiments; pinning a commit hash and releasing the full attack trace would let others verify the attribution.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This note documents an implementation error in the adaptive attacks of Zhang et al. (2024) against the multi-resolution self-ensemble defense of Fort and Lakshminarayanan (2024). The paper claims that the attack code re-baselines from the previously perturbed image in each of up to 20 rounds, so that the effective L-infinity perturbation grows approximately as 8n/255, reaching up to 160/255. The authors argue that when properly constrained to L-infinity <= 8/255, the defense retains non-trivial robustness (preliminary >20% CIFAR-100 adversarial accuracy) and that successful bounded attacks sometimes align with human perception. The note includes code listings, a timeline of discovery, and external acknowledgments from the attacked paper's authors.
Significance. The code-level analysis in Section 2 is concrete, and the external acknowledgment from Zhang et al. lends credibility to the error documentation. If the causal attribution is correct, the paper would invalidate a widely publicized near-zero robustness result and underscore the need for careful perturbation tracking in adaptive attack evaluations. The attempt to connect bounded adversarial perturbations to human perception is intriguing but is supported only by two examples and an informal lecture poll, so it currently stands as a motivating observation rather than a substantiated claim. The paper's central value is the error documentation; the broader robustness and perception claims need substantial additional evidence before they can be accepted.
major comments (3)
- [Section 2.2, Listings 1-2] The causal claim that Zhang et al.'s near-zero adversarial accuracy was caused by the accumulation bug is not fully verified because the note does not establish that the code in the private repository, or the quoted snippets, is exactly the code path that produced the published attack tables. No commit hash, repository release tag, snapshot, or run logs are provided. Please supply a versioned reference to the inspected code, ideally with the exact configuration used in the published experiments, or otherwise reproduce the published near-zero results using the identified code path. Without this, the bug mechanism is credible but the attribution to the published result remains an inference.
- [Section 3, 'Properly Bounded Adaptive Attacks'] The properly bounded counter-evidence is not a same-setup replication of the attacked system. The note reports >20% CIFAR-100 adversarial accuracy using a multi-resolution self-ensemble based on all 54 layers of ResNet152, which it explicitly calls 'significantly stronger' than the demonstration Colab architecture used by Zhang et al. Under a stronger model, higher robustness is expected even with a correct attack, so this result does not directly show that the original attacked model is non-trivially robust under proper bounds. Please report results on the exact model configuration targeted in the published attack, or clearly scope the robustness claim to the stronger model and avoid implying that the original near-zero result is refuted by this experiment alone.
- [Section 3, Figure 2 and 'Human Perception'] The human-perception claim rests on two attacked images and an informal audience poll during a lecture. The manuscript uses this to 'challenge a fundamental assumption' and to suggest that 'we need to reconsider how we measure adversarial robustness.' This is not supported by the presented evidence: two examples are anecdotal, and the audience response format (limited class choices, no controls, no systematic protocol) does not establish a reliable human-model alignment. Either add a controlled human-subject experiment with appropriate statistical analysis, or substantially temper the conclusions to note that this is a preliminary anecdotal observation.
minor comments (5)
- [Abstract and Section 1] The phrase 'up to a factor of 20x' is stated, but the paper later clarifies that the observed growth is approximately linear in the number of rounds. Consider rewording to avoid implying a fixed multiplier across all iterations; the current wording is fine if the maximum number of rounds is explicitly tied to the factor.
- [Section 3] There is a typo in 'CIF AR-100' (should be 'CIFAR-100').
- [References] The reference to Tramer's tweet uses a backtick in 'Tram` er' and is formatted inconsistently with the other references. Also, the footnote containing the Colab GitHub URL would be better placed as a formal reference.
- [Section 2.2] The sentence 'we found that in the first iteration, the L∞ ≤ 8/255 as expected' is grammatically incomplete; it appears to be missing a word such as 'is'.
