Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness

## Abstract

Abstract Adversarial examples pose a significant challenge to the robustness, reliability and alignment of deep neural networks. We propose a novel, easy-to-use approach to achieving high-quality representations that lead to adversarial robustness through the use of multi-resolution input representations and dynamic self-ensembling of intermediate layer predictions.
We demonstrate that intermediate layer predictions exhibit inherent robustness to adversarial attacks crafted to fool the full classifier, and propose a robust aggregation mechanism based on Vickrey auction that we call CrossMax to dynamically ensemble them.
By combining multi-resolution inputs and robust ensembling, we achieve significant adversarial robustness on CIFAR-10 and CIFAR-100 datasets without any adversarial training or extra data, reaching an adversarial accuracy of ≈ \approx 72% (CIFAR-10) and ≈ \approx 48% (CIFAR-100) on the RobustBench AutoAttack suite ( L ∞ = 8 / 255 ) L_{\infty}=8/255) with a finetuned ImageNet-pretrained ResNet152. This represents a result comparable with the top three models on CIFAR-10 and a +5 % gain compared to the best current dedicated approach on CIFAR-100. Adding simple adversarial training on top, we get ≈ \approx 78% on CIFAR-10 and ≈ \approx 51% on CIFAR-100, improving SOTA by 5 % and 9 % respectively and seeing greater gains on the harder dataset.
We validate our approach through extensive experiments and provide insights into the interplay between adversarial robustness, and the hierarchical nature of deep representations. We show that simple gradient-based attacks against our model lead to human-interpretable images of the target classes as well as interpretable image changes.
As a byproduct, using our multi-resolution prior, we turn pre-trained classifiers and CLIP models into controllable image generators and develop successful transferable attacks on large vision language models.

## 1 Introduction

The objective of this paper is to take a step towards aligning the way machines perceive visual information – as expressed by the learned computer vision classification function – and the way people perceive visual information – as represented by the inaccessible, implicit human vision classification function. The significant present-day mismatch between the two is best highlighted by the existence of adversarial attacks that affect machine models but do not transfer to humans. Our aim is to develop a vision model with high-quality, natural representations that agree with human judgment not only under static perturbations, such as noise or dataset shift, but also when exposed to active, motivated attackers trying to dynamically undermine their accuracy. While adversarial robustness serves as our primary case study, the broader implications of this alignment extend to aspects such as interpretability, image generation, and the security of closed-source models, underscoring its importance.

Adversarial examples in the domain of image classification are small, typically human-imperceptible perturbations $P$ to an image $X$ that nonetheless cause a classifier, $f:X\to y$, to misclassify the perturbed image $X+P$ as a target class $t$ chosen by the attacker, rather than its correct, ground truth class. This is despite the perturbed image $X+P$ still looking clearly like the ground truth class to a human, highlighting a striking and consistent difference between machine and human vision (first described in Szegedy et al. ()). Adversarial vulnerability is ubiquitous in image classification, from small models and datasets (Szegedy et al., ) to modern large models such CLIP (Radford et al., ), and successful attacks transfer between models and architectures to a surprising degree (Goodfellow et al., ) without comparable transfer to humans. In addition, adversarial examples exist beyond image classification, for example in out-of-distribution detection, where otherwise very robust systems fall prey to such targeted attacks (Chen et al., ; Fort, ), and language modeling (Guo et al., ; Zou et al., ).

We hypothesize that the existence of adversarial attacks is due to the significant yet subtle mismatch between what humans do when they classify objects and how they learn such a classification in the first place (the implicit classification function in their brains), and what is conveyed to a neural network classifier explicitly during training by associating fixed pixel arrays with discrete labels (the learned machine classification function). It is often believed that by performing such a training we are communicating to the machine the implicit human visual classification function, which seems to be borne by their agreement on the training set, test set, behaviour under noise, and recently even their robustness to out-of-distribution inputs at scale (Fort et al., ). We argue that while these two functions largely agree, the implicit human and learned machine functions are not exactly the same, which means that their mismatch can be actively exploited by a motivated, active attacker, purposefully looking for such points where the disagreement is large (for similar exploits in reinforcement learning see Leike et al. ()). This highlights the difference between agreement on most cases, usually probed by static evaluations, and an agreement in all cases, for which active probing is needed.

In this paper, we take a step towards aligning the implicit human and explicit machine classification functions, and consequently observe very significant gains in adversarial robustness against standard attacks as a result of a few, simple, well-motivated changes, and without any explicit adversarial training. While, historically, the bulk of improvement on robustness metrics came from adversarial training (Chakraborty et al., ), comparably little attention has been dedicated to improving the model backbone, and even less to rethinking the training paradigm itself. Our method can also be easily combined with adversarial training, further increasing the model’s robustness cheaply. Beyond benchmark measures of robustness, we show that if we optimize an image against our models directly, the resulting changes are human interpretable, suggesting at least much-harder-to-find instances of noise-like superstimuli that we usually find by attacking a model. This suggests an overall higher-quality, natural representations being learned by the model.

We operate under what what we call the Interpretability-Robustness Hypothesis: A model whose adversarial attacks typically look human-interpretable will also be adversarially robust. The aim of this paper is to support this hypothesis and to construct first versions of such robust classifiers, without necessarily reaching their peak performance via extensive hyperparameter tuning.

Firstly, inspired by biology, we design an active adversarial defense by constructing and training a classifier whose input, a standard $H\times W\times 3$ image, is stochastically turned into a $H\times W\times(3N)$ channel-wise stack of multiple downsampled and noisy versions of the same image. The classifier itself learns to make a decision about these $N$ versions at once, mimicking the effect of microsaccades in the human (and mammal) vision systems. We find that this alone gives us a very significant boost in adversarial robustness. An unrelated byproduct is that when we directly represent adversarial attacks as a sum of perturbations at different resolutions, by default, these attacks look human-interpretable rather than noise-like.
Secondly, we show experimentally that hidden layer features of a neural classifier show significant decorrelation between their representations under adversarial attacks – an attack fooling a network to see a dog as a car does not fool the intermediate representations, which still see a dog. We aggregate intermediate layer predictions into a self-ensemble dynamically, using a novel ensembling technique that we call a CrossMax ensemble. This leads to a classifier trained on the CIFAR-10 (or CIFAR-100) training set alone, without any additional adversarial training or extra data of any kind, that yet displays susceptibility to adversarial attacks at the standard $\ell_{\infty}=8/255$ level comparable to or surpassing the best, dedicated, and heavily adversarially trained models.

Thirdly, we show that our Vickrey-auction-inspired CrossMax ensembling yields very significant gains in adversarial robustness when ensembling predictors as varied as 1) independent brittle models, 2) predictions of intermediate layers of the same model, 3) predictions from several checkpoints of the same model, and 4) predictions from several self-ensemble models. We use the last option to gain $\approx 5\%$ in adversarial accuracy at the $L_{\infty}=8/255$ RobustBench’s AutoAttack on top of the best models on CIFAR-100. When we add light adversarial training on top, we outperform current best models by $\approx 5\%$ on CIFAR-10, and by $\approx 9\%$ on CIFAR-100, showing a promising trend where the harder the dataset, the more useful our approach compared to brute force adversarial training (see Figure [7](#S3.F7)).

Figure: Figure 2: Combining channel-wise stacked augmented and down-sampled versions of the input image with robust intermediate layer class predictions via CrossMax self-ensemble. The resulting model gains a considerable adversarial robustness without any adversarial training or extra data.
Refer to caption: /html/2408.05446/assets/x2.png

Our contributions are the following:

- 1.
Multiple resolutions as a robustness prior and an active defense. We demonstrate that stacking $N$ lower-resolution versions of an image channel-wise to form a $3N$-channel image (see Figure [3](#S2.F3)) and training a model to classify them simultaneously yields significant adversarial robustness. For this we draw biological inspiration from the saccade movements of the eye in mammals.
- 2.
A novel robust ensembling procedure called CrossMax. We introduce a novel, easy-to-use ensembling procedure inspired by Vickrey auctions that we call CrossMax, combining predictions from multiple classifiers in a robust way. We demonstrate its broad applicability for independent models, checkpoints of the same model, and predictions from intermediate layers of the same model. Using CrossMax, we improve upon leading RobustBench AutoAttack $L_{\infty}=8/255$ adversarial accuracy models by $\approx+5\%$ on CIFAR-100 and reach rough parity with top models on CIFAR-10 with no extra data or adversarial training. With light adversarial training on top, we surpass the current best models by $\approx+5\%$ on CIFAR-10 and $\approx+9\%$ on CIFAR-100, showing favourable scaling with dataset difficulty (see Figure [7](#S3.F7)).
- 3.
Using intermediate layer predictions.
We show experimentally that a successful adversarial attack on a classifier does not fully confuse its intermediate layer features (see Figure [5](#S2.F5)). An image of a dog attacked to look like e.g. a car to the classifier still has predominantly dog-like intermediate layer features. We harness this de-correlation as an active defense by CrossMax ensembling the predictions of intermediate layers. This allows the network to dynamically respond to the attack, forcing it to produce consistent attacks over all layers, leading to robustness and interpretability.
- 4.
(Byproduct) Multiple resolutions as an interpretability prior $\implies$ classifier to a generator. Using the multi-resolution intuition, we demonstrate that directly expressing an adversarial attack as a sum of perturbations of different resolutions produces human-interpretable images (see Figure [19](#S4.F19)) following natural image spectral properties instead of noise-like perturbations. We turn pretrained classifiers (Figure [15](#S4.F15)) and CLIP models (Figure [20](#S4.F20)) into controllable image generators by simply constructing an adversarial attack against them towards a particular label or text embedding. This also serves as a strong transfer prior, allowing us to construct transferable attacks on large vision language models that can be seen as early versions of jailbreaks (see Figure [18](#S4.F18) and Tables [3](#A1.T3), and [4](#A1.T4)).

