SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Normalization settings for Imagenet for Resnet were kept as-is from the pytorch examples  $^2$  and also as per the Fixup repository  $^3$  as well as for Efficientnet  $^4$ . For training, we utilize SGD. Please consult the attached codebase for all code-based details. Everything was run on a single Tesla V100 GPU, on Torch 1.6, torchvision 0.7.0. All confidence intervals appearing in this paper were generated by bootstrapping and asymmetric intervals were written in  $\pm$  of the max one-sided deviation. We use the Wilcoxon sign-rank test for determination of statistical significance, with  $p < 10^{-3}$  as the cutoff, we refer to anything more significant than this  $p$ -value as passing the test here on. Cosine learning rate is used to train the Fixup resnet as per [Zhang et al., 2019].
$^{2}$ https://github.com/pytorch/examples/blob/main/imagenet/main.py
<sup>3</sup>https://github.com/hongyi-zhang/Fixup
<sup>4</sup>https://github.com/lukemelas/EfficientNet-PyTorch/tree/master/examples/imagenet
C Original ResNets
We recall that in this class fall 5 models, namely Resnet-18,34,50,101, and 152. In terms of block count, they respectively possess 8, 16, 16, 33, 50 layers. All radial attacks are performed with the last 2 layers up to which we have access. Access is granted upto blocks 6, 12, 12, 25, 38 respectively. So for example, on Resnet-18 the radial attack uses the loss signal from blocks 5, 6 alone to craft the example. Every value provided in every table is a percentage accuracy metric.
Table 11: Clean accuracies for ResNets
ResNet type	18	34	50	101	152
Acc@1	69.75	73.31	76.13	77.37	78.31
Acc@5	89.07	91.42	92.86	93.54	94.04
Table 12: Comparison of FGSM and Random noise, Top-1 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
Resnet-18	1.95	69.40	1.16	68.58	1.22	67.11
Resnet-34	4.36	73.06	2.95	72.43	3.13	71.23
Resnet-50	8.18	75.79	6.62	74.89	7.10	73.57
Resnet-101	9.93	77.24	8.32	76.79	9.10	75.57
Resnet-152	10.23	77.21	8.76	76.76	9.82	76.28
Table 13: Comparison of FGSM and Random noise, Top-5 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
Resnet-18	21.93	88.94	15.39	88.51	13.74	87.46
Resnet-34	30.54	91.31	23.65	90.96	22.08	90.26
Resnet-50	39.04	92.07	33.33	92.32	32.58	91.58
Resnet-101	43.27	93.52	37.88	93.25	37.61	92.75
Resnet-152	44.65	93.78	39.23	93.48	38.25	92.98
Table 14: Comparison of PGD attacks, top-1 and top-5 accuracy, with confidence intervals on different Resnet types.
Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
18	0.006 ±0.001	3.374 ±0.04	0.0 ±0.0	0.484 ±0.04	0.0 ±0.0	0.17 ±0.02
34	0.006 ±0.001	4.386 ±0.03	0.006 ±0.001	0.666 ±0.04	0.004 ±0.001	0.288 ±0.03
50	0.028 ±0.007	8.076 ±1.23	0.006 ±0.002	2.914 ±0.4	0.0 ±0.0	1.956 ±0.3
101	0.032 ±0.07	9.648 ±1.76	0.008 ±0.002	3.902 ±0.62	0.006 ±0.002	2.702 ±0.54
152	0.042 ±0.08	9.864 ±1.83	0.014 ±0.003	4.16 ±0.73	0.015 ±0.004	3.253 ±0.64
Table 15: Comparison of Angular attacks, top-1 and top-5 accuracy, with confidence intervals on different Resnet types.
Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
18	23.416 ±1.22	40.034 ±2.12	2.422 ±0.52	5.980 ±1.12	0.454 ±0.11	1.602 ±0.39
34	7.164 ±1.28	14.320 ±2.48	0.592 ±0.64	1.916 ±0.32	0.216 ±0.04	0.814 ±0.27
50	13.968 ±2.82	24.796 ±5.22	1.418 ±0.22	3.680 ±0.83	0.432 ±0.12	1.478 ±0.26
101	7.012 ±0.62	13.886 ±1.23	0.874 ±0.126	2.606 ±0.78	0.390 ±0.122	1.346 ±0.28
152	5.030 ±0.4	10.438 ±1.02	0.534 ±0.12	1.572 ±0.265	0.248 ±0.05	0.808 ±0.21
At higher values of  $\epsilon$ , angular attack outperforms the FGSM one. The confidence intervals (constructed by bootstrapping, denoted by  $\pm$ ) mark the 5 and 95 percentile confidence intervals and can be used to gauge statistical significance. The wilcoxon signed rank test passed for every case where the point estimate of the angular attack was better than the FGSM one, with the exception of top-1 on Resnet-101.
