Adversarial Inputs for Linear Algebra Backends
Authors: Jonas Möller
Lukas Pirch
Felix Weissberg
Sebastian Baunsgaard
Thorsten Eisenhofer
Konrad Rieck
Venue: ICML 2025 poster (2025)
Keywords: adversarial inputs
linear algebra backends
floating-point errors
Primary area: deep_learning->robustness

Abstract: Linear algebra is a cornerstone of neural network inference. The efficiency of popular frameworks, such as TensorFlow and PyTorch, critically depends on backend libraries providing highly optimized matrix multiplications and convolutions. A diverse range of these backends exists across platforms, including Intel MKL, Nvidia CUDA, and Apple Accelerate. Although these backends provide equivalent functionality, subtle variations in their implementations can lead to seemingly negligible differences during inference. In this paper, we investigate these minor discrepancies and demonstrate how they can be selectively amplified by adversaries. Specifically, we introduce *Chimera examples*, inputs to models that elicit conflicting predictions depending on the employed backend library. These inputs can even be constructed with integer values, creating a vulnerability exploitable from real-world input domains. We analyze the prevalence and extent of the underlying attack surface and propose corresponding defenses to mitigate this threat.

Adversarial Inputs for Linear Algebra Backends
Jonas Möller 12
Lukas Pirch Felix Weissberg 12 Sebastian Baunsgaard 12
Thorsten Eisenhofer 12
Konrad Rieck
Abstract
Trick
Bird
Linear algebra is a comnestone of neural network inference. The efficiency of popular frameworks, such as TensorFlow and Py PyTorch critically de- pends on backend libraries providing highly op- timized matrix multiplications and convolutions. A diverse range of these backends exists across platforms, including Intel MKL, Nvidia CUDA, and Apple Accelerate. Although these backends provide equivalent functionality, subtle variations in their implementations can lead to seemingly negligible differences during inference. In this paper, we investigate these minor discrepancies and demonstrate how they be selectively amplified by adversaries. Specifically, we intro- duce Chimera examples, inputs to models that elicit conflicting predictions depending on the employed backend library. These inputs can even constructed with integer values, creating a vulnerability exploitable from real-world input domains. We analyze the prevalence and extent of the underlying attack surface and propose corresponding defenses to mitigate this threat.
Car
Car
Horse
Bird
Truck
Ship
Figure 1. Chimera examples: Conflicting predictions made by the same model, depending on the used linear algebra backend such as
Apple Accelerate (0), Intel MKL (0), Nvidia CUDA (0), BLIS (+).
Technically, this abstraction builds upon the classic BLAS specification by Lawson et al. (1979), which introduces standardized interface for linear algebra, referred to as Basic Linear Algebra Subprograms. While linear algebra backends strictly adhere to this specification, their low-level implementations vary significantly based on the targeted platform, encompassing the choice of algorithms, paral- lelization strategies, memory management, and hardware support (Dongarra et al., 1990). Consequently, wide array of these backends has emerged in practice, including Intel MKL, Nvidia CUDA, Apple Accelerate.
Due to these differences, no linear algebra library backend behaves exactly like another, and subtle deviations regularly occur when processing the same input. These discrepancies arise from the inherent fragility of floating-poin arithmetic: as float representations only approximate real numbers, operations such as addition and multiplication are not strictly associative (Goldberg, 1991). For example, when multiply- ing two 1000 x 1000 matrices sampled uniformly from [0, 1) with 32-bit precision, deviations of approximately 6 10- be observed between backends (see Section 2). Hence, the inference of learning models inevitably leads minor inaccuracies in their predictions.
1. Introduction
Frameworks like TensorFlow and PyTorch provide a high- level interface to machine learning, enabling developers to deploy models across diverse platforms. These frameworks abstract away the complexities of low-level implementations and hardware, offering unified access to the computing resources of each platform, ranging from large clusters to mobile devices and embedded systems. cornerstone of this abstraction lies in linear algebra backends, which deliver optimized vector and matrix operations tailored to the peculiarities of each platform, such dot products, rank updates, matrix multiplications, and convolutions.
Given the minuscule scale of these differences, it is tempt- ing to assume that backends provide sufficiently similar computations for most practical applications. this paper, we challenge this assumption and pose the question: possible craft input for model that elicits conflicting predictions depending on the employed backend library? We refer to these inputs as Chimeru examples, as they exhibit differing appearances depending on the backend library used. Figure/ illustrates examples of these inputs, each resulting in three different predicted classes depending on the linear algebra backend employed.
