{"id":"c28a8c65-4a1b-4be5-b8c4-97a32f75c78c","arxiv_id":"2411.14834","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":3,"one_line_summary":"Adaptive attacks reduce the robust accuracy of the 'Ensemble Everything Everywhere' defense to 11% on CIFAR-10 and 14% on CIFAR-100 under an l-infinity bound of 8/255.","lead":"The paper shows that a previously touted defense against adversarial image attacks, 'Ensemble Everything Everywhere', collapses under adaptive attacks, dropping to about 11-14% robust accuracy on common benchmarks. A generalist should read it because it demonstrates how deceptive gradient masking can be, and why robustness claims need attack-specific scrutiny before being trusted.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The attack targets retrained models from official code, not the exact models from the original defense paper; the headline 'not robust' claim is conditional on these reproductions being representative.","rationale":"The central claim of the note is that the Ensemble Everything Everywhere defense is not robust, with headline robust accuracies of 14% on CIFAR-100 and 11% on CIFAR-10 after adaptive attack. The evidence is a carefully constructed attack (PGD/APGD with transfer and EoT) applied to models trained from the official code. The single most load-bearing assumption is that those models faithfully represent the defense as claimed in [11]. The note itself discloses in Section 4 that the original models are not released and that the paper's higher robustness numbers come from larger models, longer training, and optional adversarial training. Indeed, the note's CIFAR-10 AutoAttack baseline is 61.8%, not the 72% claimed in the introduction. Thus the abstract's '62% to 11%' is an attack on the reproduction, not on the defense's reported 72% model. This is not a minor numerical discrepancy: if the original training protocol is what confers robustness (e.g., through better feature learning or reduced gradient masking), the conclusion may not transfer. The concurrent evaluation [26] is cited but its specific results are not integrated, so it does not resolve the gap. The paper's strengths include the honest disclosure of the earlier bug, a standalone evaluation script, and 10-run statistics; these support the attack's validity on the tested models. The sample size (100) is a secondary concern but not load-bearing because the gap to the claimed robust accuracy is large. Given the scope limitation, a CONDITIONAL verdict is appropriate: the note convincingly shows that the public implementation as trained by the authors is not robust, but the blanket statement about the defense as originally reported awaits verification on the original models or an exact reproduction. The proposed test, attacking the original or exactly reproduced models on the full test set, would settle whether the concern lands.","tokens_in":8100,"tokens_out":10106,"duration_ms":96530,"concrete_test":"Obtain the exact trained models from the original defense authors (or retrain with the original paper's full configuration, including architecture, training length, and optional adversarial training) and run the note's best-of-both adaptive attack (Table 1, 'Best-of-both' row) on those models, evaluating on the full 10,000-sample CIFAR-10 and CIFAR-100 test sets with 10 independent evaluations. If robust accuracy remains above roughly 40%, the note's claim that the defense as reported is not robust is unsupported; if it drops to about 11-14%, the concern is settled.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing assumption is that the models attacked in Section 4 are representative of the defense as proposed by Fort and Lakshminarayanan [11]. The note states (Section 4, Setup): 'The paper [11] reports slightly higher robustness numbers using larger models, longer training runs, and combining with adversarial training. As these models and their training code are not publicly released, we rely on the official training code.' The evaluated models achieve 88.9%/64.1% clean accuracy and 61.8%/47.9% AutoAttack robust accuracy (Table 1), whereas the original paper claims 72% CIFAR-10 robust accuracy (Introduction). The note's abstract headline 'reduce the robust accuracy ... from 62% to 11%' uses its own 62% reproduction, not the defense's reported 72%. Because the original models are neither attacked nor available, the central claim 'this defense is not robust' is not directly established for the defense as originally reported; it could be that longer training, larger models, or the optional adversarial training (which the note does not test) eliminate the observed vulnerability. This is a disclosed scope limitation, not an internal inconsistency, but it is load-bearing for the title's blanket conclusion.