D Fixup ResNets
Just as with original Resnets, here we have 5 models, namely Resnet-18,34,50,101, and 152. In terms of block count, they respectively possess 8, 16, 16, 33, 50 layers. All radial attacks are performed with the last 2 layers up to which we have access. Access is granted upto blocks 6, 12, 12, 25, 38 respectively. So for example, on FixUpResnet-18 the radial attack uses the loss signal from blocks 5, 6 alone to craft the example. Every value provided in every table is a percentage accuracy metric. In short, everything is performed just as with the original Resnets.
Table 16: Clean accuracies for ResNets
ResNet type	18	34	50	101	152
Acc@1	68.212	70.466	72.938	73.596	73.866
Acc@5	87.910	89.470	90.932	91.273	91.528
Table 17: Comparison of FGSM and Random noise, Top-1 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
Resnet-18	2.09	68.18	1.25	67.61	1.19	66.28
Resnet-34	3.73	70.79	2.18	70.39	2.08	69.36
Resnet-50	5.34	73.29	3.63	72.80	3.51	71.61
Resnet-101	6.37	74.41	4.17	73.93	4.17	72.76
Resnet-152	6.59	74.68	4.71	74.21	4.60	73.06
Table 18: Comparison of FGSM and Random noise, Top-5 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
Resnet-18	23.17	87.91	14.23	87.56	11.33	86.75
Resnet-34	29.86	89.52	19.71	89.28	16.05	88.58
Resnet-50	33.67	91.12	23.32	90.83	19.95	90.10
Resnet-101	37.22	91.83	26.18	91.63	22.50	91.00
Resnet-152	37.64	92.09	26.29	91.80	22.70	91.24
Table 19: Comparison of PGD attacks, top-1 and top-5 accuracy, with confidence intervals on different Resnet types.
Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
18	0.034 ±0.003	4.490 ±0.32	0.014 ±0.003	0.322 ±0.05	0.008 ±0.002	0.058 ±0.013
34	0.106 ±0.02	6.524 ±0.8	0.046 ±0.008	0.608 ±0.108	0.030 ±0.007	0.142 ±0.03
50	0.090 ±0.015	5.592 ±1.26	0.016 ±0.003	0.266 ±0.05	0.006 ±0.002	0.022 ±0.005
101	0.140 ±0.03	6.988 ±1.13	0.018 ±0.005	0.317 ±0.04	0.006 ±0.001	0.048 ±0.004
152	0.124 ±0.08	7.474 ±1.18	0.020 ±0.003	0.340 ±0.06	0.004 ±0.001	0.030 ±0.005
Table 20: Comparison of Angular attacks, top-1 and top-5 accuracy, with confidence intervals on different Resnet types.
Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
18	66.972 ±1.78	87.128 ±0.68	62.856 ±0.78	83.970 ±0.68	54.666 ±1.24	77.336 ±1.27
34	69.968 ±0.84	88.972 ±0.67	67.012 ±1.27	86.780 ±0.84	61.868 ±0.94	83.034 ±0.53
50	72.914 ±0.42	90.434 ±0.62	68.368 ±1.2	87.818 ±0.67	61.664 ±1.2	82.570 ±0.87
101	73.306 ±1.07	91.128 ±0.48	69.424 ±0.47	88.686 ±0.34	62.550 ±0.81	83.318 ±0.56
152	73.626 ±0.72	91.412 ±0.37	70.224 ±0.84	89.078 ±0.64	63.700 ±0.84	84.116 ±0.74
Unlike the original resnets, the angular values do not even come close to the FGSM counterparts. This strongly suggests that removal of batch norm completely fixes this mode of vulnerability.
E EfficientNets
Here we have 5 models, namely EfficientNets B1 to B5. In terms of block count, they respectively possess 23, 23, 26, 32, 39 layers. All radial attacks are performed with the last 2 layers upto which we have access. Access is granted upto blocks 17, 17, 19, 24, 31 respectively. So for example, on B1 the radial attack uses the loss signal from blocks 16, 17 alone to craft the example. Every value provided in every table is a percentage accuracy metric. In short, everything is performed just as with the original Resnets.