## 2 Key Observations and Techniques

In this section we will describe the three key methods that we use in this paper. In Section [2.1](#S2.SS1) we introduce the idea of multi-resolution inputs, in Section [2.2](#S2.SS2) we introduce our robust CrossMax ensembling method, and in Section [2.3](#S2.SS3) we showcase the de-correlation between adversarially induced mistakes at different layers of the network and how to use it as an active defense.

### 2.1 The multi-resolution prior

Figure: Figure 3: An image input being split into $N$ progressively lower resolution versions that are then stacked channel-wise, forming a $3N$-channel image input to a classifier.
Refer to caption: /html/2408.05446/assets/x3.png

Drawing inspiration from biology, we use multiple versions of the same image at once, down-sampled to lower resolutions and augmented with stochastic jitter and noise. We train a model to classify this channel-wise stack of images simultaneously. We show that this by default yields gains in adversarial robustness without any explicit adversarial training.

#### 2.1.1 Classifying many versions of the same object at once

The human visual system has to recognize an object, e.g. a cat, from all angles, distances, under various blurs, rotations, illuminations, contrasts and similar such transformations that preserve the semantic content of whatever a person is looking at while widely changing the "pixel" values of the image projected on the retina.

A classification decision is not performed on a single frame but rather on a long stream of such frames that come about due to changing physical conditions under which an object is viewed as well as the motion of the eyes and changing properties of the retina (resolution, color sensitivity) at a place where the object is projected. We hypothesize that this is a key difference between the human visual system and a standard approach to image classification, where still, high-resolution frames are associated with discrete labels. We believe that bridging this gap will lead to better alignment between the implicit human classification function, and the explicit machine classification function.

Augmentations that preserve the semantic content of images while increasing their diversity have historically been used in machine learning, for an early example see LeCun et al. (). However, typically, a particular image $X$ appears in a single pass through the training set (an epoch) a single time, in its augmented form $X^{\prime}$. The next occurrence takes place in the following epoch, with a different augmentation $X^{\prime\prime}$. In Havasi et al. (), multiple images are fed into the network at once through independent subnetworks. In Fort et al. (), the same image $X$ is augmented $N$ times within the same batch, leading to faster training and higher final performance, likely due to the network having to learn a more transformation-invariant notion of the object at once. In this paper, we take this process one step further, presenting different augmentations as additional image channels at the same time. This can be viewed as a very direct form of ensembling.

#### 2.1.2 Biological eye saccades

Human eyes (as well as the eyes of other animals with foveal vision) perform small, rapid, and involuntary jitter-like motion called microsaccades (see e.g. Martinez-Conde et al. () for details). The amplitude of such motion ranges from approximately 2 arcminutes to 100 arcminutes. In the center of the visual field where the human eye has the highest resolution, it is able to resolve up to approximately 1 arcminute. That means that even the smallest microsaccade motion moves the image projected on the retina by at least one pixel in amplitude. The resolution gradually drops towards the edges of the visual field to about 100 arcminutes (Wandell, ). Even there the largest amplitude macrosaccades are sufficient to move the image by at least a pixel. The standard explanation is that these motions are needed to refresh the photosensitive cells on the retina and prevent the image from fading (Martinez-Conde et al., ). However, we hypothesize that an additional benefit is an increase in the robustness of the visual system. We draw inspiration from this aspect of human vision and add deterministically random jitter to different variants of the image passed to our classifier.

Apart from the very rapid and small amplitude microsaccades, the human eye moves around the visual scene in large motions called macrosaccades or just saccades. Due to the decreasing resolution of the human eye from the center of the visual field, a particular object being observed will be shown with different amounts of blur. In addition, the density of cone cells responsible for color vision also drops radially, meaning that the image will be shown with different amounts of color-grayscale information. This inspired us to resent a cascade of resolutions to the image classifier at once, and to add a deterministically random color-grayscale change to them.

#### 2.1.3 Multi-resolution input to a classifier

We turn an input image $X$ of full resolution $R\times R$ and 3 channels (RGB) into its $N$ variations of different resolutions $r\times r$ for $r\in\rho$. For CIFAR-10 and CIFAR-100, we are (arbitrarily) choosing resolutions $\rho=\{32,16,8,4\}$ and concatenating the resulting image variations $\mathrm{rescale_{R}}\left(\mathrm{rescale}_{r}(X)\right)$ channel-wise to a $R\times R\times(3|\rho|)$ augmented image $\bar{X}$. This is shown in Figure [3](#S2.F3). Similar approaches have historically been used to represent images, such as Gaussian pyramids introduced in Burt and Adelson (). To each variant we add 1) random noise both when downsampled and at the full resolution $R\times R$ (in our experiments of strength 0.1 out of 1.0), 2) a random jitter in the $x-y$ plane ($\pm 3$ in our experiments), 3) a small, random change in contrast, and 4) a small, random color-grayscale shift. This can also be seen as an effective reduction of the input space dimension available to the attacker, as discussed in Fort ().

### 2.2 CrossMax robust ensembling

#### 2.2.1 Robust aggregation methods, Vickrey auctions and load balancing

The standard way of ensembling predictions of multiple networks is to either take the mean of their logits, or the mean of their probabilities. This increases both the accuracy as well as predictive uncertainty estimates of the ensemble. (Lakshminarayanan et al., ; Ovadia et al., ) Such aggregation methods are, however, susceptible to being swayed by an outlier prediction by a single member of the ensemble or its small subset. This produces a single point of failure. The pitfalls of uncertainty estimation and ensembling have been highlighted in e.g. Ashukha et al. (), while the effect of ensembling on the learned classification function was studied in Fort et al. ().

With the logit mean in particular, an attacker can focus all their effort on fooling a single network’s prediction strongly enough towards a target class $t$. Its high logit can therefore dominate the full ensemble, in effect confusing the aggregate prediction. An equivalent and even more pronounced version of the effect would appear were we to aggregate by taking a max over classifiers per class. The calibration of individual members vs their ensemble is theoretically discussed in Wu and Gales ().

Our goal is to produce an aggregation method that is robust against an active attacker trying to exploit it, which is a distinct setup from being robust against e.g. untargeted perturbations. In fact, methods very robust against out-of-distribution inputs (Fort et al., ) are still extremely brittle against targeted attacks (Fort, ). Generally, this observation, originally stated as "Any observed statistical regularity will tend to collapse once pressure is placed upon it for control purposes" in Goodhart (), is called Goodhart’s law, and our goal is to produce an anti-Goodhart ensemble.

We draw our intuition from Vickrey auctions (Wilson, ) which are designed to incentivize truthful bidding. Viewing members of ensembles as individual bidders, we can limit the effect of wrong, yet overconfident predictions by using the 2^nd highest, or generally $k^{\mathrm{th}}$ highest prediction per class. This also produces a cat-and-mouse-like setup for the attacker, since which classifier produces the $k^{\mathrm{th}}$ highest prediction for a particular class changes dynamically as the attacker tries to increase that prediction. A similar mechanism is used in balanced allocation (Azar et al., ) and specifically in the k random choices algorithm for load balancing (Mitzenmacher et al., ).

Our CrossMax aggregation works a follows: For logits $Z$ of the shape $[B,N,C]$, where $B$ is the batch size, $N$ the number of predictors, and $C$ the number of classes, we first subtract the max per-predictor $\mathrm{max}(Z,\mathrm{axis}=1)$ to prevent Goodhart-like attacks by shifting the otherwise-arbitrary overall constant offset of a predictor’s logits. This prevents a single predictor from dominating. The second, less intuitive step, is subtracting the per-class max to encourage the winning class to win via a consistent performance over many predictors rather than an outlier. This is to prevent any class from spuriously dominating. We aggregate such normalized logits via a per-class topk function for our self-ensembles and median for ensembles of equivalent models, as shown in Algorithm [1](#alg1).

Figure: Algorithm 1 CrossMax = An Ensembling Algorithm with Improved Adversarial Robustness

To demonstrate experimentally different characteristics of prediction aggregation among several classifiers, we trained 10 ResNet18 models, starting from an ImageNet pretrained model, changing their final linear layer to output 10 classes of CIFAR-10. We then used the first 2 attacks of the RobustBench AutoAttack suite (APGD-T and APGD-CE; introduced in Croce and Hein () as particularly strong attack methods) and evaluated the robustness of our ensemble of 10 models under adversarial attacks of different $L_{\infty}$ strength. The results are shown in Figure [4](#S2.F4).

Figure: (a) CIFAR-10
Refer to caption: /html/2408.05446/assets/x4.png

The aggregation methods we show are 1) our CrossMax (Algorithm [1](#alg1)) (using median since the 10 models are expected to be equally good), 2) a standard logit mean over models, 3) median over models, and 4) the performance of the individual models themselves. While an ensemble of 10 models, either aggregated with a mean or median, is more robust than individual models at all attack strengths, it nonetheless loses robust accuracy very fast with the attack strength $L_{\infty}$ and at the standard level of $L_{\infty}=8/255$ it drops to $\approx$0%. Our CrossMax in Algorithm [1](#alg1) provides $>0$ robust accuracy even to $10/255$ attack strengths, and for $8/255$ gives a 17-fold higher robust accuracy than just plain mean or median. We use this aggregation for intermediate layer predictions (changing median to top3) as well and see similar, transferable gains. We call this setup a self-ensemble.