- [Section 1, Figure 1] The caption states 'L∞ = 83/255' for the right panel, while the introductory text says the code can reach up to 160/255. Clarify whether 83/255 is from a particular run or a representative example, to avoid confusion with the maximum bound.
Circularity Check
No significant circularity: the bug finding rests on code inspection and external acknowledgment, not on the defense author's own assumptions.
full rationale
The paper's central claim is that Zhang et al.'s adaptive attack code accumulated perturbations across rounds, so the reported near-zero adversarial accuracy came from perturbations exceeding the standard L_infinity = 8/255 bound. This claim is supported by quoted code listings, a measured accumulation pattern, and an email/tweet acknowledgment from the original attack authors. The evidence is external to Fort's own defense construction, so there is no equation or fitted parameter that is being renamed as a prediction. The only self-citations are to the defense paper being attacked and to the author's own lecture for the human-perception demonstration; neither is load-bearing in a circular sense, since the defense is the target of analysis rather than the justification for the bug diagnosis. The human-perception discussion is interpretive and self-serving, but it does not reduce to an input of the derivation. The main weakness of the paper is an evidentiary gap, not circularity: no commit hash or full repository snapshot ties the inspected private code to the published runs, and the properly bounded robustness number comes from a stronger model than the one attacked. Those concerns belong to correctness/verification risk, not to circularity. Under the requirement that circularity be exhibited by quotation and reduction, no circular step is present.
Assumptions & free parameters
assumptions (2)
- domain assumption Listings 1 and 2 accurately reproduce the Zhang et al. attack code that produced the published results
- domain assumption An informal lecture audience poll is a valid measurement of human perception
Cite this review
Pith. "Pith review of A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles." pith.science (2026). https://pith.science/paper/5RS326IW
@misc{pith2026250114496,
author = {Pith},
title = {Pith review of: A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles},
year = {2026},
howpublished = {\url{https://pith.science/paper/5RS326IW}},
note = {Machine review of arXiv:2501.14496}
}
abstract
This note documents an implementation issue in recent adaptive attacks (Zhang et al. [2024]) against the multi-resolution self-ensemble defense (Fort and Lakshminarayanan [2024]). The implementation allowed adversarial perturbations to exceed the standard $L_\infty = 8/255$ bound by up to a factor of 20$\times$, reaching magnitudes of up to $L_\infty = 160/255$. When attacks are properly constrained within the intended bounds, the defense maintains non-trivial robustness. Beyond highlighting the importance of careful validation in adversarial machine learning research, our analysis reveals an intriguing finding: properly bounded adaptive attacks against strong multi-resolution self-ensembles often align with human perception, suggesting the need to reconsider how we measure adversarial robustness.
Figures
Forward citations
Cited by 1 Pith paper
-
Direct Ascent Synthesis: Revealing Hidden Generative Capabilities in Discriminative Models
Direct Ascent Synthesis generates recognizable images from CLIP embeddings by optimizing a sum of multi-resolution image components, requiring no generative training.
Reference graph
Works this paper leans on
-
[1]
Gradient masking all-at-once: Ensemble everything everywhere is not robust, 2024
Jie Zhang, Kristina Nikolić, Nicholas Carlini, and Florian Tramèr. Gradient masking all-at-once: Ensemble everything everywhere is not robust, 2024. URL https://arxiv.org/abs/2411.14834v1
arXiv 2024
-
[2]
Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness, 2024
Stanislav Fort and Balaji Lakshminarayanan. Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness, 2024. URL https://arxiv.org/abs/2408.05446
arXiv 2024
-
[3]
This was an unfortunate mistake, sorry about that
Florian Tramer. This was an unfortunate mistake, sorry about that. [...], 12 2024. URL https://x.com/florian_tramer/status/1867247951913029671
-
[4]
Adversarial attacks as a baby version of a(g)i alignment, 2024
Stanislav Fort. Adversarial attacks as a baby version of a(g)i alignment, 2024. URL https://www.youtube.com/watch?v=xFMbpPmhodQ. A recording of a lecture at EPFL on YouTube
work page 2024
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.