Pith. sign in

REVIEW 2 major objections 3 minor 3 cited by

Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense

T0 review · 2 major / 3 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The 'Ensemble Everything Everywhere' defense is not robust to adversarial attack: adaptive attacks reduce its robust accuracy from 62% to 11% on CIFAR-10 and from 48% to 14% on CIFAR-100 under $\ell_\infty$ perturbations of $8/255$.

desk verdict Strong adaptive attack with disclosed bug fix convincingly breaks the released E3 implementation; the only real caveat is that the exact original models were not attacked, but the limitation is disclosed and the core diagnosis holds. read the letter →

arxiv 2411.14834 v2 pith:3QKOZD7S submitted 2024-11-22 cs.LG cs.CR

Jie Zhang , Christian Schlarmann , Kristina Nikolić , Nicholas Carlini , Francesco Croce , Matthias Hein , Florian Tramèr This is my paper · ORCID
classification cs.LGcs.CR
keywords adversarialrobustnessgradientmaskingadaptiveattacksexpectationovertransformationensembleeverythingeverywhereCIFAR-10CIFAR-100evaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the recently proposed 'Ensemble Everything Everywhere' defense, which ensembles a model's intermediate representations across noisy image resolutions, is not robust to adversarial examples. Under an $\ell_\infty$ threat model with $\varepsilon=8/255$, the authors' adaptive attacks reduce robust accuracy from 62% to 11% on CIFAR-10 and from 48% to 14% on CIFAR-100, roughly a three-to-four-fold overstatement of the claimed robustness. The root cause is severe gradient masking introduced by the defense's random preprocessing and its CrossMax aggregation, which makes standard attacks such as AutoAttack appear to succeed while failing to find real adversarial examples. The paper also corrects a bug in its earlier version that had inflated perturbation sizes by a factor of ten.

What carries the argument

The central objects are the defense's CrossMax aggregation (normalize each layer's logits, then each class, then take the $k$-th highest score across layers) and its random multi-resolution preprocessing; together they create a spiky loss landscape that masks gradients. The attack's load-bearing mechanism is expectation over transformation: averaging gradients over many random preprocessings, combined with transfer from the mean-aggregation variant, bypasses the masking and lets standard PGD and APGD find adversarial examples.

What would settle it

Train the original defense exactly as described (larger models, longer training, with adversarial training) and run this paper's adaptive attack under the same $\ell_\infty$ threat model; if the adversarial training version keeps robust accuracy near the claimed 48% (CIFAR-100) or 62% (CIFAR-10), the paper's conclusion that the defense is not robust would be falsified for that version.

Watch

Extended reading notes

Core claim

The paper claims that the defense's published robustness numbers are overclaimed. Using the officially released training code, the authors reproduce clean accuracies of 88.9% (CIFAR-10) and 64.1% (CIFAR-100) and AutoAttack robust accuracies consistent with the original reports (61.8% and 47.9%). They then build an adaptive attack that first reveals gradient masking in the loss landscape, then attacks a mean-aggregation variant of the model and transfers the resulting adversarial examples to the full defense while averaging gradients over many random preprocessings (expectation over transformation). With further tricks—more steps, a larger initial radius, and a hinge loss—the attack drives robust accuracy down to 11.3% on CIFAR-10 and 13.8% on CIFAR-100.

Load-bearing premise

The attack targets models trained from the official released code, not the exact models used in the original defense paper (which trained larger models for longer and optionally with adversarial training), so the conclusion depends on these public-code models faithfully representing the defense.