As an ablation, we tested variants of the CrossMax method. There are two normalization steps: A) subtracting the per-predictor max, and B) subtracting the per-class max. We exhaustively experiment with all combinations, meaning $\{_,A,B,AB,BA\}$, (robust accuracies at 4/255 are $\{4,4,0,22,0\}$%) and find that performing $A$ and then $B$, as in Algorithm [1](#alg1), is by far the most robust method. We perform a similar ablation for a robust, multi-resolution self-ensemble model in Table [5](#A4.T5) and reach the same verdict, in addition to confirming that the algorithm is very likely not accidentally masking gradients.

### 2.3 Only partial overlap between the adversarial susceptibility of intermediate layers

Figure: Figure 5: The impact of adversarial attacks ($L_{\infty}=8/255$, 128 attacks) against the full classifier on the accuracy and probabilities at all intermediate layers for an ImageNet-1k pretrained ResNet152 finetuned on CIFAR-10 via trained linear probes. The left panel shows the prediction accuracy on clean, unperturbed images, which rises from layer to layer, and the accuracy on adversarially attacked images, which is only lightly affected for all layers apart from the very last ones. These are the closest to the last layer, whose classification the attack was designed against. On the right panel, the mean predicted probability of the ground truth class and the target class of the adversary (always different from the ground truth) are shown. The target class probability only rises for the very last layers. Therefore the intermediate activations of an adversarially attacked image do not look like the target class, retaining the character of the original class instead.
Refer to caption: /html/2408.05446/assets/x6.png

Figure: Figure 6: Transfer of adversarial attacks ($L_{\infty}=8/255$, 512 attacks) against the activations of layer $\alpha$ on the accuracy of layer $\beta$ for $\alpha=0,10,27,43,53$ on ImageNet-1k pretrained ResNet152 finetuned on CIFAR-10 via trained linear probes. Each panel shows the effect of designing a pixel-level attack to confuse the linear probe at a particular layer. The blue curve is the test accuracy on the unperturbed data, and the red line shows the accuracy on the attacked images. The accuracy drops to 0 at the layer that is directly attacked (marked in orange), showing a successful attack. The effect is localized: attacking early layers mainly affects early layer predictions, middle layer attacks primarily affect middle layers, and likewise attacks on the final layers (the standard regime) primarily influence late layer performance. For more details, see Figure [21](#A1.F21).
Refer to caption: /html/2408.05446/assets/figures/attack_layer_transfer.png

A key question of both scientific and immediately practical interest is whether an adversarially modified image $X^{\prime}$ that looks like the target class $t$ to a classifier $f:X\to y$ also has intermediate layer representations that look like that target class. In Olah et al. (), it is shown via feature visualization that neural networks build up their understanding of an image hierarchically starting from edges, moving to textures, simple patterns, all the way to parts of objects and full objects themselves.
This is further explored in Carter et al. (). Does an image of a car that has been adversarially modified to look like a tortoise to the final layer classifier carry the intermediate features of the target class tortoise (e.g. the patterns on the shell, the legs, a tortoise head), of the original class car (e.g. wheels, doors), or something else entirely? We answer this question empirically.

To investigate this phenomenon, we fix a trained network $f:X\to y$ and use its intermediate layer activations $h_{1}(X),h_{2}(X),\cdots,h_{L}(X)$ to train separate trained linear probes (affine layers) that map the activation of the layer $l$ into classification logits $z_{i}$ as $g_{i}:h_{i}(X)\to y_{i}$. An image $X$ generates intermediate representations $(h_{1},h_{2},\dots,h_{L})$ that in turn generate $L$ different sets of classification logits $(z_{1},z_{2},\dots,z_{L})$.

In Figure [5](#S2.F5) we showcase this effect using an ImageNet-pretrained ResNet152 (He et al., ) finetuned on CIFAR-10. Images attacked to look like some other class than their ground truth (to the final layer classification) do not look like that to intermediate layers, as shown by the target class probability only rising in the very last layers (see Figure [5](#S2.F5)). We can therefore confirm that indeed the activations of attacked images do not look like the target class in the intermediate layers, which offers two immediate use cases: 1) as a warning flag that the image has been tempered with and 2) as an active defense, which is strictly harder.

This setup also allows us not only to investigate what the intermediate classification decision would be for an adversarially modified image $X^{\prime}$ that confuses the network’s final layer classifier, but also to generally ask what the effect of confusing the classifier at layer $\alpha$ would do to the logits at a layer $\beta$. The results are shown in Figure [6](#S2.F6) for 6 selected layers to attack, and the full attack layer $\times$ read-out layer is show in Figure [21](#A1.F21).

We find that attacks designed to confuse early layers of a network do not confuse its middle and late layers. Attacks designed to fool middle layers do not fool early nor late layers, and attacks designed to fool late layers do not confuse early or middle layers. In short, there seems to be roughly a 3-way split: early layers, middle layers, and late layers. Attacks designed to affect one of these do not generically generalize to others. We call this effect the adversarial layer de-correlation. This de-correlation allows us to create a self-ensemble from a single model, aggregating the predictions resulting from intermediate layer activations. To make sure that the ensemble is robust, we use the CrossMax method described in Section [2.2](#S2.SS2) and Algorithm [1](#alg1). While ensembling multiple equivalent models, we did not have to care about their different quality, however, here early layers are typically less accurate than late layers, as shown in Figure [5](#S2.F5).

In Figure [25](#A3.F25) we show the self-ensemble robustness under adversarial attacks of different strength for an ImageNet pretrained ResNet152 and ViT-B/16, with linear heads at each layer separately finetuned on CIFAR-10. The aggregation method in Algorithm [1](#alg1) provides non-zero robust accuracy for attacks of even $L_{\infty}=5/255$, while standard ensembling using mean logits as well as just the last layer prediction loses robust accuracy around 3/255. This is an early indication that CrossMax self-ensembling can actively use the decorrelation of intermediate layer adversarial susceptibilities for an active, white-box defense.

## 3 Training and Experimental Results

In this section we present in detail how we combine the previously described methods and techniques into a robust classifier on CIFAR-10 and CIFAR-100. We start both with a pretrained model and finetune it, as well as with a freshly initialized model. It turns out that finetuning a pre-existing model for robustness is technically easier and faster, therefore we predominantly focus on this approach. However, to demonstrate that the success of our technique does not simply come from massive pretraining, we also train a model from scratch.

### 3.1 Model and training details

The pretrained models we use are the ImageNet (Deng et al., ) trained ResNet18 and ResNet152 (He et al., ). Our hyperparameter search was very minimal and we believe that additional gains are to be had with a more involved search easily. The only architectural modification we make is to change the number of input channels in the very first convolutional layer from 3 to $3N$, where $N$ is the number of channel-wise stacked down-sampled images we use as input. We also replaced the final linear layer to map to the correct number of classes (10 for CIFAR-10 and 100 for CIFAR-100). Both the new convolutional layer as well as the final linear layer are initialized at random. The batch norm (Ioffe and Szegedy, ) is on for finetuning a pretrained model (although we did not find a significant effect beyond the speed of training).

We focused on the CIFAR-* datasets (Krizhevsky, ; ) that comprise 50,000 $32\times 32\times 3$ images. We arbitrarily chose $N=4$ and the resolutions we used are $32\times 32$, $16\times 16$, $8\times 8$, $4\times 4$ (see Figure [3](#S2.F3)). We believe it is possible to choose better combinations, however, we did not run an exhaustive hyperparameter search there. The ResNets we used expect $224\times 224$ inputs. We therefore used a bicubic interpolation to upsample the input resolution for each of the $12$ channels independently.

To each image (the $32\times 32\times 3$ block of RGB channels) we add a random jitter in the $x-y$ plane in the $\pm 3$ range. We also add a random noise of standard deviation 0.2 (out of 1.0). We believe that the biological jitter and noise are key aspects of a successful robust classifier, and therefore want to mimic their function here as well.

For training from scratch, we use a standard ResNet18 with the modifications above. We chose it since we primarily wanted to show the effect of multi-resolution inputs and multi-layer prediction aggregation rather than to find the maximum possible performance. We turn off batch normalization (Ioffe and Szegedy, ) not to conflate the effects we are exploring. While it is possible that additional architectural choices could lead to more robustness (as convincingly demonstrated in Peng et al. ()), we wanted to show the effect of our multi-resolution and self-ensemble choices in isolation.

All training is done using the Adam (Kingma and Ba, ) optimizer at a flat learning rate $\eta$ that we always specify. Optimization is applied to all trainable parameters and the batch norm is turned on in case of finetuning, but turned off for training from scratch.

Linear probes producing predictions at each layer are just single linear layers that are trained on top of the pre-trained and frozen backbone network, mapping from the number of hidden neurons in that layer (flattened to a single dimension) to the number of classes ($10$ for CIFAR-10 and $100$ for CIFAR-100). We trained them using the same learning rate as the full network for 1 epoch each.

### 3.2 Adversarial vulnerability evaluation

To make sure we are using as strong an attack suite as possible to measure our networks’ robustness and to be able to compare our results to other approaches, we use the RobustBench (Croce et al., ) library and its AutoAttack method, which runs a suite of four strong, consecutive adversarial attacks on a model in a sequence and estimates its adversarial accuracy (e.g. if the attacked images were fed back to the network, what would be the classification accuracy with respect to their ground truth classes). For faster evaluation during development, we used the first two attacks of the suite (APGD-CE and APGD-T) that are particularly strong and experimentally we see that they are responsible for the majority of the accuracy loss under attack. For full development evaluation (but still without the rand flag) we use the full set of four tests: APGD-CE, APGD-T, FAB-T and SQUARE. Finally, to evaluate our models using the hardest method possible, we ran the AutoAttack with the rand flag that is tailored against models using randomness.