Table 21: Clean accuracies for EfficientNets
Efficientnet type	B1	B2	B3	B4	B5
Clean accuracy (top-1)	78.382	79.808	81.532	83.026	83.778
Clean accuracy (top-5)	94.036	94.732	95.646	96.342	96.710
Table 22: Comparison of FGSM and Random noise, Top-1 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
B1	21.314	77.863	16.860	77.950	14.220	77.296
B2	26.522	79.604	21.926	79.302	20.218	78.564
B3	30.700	81.430	26.526	81.064	25.164	80.678
B4	39.380	82.842	34.820	82.712	33.274	82.344
B5	42.012	83.744	38.002	83.628	36.764	83.424
Table 23: Comparison of FGSM and Random noise, Top-5 accuracy.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
FGSM	Random	FGSM	Random	FGSM	Random
B1	47.767	93.663	39.758	93.681	38.54	93.582
B2	52.634	94.696	45.114	94.532	42.356	94.222
B3	56.612	95.650	50.478	95.484	48.448	95.282
B4	63.678	96.314	58.024	96.226	56.314	96.116
B5	67.620	96.740	62.750	96.708	61.226	96.626
Table 24: Comparison of PGD attacks, top-1 and top-5 accuracy, with confidence intervals.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
B1	0.430 ±0.082	3.318 ±0.43	0.078 ±0.012	0.386 ±0.05	0.017 ±0.004	0.197 ±0.022
B2	0.618 ±0.102	3.092 ±0.52	0.064 ±0.006	0.340 ±0.07	0.012 ±0.002	0.218 ±0.04
B3	0.698 ±0.108	2.482 ±0.56	0.136 ±0.02	0.484 ±0.07	0.044 ±0.006	0.318 ±0.07
B4	0.590 ±0.08	2.112 ±0.4	0.054 ±0.009	0.470 ±0.08	0.018 ±0.004	0.380 ±0.05
B5	0.812 ±0.12	1.728 ±0.35	0.135 ±0.02	0.260 ±0.04	0.073 ±0.008	0.125 ±0.03
Table 25: Comparison of Angular attacks, top-1 and top-5 accuracy, with confidence intervals.
Net Type	ε = 0.03	ε = 0.06	ε = 0.1
Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
B1	11.479 ±1.25	19.501 ±1.86	0.592 ±0.063	1.616 ±0.22	0.156 ±0.024	0.533 ±0.083
B2	13.902 ±1.74	22.421 ±1.54	0.878 ±0.122	2.208 ±0.37	0.153 ±0.024	0.589 ±0.028
B3	9.596 ±0.64	16.476 ±1.12	0.442 ±0.07	1.267 ±0.112	0.130 ±0.002	0.474 ±0.028
B4	12.045 ±1.54	19.192 ±2.05	0.377 ±0.042	1.104 ±0.17	0.091 ±0.008	0.377 ±0.042
B5	16.164 ±2.41	24.350 ±1.54	0.728 ±0.062	1.793 ±0.289	0.104 ±0.014	0.468 ±0.047
With the re-introduction of Batchnorm, the radial attack is again competitive and beats FGSM. We re-perform the same procedure as for Resnets to determine statistical significance against FGSM. The wilcoxon signed rank test passed for every case where the point estimate of the angular attack was better than the FGSM one.
F Results on ViT models
These results should be taken in context of our discussions on Layer normalization. Note that all models are from the PyTorch implementation of ViT [Dosovitskiy et al., 2020].
Table 26: Attack results for  $\epsilon = 0.03$ . Main values represent top-1 accuracy, and values in brackets represent top-5 accuracy.
Model	FGSM	PGD	Angular
ViT-B-16	45.5(73.5)	21.8(67.5)	38.2(69.4)
ViT-B-32	42.9(70.2)	24.7(68.6)	36.5(69.3)
ViT-L-16	55.4(84.1)	15.9(63.5)	38.4(70.8)
ViT-L-32	43.6(73.4)	29.7(73.8)	34.8(73.2)
Table 27: Attack results for  $\epsilon = 0.06$ . Main values represent top-1 accuracy, and values in brackets represent top-5 accuracy.