'Berlin Institute for the Foundations of Learning and Data (BIFOLD), Germany "TU Berlin, Germany. Correspondence to: Jonas Möller mooller @ttuberlin..e:.
Proceedings of the nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Adversarial Inputs for Lincar Algebra Backends
So far, previous work has focused on floating-point impre- cision arising from differences in CPU architectures, for example, for fingerprinting systems (Schlögl et al., 2021; 2024) or breaking the certification of models (Jin et al., 2022; 2024; Voráček & Hein, 2023). Our analysis of linear algebra backends builds on this work; yet, we aim to induce significantly larger changes that flip the prediction of a model given an adversarial input. While differences in CPU architecture may further exacerbate this issue, we demonstrate that Chimera examples also exist between backends on the same CPU architecture.
specifies binary formats for 16-bit, 32-bit, 64-bit, and 128- bit representations. In each format, floats represented as triples consisting of sign s, an exponent e, and significand m, where the exponent uses w bits and the significand uses t bits. A real number x E R can then be approximated using b 2(w-1) and p = 1 by:
I x² (-1)* 2(c 6). (1 + 11+2002 20--)) m))
Due to their fixed bit representation, floats can naturally represent only a finite subset of R. As a consequence, common properties of arithmetic in do not hold for floats. For example, IEEE (1985) specifies that I values are correctly rounded if they are mapped the nearest representable value in F. This rounding scheme introduces non von-associativity in operations, such as (a + b) + * a + (b + cc. since all intermediate results are rounded to the nearest representable value. While the BLAS specification defines the inputs and outputs of matrix operations, it does not specify the order of computational steps, creating a vulnerable spot via this non-associativityy
Uncovering Chimera examples for a model, however, is surprisingly challenging: First, the exploited minor dif- ferences between backends are non-continuous and non- differentiable, obstructing the use of common attack strate- gies. Second, the imput to models cannot be assumed to have arbitrary precision. For example in computer vision, images are typically represented by 8-bit or 16-bit matrices, making it hard to control tiny differences in calculations. To address these challenges, we present a generalized method for constructing Chimera examples. Using this method, we explore the underlying attack surface and evaluate its prevalence across six backend libraries, including all major platforms. Finally, we propose defense that mitigates the threat of Chimera examples.
To analyze the differences resulting from this imprecision, we quantify the distance between floats using the concept of units in the last place (ULP) (Goldberg, 1991). In the discrete space of IF, this metric measures the number of representable values between two floats, independent the exponent and scale of the numbers. For instance, the 32-bit floats representing the numbers 1 and 1. 1.0000001, well as 10, 000, 000 and 10, 000, 001, both have distance of only ULP. Practically, for same-sign floats the measure is easy to calculate by casting the bit representations of the floats to integers and returning the absolute delta.
In summary, we make the following major contributions:
We present the first method for constructing adversarial inputs that induce confficting predictions of models due to differences in linear algebra backends.
We identify and analyze Chimera examples across six common backends, including GPU-accelerated and CPU-based implementations.
2.2. BLAS Interface
We derive a defense mechanism for Chimera examples based on our analysis, preserving both the model's accuracy and its deterministic nature.
Similarly to IEEE-754, BLAS is the de-facto standard for linear algebra operations in machine learning. Lawson et al. (1979) introduced the term BLAS, referring to 38 subprograms for linear algebra operations such as dot products, matrix multiplications, and convolutions. Since its introduction, the specified set of operations has undergone numerous updates and extensions (Blackford et al., 2002) and is now implemented in various backends, including Intel MKI, Nvidia CUDA, and Apple Accelerate.
2. Background
Subtle inconsistencies observed in the output of linear algebra backends stem from the inherent limitation of rep- resenting real numbers, E, within a fixed bit representation. To set the scene for our analysis, we first examine how floating-poin -pinn numbers approximate IR and then explore how variations in the implementation of linear algebra operations can magnify these deviations during computation.
To allow a high degree of freedom in implementation, the BLAS specification states; "any algorithm that produces results close enough the usual algorithmms presented in standard book on matrix computations is accept- able" (Blackford et al., 2002). This flexibility is crucial for accommodating advanced computation techniques, such as the Strassen (1969) algorithm. However, this same flexibility in implementation leads to variations in results across different BLAS backends.
2. IEEF-754 Floats
The IEEE-754 specification (EEEE 1985; 2019) serves as the de-facto standard for floating-poin numbers F, commonly referred as floats. Widely adopted, the standard
2