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This short note evaluates the robustness of the 'Ensemble Everything Everywhere' defense [11] under an l_infinity threat model with epsilon = 8/255. The authors retrain the official implementation on CIFAR-10 and CIFAR-100, demonstrate severe gradient masking via loss-landscape plots and unit tests, and then apply adaptive attacks (PGD with EoT, transfer from a mean-aggregation surrogate, and APGD with a larger initial radius) to reduce robust accuracy from 61.8% to 10.9% on CIFAR-10 and from 47.9% to 13.6% on CIFAR-100. They conclude that the defense is not robust and that its earlier evaluation was inadequate. The report also discloses and corrects a bug in an earlier version of the attack, and uses a separate verification script to ensure final perturbations respect the epsilon bound.","tokens_in":8291,"tokens_out":6738,"duration_ms":63011,"significance":"If the result holds, this is a valuable negative result for a high-profile defense and a useful case study in the adaptive evaluation of stochastic defenses. The paper's strengths include the careful attack construction: it discloses the earlier implementation bug, uses a standalone verification script, reports ablations for the number of EoT iterations, and applies existing unit tests for detecting weak evaluations. The main limitation is that the attacks are run on models retrained from the official code rather than on the exact models from the original defense paper, and the paper acknowledges that the original models were larger, trained longer, and sometimes adversarially trained. Consequently, the blanket conclusion that 'the defense is not robust' is stronger than what the evidence directly establishes.","major_comments":[{"comment":"The paper's headline claim that the defense 'is not robust' is broader than the evidence. The models attacked in Table 1 are retrained from the official code, not the exact models from [11]; the paper itself states that 'the paper [11] reports slightly higher robustness numbers using larger models, longer training runs, and combining with adversarial training' and that those models and training code are not publicly released. Thus the attack directly shows only that the reproduced official implementation is vulnerable, not that the defense as originally claimed is not robust. The abstract and conclusion should either be scoped to 'the public implementation' or 'the reproduced model,' or the authors should provide evidence that the reproduction is representative of the original defense (e.g., by comparing clean and robust accuracy profiles on the same protocol).","section":"Section 4 (Setup) and Abstract"},{"comment":"The quantitative reductions quoted in the abstract (e.g., 'from 62% to 11%') are measured on only 100 test samples, and the paper does not describe how these samples were selected. The large gap between the achieved robust accuracy and the AutoAttack baseline is sufficient for a qualitative refutation, but the exact figures should be reported with a confidence interval or the evaluation should be run on a larger random subset of the test set so that the numerical claims are not overstated.","section":"Section 4, Table 1"}],"minor_comments":[{"comment":"There is a typo in the abstract ('this defense' robustness' should be 'this defense's robustness') and in Section 1 'the notably exception' should be 'the notable exception.'","section":"Abstract and Section 1"},{"comment":"The unit test description omits the number of unit-test models and the exact pass criterion, so a reader cannot tell whether a 'unit test pass rate of 60%' refers to the fraction of models on which the attack succeeded or the fraction of samples. Please clarify and refer to the exact protocol in [36].","section":"Section 3.2"},{"comment":"Reference [34] is missing the full author list ('W Xu' should be 'Weilin Xu, David Evans, and Yanjun Qi').","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The technical content is sound and the attack appears carefully implemented, with the disclosed bug fix and standalone verification script being particularly reassuring. The main concern is that the paper's title and abstract make a blanket claim about the defense, while the experiments only cover a reproduction from the official code. If the authors are willing to scope the claim to the official implementation (or provide evidence of representativeness), the paper would be acceptable. The sample-size issue for the exact numerical claims is secondary but should also be addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is a short note that delivers a straightforward message: the Ensemble Everything Everywhere defense, as implemented in the official released code, is not robust. The authors train from that code, reproduce a 62% AutoAttack robust accuracy on CIFAR-10 (48% on CIFAR-100), and with a standard bag of tricks — PGD plus transfer from a model without the CrossMax operator, EoT, hinge loss, more steps — they drop that to 11% and 14%. The gradient-masking diagnosis is clearly demonstrated with loss-surface plots and the Zimmerman unit test, which passes at only 60% on the original evaluation. That is a solid, useful result.\n\nThe paper is honest about its own process. The original version of this report had a bug that made perturbations up to 10x too large; it is disclosed at the top, corrected, and the corrected attack is verified by a standalone script that saves adversarial examples and re-evaluates them. That kind of transparency is rare and should count as a plus.\n\nThe soft spots are the ones you'd expect. First, robust accuracy is measured on only 100 test samples. That's thin, though the 10-run averaging and standard deviations help. Second, the attack code is not released, which makes exact replication harder. Third, and most important: the models attacked are retrained from the official code, not the exact models from the original defense paper. The original reported 72% on CIFAR-10 and used larger models and longer training; the note's reproduction gets 61.8% under AutoAttack. The stress-test concern that the original version might be more robust is real but, in my reading, not fatal. The vulnerability comes from the CrossMax operator and the randomness, which are present in any version, and the attack transfers from a no-CrossMax model. It is possible that a heavily adversarially-trained variant would do better, but the note explicitly limits its claim to the released implementation, and the released implementation is what the community has. The title is a bit broader than the evidence, and the abstract's 'from 62% to 11%' should have been clear that 62% is their reproduction, not the defense's claimed 72%. That's a wording issue, not a scientific one.