Model	FGSM	PGD	Angular
ViT-B-16	40.2(67.2)	13.5(44.3)	26.8(52.3)
ViT-B-32	37.5(64.3)	17.4(40.2)	28.5(50.8)
ViT-L-16	45.3(73.8)	12.5(32.8)	31.7(45.2)
ViT-L-32	38.7(68.4)	15.2(44.2)	22.8(52.8)
Table 28: Attack results for  $\epsilon = 0.1$ . Main values represent top-1 accuracy, and values in brackets represent top-5 accuracy.
Model	FGSM	PGD	Angular
ViT-B-16	35.1(60.6)	5.7(18.5)	16.7(28.5)
ViT-B-32	34.8(59.4)	5.4(21.1)	17.8(31.8)
ViT-L-16	36.0(65.6)	8.2(17.7)	14.5(33.8)
ViT-L-32	34.1(61.7)	5.8(22.9)	13.9(38.5)
For context, we show the clean accuracies as follows:
Table 29: Top-1 and Top-5 accuracies on ImageNet-1K for various models.
Model	Top-1 Acc.	Top-5 Acc.
ViT-B-16	81.072	95.318
ViT-B-32	75.912	92.466
ViT-L-16	79.662	94.638
ViT-L-32	76.972	93.07
G Ablations on Resnets-18,34,50
We first check if the independence structure of latents grows more independent with depth by examining the cross-diagonal average absolute correlation across block groups in Resnet-18. This is seen to decay with depth.
Table 30: Comparing independence structures on Resnet-18 by comparing absolute value of cross-diagonal correlations, across block groups.
Block count	1	2	3
Average off-diagonal coefficient (absolute)	0.41	0.32	0.19
Now, we present results that exhibit the variation in accuracies as the layers being attacked grow further in the network. As a reminder, resnet-18 possesses 8 blocks divided into 4 groups as  $[2,2,2,2]$  while resnets 34 and 50 both possess 16 blocks divided as  $[3,4,6,3]$ . We will use 1-based indexing to denote the layer upto which we have access, and the last 2 layers upto which we have access will provide the entire signal. Under the Wilcoxon sign rank test, the fall was monotonic, as suggested by the point estimates.
Table 31: Ablation on Resnet-18. Last 2 layers of the net granted access to are used to craft the attack.
Access till	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
5	47.55 ±2.2	71.09 ±3.2	12.6 ±1.2	27.8 ±2.1	3.38 ±0.4	8.28 ±0.6
6	22.57 ±1.4	39.82 ±1.2	2.12 ±0.3	6.55 ±0.4	0.60 ±0.1	1.81 ±0.3
7	7.84 ±0.83	16.58 ±0.76	0.18 ±0.03	1.44 ±0.16	0.13 ±0.02	0.54 ±0.12
Table 32: Ablation on Resnet-34. Last 2 layers of the net granted access to are used to craft the attack.
Access till	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
8	54.46 ±1.78	77.35 ±0.68	18.44 ±0.45	32.68 ±0.68	4.95 ±0.86	11.68 ±1.26
9	35.84 ±0.78	59.32 ±0.82	6.32 ±0.56	13.84 ±0.56	1.39 ±0.37	13.84 ±1.78
10	26.22 ±1.56	41.5 ±1.45	1.58 ±0.38	3.88 ±1.02	0.60 ±0.12	1.52 ±0.37
11	13.20 ±0.26	22.68 ±0.86	0.94 ±0.31	2.34 ±0.22	0.34 ±0.06	0.92 ±0.17
12	6.40 ±0.72	12.05 ±1.89	0.45 ±0.12	2.27 ±0.56	0.20 ±0.08	0.65 ±0.22
Table 33: Ablation on Resnet-50. Last 2 layers of the net granted access to are used to craft the attack.