---

Adversarial Inputs for Lincar Algebra Backends
3. Attacking BLAS Backends
Equipped with an understanding of deviation sources, we are now ready to tackle the generation of adversarial inputs exploiting these inconsistencies. In particular, we focus on inputs that cause model to produce conflicting predictions. Before outlining our approach, we first introduce notation and formalize the concept of Chimera examples.
3.1. Chimera Examples
Figure 2. Abstract visualization of GEMM, C = AB. The sum of a box column in the middle cube symbolizes the addition into single block of C. Because arithmetic in IF is non-associative, the order of adding column boxes matter.
We consider a learning model 0 for classification, deployed across n different platforms, each utilizing distinct linear algebra backend. The inference process of on these backends gives rise to n functions, fi...., F + F where d the number of input dimensions and e the number of output classes. Due to variations in backend implementations, each pair of functions f., fj may exhibit slight deviations in its output, creating attack surface.
2.3. Sources of Differences
To illustrate the impact of this flexibility, we consider matrix multiplication as an example. Specifically, we have three matrices A, B, and C, with a general matrix mul- tiplication (GEMM) operation defined as C AB. The most common approach to implementing GEMM efficiently involves decomposing and B into smaller blocks and distributing the computation, as also recommended in the BLAS specification (Blackford al., 2002).
In practice, models are rarely applied over the entire range of floating-poin numbers Fd. Instead, the input format constrains the data to a discrete set of feasible vectors, which we denote as C Fd. For example, when processing an image, individual pixels are represented as fixed-bit integers, drastically reducing the input domain. Similarly, when processing text, inputs are inherently discrete and map only to small subset of the space represented by Fd.
In particular, the matrices A and B are divided into small blocks X E [eee, whose size is determined by the available cache of the underlying hardware (Goto & van de Geijn, 2008a). Depending on CPU features, such as SSE and AVX, these blocks are multiplied using hardware- accelerated kernels that concurrently process multiple el- ements within each block. As an example, 32-bit float GEMM multiplication in OpenBLAS uses a 16x4 kernel' and 1024x 1024 blocks on an Intel Xeon Gold processor.
As a consequence, we consider the function fi as part of a high-level classification function
h; S - {1, (1.....cy c), x arg max fi())::
which receives an input from S and predicts a class label. Based on this function, we can formally define Chimera examples that exist in the input domain S. Definition 3.1 (Chimera example). Let hi,..., ,, be set of classification functions that utilize the same model on n different linear algebra backends. A Chimera example is an input o that satisfies
Figure 2 illustrates this decomposition process. The matrices A and B are divided into blocks, whose products are sequen- tially accumulated in C. While each block multiplication is accurate within the limits of IEEE 754, the accumulation in C amplifies deviations due to non-associativity. Depending on the kernel size, block size and processing order, the backends implicitly prioritize the summation of values into C, which can be conceptually visualized by adding parentheses to group additions.
ZES, hz + (T), Vi
so that the predictions conflict for every pair i of the considered backends.
The discrete nature of S plays a crucial role in the existence of Chimera examples and has received little attention in current literature on numerical imprecision. While differ- ences on the scale of a few ULPs can be easily induced using high-precision floats, achieving similarly fine-grained variations from within limited set S is significantly more challenging. Consequently, the attack surface depends not only on the deviations between backends but also on those that can be realized in practice. This challenge is illustrated in Figure 3, which shows deviations between the functions fi and f2 while overlaying the feasible vectors of S.
Note that GEMM is just one example, as many other operations similarly suffer from rounding errors. Two promi- nent cases include aggregation (Kahan, 1965), commonly used in machine learning for gradient summation, and convolutions, which can be interpreted or transformed into GEMM calls (Chellapilla et al., 2006). Like GEMM, efficient implementations of both operations compute results using blocks and kernels.
"ApenBLAS 16x4 32-bit float kernel.
3

---

Adversarial Inputs for Linear Algebra Backends
For a single backend this formulation moves the sample from its source class target class yi- If we dynamically adapt the step size a, this approach theoretically brings us infinitesimally close to the decision boundary, potentially leading to deviations among multiple backends.
Chimera examples
Infeasible area
fi f2
However, there is a catch: the generated points do not lie within S, and thus moving along their gradients may lead into infeasible regions, as demonstrated in Section 4.5. To address this problem, we introduce two strategies: First, we map Ty back to S when computing its gradient, ensuring that the gradients reflect the view from S while optimization occurs in F. Second, we let the backends "compete" against each other. This represents an important distinction from the standard search for adversarial examples. By setting a different target label yi for each backend we achieve tug- war effect. Because each backend pulls the input towards its target class, the input sample is ultimately moved closer to the decision boundary.
Figure 3. Schematic depiction of Chimera examples. The light blue area represents Ipd (1), while feasible vectors in & are shown as dots (o). Chimera examples are feasible vectors that lie within a pocket between the decision boundaries of fi and fz.
3.2. Threat Model
We assume an adversary with white-box access to the learning model f and the employed linear algebra backends. This access enables them to perform inference using the classification functions fi...., h,, analyze intermediate computations such as fi(x),, and compute gradients over 9 on individual backends. Note, however, the adversary does not have direct access to genuine numerical results themselves, as also their computations must be executed on some linear algebra backend.
Considering these strategies and multiple backends, we arrive at the following aggregated perturbation:
This threat model reflects common scenarios where models are deployed in different configurations practice, known to the adversary. These configurations may include develop- ment and production systems, as well as nigh-performance and mobile/embedded implementations. While white-box access is not typically guaranteed in such settings, we adopt this strong attacker model to better evaluate the corresponding defenses introduced later (Section 5).
with Jx = ((*)) and Vi4s Dt # y33
where n is the number of backends and Fd + maps an input from the floating point space Fdd back to the constrained input space S. Depending on the input domain, this function can be implemented as a quantization, an assignment grid, or lookup of the closest elements in S. In the image domain, the quantization function q maps the input vector to the closest vector representing valid 8-bit image. One step of this search method, including quantization, illustrated in Figure 4.
One may argue that keeping the models and backends confi- dential might be possible defense, since black-box attacks are significantly harder to conduct in this brittle environment. However, this is not a reliable protection strategy, as it depends on keeping information confidential that is typically not considered sensitive. Moreover, in standard machine learning frameworks, the available backends are usually known to the adversary by default.
To ensure that the input oy remains within the general bounds of the input domain, i.c., for images in [o. 1]. we also introduce change of variables during optimization, similar to Carlini & Wagner (2017), reparameterizing each instance as Fy = (tanh(w;) ) + 1). For brevity, we omit the additional variable w from the mathematical notation.
3.3. Finding Chimeras
For constructing inputs following Definition 3.1, we build on a common strategy for generating adversarial exam- ples (Carlini & Wagner, 2017): We first select starting point 1 and iteratively move it toward the decision function by computing a perturbations from its gradient,
8 Va, (f)
F6+1
Tk+1 3e + add
f1 f2
where l is a loss function, such as the cross-entropy loss, a E R+ the step size, and y/s the target label for the linear algebra backend i.
Figure 4. Perturbation step of our method. The point 2% is moved along the gradient determined from a feasible input Fg.
4