For quick evaluation, we used 128 test images, and for a detailed evaluation 1024 images (on an A100 such a full evaluation takes several hours). We use the benchmark’s default settings. Given that our models use randomized components, we finally use the rand flag that triggers much slower but more powerful attacks (APGD-CE followed by APGD-DLR, with a modification for randomized classifiers, as described in Croce et al. ()). We only run them (on 128 test examples) at the very end without any tuning against them for fairness and compare our results to the leaderboard(^1^11[https://robustbench.github.io/](https://robustbench.github.io/)). The results without adversarial training are shown in Table [1](#S3.T1) and with adversarial training at Table [2](#S3.T2). The visual representation of the results is presented in Figure [7](#S3.F7).

### 3.3 Multi-resolution finetuning of a pretrained model

**Table 1: Full randomized (=the strongest against our approach) RobustBench AutoAttack adversarial attack suite results for 128 test samples at the $L_{\infty}=8/255$ strength. In this table we show the results of attacking our multi-resolution ResNet152 models finetuned on CIFAR-10 and CIFAR-100 from an ImageNet pretrained state without any adversarial training or extra data for 20 epochs with Adam at $\eta=3.3\times 10^{-5}$. We use our CrossMax ensembling on the model itself (self-ensemble), the final 3 epochs (3-ensemble), and on self-ensembles from 3 different runs (3-ensemble of self-ensembles). We also include results for a ResNet18 trained from scratch on CIFAR-10. Despite its simplicity, our method gets adversarial robustness of $\approx 72\%$ on CIFAR-10 (ranking #3 on RobustBench leaderboard) and $\approx 48\%$ on CIFAR-100, surpassing current best models by $+5\%$. Unlike other approaches, we do not use any extra data or adversarial training and our models gain adversarial robustness by default. Additional adversarial training helps, as shown in Table [2](#S3.T2).**
|  |  |  |  |  |  | rand RobustBench AutoAttack<br>$L_{\infty}=8/255$ # samples (%) |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Dataset | Adv. | Model | Method | # | Test | Adv | APGD$\to$ | APGD |
|  | train |  |  |  | acc | acc | CE | DLR |
| CIFAR-10 | $\times$ | ResNet18* | Self-ensemble | 1024 | 76.94 | 64.06 | 51.56 | 44.53 |
| CIFAR-10 | $\times$ | ResNet152 | Multi-res backbone | 128 | 89.17 | 41.44 | 32.81 | 21.88 |
| CIFAR-10 | $\times$ | ResNet152 | 3-ensemble | 128 | 91.06 | 67.97 | 61.72 | 59.38 |
| CIFAR-10 | $\times$ | ResNet152 | Self-ensemble | 128 | 87.14 | 53.12 | 50.00 | 43.75 |
| CIFAR-10 | $\times$ | ResNet152 | 3-ensemble of<br>self-ensembles | 128 | 90.20 | 71.88 | 68.75 | 68.75 |
| CIFAR-10 | $\checkmark$ | [] | SOTA #1 |  |  | 73.71 |  |  |
| CIFAR-100 | $\times$ | ResNet152 | Multi-res backbone | 128 | 65.70 | 25.00 | 21.88 | 13.28 |
| CIFAR-100 | $\times$ | ResNet152 | 3-ensemble | 128 | 66.63 | 47.66 | 39.06 | 37.50 |
| CIFAR-100 | $\times$ | ResNet152 | Self-ensemble | 512 | 65.71 | 46.29<br>$\pm$2.36 | 34.77<br>$\pm$2.09 | 30.08<br>$\pm$2.13 |
| CIFAR-100 | $\times$ | ResNet152 | 3-ensemble of<br>self-ensembles | 512 | 67.71 | 48.16<br>$\pm$2.65 | 40.63<br>$\pm$2.11 | 37.32<br>$\pm$1.98 |
| CIFAR-100 | $\checkmark$ | [] | SOTA #1 |  |  | 42.67 |  |  |

Figure: (a) CIFAR-10
Refer to caption: /html/2408.05446/assets/x7.png

In this section we discuss finetuning a standard pretrained model using our multi-resolution inputs. We demonstrate that this quickly leads to very significant adversarial robustness that matches and in some cases (CIFAR-100) significantly improves upon current best, dedicated approaches, without using any extra data or adversarial training. We see stronger gains on CIFAR-100 rather than CIFAR-10, suggesting that its edge might lie at harder datasets, which is a very favourable scaling compared to brute force adversarial training.

Figure: (a) Learning rate effects
Refer to caption: /html/2408.05446/assets/x9.png

We show that we can easily convert a pre-trained model into a robust classifier without any data augmentation or adversarial training in a few epochs of standard training on the target downstream dataset.

The steps we take are as follows:

- 1.
Take a pretrained model (in our case ResNet18 and ResNet152 pretrained on ImageNet)
- 2.
Replace the first layer with a fresh initialization that can take in $3N$ instead of $3$ channels
- 3.
Replace the final layer with a fresh initialization to project to 10 (for CIFAR-10) or 100 (for CIFAR-100) classes
- 4.
Train the full network with a small (this is key) learning rate for a few epochs

We find that using a small learning rate is key, which could be connected to the effects described for example in Thilak et al. () and Fort et al. (). While the network might reach a good clean test accuracy for high learning rates as well, only for small learning rates will it also get significantly robust against adversarial attacks, as shown in Figure [8](#S3.F8). In Figure [8(a)](#S3.F8.sf1) we show this effect for a ResNet18 trained for 3 epochs at different learning rates with the Adam optimizer. The optimum we find is around $3.3\times 10^{-5}$, which is what we use for all of our subsequent experiments in this section. We also find that the robust accuracy peaks early during training and decreases after that, as shown in Figure [8(b)](#S3.F8.sf2) for ResNet18.

In Table [1](#S3.T1) we present our results of finetuning an ImageNet pretrained ResNet152 on CIFAR-10 and CIFAR-100 for 10 epochs at the constant learning rate of $3.3\times 10^{-5}$ with Adam followed by 3 epochs at $3.3\times 10^{-6}$.

We find that even a simple 10 epoch finetuning of a pretrained model using our multi-resolution input results in a significant adversarial robustness. Somewhat surprisingly, the CrossMax ensemble is very good at increasing adversarial accuracy further even when taking close checkpoints from the same training run as independent classifiers.

When using the strongest rand flag for models using randomized components in the RobustBench AutoAttack without any tuning against, we show significant adversarial robustness, as shown in Tab [1](#S3.T1). On CIFAR-10, our results are comparable to the top three models on the leaderboard, despite never using any extra data or adversarial training. On CIFAR-100, our models actually lead by $+5\%$ over the current best model.

In Figure [7](#S3.F7) we can see the gradual increase in adversarial accuracy as we add layers of robustness. First, we get to $\approx 40\%$ by using multi-resolution inputs. An additional $\approx 10\%$ is gained by combining intermediate layer predictions into a self-ensemble. An additional $\approx 20\%$ on top is then gained by using CrossMax ensembling to combining 3 different self-ensembling models together. Therefore, by using three different ensembling methods at once, we reach approximately $70\%$ adversarial accuracy on CIFAR-10. The gains on CIFAR-100 are roughly equally split between the multi-resolution input and self-ensemble, each contributing approximately half of the robust accuracy.

### 3.4 Training from scratch

We train a ResNet18 from scratch on CIFAR-10 as a backbone, and then train additional linear heads for all of its intermediate layers to form a CrossMax self-ensemble. We find that, during training, augmenting our input images $X$ with an independently drawn images $X^{\prime}$ with a randomly chosen mixing proportion $p$ as $(1-p)X+pX^{\prime}$ increases the robustness of the trained model. This simple augmentation technique is known as mixup and is described in Zhang et al. ().
We believe that this works well due to our multi-resolution inputs that are the correct prior for robustness, and show that without them such mixing does not increase robustness. For finetuning a pretrained model, however, this is not needed.

For our ResNet18 model trained from scratch on CIFAR-10, we keep the pairs of images that are mixed in mixup fixed for 20 epochs at a time, producing a characteristic pattern in the training accuracies. Every 5 epochs we re-draw the random mixing proportions in the $[0,1/2]$ range. We trained the model for 380 epochs with the Adam optimizer (Kingma and Ba, ) at learning rate $10^{-3}$ and dropped it to $10^{-4}$ for another 120 epochs. The final checkpoint is the weight average of the last 3 epochs. The training batch size is 512. These choices are arbitrary and we did not run a hyperparameter search over them.

The results on the full RobustBench AutoAttack suite of attacks for CIFAR-10 are shown in Table [1](#S3.T1) for self-ensemble constructed on top of the multi-resolution ResNet18 backbone (the linear heads on top of each layer were trained for 2 epochs with Adam at $10^{-3}$ learning rate).

