A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles

TL;DR

An implementation issue in recent adaptive attacks against the multi-resolution self-ensemble defense is documents, revealing an intriguing finding: properly bounded adaptive attacks against strong multi-resolution self-ensembles often align with human perception, suggesting the need to reconsider how to measure adversarial robustness.

Abstract

This note documents an implementation issue in recent adaptive attacks (Zhang et al. [2024]) against the multi-resolution self-ensemble defense (Fort and Lakshminarayanan [2024]). The implementation allowed adversarial perturbations to exceed the standard $L_\infty = 8/255$ bound by up to a factor of 20$\times$, reaching magnitudes of up to $L_\infty = 160/255$. When attacks are properly constrained within the intended bounds, the defense maintains non-trivial robustness. Beyond highlighting the importance of careful validation in adversarial machine learning research, our analysis reveals an intriguing finding: properly bounded adaptive attacks against strong multi-resolution self-ensembles often align with human perception, suggesting the need to reconsider how we measure adversarial robustness.

Figures (2)

• Figure 1: Comparison of standard adversarial perturbations and implementation-error perturbations. In zhang2024gradientmaskingallatonceensemblev1, the authors used an adaptive adversarial attack technique that, due to an implementation error and unbeknownst to them, exceeded the standard attack bound of $L_\infty = 8/255$ by a factor of over 10$\times$. The left panel shows a standard attack within accepted bounds, while the right panel showcases a real adversarial perturbation generated by the authors' code that significantly exceeds these bounds. The excessive perturbation becomes clearly visible to human observers, indicating a significant departure from the standard evaluation protocol where perturbations should be imperceptible.
• Figure 2: Standard adversarial accuracy benchmarks assume that humans will not perceive a different class under $L_\infty = 8/255$ perturbations, but our properly bounded adaptive attacks challenge this assumption. Here we show two "successful" adaptive attacks on a multi-resolution self-ensemble, changing the model's decision from house to road on the left, and sea to mountain on the right. When participants of a lecture at EPFL fort2024epfllecture presented these attacked images and a limited set of classes to choose from, they agreed with the target label, being "confused" in the same way the model was. This shows a remarkable alignment of the model with human perception. Given that this is traditionally labeled as a "successful" attack, we believe that we need to reconsider how we establish adversarial robustness.