---

Adversarial Inputs for Lincar Algebra Backends
The resulting method is described in Algorithm 1. We search for an input 3y E $ that satisfies the Chimera conditions (Definition 3.1). The loop terminates when Chimera is found or the maximum iterations N = 3000 is reached.
Table 1. Overview of considered linear algebra backends
Backend
Type
Platform
Version
OpenBLAS
CPU
Cross-platfone
0.3.28+
Note that we express the calculation of the aggregated perturbation as a for-loop, as it depends on an architecture capable of simultaneously obtaining results from multiple backend instances, such as virtual machines or containers. The starting point Ti is obtained from 2000 iterations of our search on single backend to move towards the proximity of the decision boundary first.
Eigen
CPU
Cross-platform
1.0
BLIS
CPU
Cross-platform
3.4.0+
Intel MKL
CPU
Cross-platform
2024.1.0-691
Apple Accelerate
CPU
Apple Silicon
macOS 14.6.1
Nvidia cuBLAS
GPU
Nvidia GPUs
12.4
algebra operations. Eigen supports a wide range of CPU features and extensions.
Algorithm 1 Finding Chimera examples
Input: Starting point ii; ʃi and yi for each backend i Result: Chimera example S
Intel MKL (Intel, 2025) (Math Kernel Library) is a propri- etary library developed by Intel, offering an extensive set of highly optimized kernels. Despite its origin, the backend is not restricted to Intel CPUs and provides cross-platform functionality with BLAS interface.
for i < to N do
TR g(xx)
if Ty is a Chimera then
L break
Nvidia cuBLAS is a BLAS implementation included in the installation of CUDA (NVIDIA, 2020), a library for GPU calculations. It uses massively parallel instructions to compute linear algebra. We use CUDA 12.4.
5 5=0
for i 1---11 1 to n do
L 8 8 + V 2, (fi(
1k+1 3k + 28
Apple Accelerate (Apple, 2025) contains the default collec- tion of operations on macOS, featuring a BLAS implementa- tion. It utilizes either the on-dic CPU or the GPU via Metal Performance Shaders (MPS). We found that the GPU-based version of MPS does not behave deterministically and so we disabled this extension of the library.
return 3g
4. Chimeras in Practice
We begin our empirical evaluation by investigating the existence of Chimera examples in practice. Our goal is to assess whether we can construct corresponding feasible inputs for a learning model and sufficiently amplify their effect to cause conflcciing predictions.
4.2. Experimental Setup
We consider three datasets, FMNIST (Xiao et al., 2017), CIFAR- 10 (Krizhevsky et al., 2009), and ImageNet (Deng et al., 2009). For FMNIST, we fully connected network with two layers. For CIFAR, we employ a convolutional neural network with three VGG blocks (Simonyan & Zisser- man, 2015) and three dense layers. We train both models to achieve a test accuracy of 82.32 % and 80.75 %, respectively. For ImageNet, we use a pre-trained EfficientNetV22 (Tan & Le, 2021) with a test accuracy of 84.2 %. Refer to Appendix B for more details. We use 32-bit floats with 23- significand in all experiments.
To facilitate future work, we have uploaded our source code to https:://gtttaaa coom/mlsec-grae dila
4.1. Linear Algebra Backends
For our experiments, we consider the linear algebra back- ends shown in Table 1, which are widely used in machine learning frameworks, such as TensorFlow and py Pyrch..
OpenBLAS (Xianyi et al., 2012) is an open-source, CPU- focused library and the successor to the discontinued GotoBLAS implementation (Gunnels et al., 2001; Goto & van de Geijn, 2008b). It is a prominent BLAS backend with numerous CPU-specific optimizations and is widely used in projects such NumPy, SciPy, and OpenCV.
For all of our experiments, we execute the same code on top of PyTorch v2.5.1 with the different BLAS backends. All libraries use the default number of threads, as would be employed in a practical scenario. Moreover, we conduct our experiments on the following three platforms:
BLIS (Van Zee & van de Geijn, 2015) is another open- source backend for linear algebra, developed in an academic setting. It provides superset of BLAS functionalities while maintaining a high-performance base interface.
P1
an Intel Xeon Gold 6326 CPU @ 2.90GHz, 16 cores, and 24 MB L3 cache (Ice Lake),
P2 an Intel Xeon Silver 4114 CPU @ 2.20GHz with an Nvidia RTX 3090 24GB GPU
Eigen is free software and a widely used C++ library that implements the BLAS interface, providing efficient linear
P3 a Macbook Air M2, running macOS Sonoma 14.6.1
5