Editorial extensions

If this is right

  • AutoAttack alone is not a sufficient evaluation for defenses with random preprocessing and non-smooth aggregation; adaptive attacks that account for the randomness are needed.
  • The defense does not provide a fourth, non-adversarial-training approach to high robustness, contrary to its initial claim.
  • Perceptually aligned gradients do not imply adversarial robustness; interpretable perturbations can coexist with severe gradient masking.
  • Existing evaluation techniques—unit tests, loss landscape visualization, and expectation over transformation—suffice to break this defense, reinforcing the need for rigorous adaptive evaluation before claiming robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the authors evaluated models from the official code without the original paper's larger networks, longer training, or optional adversarial training, the result does not strictly rule out that the adversarially trained version is more robust; the evidence refutes the claim for the standard version released in the official repository.
  • The failure mode suggests that other defenses combining random input transformations with piecewise-constant aggregation functions may hide similar gradient masking, so future evaluations should include a 'remove the non-smooth component and transfer' baseline before making robustness claims.
  • The multi-resolution representation itself may still be useful for interpretability and image manipulation, independent of worst-case robustness.
  • A testable extension: run the same adaptive attack on the original authors' exact models if they are released; if robust accuracy remains near the claimed 48% (CIFAR-100) or 62% (CIFAR-10), the overclaim would be confined to the re-implementation rather than the defense idea.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 3 minor

Summary. This short note evaluates the robustness of the 'Ensemble Everything Everywhere' defense [11] under an l_infinity threat model with epsilon = 8/255. The authors retrain the official implementation on CIFAR-10 and CIFAR-100, demonstrate severe gradient masking via loss-landscape plots and unit tests, and then apply adaptive attacks (PGD with EoT, transfer from a mean-aggregation surrogate, and APGD with a larger initial radius) to reduce robust accuracy from 61.8% to 10.9% on CIFAR-10 and from 47.9% to 13.6% on CIFAR-100. They conclude that the defense is not robust and that its earlier evaluation was inadequate. The report also discloses and corrects a bug in an earlier version of the attack, and uses a separate verification script to ensure final perturbations respect the epsilon bound.

Significance. If the result holds, this is a valuable negative result for a high-profile defense and a useful case study in the adaptive evaluation of stochastic defenses. The paper's strengths include the careful attack construction: it discloses the earlier implementation bug, uses a standalone verification script, reports ablations for the number of EoT iterations, and applies existing unit tests for detecting weak evaluations. The main limitation is that the attacks are run on models retrained from the official code rather than on the exact models from the original defense paper, and the paper acknowledges that the original models were larger, trained longer, and sometimes adversarially trained. Consequently, the blanket conclusion that 'the defense is not robust' is stronger than what the evidence directly establishes.

major comments (2)
  1. [Section 4 (Setup) and Abstract] The paper's headline claim that the defense 'is not robust' is broader than the evidence. The models attacked in Table 1 are retrained from the official code, not the exact models from [11]; the paper itself states that 'the paper [11] reports slightly higher robustness numbers using larger models, longer training runs, and combining with adversarial training' and that those models and training code are not publicly released. Thus the attack directly shows only that the reproduced official implementation is vulnerable, not that the defense as originally claimed is not robust. The abstract and conclusion should either be scoped to 'the public implementation' or 'the reproduced model,' or the authors should provide evidence that the reproduction is representative of the original defense (e.g., by comparing clean and robust accuracy profiles on the same protocol).
  2. [Section 4, Table 1] The quantitative reductions quoted in the abstract (e.g., 'from 62% to 11%') are measured on only 100 test samples, and the paper does not describe how these samples were selected. The large gap between the achieved robust accuracy and the AutoAttack baseline is sufficient for a qualitative refutation, but the exact figures should be reported with a confidence interval or the evaluation should be run on a larger random subset of the test set so that the numerical claims are not overstated.
minor comments (3)
  1. [Abstract and Section 1] There is a typo in the abstract ('this defense' robustness' should be 'this defense's robustness') and in Section 1 'the notably exception' should be 'the notable exception.'
  2. [Section 3.2] The unit test description omits the number of unit-test models and the exact pass criterion, so a reader cannot tell whether a 'unit test pass rate of 60%' refers to the fraction of models on which the attack succeeded or the fraction of samples. Please clarify and refer to the exact protocol in [36].
  3. [References] Reference [34] is missing the full author list ('W Xu' should be 'Weilin Xu, David Evans, and Yanjun Qi').