### 3.5 Adversarial finetuning

**Table 2: Full randomized (=the strongest against our approach) RobustBench AutoAttack adversarial attack suite results for 128 test samples at the $L_{\infty}=8/255$ strength. In this table we show the results of attacking our multi-resolution ResNet152 models finetuned on CIFAR-10 and CIFAR-100 from an ImageNet pretrained state with light adversarial training.**
|  |  |  |  |  |  | rand RobustBench AutoAttack<br>$L_{\infty}=8/255$ # samples (%) |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Dataset | Adv. | Model | Method | # | Test | Adv | APGD$\to$ | APGD |
|  | train |  |  |  | acc | acc | CE | DLR |
| CIFAR-10 | $\checkmark$ | ResNet152 | Multi-res backbone | 128 | 87.19 | 46.88 | 34.38 | 32.03 |
| CIFAR-10 | $\checkmark$ | ResNet152 | Self-ensemble | 128 | 84.58 | 67.94 | 64.06 | 54.69 |
| CIFAR-10 | $\checkmark$ | ResNet152 | 3-ensemble of<br>self-ensembles | 128 | 87.00 | 78.13 | 73.44 | 72.65 |
| CIFAR-10 | $\checkmark$ | [] | SOTA #1 |  |  | 73.71 |  |  |
| CIFAR-100 | $\checkmark$ | ResNet152 | Multi-res backbone | 128 | 62.72 | 37.50 | 32.03 | 22.66 |
| CIFAR-100 | $\checkmark$ | ResNet152 | Self-ensemble | 512 | 58.93 | 47.85<br>$\pm$2.66 | 36.72<br>$\pm$3.01 | 33.98<br>$\pm$2.72 |
| CIFAR-100 | $\checkmark$ | ResNet152 | 3-ensemble of<br>self-ensembles | 512 | 61.17 | 51.28<br>$\pm$1.95 | 44.60<br>$\pm$2.00 | 43.04<br>$\pm$1.97 |
| CIFAR-100 | $\checkmark$ | [] | SOTA #1 |  |  | 42.67 |  |  |

Adversarial training, which adds attacked images with their correct, ground truth labels back to the training set, is a standard brute force method for increasing models’ adversarial robustness. (Chakraborty et al., ) It is ubiquitous among the winning submissions on the RobustBench leader board, e.g. in Cui et al. () and Wang et al. (). To verify that our technique does not only somehow replace the need for dedicated adversarial training, but rather that it can be productively combined with it for even stronger adversarial robustness, we re-ran all our finetuning experiments solely on adversarially modified batches of input images generated on the fly.

For each randomly drawn batch, we used the single-step fast gradient sign method from Goodfellow et al. () to increase its cross-entropy loss with respect to its ground truth labels. We used the $L_{\infty}=8/255$ for all attacks. In Table [2](#S3.T2) we show the detailed adversarial robustness of the resulting models. Figure [7](#S3.F7) shows a comparison of the standard training and adversarial training for all models on CIFAR-10 and CIFAR-100. In all cases, we see an additive benefit of adversarial training on top of our techniques. In particular, for CIFAR-10 we outperform current SOTA by approximately 5 % while on CIFAR-100 and by approximately 9 % on CIFAR-100, which is a very large increase. The fact that our techniques benefit even from a very small amount of additional adversarial training (units of epochs of a single step attack) shows that our multi-resolution inputs and intermediate layer aggregation are a good prior for getting broadly robust networks.

### 3.6 Visualizing attacks against multi-resolution models

Figure: (a) Pear to apple
Refer to caption: /html/2408.05446/assets/x12.png

Figure: Figure 10: An example of a $L_{\infty}=64/255$ RobustBench AutoAttack on our model, changing a bicycle into a snake in an interpretable way.
Refer to caption: /html/2408.05446/assets/x16.png

We wanted to visualize the attacks against our multi-resolution models. In Figure [9](#S3.F9) we start with a test set image of CIFAR-100 (a pear, cloud, camel and elephant) and over 400 steps with SGD and $\eta=1$ minimize the loss with respect to a target class (apple, mountain, rabbit and dinosaur). We allow for large perturbations, up to $L_{\infty}=128/255$, to showcase the alignment between our model and the implicit human visual system classification function. In case of the pear, the perturbation uses the underlying structure of the fruit to divide it into 2 apples by adding a well-placed edge. The resulting image is very obviously an apple to a human as well as the model itself. In case of the cloud, its white color is repurposed by the attack to form the snow of a mountain, which is drawn in by a dark sharp contour. In case of the elephant, it is turned into a dinosaur by being recolored to green and made spikier – all changes that are very easily interpretable to a human.

Figure: (a) $c=0$ apple
Refer to caption: /html/2408.05446/assets/x17.png

In Figure [11](#S3.F11) we start with a uniform gray image of color (128, 128, 128) and by changing it to maximize the probability of a target class with respect to our model, we generate an image. The resulting images are very human-interpretable. This can be directly contrasted with the results in Figure [12](#S3.F12) that one gets running the same procedure on a brittle model (noise-like patterns) and a current best, adversarially trained CIFAR-100 model ((Wang et al., ); suggestive patterns, but not real images). We also generated 4 examples per CIFAR-100 class for all 100 classes in Figure [24](#A2.F24) to showcase that we do not cherrypick the images shown.

Figure [23](#A2.F23) shows 6 examples of successfully attacked CIFAR-100 test set images for an ensemble of 3 self-ensemble models – our most adversarially robust model. When looking at the misclassifications caused, we can easily see human-plausible ways in which the attacked image can be misconstrued as the most probable target class. For example, a crab with a body resembling a mushroom cap gets a foot of a mushroom added by the attack, causing a misclassification as $40\%$ mushroom from a $90\%$ crab. A blurry picture of a sting ray gets 3D-like shading added by the attack, making it look mouse-like and being classified as $30\%$ shrew from a $90\%$ ray. Overall, we see that the changes that are induced by the attacker seem to have a human-understandable explanation. Figure [10](#S3.F10) shows an example of a successful $L_{\infty}=64/255$ (much larger than the standard 8/255 perturbations) RobustBench AutoAttack on a test image of a bicycle converting it, in a human-interpretable way, to a snake by re-purposing parts of the bicycle frame as the snake body.

Figure: (a) Apple ($c=0$): The image generated from our model looks like an apple to itself, the Wang et al. () robust model, and a brittle ResNet152 alike. The attacks against Wang et al. () and standard ResNet152, on the other hand, convince only themselves.
Refer to caption: /html/2408.05446/assets/figures/comparison-apple.png

## 4 Additional Insights and Applications

We want to support our multi-resolution input choice as an active defense by demonstrating that by reversing it and representing an adversarial perturbation explicitly as a sum of perturbations at different resolutions, we get human-interpretable perturbations by default.

### 4.1 Single-resolution adversarial attacks

Figure: Figure 13: The image spectrum of generated multi-resolution attacks. The adversarial attacks generated over multiple resolutions at once end up showing very white-noise-like distribution of powers over frequencies (the slope for natural images is $\approx-2$). This is in contrast with standard noise-like attacks.
Refer to caption: /html/2408.05446/assets/figures/spectrum.png

Natural images contain information expressed on all frequencies, with an empirically observed power-law scaling. The higher the frequency, the lower the spectral power, as $\propto f^{-2}$ (van der Schaaf and van
Hateren, ).

While having a single perturbation $P$ of the full resolution $R\times R$ theoretically suffices to express anything, we find that this choice induces a specific kind of high frequency prior. Even simple neural networks can theoretically express any function (Hornik et al., ), yet the specific architecture matters for what kind of a solution we obtain given our data, optimization, and other practical choices. Similarly, we find that an alternative formulation of the perturbation $P$ leads to more natural looking and human interpretable perturbations despite the attacker having access to the highest-resolution perturbation as well and could in principle just use that.

### 4.2 Multi-resolution attacks

Figure: Figure 14: The result of expressing an image as a set of resolutions and optimizing it towards the CLIP embedding of the text ’a photo of a nuclear explosion’. The plot shows the resulting sum of resolutions (left panel, marked with $\rho$) and selected individual perturbations $P_{r}$ of resolutions $2\times 2$, $8\times 8$, $32\times 32$ and $128\times 128$. The intensity of each is shifted and rescaled to fit between 0 and 1 to be recognizable visually, however, the pixel values in the real $P_{r}$ fall of approximately as $r^{-1}$.
Refer to caption: /html/2408.05446/assets/x27.png

We express the single, high resolution perturbation $P$ as a sum of perturbations $P=\sum_{r\in\rho}\mathrm{rescale}_{R}(P_{r})$, where $P_{r}$ is of the resolution $r\times r$ specified by a set of resolutions $\rho$, and the $\mathrm{rescale}_{R}$ function rescales and interpolates an image to the full resolution $R\times R$. When we jointly optimize the set of perturbations $\{P_{r}\}_{r\in\rho}$, we find that: a) the resulting attacked image $X+\sum_{r\in\rho}\mathrm{rescale}_{R}(P_{r})$ is much more human-interpretable, b) the attack follows a power distribution of natural images.

When attacking a classifier, we choose a target label $t$ and optimize the cross-entropy loss of the predictions stemming from the perturbed image as if that class $t$ were ground truth. To add to the robustness and therefore interpretability of the attack (as hypothesized in our Interpretability-Robustness Hypothesis), we add random jitter in the x-y plane and random pixel noise, and design the attack to work on a set of models.

An example of the multi-resolution sum is show in Figure [15](#S4.F15). There we use a simple Stochastic Gradient Descent (Robbins and Monro, ) optimization with the learning rate of $5\times 10^{-3}$ and a cosine decay schedule over 50 steps. We add a random pixel noise of $0.6$ (out of 1), jitter in the x-y plane in the $\pm 5$ range and a set of all perturbations from $1\times 1$ to $224\times 224$ interpolated using bicubic interpolation (Keys, ). In Figure [15](#S4.F15) we see that despite the very limited expressiveness of the final layer class label, we can still recover images that look like the target class to a human. We also tested them using Gemini Advanced and GPT-4, asking what the AI model sees in the picture, and got the right response in all 8 cases.