Access till	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
9	53.06 ±1.89	72.74 ±2.76	14.48 ±1.74	25.52 ±1.29	2.16 ±0.48	5.84 ±0.62
10	38.10 ±1.44	54.3 ±0.57	6.44 ±0.42	12.24 ±0.82	1.08 ±0.24	2.24 ±0.45
11	24.55 ±1.22	42.78 ±1.04	2.84 ±0.32	8.44 ±0.18	0.14 ±0.06	2.04 ±0.28
12	8.56 ±1.08	14.08 ±1.78	1.76 ±0.035	3.22 ±0.83	0.55 ±0.12	1.55 ±0.37
The point we wish to make clear is this: the fall is fairly unidirectional across all models with depth, as suggested by our previous analysis. Fixing the  $\epsilon = 0.03$ , which shows the biggest gap between layers as larger values of  $\epsilon$  decrease every accuracy to zero, we can examine more layers to see this for the angular attack:
Table 34: Resnet-18: Top-1 and Top-5 under angular attack
Depth	5	6	7	8
Top-1	47.55	22.57	7.84	2.78
Top-5	71.09	39.82	16.58	7.89
Table 35: Resnet-34: Top-1 and Top-5 under angular attack
Depth	8	9	10	11	12	13	14	15	16
Top-1	54.46	35.84	26.22	13.20	6.40	6.32	5.92	5.7	5.2
Top-5	77.35	59.32	41.50	22.68	12.05	11.86	10.53	10.46	10.29
Table 36: Resnet-50: Top-1 and Top-5 under angular attack
Depth	8	9	10	11	12	13	14	15
Top-1	65.54	53.06	38.10	24.55	8.56	7.2	5.42	2.95	2.42
Top-5	87.55	72.74	54.3	42.78	14.08	12.56	9.87	6.28	5.76
H Ablations with respect to number of iterations, number of layers averaged over and ensembling
Table 37 reports the difference in performance with respect to the default case ( $t_{init} = 20$ ) as we vary the number of initial iterations. All results were performed on the vanilla Resnets. Positive values indicate stronger attack. There is no clear trend except that 20 is actually not the optimal value (15 is a bit stronger).
Table 37: Ablation with respect to number of initial iterations  $t_{init}$  with Resnets trained on Imagenet ( $\epsilon = 0.03$  and average over 2 layers). Top-1 results (top-5 results in brackets).
Resnet	\(t_{init}\)=5	\(t_{init}\)=10	\(t_{init}\)=15	\(t_{init}\)=20	\(t_{init}\)=25	\(t_{init}\)=30
18	-0.5(-0.6)	0.1(1.3)	-0.2(0.5)	0.0	0.6(-1.4)	1.7(0.1)
34	1.5(0.4)	-1.5(-0.5)	0.8(0.3)	0.0	-1.3(1.1)	-1.9(1.7)
50	1.9(-1.6)	-1.3(-0.4)	1.5(1.7)	0.0	-0.1(-1.4)	0.5(-0.5)
101	1.3(-0.4)	0.1(1.3)	1.8(-1.0)	0.0	-1.1(1.3)	-0.8(1.6)
152	0.6(-0.3)	1.6(1.1)	1.2(0.2)	0.0	-0.1(-1.3)	-0.3(-0.5)
Table 38 compares performance of our attack as we vary the number of iterations. Negative values indicate worse performance relative to baseline (40 iterations). We can see there is some gain in moving to 50 iterations. However the standard evaluation practice is with 40, so we did not optimize over this step.
Table 38: Ablation with respect to the total number of iterations ( $t_{init} + t_{radial}$ ) with Resnets trained on Imagenet ( $\epsilon = 0.03$  and average over 2 layers). Top-1 results (top-5 results in brackets).
Resnet	30 iterations	40 iterations	50 iterations
18	-0.52(-0.43)	0.0(0.0)	0.38(1.97)
34	-1.36(-0.7)	0.0(0.0)	0.3(0.87)
50	-1.16(-0.34)	0.0(0.0)	0.28(0.02)
101	-0.21(-0.02)	0.0(0.0)	0.63(0.74)
152	-1.56(-0.19)	0.0(0.0)	0.11(1.86)
Table 39 compares the performance of our attack as we vary the number of layers that we average over. Negative values are worse relative to baseline (2 layers to be averaged over). We can clearly see the 2-layer averaging is actually quite helpful. Bigger gains are possible with 3 or 4 layers averaged over, but at the cost of more evaluations.
Table 39: Ablation with respect to number of layers averaged over with Resnets trained on Imagenet for 40 iterations ( $\epsilon = 0.03$ ). Top-1 results (top-5 results in brackets).
Resnet	1 layer	2 layers	3 layers	4 layers
18	-1.37(-1.21)	0.0(0.0)	1.09(1.79)	3.49(2.93)
34	-2.64(-3.08)	0.0(0.0)	2.95(2.67)	3.47(0.93)
50	-2.79(-2.95)	0.0(0)	2.8(2.15)	3.8(3.18)
101	-3.27(-3.55)	0.0(0.0)	0.47(0.31)	0.39(0.5)
152	-2.74(-2.98)	0.0(0.0)	0.66(0.45)	0.83(0.33)
Table 40 reports the performance of ensembling targeted and angular losses. Positive values indicate gains with respect to the angular attack on its own.