---

Adversarial Inputs for Lincar Algebra Backends
OpesSLAS
0.21
0.21
0.24
0.15
0.11
0.11
1.00
0.8
0.10
0.15
0.22
XXL
0.16
0.16
0:17
0.00
0.00
0.15
0.16
0.96
0.30
0.23
0.30
0.54
1.00
0.6
Bignn
0.23
1120
0.21
0.17
11
0.16
0.16
0:15
0.12
0.95
0.35
0.330
0.30
0.41
1.00
Accolerate
0.21
0.18
0.36
0.17
0.119
0.12
0.44
0.30
0.34
0:41
1.00
CIBLAS
0.0
Open
BLIS
AIKL
Bige
Acc
aiBLAS
Open
BLI5
MXL.
Bige
Ace
caBLAS
Open
BL.5
MKL
Biges
Abc
SaBL
FMNIST
(b) CIFAR
(c) ImageNet
Figure 5. Attack success rates for each pair of BLAS libraries FMNIST, CIFAR and ImageNet.
Except when the Apple Accelerate or Nvidia cuBLAS backends considered, all experiments platform P1. Otherwise, the respective platforms P2 and P3 are used. This experimental setup minimizes the impact of CPU dif- ferences, as all backends run on the same CPU architecture, except for Apple Accelerate and Nvidia cuBLAS, which are bound specific hardware.
We attribute these disparities to the convolutional layers in the CNN model used, which amplify numerical differences during GPU computation. Upon deeper inspection of the PyTorch code, we find that all CPU-based implementation appear to use the same default implementation for the convolution layer. For these backends, the differences only stem from the dense layers of the network and thus the error aggregation is significantly reduced. On the other hand, the CUDA- GPU backend uses separate convolution implementation. Due the large amount of floating point operations in a convolution (Schlögl et al., 2024), the gap between the CPU backends and the GPU backend is significantly higher.
Due to blocking and other design choices in efficient matrix multiplication (see Section 2), the size and order of mini- batches introduce extra sources of indeterminism, even within equivalent BLAS implementations. To mitigate this effect, and to ensure the reproducibility of our experiments, we default to inference batches size one.
4.4. Ablation Study
4.3. Finding Chimeras
An important component of our methodology is the quantiza- tion function q. which ensures that only vectors representing valid objects from S are returned as Chimera examples. In our search method, gradient computations are based exclu- sively on quantized inputs. To evaluate the effectiveness of this quantization step, we conduct ablation study, Specifically, we compare our approach to an alternative strategy where we compute gradients on the unquantized inputs and only apply quantization to check whether a Chimera example has been found.
To uncover Chimera examples, we systematically search across all six linear algebra backends. Specifically, we consider pairs of backends (n 2) and apply our attack method (see Algorithm 1) 1,024 (for FMNIST and CIFAR) and 128 (for ImageNet) randomly selected test samples per pair. For each sample, the first backend uses the input's 's true class as its target, while the second backend is assigned a different, randomly chosen class.
The results this experiment are displayed in Figure 5. We observe that Chimera examples can be consistently found across all backend combinations. The search FMNIST yields relatively uniform success rates, ranging from 16 % to 24 %. In contrast, both CIFAR and ImageNet exhibit more pronounced variation. We identify two clusters for both datasets: one consisting of all CPU-based backends, with success rates between 9 % and 18 % for CIFAR and 27 % 44 % for ImageNet, and another induced by the cuBLAS GPU backend. When this backend is used, our method achieves significantly higher success rates of 95 %-96% % for CIFAR and 100% for ImageNet.
We find that the ablated setup perform worse. While our quantization step results in slight performance reduction of about 1% to 2% for GPU-based backends, it yields substantial improvements for CPU-based backends, pro- ducing approximately 2.2x more Chimera examples for CIFAR and between 1.1 x to 7x more for FMNIST. As an additional benefit, the step saves one forward pass through the model, since only one pass on the quantized input is needed to obtain both classification results and gradients.
6