Figure: (a) $c=309$ bee
Refer to caption: /html/2408.05446/assets/x28.png

Figure: Figure 16: Optimizing towards a probability vector with a sliding scale between $c=974$ geyser and $c=975$ lakeside. Optimizing against pretrained classifiers generated semantically blended image of the two concepts.
Refer to caption: /html/2408.05446/assets/x36.png

To demonstrate that we can generate images beyond the original 1000 ImageNet classes, we experimented with setting the target label not as a one-hot vector, but rather with target probability $p$ on class $t_{1}$ and $1-p$ on $t_{2}$. For classes $c=974$ (geyser) and $c=975$ (lakeside) we show, in Figure [16](#S4.F16) that we get semantically meaningful combinations of the two concepts in the same image as we vary $p$ from 0 to 1. $p=1/2$ gives us a geyser hiding beyond trees at a lakeside. This example demonstrates that in a limited way, classifiers can be used as controllable image generators.

Figure: (a) Just a $224\times 224$ perturbation alone.
Refer to caption: /html/2408.05446/assets/x37.png

### 4.3 Multi-resolution attack on CLIP

The CLIP-style (Radford et al., ) models map an image $I$ to an embedding vector $f_{I}:I\to v_{I}$ and a text $T$ to an embedding vector $f_{T}:T\to v_{T}$. The cosine between these two vectors corresponds to the semantic similarity of the image and the text, $\mathrm{cos}(v_{I},v_{T})=v_{I}\cdot v_{T}/(|v_{I}||v_{T}|)$. This gives us $\mathrm{score}(I,T)$ that we can optimize.

Adversarial attacks on CLIP can be thought of as starting with a human-understandable image $X_{0}$ (or just a noise), and a target label text $T^{*}$, and optimizing for a perturbation $P$ to the image that tries to increase the $\mathrm{score}(X_{0}+P,T^{*})$ as much as possible. In general, finding such perturbations is easy, however, they end up looking very noise-like and non-interpretable. (Fort, , ).

Figure: Figure 18: An attack on vision language models. GPT-4 sees Rick Astley from his famous "Never Gonna Give You Up" music video tree. See Table [3](#A1.T3) and [4](#A1.T4) for details.
Refer to caption: /html/2408.05446/assets/figures/hawking_to_rickroll_attacksize40_actual38.png

If we again express $P=\mathrm{rescale}_{224}(P_{1})+\mathrm{rescale}_{224}(P_{2})+\dots+P_{224}$, where $P_{r}$ is a resolution $r\times r$ image perturbation, and optimize $\mathrm{score}(X_{0}+\mathrm{rescale}_{224}(P_{1})+\mathrm{rescale}_{224}(P_{2})+\dots+P_{224},T^{*})$ by simultaneously updating all $\{P_{r}\}_{r}$, the resulting image $X_{0}+\sum_{r\in[1,224]}\mathrm{rescale}_{R}(P_{r})$ looks like the target text $T^{*}$ to a human rather than being just a noisy pattern. Even though the optimizer could choose to act only on the full resolution perturbation $P_{224}$, it ends up optimizing all of them jointly instead, leading to a more natural looking image. To further help with natural-looking attacks, we introduce pixel noise and the x-y plane jitter, the effect of which is shown in Figure [17](#S4.F17).

We use SGD at the learning rate of $5\times 10^{-3}$ for 300 steps with a cosine decay schedule to maximize the cosine between the text description and our perturbed image. We use the OpenCLIP models (Ilharco et al., ; Cherti et al., ) (an open-source replication of the CLIP model (Radford et al., )). Examples of the resulting "adversarial attacks", starting with a blank image with $0.5$ in its RGB channels, and optimizing towards the embedding of specific texts such as "a photo of Cambridge UK, detailed, and "a photo of a sailing boat on a rough sea" are shown in Figure [20](#S4.F20). The image spectra are shown in Figure [13](#S4.F13), displaying a very natural-image-like distribution of powers. The resulting images look very human-interpretable.

Figure: (a) Original
Refer to caption: /html/2408.05446/assets/x41.png

Starting from a painting of Isaac Newton and optimizing towards the embeddings of "Albert Einstein", "Queen Elizabeth" and "Nikola Tesla", we show that the attack is very semantically targeted, effectively just changing the facial features of Isaac Newton towards the desired person. This is shown in Figure [19](#S4.F19). This is exactly what we would ideally like adversarial attacks to be – when changing the content of what the model sees, the same change should apply to a human. We use a similar method to craft transferable attacks (see Figure [18](#S4.F18) for an example) against commercial, closed source vision language models (GPT-4, Gemini Advanced, Claude 3 and Bing AI) in Table [3](#A1.T3), in which a turtle turns into a cannon, and in Table [4](#A1.T4), where Stephen Hawking turns into the music video Never Gonna Give You Up by Rick Astley. The attacks also transfer to Google Lens, demonstrating that the multi-resolution prior also serves as a good transfer prior and forms an early version of a transferable image vision language model jailbreak. This is a constructive proof to the contrary of the non-transferability results in Schaeffer et al. ().

Figure: (a) Ancient Rome
Refer to caption: /html/2408.05446/assets/x45.png

## 5 Discussion and Future Work

Our work demonstrates that taking inspiration from biology and stochastically translating an input image into a multi-resolution stack of inputs that are classified simultaneously by a model leads to higher-quality, natural representations, significant adversarial robustness, and human-interpretable attacks. Combining this with a novel, robust ensembling method inspired by Vickrey auctions that we call CrossMax, we demonstrate that we can further improve the model’s adversarial robustness by combining its intermediate layer predictions into a self-ensemble. This is due to our empirical observation that intermediate layer representations are not fooled by attacks against the classifier as a whole, and that their induced errors are only partially correlated.

We are able to match the current state-of-the-art adversarial accuracy results on CIFAR-10 and surpass them by $\approx 5\%$ CIFAR-100 on a strong adversarial benchmark RobustBench without any extra data or dedicated adversarial training, that is usually needed to produce a robust model. When we add light adversarial training on top, we see that our methods are complementary to it and that we surpass the best models on CIFAR-10 by $\approx 5\%$ and by a very significant $\approx 9\%$ on CIFAR-100, taking it from $\approx 40\%$ to $\approx 50\%$ in a single step. Our methods seem to perform better on the harder dataset, suggesting a favourable scaling compared to the usual brute force adversarial training.

Our approach not only enhances robustness but also aligns the learned representations more closely with human visual processing, leading to more interpretable and reliable models. We demonstrate this by optimizing images against the outputs of our classifier directly and obtaining either human-interpretable changes, when applied to an existing image, or completely new, interpretable images, when starting from a uniform, empty image. This is in stark contrast to the usual result of such a procedure which would be a noise-like picture that would look very convincing to the network but would not resemble anything to a human.

Key observations and implications of our work include:

- 1.
Efficacy of multi-resolution inputs: The use of multi-resolution inputs as an active defense mechanism proves highly effective in improving adversarial robustness and aligning the learned classifier with the implicit human function. This suggests that incorporating diverse scales of information during training and inference can help models develop more robust, higher-quality, and more natural representations that are less susceptible to adversarial perturbations.
(a)
We speculate that this might be connected to the observation in Elsayed et al. () that humans get measurably partially fooled by adversarial attacks, but only when looking at them very briefly. This could be viewed as having only a single or a few "frames" to classify, which is the standard regime in which neural nets are also brittle. The longer exposure, both for humans and as shown here for neural networks, remedies this.
- 2.
Robustness of intermediate layer features: Our findings regarding the partial robustness of intermediate layer features to adversarial attacks on the final layer provide valuable insights into the hierarchical nature of neural network representations. This observation opens up new avenues for designing robust architectures and defense mechanisms.
- 3.
CrossMax ensemble aggregation: The proposed CrossMax method for robust ensemble aggregation demonstrates significant improvements over traditional ensemble techniques. Its effectiveness in combining predictions from multiple models, checkpoints, or intermediate layers suggests a promising direction for enhancing model robustness and reliability cheaply and with very little architectural overhead.
- 4.
Interpretability-robustness connection: Our results support the Interpretability-Robustness Hypothesis, suggesting that models producing more interpretable adversarial examples tend to be more robust. This connection between interpretability and robustness warrants further investigation and could lead to the development of more reliable and explainable AI systems.
- 5.
Generative capabilities: The discovery that our approach can turn pre-trained classifiers and CLIP models into controllable image generators opens up interesting possibilities for exploring the latent representations learned by these models, and forms a connection between noise-like adversarial attacks and human-interpretable modifications to an image. They are a part of the same spectrum. In addition, this proves to be a good transfer prior as well, allowing us to construct adversarial image attacks on closed-source large vision language models.

While our results are promising, several areas require further exploration:

- 1.
Scalability to larger datasets and models: Future work should investigate how our approach scales to larger, more complex datasets (ImageNet is the primary target here) and state-of-the-art model architectures. However, given that even very basic architectures yield very strong robustness, we do not expect issues here. We also see our method to perform relatively better over standard techniques on CIFAR-100 rather than CIFAR-10, suggesting favourable scaling with dataset difficulty.
- 2.
Theoretical foundations: Developing a deeper theoretical understanding of why multi-resolution inputs and CrossMax ensembling contribute to robustness could provide insights for designing even more effective defense mechanisms.
- 3.
Robustness to other types of attacks: While we focused on $L_{\infty}$ norm-bounded perturbations, evaluating and improving robustness against other types of adversarial attacks (e.g., $L_{2}$, $L_{1}$, or semantic adversarial examples) would be valuable. We expect this to work but an explicit evaluation would be valuable.
- 4.
Integration with other defense techniques: Exploring how our approach can be combined with other defense mechanisms, such as adversarial training or certified defenses, could lead to even more robust models. Our method combines well with light adversarial training already.