\n\nWho is this for? Anyone working on adversarial robustness, specifically defense evaluation. It's a clean case study in why AutoAttack is not enough and why adaptive attacks are mandatory. It deserves a real referee, not a desk reject. I'd recommend sending it to review, with the main requests being: release the attack code, and either evaluate on more samples or explicitly frame the results as an attack on the released implementation rather than the defense in full generality.","headline":"Strong adaptive attack with disclosed bug fix convincingly breaks the released E3 implementation; the only real caveat is that the exact original models were not attacked, but the limitation is disclosed and the core diagnosis holds.","tokens_in":8853,"tokens_out":5867,"would_cite":true,"duration_ms":51606,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The 'Ensemble Everything Everywhere' defense is not robust to adversarial attack: adaptive attacks reduce its robust accuracy from 62% to 11% on CIFAR-10 and from 48% to 14% on CIFAR-100 under $\\ell_\\infty$ perturbations of $8/255$.","keywords":["adversarial robustness","gradient masking","adaptive attacks","expectation over transformation","ensemble everything everywhere","CIFAR-10","CIFAR-100","robustness evaluation"],"falsifier":"Train the original defense exactly as described (larger models, longer training, with adversarial training) and run this paper's adaptive attack under the same $\\ell_\\infty$ threat model; if the adversarial training version keeps robust accuracy near the claimed 48% (CIFAR-100) or 62% (CIFAR-10), the paper's conclusion that the defense is not robust would be falsified for that version.","tokens_in":7904,"feed_emoji":"🛡️","tokens_out":5248,"duration_ms":45782,"temperature":0.7,"pith_summary":"This paper argues that the recently proposed 'Ensemble Everything Everywhere' defense, which ensembles a model's intermediate representations across noisy image resolutions, is not robust to adversarial examples. Under an $\\ell_\\infty$ threat model with $\\varepsilon=8/255$, the authors' adaptive attacks reduce robust accuracy from 62% to 11% on CIFAR-10 and from 48% to 14% on CIFAR-100, roughly a three-to-four-fold overstatement of the claimed robustness. The root cause is severe gradient masking introduced by the defense's random preprocessing and its CrossMax aggregation, which makes standard attacks such as AutoAttack appear to succeed while failing to find real adversarial examples. The paper also corrects a bug in its earlier version that had inflated perturbation sizes by a factor of ten.","feed_headline":"Adaptive attacks cut 'ensemble everything' defense to 11–14%","feed_subtitle":"CIFAR robust accuracy drops from 62% to 11% (CIFAR-10) and 48% to 14% (CIFAR-100) once gradient masking is bypassed.","key_machinery":"The central objects are the defense's CrossMax aggregation (normalize each layer's logits, then each class, then take the $k$-th highest score across layers) and its random multi-resolution preprocessing; together they create a spiky loss landscape that masks gradients. The attack's load-bearing mechanism is expectation over transformation: averaging gradients over many random preprocessings, combined with transfer from the mean-aggregation variant, bypasses the masking and lets standard PGD and APGD find adversarial examples.","core_discovery":"The paper claims that the defense's published robustness numbers are overclaimed. Using the officially released training code, the authors reproduce clean accuracies of 88.9% (CIFAR-10) and 64.1% (CIFAR-100) and AutoAttack robust accuracies consistent with the original reports (61.8% and 47.9%). They then build an adaptive attack that first reveals gradient masking in the loss landscape, then attacks a mean-aggregation variant of the model and transfers the resulting adversarial examples to the full defense while averaging gradients over many random preprocessings (expectation over transformation). With further tricks—more steps, a larger initial radius, and a hinge loss—the attack drives robust accuracy down to 11.3% on CIFAR-10 and 13.8% on CIFAR-100.","pith_inferences":["Because the authors evaluated models from the official code without the original paper's larger networks, longer training, or optional adversarial training, the result does not strictly rule out that the adversarially trained version is more robust; the evidence refutes the claim for the standard version released in the official repository.","The failure mode suggests that other defenses combining random input transformations with piecewise-constant aggregation functions may hide similar gradient masking, so future evaluations should include a 'remove the non-smooth component and transfer' baseline before making robustness claims.","The multi-resolution representation itself may still be useful for interpretability