---

Adversarial Inputs for Lincar Algebra Backends
4.5. Alternative Approaches
100%
FMNIST
We identify Chimera examples across all considered back- end pairs, yet with varying success rates. This naturally raises the question: how well does approach perform compared to alternative methods? To address this, we evaluate it against three baseline approaches.
80%
CIFAR (CPU only)
CIFAR (CPU vs. GPU)
Density
60%
40%
20%
Binary Search. Instead of following gradients, this baseline starts with two initial samples from different classes and iteratively interpolates between them until the resulting sample lies on the decision boundary.
109
10
10a
10
10a
10a
10
Distance to Original Chimera Example
Figure 6. Estimated probability of infeasible Chimera examples around previously found Chimera examples at a given distance.
Boundary sample search. Schlögl et al. (2021) propose a modified iterative FGSM that approaches the decision boundary. Their algorithm identifies "boundary samples", which are inputs used to fingerprint different CPU archi- tectures and may therefore potentially constitute Chimera examples in our setting.
4.6. Spatial Analysis
So far, we know little about the characteristies of the regions containing the identified Chimera examples. Are these points isolated singularities that correspond to numerical anomalies between decision boundaries, or do they form "pockets" spanning hundreds of ULPs? While in both cases the phenomenon corresponds to only a tiny part of IF, in the latter, the vulnerability must addressed on broader scale to protect learning models from attacks.
Adversarial example search. Carlini & Wagner (2017) suggest an attack that minimizes the perturbation applied to the original sample. Consequently, the resulting adversarial examples should be near the decision boundary and may serve as potential Chimera candidates.
To compare these baselines with our approach, we repeat the previous experiment and measure their respective success rates. Based on the observations from the previous experi- ment, we group the backends into two categories: CPU only backends and CPU vs. GPU backends. We report the mean success rates for both categories in Table 2.
To gain insight into this question, we broaden our setup: First, we lift the input constraints on the classification function h, allowing it to accept any vector from F. Second, we relax our definition of Chimera examples to include any input from F that causes conflicting predictions. We refer to these as infeasible Chimera examples distinguish them from those within S. Our goal is to estimate the density of these confliciing vectors around feasible Chimera example in the space of floats.
We find that all three baseline approaches exhibit consider- ably lower success rates than our method across all datasets and categories. This difference is particularly pronounced for the FMNIST dataset, where the baseline methods either fail to find any Chimera examples or achieve success rates below 0.1 %. Similarly, for CPU-only backends, all base- lines struggle to achieve good results on the CIFAR dataset, with the highest rate reaching 1.41 %. When considering the cuBLAS backend, baseline performance improves, with the method of Schlögl al. (2021) achieving up 67.38 %. Nonetheless, a significant gap remains between all baselines and our approach in every setting.
Due to the high dimensionality of Fd,, however, system- atically traversing all adjacent vectors to some point intractable. The curse of dimensionality makes exhaustive exploration computationally prohibitive. Consequently, we employ sampling method to approximate the density of conflicting vectors at distance of d from a feasible Chimera example J. Specifically, our sampling for a distance d is defined as
V d) = ES-A, (1 [In 8) * h2( + +)]]
Table 2. Comparison of attack success rates for the baselines.
where A₂ represents the probability distribution of pertur- bations with an Lex norm of exactly d ULP, and 1(.) the indicator function.
CIFAR
FMNIST
CPU only
GPU/CPU
To estimate V, perform Monte Carlo sampling over the set of perturbations Aa and compute the average across all Chimera examples identified in previous experiments. By varying d, we can approximate the density of conflicting vectors surrounding a Chimera example, allowing us to assess the extent of the surrounding pocket, if one exists.
Ours
19.19%
13.61%
95.26%
Binary search
< 0.1%
< 0.1%
18.14%
Boundary samples
0%
1.41%
67.38%
Adv. examples
0%
0%
1.76%
7