We are also very interested in the existence of adversarial attacks on the human visual system and we believe that our work should be an update against their likelihood. We use biologically inspired methods (multiple resolutions, jitter, noise) that work as a defense against a white-box attacker. When flipped around, the same ideas generate human-interpretable images. The intermediate layer representations could also be viewed as using shallower circuits in the brain, and their partial robustness might suggest the same in humans. Given that moving closer (in a very rudimentary way) to the human visual system in these regards gave us both a practical defense and an image generator, we believe that we should update against adversarial vulnerability of humans.

## 6 Conclusion

In this paper, we introduced a novel approach to bridging the gap between machine and human vision systems. Our techniques lead to higher-quality, natural representations that improve the adversarial robustness of neural networks by leveraging multi-resolution inputs and a robust (self-)ensemble aggregation method we call CrossMax. Our method approximately matches state-of-the-art adversarial accuracy on CIFAR-10 and exceeds it on CIFAR-100 without relying on any adversarial training or extra data at all. When light adversarial training is added, it sets a new best performance on CIFAR-10 by $\approx 5\%$ and by a significant $\approx 9\%$ on CIFAR-100, taking it from $\approx 40\%$ to $\approx 50\%$. Key contributions of our work include:

- 1.
Demonstrating the effectiveness of multi-resolution inputs as an active defense mechanism against adversarial attacks and a design principle for higher-quality, robust classifiers.
- 2.
Introducing the CrossMax ensemble aggregation method for robust prediction aggregation.
- 3.
Providing insights into the partial robustness of intermediate layer features to adversarial attacks.
- 4.
Supporting the Interpretability-Robustness Hypothesis through empirical evidence.
- 5.
Discovering a method to turn pre-trained classifiers and CLIP models into controllable image generators.
- 6.
Generating transferable image attacks on closed-source large vision language models which can be viewed as early versions of jailbreaks.

We believe that our findings not only advance the field of adversarial robustness but also provide valuable insights into the nature of neural network representations and their vulnerability to adversarial perturbations. The connection between interpretability and robustness highlighted in this work also opens up new research directions for developing more reliable and explainable AI systems.

As adversarial attacks continue to pose significant challenges to the deployment of deep learning models in safety-critical applications, our approach offers a promising direction for building more robust and reliable systems. Future work in this area has the potential to further bridge the gap between machine and human perception, leading to AI systems that are not only more robust but also more aligned with human visual processing and decision-making. We believe that solving adversarial brittleness in the classification setting is the first step towards aligning stronger AI systems.

#### Acknowledgements

We would like to thank Kristina Fort, Jie Ren, Vaclav Rozhon, Nicholas Carlini and Jasper Snoek for useful discussions.

## Appendix A Appendix

### A.1 Transfer to massive commercial models

In Table [3](#A1.T3) we show the results of asking "What do you see in this photo?" and adding the relevant picture to four different, publicly available commercial AI models: GPT-4(^2^22[chatgpt.com](chatgpt.com)), Bing Copilot(^3^33[bing.com/chat](bing.com/chat)), Claude 3 Opus(^4^44[claude.ai/](claude.ai/)) and Gemini Advanced(^5^55[gemini.google.com](gemini.google.com)). We find that, with an exception of Gemini Advanced, even a $L_{\infty}=30/255$ attack generated in approximately 1 minute on a single A100 GPU (implying a cost at most in cents) fools these large models into seeing a cannon instead of a turtle. The attack also transfers to Google Lens.

**Table 3: Multi-resolution adversarial attacks of increasing $L_{\infty}$ using OpenCLIP on an image of a sea turtle towards the text "a cannon" tested on GPT-4, Bing Copilot (Balanced), Claude 3 Sonnet and Gemini Advanced. All models we tested the images on were publicly available. The conversation included a single message "What do you see in this photo?" and an image. We chose the most relevant parts of the response.**
|  | Original | $L_{\infty}=20/255$ | $L_{\infty}=30/255$ | $L_{\infty}=40/255$ | $L_{\infty}=70/255$ | $L_{\infty}=100/255$ |
| --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |
| GPT-4 | sea turtle swimming | turtle swimming in water | cannon, mounted on stone base, firing | cannon with a notably ornate and rusted appearance | cannon mounted on a brick platform | stylized or artistically rendered depiction of a cannon |
| Bing Copilot | sea turtle gracefully swimming | sea turtle gracefully swimming | a cannon mounted on a stone base | cannon with a wheel, mounted on a stone base | old cannon mounted on a brick platform | color-saturated cannon mounted on wheels |
| Claude 3 Opus | sea turtle swimming in clear, turquoise water | sea turtle swimming underwater | old cannon submerged underwater | old decorative cannon sitting on a stone or concrete platform | old naval cannon set on a stone or brick platform | artistic painting or illustration of an old cannon |
| Gemini Advanced | sea turtle swimming underwater | sea turtle swimming underwater | sea turtle swimming | sea turtle swimming in a pool | cannon being fired by a turtle wearing a red jacket | artistic interpretation of a cannon firing |

**Table 4: Multi-resolution adversarial attacks of increasing $L_{\infty}$ using OpenCLIP on an image of Stephen Hawking towards the embedding of an image from the famous Rick Astley’s song Never Gonna Give You Up from the 1980s tested on GPT-4, Bing Copilot (Balanced), Claude 3 Sonnet and Gemini Advanced. All models we tested the images on were publicly available. The conversation included a single message "What do you see in this photo?" and an image. We chose the most relevant part of the response. Unfortunately, Gemini refused to answer, likely due to the presence of a human face in the photo.**
|  | Original | $L_{\infty}=20/255$ | $L_{\infty}=30/255$ | $L_{\infty}=40/255$ | $L_{\infty}=70/255$ | $L_{\infty}=100/255$ |
| --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |
| GPT-4 | Stephen Hawking | Stephen Hawking | Never Gonna Give You Up | Never Gonna Give You Up | Never Gonna Give You Up | singer or performer, possibly Rick Astley |
| Bing Copilot | individual sitting in a wheelchair | individual sitting on a bench | individual sitting down, holding a microphone, singing | person seated, holding a musical instrument | two individuals in an indoor setting | person in front of a microphone, singing |
| Claude 3 Opus | elderly man in a wheelchair | man in a wheelchair, smiling | young man with blonde hair, vintage-style microphone, singing | young man with blond hair, 1980s pop music | music video, 1980s, singer | music video, 1980s fashion |
| Gemini Advanced | Refused to answer. | Refused to answer. | Refused to answer. | Refused to answer. | Refused to answer. | Refused to answer. |

### A.2 Attack transfer between layers

Figure: Figure 21: Attack transfer between layers of the ResNet154 model pre-trained on ImageNet-1k. The individual linear heads were finetuned on CIFAR-10 on top of the frozen model.
Refer to caption: /html/2408.05446/assets/figures/full_grid_of_transfer.png

## Appendix B Visualizing attacks on multi-resolution models

Figure: (a) Bicycle to motorbike
Refer to caption: /html/2408.05446/assets/x53.png

Figure: Figure 23: Examples of successfully attacked CIFAR-100 images for an ensemble of self-ensembles – our most robust model. We can see human-plausible ways in which the attack changes the perceived class. For example, the skyscraper has a texture added to it to make it look tree-like.
Refer to caption: /html/2408.05446/assets/x57.png

Figure: Figure 24: Examples of optimizing towards all 100 CIFAR-100 classes against our multi-resolution ResNet152 model, 4 examples for each. We use 400 simple gradient steps at learning rate $\eta=1$ with SGD with respect to the model, starting from all grey pixels (128,128,128). The resulting attacks are easily recognizable as the target class to a human.
Refer to caption: /html/2408.05446/assets/x58.png

## Appendix C Additional experiments for CrossMax

Figure: (a) ResNet154 self-ensemble on CIFAR-10
Refer to caption: /html/2408.05446/assets/x59.png

## Appendix D Additional CrossMax validation

**Table 5: CrossMax algorithm ablation. The Algorithm [1](#alg1) contains two subtraction steps: A = the per-predictor max subtraction, and B = the per-class max subtraction. This Table shows the robust accuracies of a self-ensemble model on CIFAR-100 trained with light adversarial training, whose intermediate layer predictions were aggregated using different combinations and orders of the two steps. We also look at the effect of using the final $\mathrm{topk}_{2}$ aggregation vs just using a standard $\mathrm{mean}$. The best result is obtained by the Algorithm [1](#alg1), however, we see that not using the $\mathrm{topk}$ does not lead to a critical loss of robustness as might be expected if there were accidental gradient masking happening.**
| Aggregation fn | $\mathrm{topk}_{2}$ | $\mathrm{mean}$ |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | _ | A | B | BA | AB | _ | A | B | BA | AB |
| Test acc | 57.08 | 59.86 | 0.82 | 1.27 | 58.92 | 60.31 | 59.89 | 1.1 | 1.05 | 57.23 |
| Adv acc | 46.88 | 46.88 | 1.56 | 0.00 | 57.81 | 40.62 | 48.44 | 0.00 | 0.00 | 39.06 |

## Peer Reviews

confidence: 4
contribution: 4
initial_rating: 5
presentation: 4
questions: 1) As I previously mentioned, I think the paper could really benefit from some analysis regarding its resistance to some relative adaptive attack. 

2) I also believe that since their method can adapt quite rapidly from a naturally trained model into an adversarially robust classifier, it would be a missed opportunity if it did not provide robustness results on ImageNet (or any other larger / more complex datasets). 