and image manipulation, independent of worst-case robustness.","A testable extension: run the same adaptive attack on the original authors' exact models if they are released; if robust accuracy remains near the claimed 48% (CIFAR-100) or 62% (CIFAR-10), the overclaim would be confined to the re-implementation rather than the defense idea."],"forward_implications":["AutoAttack alone is not a sufficient evaluation for defenses with random preprocessing and non-smooth aggregation; adaptive attacks that account for the randomness are needed.","The defense does not provide a fourth, non-adversarial-training approach to high robustness, contrary to its initial claim.","Perceptually aligned gradients do not imply adversarial robustness; interpretable perturbations can coexist with severe gradient masking.","Existing evaluation techniques—unit tests, loss landscape visualization, and expectation over transformation—suffice to break this defense, reinforcing the need for rigorous adaptive evaluation before claiming robustness."],"supporting_citations":[{"why":"The defense under evaluation; supplies the method and the claimed robust accuracy numbers that this paper challenges.","marker":"[11]"},{"why":"AutoAttack baseline used to confirm the reported robustness before showing it is insufficient.","marker":"[8]"},{"why":"Supplies the expectation-over-transformation attack strategy and the gradient-masking framework.","marker":"[2]"},{"why":"Unit tests whose 60% pass rate shows the original evaluation was too weak.","marker":"[36]"},{"why":"Adaptive attack methodology that motivates attacking the defense directly rather than with off-the-shelf tools.","marker":"[28]"},{"why":"PGD, the base attack that the authors extend with transfer, EoT, and extra tricks.","marker":"[18]"},{"why":"Concurrent evaluation that also found transfer from the mean-aggregation model reduces robustness.","marker":"[26]"},{"why":"Records the bug in the earlier attack version that created perturbations ten times larger than allowed, which this version corrects.","marker":"[10]"}],"fun_headline_variants":["Adaptive attack cuts 'ensemble everything' robust accuracy to 11–14%","Gradient masking exposed: 'ensemble everything' robust drops to 11–14%","Overclaimed defense: adaptive attack drops 'ensemble everything' to 11–14%","Adaptive attack reveals 'ensemble everything' not robust: 11–14% accuracy","Ensemble everything defense fails adaptive attack: robust accuracy 11–14%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack targets models trained from the official released code, not the exact models used in the original defense paper (which trained larger models for longer and optionally with adversarial training), so the conclusion depends on these public-code models faithfully representing the defense.","fun_headline_variants_meta":{"raw":{"variants":["Adaptive attack cuts 'ensemble everything' robust accuracy to 11–14%","Gradient masking exposed: 'ensemble everything' robust drops to 11–14%","Overclaimed defense: adaptive attack drops 'ensemble everything' to 11–14%","Adaptive attack reveals 'ensemble everything' not robust: 11–14% accuracy","Ensemble everything defense fails adaptive attack: robust accuracy 11–14%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00056,"raw_usage":{"total_tokens":2637,"prompt_tokens":901,"completion_tokens":1736,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":517,"completion_tokens_details":{"reasoning_tokens":1628}},"tokens_in":517,"tokens_out":1736,"duration_ms":15028,"temperature":1.0,"reasoning_tokens":1628,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:48:58.823973+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the original defense exactly as described (larger models, longer training, with adversarial training) and run this paper's adaptive attack under the same $\\ell_\\infty$ threat model; if the adversarial training version keeps robust accuracy near the claimed 48% (CIFAR-100) or 62% (CIFAR-10), the paper's conclusion that the defense is not robust would be falsified for that version.","supporting_citations":[{"cited_title":"Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness, 2024","cited_arxiv_id":null,"evidence_quote":"The defense under evaluation; supplies the method and the claimed robust accuracy numbers that this paper challenges."},{"cited_title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","cited_arxiv_id":null,"evidence_quote":"AutoAttack baseline used to confirm the reported robustness before showing it is insufficient."},{"cited_title":"Increasing confidence in adversarial robustness evaluations","cited_arxiv_id":null,"evidence_quote":"Unit tests whose 60% pass rate shows the original evaluation was too weak."},{"cited_title":"On adaptive attacks to adversarial example defenses","cited_arxiv_id":null,"evidence_quote":"Adaptive attack methodology that motivates attacking the defense directly rather than with off-the-shelf tools."},{"cited_title":"Public comment: Robustness eval- uation seems invalid","cited_arxiv_id":null,"evidence_quote":"Concurrent evaluation that also found transfer from the mean-aggregation model reduces robustness."},{"cited_title":"A note on implementation errors in recent adaptive attacks against multi-resolution self-ensembles, 2025","cited_arxiv_id":null,"evidence_quote":"Records the bug in the earlier attack version that created perturbations ten times larger than allowed, which this version corrects."}],"review_version":1}