---

Adversarial Inputs for Linear Algebra Backends
The results of this experiment are presented in Figure 6, where the x-axis denotes the distance d to x. and the y-axis indicates the density of conflicting vectors.
Based this primitive, we define noisy version of the classification function
ha(1) = arg max fi(2 + (1)
In this experiment, we rarely discover isolated Chimera examples. Instead, almost all examples are surrounded by ad- ditional conflicting vectors, forming pockets that range from 1 up 100,000 ULP. While pocket sizes for CPU-based backends rarely exceed 100 ULP, the regions of conflicting vectors for GPU-based backends CIFAR are considerably larger. This aligns with our experimental findings, where the success rate of our approach is significantly higher when one of the considered backends is Nvidia cuBLAS and the CIFAR dataset is used.
where each input æ is perturbed by noise of magnitude d ULP, determined by and s. An adversary aware of the defense but lacking knowledge of cannot compute Ca(z, s) if cryptographically secure PRNG is used. Since the noise depends on both and 8, repeatedly running the same input through h2 does not yield additional insights, At the same time, the prediction remains deterministic and does not interfere with existing machine learning workflows.
The parameter d controls the strength of the added noise, thereby obstructing the discovery of Chimera examples in F. Based on the results from the previous section, we find that these examples reside in confined regions. Thus, increasing the noise magnitude beyond the size of these regions significantly hinders their identification, as any attempt to gradually approach them will overshoot.
Although each of the considered pocket regions remains very small relative to the actual numerical values, the attack surface of Chimera examples spans non-trivial region. Consequently, defenses must address this issue broadly, as we demonstrate in the following, rather than applying localized fixes to individual deviations.
5. Defense
5.2. Defense Evaluation
Finally, turn our foeus the challenge of preventing adversaries from discovering Chimera examples. Construct- ing defenses in adversarial machine learning is notoriously hard. Previous work has repeatedly shown that integrating robustness directly into models can be a tedious and often fruitless task (Athalye et al., 2018).
To evaluate the defense, we assume an attacker with white- box access to the deployed target model, the utilized backends, and the noise magnitude of the defense; only the secret s remains unknown. In Section 4.6, observe that pockets for the FMNIST and CIFAR dataset extend at most to 103 ULP and 103 ULP, respectively. Based on these observations, we calibrate d to these distances. Since this noise level is relatively small compared to natural input variations, we observe no negative impact on the test accuracy of the evaluated models.
Since Chimera examples are closely related to adversarial examples, adversarial training (Goodfellow et al., 2015; Madry et al., 2018) appears to be natural defense strategy. However, we find that it does not sufficiently reduce the attack success rate and can be further weakened by increasing the number of search iterations. Conceptually, this limitation arises because adversarial training not designed to eliminate the tiny pockets of imprecision near the decision boundary, but instead shift the decision boundary. A detailed description of our setup and results is provided in Appendix A. As remedy, we propose a defense based on different principle: we introduce secret to protect the model from Chimera examples without requiring any retraining or changes to the model architecture.
To account for the additional noise layer, extend the Chimera example search include these noise perturbations. However, because the secret key is unknown, the adversary can only approximate this layer with their own key, with the goal to identify Chimera examples that remain resilient against the perturbations applied by the target model.
Using this adversary, we can evaluate the defense's effective- ness by repeating the experiment described in Section 4.3. The results are summarized in Table 3 and show a significant decline in success rate compared to the undefended model.
5.1. Keyed Noise Defense
Given a secret s, such as a random bit string known only to the defender, we introduce a keyed noise function Ça(x, s).
Table 3. Comparison of the attack success rate with and without the noise defense applied to the model.
This function generates uniform noise of magnitude ULP using pseudorandom number generator (PRNG) initialized with the current input and the secret As result, the generated noise remains deterministic for each pair (ar, s) but varies if either æ or changes.
CIFAR
FMNIST
CPU only
GPU/CPU
w/o defense defense
19.20 %
18.04 %
95.26 %
0.00
0.69 %
0.00 %
8