3) In your setting, could the authors clarify if the attacker is aware of the parameters of the multi-resolution inputs? And also, for a single sample, is the process of generating different resolutions of the same image a randomized process or a fixed process for iterative PGD attacks? And also, how much the authors attribute the robustness to the randomization. If yes (and the process is randomized), could they provide similar results by fixing the random seed throughout the iterative generations to see if that effects the effectiveness of auto-attack. 

4) On 336, why was the batch-norm turned off for the setting with training from the scratch? 

5) Could the authors please enhance their representation of other methods? For instance,  mention the name of their method or name of the authors or some other representation that would give some sense of what the other baseline is. 

6) Not a question, only a comment, the material covered in the appendix was really interesting and I really enjoyed them. I would be really happy to increase my score if the authors can convince me that the robusntess is preserved, even with adaptive attacks.
soundness: 2
strengths: The paper was well written and well structured. The flow of the paper was easy to follow. And I would like to thank the reviewers for their presentation. 

I really liked that the idea of multi-scaling was inspired by the real human biology. I also enjoyed the cleaver trick leveraged in the CrossMax ensembling (and also in self-ensembling) to avoid fitting to the outlier predictions. 

The results provided in the paper have significant value and are truly incredible. The idea is novel and the contributions are adequate.
summary: This paper proposes an innovative method for adversarial robustness in deep learning through multi-scale input processing and dynamic self-ensembling. By introducing multi-resolution input representations and CrossMax ensembling—a unique aggregation strategy that reduces susceptibility to adversarial perturbations—the authors effectively address key limitations in existing robustness approaches. This work is particularly notable for its ability to achieve competitive performance on CIFAR-10 and SOTA results on CIFAR-100 without relying on adversarial training, a common but computationally intensive technique.
weaknesses: The only weakness of the paper seems to be lack of evidence for adaptive attacks. I am not exactly sure if the following will be the best implementation, but just as an example the attacker could possibly optimize the input image with the objective of making a misclassification to happen across all layers in self-ensembled networks, or if the adaptive attack could optimize the input image across all resolutions, for white box attacks.

---

confidence: 3
contribution: 4
initial_rating: 8
presentation: 4
questions: - I find the observation of using multi-resolution input to the classifier makes it much more adversarially robust interesting and somewhat surprising, since all the different resolutions are derived from the single-resolution image. Would it be possible at all to encoder this prior implicitly into the classifier model instead, so that we don't need to explicitly feed in N images of different resolution? 
- Does the performance of the model get better as we feed in images of more and more resolutions? 
- While I understanding the rationale of using Vickrey auction for ensembling, I wonder what inspired the use of it for self-ensembling? Does the same approach work for ensembling in general?
soundness: 3
strengths: - The paper is very well written and easy to follow. I enjoyed reading it. 
- The proposed method is technically sound.
- The proposed idea is novel and generally applicable to a lot of different scenarios.
- The proposed method achieves impressive benchmark performance on various tasks. 
- The authors of the paper conduct ample experiments to support their hypothesis.
summary: This paper addresses the challenge of adversarial robustness in deep neural networks. To tackle this problem, the authors of the paper propose a mechanism called CrossMax, based on Vickrey auction, to ensemble predictions from different layers given a multi-resolution input. The proposed method achieves adversarial robustness by leveraging the inherent robustness of intermediate layer predictions. The authors of the paper demonstrate that this method achieves significant adversarial accuracy on CIFAR-10 and CIFAR-100 without adversarial training. With the addition of adversarial training, the results can be further improved. Furthermore, the authors also explore the connection between adversarial robustness and the hierarchical nature of deep representations, showing that gradient-based attacks yield interpretable images of target classes. Additionally, they demonstrate that this approach enables controllable image generation using pre-trained classifiers and CLIP models.
weaknesses: - Most of the claims made in the paper seem to be empirical. It is not immediately clear how generalizable the conclusions are to other datasets and problems. 
- The proposed multi-resolution approach can make the classifiers less computationally efficient. 
- Hyperparameters on how to choose resolutions and number of resolutions can be hard to find/optimize.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: - During the generation of whitebox attacks is the multi-resolution image expansion considered as a differentiable step that the attack method backpropagates through?
- How would this method be generalized to transformer architectures?
- Was there any fine tuning of the model for the multiple linear probes used to create the ensemble? In other words, were the linear probes only generated after the intermediate layers were fixed? If so, what do you think the effect would be of training each intermediate layer linear readout jointly?
soundness: 3
strengths: - Clear description of gaussian pyramid image stack and CrossMax aggregation strategies
- Empirical validation of the increased adversarial robustness of intermediate network layers
- Strong adversarial robustness results in CIFAR-10/100 without adversarial training
- Verification of the Interpretability-Robustness Hypothesis through qualitative examples of generated perturbations
summary: A novel method for improving adversarial robustness is used that does not necessitate adversarial specific training, but can be complemented by it. Using biological inspiration, the authors device two strategies for improving adversarial robustness: the creation of a gaussian pyramid like view of an input image for a network as well as the CrossMax self-ensemble strategy.
weaknesses: - Robustness method requires extra effort to generalize to new architectures as opposed to adversarial training
- Max operation in CrossMax may introduce discontinuities in training that may make learning more difficult
- While the performance on CIFAR is impressive, a large scale dataset like ImageNet may be required to fully understand the generalizability of this method

---

confidence: 5
contribution: 3
initial_rating: 6
presentation: 3
questions: My major concern refers to the weaknesses.
soundness: 3
strengths: 1. The observation in this study is very interesting. 
2. The design of CrossMax is inspired by the Vickrey auction mechanism, aiming to create an integrated model that is more robust against attackers by leveraging the top-ranked predictions. This is a meaningful design.
3. As we know, adversarial training is usually time consuming, while the proposed method can achieve good results without adversarial training or additional data.
summary: This paper introduces a new method for adversarial defense, which improves the adversarial robustness of neural networks by utilizing multi-resolution inputs and robust integration methods. The authors assume that the existence of adversarial attacks is due to the differences between human and machine vision systems. To bridge this gap, they suggest using the dynamic self-ensemble of multi-scale input representations and intermediate layer predictions. They show that intermediate layer predictions exhibit inherent robustness against adversarial attacks aimed at deceiving the entire classifier, and propose a robust aggregation mechanism based on the Vickrey auction, called CrossMax, to dynamically integrate them. The proposed method can achieve good results on CIFAR-10 and CIFAR-100, without any adversarial training or additional data.
weaknesses: 1. The proposed scheme is interesting and it can also achieves good results on CIFAR-10/100. However, the experiments in this paper are not very convincing. Firstly, the images in the CIFAR dataset have very low pixels, and it's hard to determine the actual impact of multi-scale or multi-resolution approaches. Although the supplementary materials cover the size of $224\times 224$, there is no comparison, testing, and analysis with mainstream methods. It's better to evaluate the performance on ImageNet or its subset. 
2. The evaluation of the adaptive attack is missing. I only found the appendix A shows some visualization results of adaptive attack by the  multi-resolution attack. This must be evaluated in the main experiments and the statistical results should be reported. Otherwise, it cannot show that the proposed method can defend against the adaptive attack. Maybe other adversarial defense methods can achieve better results. 
3. What are the contents of A.8, C and D in the supplementary materials? Are they the corresponding figures that follow? I suggest that the author should provide a detailed description of them.
4. What would the effect be if training were started from scratch? Since the most adversarial training methods are trained from scratch, the authors fine-tune the model on a ImageNet pre-trained model. If the previous adversarial defense also follow the same experiment setting, what would the results be?

Meta-review: This paper proposes a defense against adversarial attacks that uses hierarchical self-ensembles which are augmented using jittering and noise. While the paper has received good initial reviews, the validity of the approach has been publicly challenged during the discussion. In particular, the evaluation on RobustBench, on which the paper claims to achieve state-of-the-art results, is not entirely valid. As clarified by the authors during the rebuttal, the proposed approach remains fully differentiable through the noise and jittering operations. Therefore, the attacks executed in RobustBench succeed to some extent. Yet, the SotA on RobustBench is compared on deterministic models - the randomization within the proposed method switches the paradigm so that the adversarial robustness between the referred methods is not directly comparable. 
Following this discussion, and in the context of the positive ratings given by the reviewers, I have carefully read the paper. I agree with the reviewers that the paper is well written and motivated, and that the measured increase in robustness is promising - even if the results on RobustBench are not comparable to previous results reported there. However the biggest flaws of the paper are to be seen in two aspects: (1) The limited novelty of the approach and (2) the missing comparison to previous adversarial defenses the incorporate randomization. In particular, there are several previous works stating that self ensembles and hierarchical representations improve adversarial robustness, in particular when considered with additional noise.
Examples would be:
- Liu, X., M. Cheng, H. Zhang, and C.-J. Hsieh, Towards robust neural networks via random self-ensemble, ECCV, 2018.
- X. Wang, S. Wang, P.Y. Chen, X. Lin, and P. Chin, Advms: A multi-source multi-cost defense against adversarial attacks. In ICASSP, 2020. 
- X. Wang, S. Wang, P.Y. Chen, Y. Wang,B. Kulis, X. Lin, and P. Chin. Protecting neural networks with hierarchical random switching: Towards better robustness-accuracy trade-off for stochastic defenses. IJCAI 2019.
 
The delineation to these previous works is missing in the submitted manuscript,  a proper evaluation of the proposed method in the paradigm of defenses through randomization is also missing. Therefore, even though the manuscript is well written and the proposed technique might have promise, it is not ready for acceptance.

Decision: Reject