Table 40: Ensemble (targeted loss with angular loss) for Resnets trained on Imagenet for 40 iterations ( $\epsilon = 0.03$  and average over 2 layers). Top-1 results (top-5 results in brackets).
Resnet	ensemble
18	3.38(1.62)
34	0.88(2.05)
50	0.64(3.81)
101	0.89(1.79)
152	0.99(2.1)
I Baselines of Targeted Attacks and Stronger Random Attacks
Here, we check if providing a latent, generated from an instance of a different label, as the initial direction of ILAP is useful as opposed to using  $-||z_i||$ . To be clear, in this case,  $||z_{i} - z_{j}||$  is minimized, where  $z_{j}$  arises from an instance of a different label. Then, the initial deviation is increased via ILAP.
We also construct an alternative random baseline, termed "naive ILAP". In this, an initial random deviation of a random, not necessarily batchnormed layer (we select a random ReLU layer per instance), is increased via ILAP, in the  $L_{2}$  norm.
We run these baselines for  $\epsilon = 0.03, 0.06$  as at 0.1 the values rapidly approach zero for any method. It is apparent that the targeted method is roughly on par with ours and the naive method performs worse. Hence, our method is basically as good as having these points to perturb towards, "for free" just from the manifold structure.
Table 41: Targeted benchmark on all original Resnets
Net Type	ε = 0.03	ε = 0.06
Top 1	Top 5	Top 1	Top 5
Resnet-18	25.16	42.58	1.46	5.85
Resnet-34	12.2	21.8	1.9	2.86
Resnet-50	13.55	30.97	0.65	5.16
Resnet-101	5.85	13.66	2.86	6.67
Resnet-152	9.68	16.77	1.29	3.87
Table 42: Naive ILAP on all original Resnets
Net Type	ε = 0.03	ε = 0.06
Top 1	Top 5	Top 1	Top 5
Resnet-18	31.11	52.11	9.92	20.66
Resnet-34	19.57	37.59	6.34	15.15
Resnet-50	25.37	36.59	5.81	14.84
Resnet-101	25.37	37.56	5.71	14.29
Resnet-152	22.58	36.13	3.23	8.39
J Transfer Results on CIFAR-10 and CIFAR-100
We show accuracies under the radial attack when Resnet-18,34, and 50 are subjected to it after transfer learning on CIFAR-10 and CIFAR-100. We also show the corresponding baseline drops under FGSM, PGD, random noise and no noise. For Resnets, the final block group (i.e. for example, Resnet-50 has [3, 4, 6, 3] as its block groups, so the last 3) is tuned along with a linear classifier. The wilcoxon signed rank test passed for every case where the point estimate of the angular attack was better than the FGSM one.
Note that our attack is markedly more successful on CIFAR-100 and in general seems to reduce the classifier to randomly guessing and thus has difficulty lowering it below 10 and 50 percent on CIFAR-10 for top-1 and top-5 respectively.