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the robustness evaluation is an empirical measurement, not a derivation from the paper's own claims.

full rationale

This paper makes no predictive claim and fits no parameters to a target outcome; its central numbers are direct empirical measurements of attack success on models trained from the defense's official code. The reported robust-accuracy drops (61.8% to 11.3% on CIFAR-10, 47.9% to 13.8% on CIFAR-100) are results of running adaptive attacks, not quantities implied by construction from the paper's assumptions. The methodology it cites—Expectation over Transformation, AutoAttack, adaptive-attack guidelines, and unit tests for evaluating defenses—is external, established work and is used as a toolkit rather than as a premise that contains the conclusion. The authors' own prior publications appear only as standard methodological references, not as load-bearing self-citations invoked to force a result. The disclosed limitation that the original defense's exact trained models were not released, so the authors attack retrained models from official code, is a scope caveat about representativeness, not a circular step: the attack does not assume the defense is broken in order to show it is broken. No equation, definition, or citation chain equates the output to an input. Therefore the derivation chain is self-contained and no significant circularity is present.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper's central claim is an attack result, so the main 'free parameters' are attack effort hyperparameters (steps, EoT iterations, radius schedule). These are hand-chosen to be strong but are not fitted to the data. The axioms concern the representativeness of the retrained models, the small evaluation sample, and the validity of standard adaptive attack techniques. No new entities are introduced.

free parameters (3)
  • PGD steps = 400-1000
    The number of attack steps is a hand-chosen hyperparameter; more steps improve the attack, and the reported robust accuracy depends on this effort.
  • EoT iterations = 100
    The number of stochastic backward passes used to average gradients is chosen via an ablation (Figure 2b); the attack needs enough iterations to overcome the defense's randomness.
  • APGD initial radius schedule = 3 epsilon, then 2 epsilon, then epsilon
    The attack starts with a larger perturbation budget for a fraction of steps to escape local regions, then decays to the allowed bound; this is an existing APGD option that is hand-enabled.
assumptions (3)
  • domain assumption The officially released training code faithfully implements the E3 defense as described in [11].
    The paper trains models from the public repository because the exact models from the original paper (larger, longer training, adversarially trained) are not released; if the public code differs, the result may not transfer exactly.
  • domain assumption Robust accuracy measured on 100 test samples is representative of the defense's robustness.
    All attack numbers in Table 1 use 100 test samples, with 10 random runs; this small sample limits precision but the standard deviations are about 2-3%.
  • standard math Standard adaptive attack techniques (EoT, transfer learning from a simplified model, APGD) are valid evaluations for a randomized defense.
    These methods are established in the adversarial robustness literature and have been used to break prior defenses; they are cited as [2], [8], [28].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense." pith.science (2026). https://pith.science/paper/3QKOZD7S

@misc{pith2026241114834,
  author       = {Pith},
  title        = {Pith review of: Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3QKOZD7S}},
  note         = {Machine review of arXiv:2411.14834}
}
abstract

Ensemble everything everywhere is a defense to adversarial examples that was recently proposed to make image classifiers robust. This defense works by ensembling a model's intermediate representations at multiple noisy image resolutions, producing a single robust classification. This defense was shown to be effective against multiple state-of-the-art attacks. Perhaps even more convincingly, it was shown that the model's gradients are perceptually aligned: attacks against the model produce noise that perceptually resembles the targeted class. In this short note, we show that this defense is not robust to adversarial attack. We first show that the defense's randomness and ensembling method cause severe gradient masking. We then use standard adaptive attack techniques to reduce the defense's robust accuracy from 48% to 14% on CIFAR-100 and from 62% to 11% on CIFAR-10, under the $\ell_\infty$-norm threat model with $\varepsilon=8/255$.

Figures

Figures reproduced from arXiv: 2411.14834 by the authors.