Table 43: Clean accuracies on CIFAR-10
Network type	Resnet-18	Resnet-34	Resnet-50
Clean accuracy (top-1)	89.380	89.500	91.210
Clean accuracy (top-5)	99.640	99.790	99.740
Table 44: Results on CIFAR-10, Resnet-50
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	4.230	16.680	4.250	15.360	4.250	15.320
Random FGSM	83.930	99.480	71.730	98.520	59.180	83.220
Angular	52.950	94.770	48.250	92.00	38.300	83.220
15.020	58.700	14.160	55.310	14.080	54.200
Table 45: Results on CIFAR-10, Resnet-34
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	2.88	13.74	2.81	8.67	2.84	7.97
Random FGSM	81.59	99.19	66.7	96.95	52.25	93.30
Angular	47.00	92.08	42.77	89.58	30.79	83.18
10.29	54.79	9.4	52.17	8.940	52.100
Table 46: Results on CIFAR-10, Resnet-18
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	4.3	6.3	4.3	5.6	4.28	5.58
Random FGSM	84.10	99.25	73.69	98.05	68.22	97.08
Angular	36.82	88.74	36.52	87.33	30.65	82.2
10.83	52.38	10.82	49.22	10.51	49.14
Table 47: Clean accuracies on CIFAR-100
Network type	Resnet-18	Resnet-34	Resnet-50
Clean accuracy (top-1)	67.410	69.500	71.170
Clean accuracy (top-5)	90.270	91.140	92.510
Table 48: Results on CIFAR-100, Resnet-50
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	0.16	0.20	0.14	0.14	0.14	0.14
Random FGSM	64.42	88.18	53.1	79.76	38.63	66.23
Angular	29.28	59.02	25.86	51.95	15.01	35.14
2.32	10.79	2.16	9.72	1.88	9.49
Table 49: Results on CIFAR-100, Resnet-34
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	1.16	1.38	1.13	1.2	1.14	1.22
Random FGSM	60.37	85.01	46.68	73.09	34.37	60.34
Angular	25.97	52.32	25.27	48.92	20.08	40.94
1.63	7.55	1.440	6.22	1.39	6.16
Table 50: Results on CIFAR-100, Resnet-18
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	0.0	0.0	0.0	0.0	0.0	0.0
Random FGSM	60.88	86.19	49.94	78.68	42.41	71.08
Angular	13.28	36.48	15.88	37.77	13.84	32.8
2.17	8.57	1.57	7.04	1.34	6.48
J.1 Results on the Caltech Birds Dataset (CUB)
These experiments were performed on Resnet-50 on the Caltech Birds dataset [Wah et al., 2011]. Everything in the setup is exactly as per the CIFAR-10 and CIFAR-100 case.
Table 51: Results on Caltech-Birds, Resnet-50
Method	ε = 0.03	ε = 0.06	ε = 0.1
Top 1	Top 5	Top 1	Top 5	Top 1	Top 5
PGD	0.0	0.03	0.0	0.0	0.0	0.0
Baseline	61.02	88.9	61.02	88.9	61.02	88.9
FGSM	1.2	11.7	1.0	10.5	0.7	9.5
Angular	10.31	25.15	0.8	6.2	0.5	3.8
K Transfer results between architectures
First, we consider results of adversarial attacks as we transfer between different types of Resnets. We consider the difference in transferability between our method and that of PGD for all cases (positive values denote our attack is stronger).
Table 52: Transfer results at  $\epsilon = 0.03$ . Row denotes the source model, column denotes the model attacked. All values denote differences relative to the corresponding PGD values (positive values denote our attack is stronger).
Resnet types	18	34	50	101
18	-	1.4	2.2	-1.2
34	1.5	-	2.1	1.5
50	1.7	2.2	-	2.4
101	1.3	3.7	2.5	-
Table 53: Transfer results at  $\epsilon = 0.06$ . Row denotes the source model, column denotes the model attacked. All values denote differences relative to the corresponding PGD values (positive values denote our attack is stronger).
Resnet types	18	34	50	101
18	-	-0.8	0.7	-1.2
34	2.6	-	3.2	4.5
50	4.8	3.4	-	1.5
101	2.1	5.2	3.2	-
Table 54: Transfer results at  $\epsilon = 0.1$ . Row denotes the source model, column denotes the model attacked. All values denote differences relative to the corresponding PGD values (positive values denote our attack is stronger).
Resnet types	18	34	50	101
18	-	3.5	4.6	5.2
34	6.5	-	5.2	6.4
50	5.9	9.1	-	7.2
101	6.4	5.9	7.0	-
We also will show a case where the model being attacked can be a non-batchnormed model, in this case, VGG16 [Simonyan and Zisserman, 2014]. The results appear below. In all cases, the source model is a Resnet, the attacked model is VGG16, and the result is the difference between PGD and our attack (positive values denote our attack is stronger).
Table 55: Difference between PGD and our attack (positive values indicate that our attack is stronger). The source model is a Resnet, the attacked model is VGG16.
Source Resnet	ε = 0.03	ε = 0.06	ε = 0.1
18	+3.8	+5.4	+7.5
34	+4.3	+5.8	+8.6
50	+3.2	+4.7	+10.5
101	+4.8	+6.2	+9.2
L Interactions with defenses and robust models
We consider the most key defence - adversarial training [Shrivastava et al., 2017]. For this process, we carried out adversarial training with an even mixture of FGSM, PGD, and radial attack (1 each for each training instance) for Resnet-18,34,50 for 20 epochs. Even after the training process, the radial attack remained effective. We show the results so obtained.