Figure 1
Figure 1. If we plot a two-dimensional slice of the loss surface, the original model in (a) has extremely [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. (a) For different attack strategies, we plot the attack’s loss averaged over 100 examples: (1) directly optimizing the target model (in green) has trouble converging due to gradient masking; (2) attacking the “source” model with a mean aggregation (blue) works well; (3) transferring the attack from the source model to the target model (red) outperforms the attack that directly optimizes over the target model. (b) We… view at source ↗
Figure 3
Figure 3. Examples of clean images (top row) with the adversarial examples found by our attack [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Obfuscated Activations Bypass LLM Latent-Space Defenses

    cs.LG 2024-12 conditional novelty 6.0 of 10

    Obfuscation attacks that jointly optimize for target behavior and for low monitor scores bypass sparse autoencoders, probes, and OOD detectors on LLMs, while performance degrades mainly on hard tasks like writing correct SQL.

  2. Position: Machine Learning Conferences Should Establish a "Refutations and Critiques" Track

    cs.LG 2025-06 conditional novelty 5.0 of 10

    ML conferences should create an official peer-reviewed track dedicated to refuting and critiquing previously published work.

  3. A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles

    cs.CR 2025-01 conditional novelty 5.0 of 10

    An implementation bug in Zhang et al.'s adaptive attack accumulated L-infinity perturbations up to 160/255, and with correct 8/255 bounds the multi-resolution self-ensemble defense retains non-trivial robustness.

Reference graph

Works this paper leans on

36 extracted references · 20 canonical work pages · cited by 3 Pith papers

  1. [11]

    Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness, 2024

    Stanislav Fort and Balaji Lakshminarayanan. Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness, 2024

    work page 2024

  2. [1]

    Robustness to Adversarial Examples through an Ensemble of Specialists

    Mahdieh Abbasi and Christian Gagn´ e. Robustness to adversarial examples through an ensemble of specialists. arXiv preprint arXiv:1702.06856 , 2017

    work page Pith review arXiv 2017

  3. [2]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274–283. PMLR, 2018

    2018

  4. [3]

    Evasion attacks against machine learning at test time

    Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim ˇSrndi´ c, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In European Conference on Machine Learning and Knowledge Discovery in Databases, pages 387–402. Springer, 2013

    work page 2013

  5. [4]

    Comment on "Biologically inspired protection of deep networks from adversarial attacks"

    Wieland Brendel and Matthias Bethge. Comment on ”biologically inspired protection of deep networks from adversarial attacks”. arXiv preprint arXiv:1704.01547 , 2017

    work page Pith review arXiv 2017

  6. [5]

    Defensive distillation is not robust to adversarial examples

    Nicholas Carlini and David Wagner. Defensive distillation is not robust to adversarial examples. arXiv preprint arXiv:1607.04311 , 2016

    arXiv 2016

  7. [6]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pages 39–57. Ieee, 2017

    2017

  8. [7]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning , pages 1310–1320, 2019

    work page 2019

Show all 36 references
  1. [8]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206–2216. PMLR, 2020

    2020

  2. [9]

    Mind the box: l 1-apgd for sparse adversarial attacks on image classifiers

    Francesco Croce and Matthias Hein. Mind the box: l 1-apgd for sparse adversarial attacks on image classifiers. In ICML, 2021

    2021

  3. [10]

    A note on implementation errors in recent adaptive attacks against multi-resolution self-ensembles, 2025

    Stanislav Fort. A note on implementation errors in recent adaptive attacks against multi-resolution self-ensembles, 2025

    2025

  4. [12]

    Do perceptually aligned gradients imply adversarial robustness? arXiv preprint arXiv:2207.11378 , 2022

    Roy Ganz, Bahjat Kawar, and Michael Elad. Do perceptually aligned gradients imply adversarial robustness? arXiv preprint arXiv:2207.11378 , 2022

    2022 arXiv

  5. [13]

    Ai2: Safety and robustness certification of neural networks with abstract interpretation

    Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin Vechev. Ai2: Safety and robustness certification of neural networks with abstract interpretation. In IEEE Symposium on Security and Privacy , 2018

    2018

  6. [14]

    Countering adversarial images using input transformations

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117 , 2017

    2017 arXiv

  7. [15]

    Certified robustness to adversarial examples with differential privacy

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy , pages 656–672, 2019. 8

    2019

  8. [16]

    Towards better adversarial purification via adversarial denoising diffusion training

    Yiming Liu, Kezhao Liu, Yao Xiao, Ziyi Dong, Xiaogang Xu, Pengxu Wei, and Liang Lin. Towards better adversarial purification via adversarial denoising diffusion training. arXiv preprint arXiv:2404.14309, 2024

    2024 arXiv

  9. [17]

    Foveation-based mechanisms alleviate adversarial examples

    Yan Luo, Xavier Boix, Gemma Roig, Tomaso Poggio, and Qi Zhao. Foveation-based mechanisms alleviate adversarial examples. arXiv preprint arXiv:1511.06292 , 2015

    2015 arXiv

  10. [18]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  11. [19]

    On detecting adversarial perturbations

    Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. arXiv preprint arXiv:1702.04267 , 2017

    2017 arXiv

  12. [20]

    Biologically inspired protection of deep networks from adversarial attacks

    Aran Nayebi and Surya Ganguli. Biologically inspired protection of deep networks from adversarial attacks. arXiv preprint arXiv:1703.09202 , 2017

    2017 arXiv

  13. [21]

    Improving adversarial robustness via promoting ensemble diversity

    Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning, pages 4970–4979. PMLR, 2019

    2019

  14. [22]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In ACM Asia Conference on Computer and Communications Security , pages 506–519, 2017

    2017

  15. [23]

    Barrage of random transforms for adversarially robust defense

    Edward Raff, Jared Sylvester, Steven Forsyth, and Mark McLean. Barrage of random transforms for adversarially robust defense. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6528–6537, 2019

    2019

  16. [24]

    Certified defenses against adversarial examples

    Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial examples. In International Conference on Learning Representations , 2018

    2018

  17. [25]

    Adversarial manipulation of deep representations

    Sara Sabour, Yanshuai Cao, Fartash Faghri, and David J Fleet. Adversarial manipulation of deep representations. arXiv preprint arXiv:1511.05122 , 2015

    2015 arXiv

  18. [26]

    Public comment: Robustness eval- uation seems invalid

    Christian Schlarmann, Francesco Croce, and Matthias Hein. Public comment: Robustness eval- uation seems invalid. https://openreview.net/forum?id=IHRQif8VQC&noteId=vUzo8RWZeM, 2024

    2024

  19. [27]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

    2014

  20. [28]

    On adaptive attacks to adversarial example defenses

    Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33:1633–1645, 2020

    2020

  21. [29]

    Ensemble adversarial training: Attacks and defenses

    Florian Tram` er, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018

    2018

  22. [30]

    Robustness may be at odds with accuracy

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 , 2018

    2018 arXiv

  23. [31]

    Provable defenses against adversarial examples via the convex outer adversarial polytope

    Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International conference on machine learning , pages 5286–5295. PMLR, 2018

    2018

  24. [32]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994 , 2020

    2001 arXiv

  25. [33]

    Mitigating adversarial effects through randomization

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991 , 2017. 9

    2017 arXiv

  26. [34]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    W Xu. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017

    2017 arXiv

  27. [35]

    ME-Net: Towards effective adversarial robustness with matrix estimation

    Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. ME-Net: Towards effective adversarial robustness with matrix estimation. arXiv preprint arXiv:1905.11971 , 2019

    1905 arXiv

  28. [36]

    Increasing confidence in adversarial robustness evaluations

    Roland S Zimmermann, Wieland Brendel, Florian Tramer, and Nicholas Carlini. Increasing confidence in adversarial robustness evaluations. Advances in neural information processing systems, 35:13174–13189, 2022. 10

    2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.