---

Adversarial Inputs for Lincar Algebra Backends
In most cases, the success rate drops to zero, with the only exception being CPU only backends on CIFAR, where we observe minimal success rate of 0.69 %. This rate could be further reduced by increasing the noise level d.
internal workings are not differentiable, making successful attacks more challenging. Second, we construct feasible inputs adhering to the constraints of the input space S, similar to problem-space attacks (Pierazzi et al., 2020).
In summary, while our defense strategy does not eliminate the vulnerability, it introduces uncertainty, making it more difficult for an attacker to construct a successful attack. Even if an attacker were able identify Chimera example without directly approaching the decision boundary, the keyed noise function prevent them from exploiting it.
7. Conclusions
Despite being largely invisible to practitioners, linear al- gebra backends are omnipresent in machine learning and introduce an unexpected vulnerability. In this work, demonstrate that subtle implementation differences can be exploited to generate adversarial inputs, causing learning models to produce conflicting predictions depending on the backend used. These Chimera examples arise across all six backends examined in our experiments, revealing a previously unexplored attack surface in practice.
6. Related Work
Our work explores the combination of numerical impre- cision in floats and adversarial machine learning. Conse- quently, it is closely related previous research in these areas, which we briefly discuss in the following.
Searching for Chimera examples, however, is challenging due to the subtle and non-differentiable nature of underlying floating-point issues. The success rate of our attack varies, ranging from 8% for some backends to as high as 96% with Nvidia CUDA. Upon analyzing this phenomenon, we observe that numerical deviations between backends create "pockets" of 1-10000 ULPs near the decision boundary. Building this insight, our defense prevents the reliable identification of pockets close to the boundary and thus impedes the search for Chimera examples.
Floating-point imprecision. The existence of numerical deviations in floating-point arithmetic due to swamping is long-standing issue (Goldberg, 1991). These errors have been experimentally studied in modern machine learning (Al-Rikabi & Renczes, 2022), paving the way for various attacks against neural networks.
For example, numerical errors in floating point computa- tions can compromise soundness assumptions in verifiably robust models (Jia & Rinard, 2021). They can also be exploited to embed neural backdoors during model prun- ing through quantization artifacts (Tian et al., 2022). Similarly, subtle differences in model outputs can be leveraged to fingerprint CPU microarchitectures (Schlögl et al., 2021; 2024), as well as software stacks and GPU architectures (Zhang et al., 2024).
Impact Statement
We identify a novel attack surface in current machine learning systems and propose corresponding defense. As result, our work enhances the security of learning-based systems and mitigates potential risks to users.
Our work extends this line of research by introducing linear algebra backends as another source of imprecision that when effectively exploited mislead models.
Acknowledgments
This work was supported by the Deutsche Forschungsge- meinschaft (DFG, German Research Foundation) under Germany's Excellence Strategy EXC 2092 CASA 390781972, and the project ALISON (492020528), as well as by the European Research Council (ERC) through the Consolidator Grant MALFOY (101043410).
Adversarial machine learning. Our attack builds on ex- isting work for generating adversarial examples. Technically, this research has primarily focused two attack strategies. The first aims to minimize the required perturbation (Pa- pernot et al., 2016; Carlini & Wagner, 2017) and improve efficacy across different models (Moosavi-Dezfeee 2017; Gao et al., 2022). The second explores query efffc-efficient algorithms under black-box threat models (Chen et al., 2020; 2017; Chen & Gu, 2020). Closest to our work is the method by Schlögl et al. (2021) that employs an iterative method to identify boundary samples for fingerprinting CPUs, which serves as simple baseline in our study.
et al.,
References
Al-Rikabi, H. and Renezes, B. Floating-Point Roundoff Error Analysis in Artificial Neural Networks. In- ternational Symposium on Measurement of Electrical Quantities (IMEKO), 2022.
While our approach follows the blueprint of adversarial examples, it differentiates in two key aspects. First, we optimize over multiple slightly different functions whose
Apple. Accelerate. /etepe// wpw.pper..ppp........mmpm m/ wt/bccmmetaccioo/ccceleeetttttte 2025.

---

Adversarial Inputs for Lincar Algebra Backends
Athalye, A., Carlini, N., and Wagner, D. A. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In Proc. of the Inter- national Conference on Machine Learning (ICML), pp. 274-283, 2018.
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations (ICLR), 2015,
Goto, K. and van de Geijn, R. Anatomy of matrix multiplication. ACM Transactions on Mathemai- cal Software (TOMS), 34(3):1-25, 2008a.
Blackford, L. S., Demmel, J., Dongaita, J.. Duff, I., Hammarling, S., Henry, G., Heroux, M., Kaufman, I.., Lumsdaine, A., Petitet, A., Pozo, R., Remington, R., and Whaley, R. C. An updated set of basic linear algebra subprograms (BLAS). ACM Trans. Math. Softw., 28(2): 135-151, June 2002.
Goto, K. and van de Geijn, R. mentation of the level-3 blas. ACM Transactions on Mathematical Software (TOMS), 35(1):1-14, 2008b.
imple-
Gunnels, J. A., Henry, G. M., and van de Geijn, R. A. A family of high-performance matrix multiplication algo- rithms. In International Conference on Computational Science, pp. 51-60. Springer, 2001.
Carlini, N. and Wagner, D. A. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, (SP), pp. 39-57, 2017.
Chellapilla, K., Puri, S., and Simard, P. High performance convolutional neural networks for document processing. IWFHR, 10 2006.
IEEE. Standard for Binary Floating-Poin Arithmetic. IEEE Std 754-1985, 1985.
IEEE. Standard for Floating- Point Arithmetic. IEEE Std 754-2019 (Revision of IEEE 754-2008), 2019.
Chen, J. and Gu, Q. Rays: A ray searching method for hard- label adversarial attack. In Proc. of the ACM Knowledge Discovery and Data Mining (KDD), 2020.
Intel. Math kernel liberary. httpt:ttt///// https:ttstttttteeeeeees http:///sfttaatee/e int
el www.co//een..m comm/en-us//e mat--uuiineeemm1//222 2025.
Chen, J., Jordan, M. I., and Wainwright, M. J. Hop- skipjumpattack: A query-efficient decision based attack. In 2020 /EEE Symposium on Security and Privacy (SP), pp. 1277-1294, 2020.
Jia, K. and Rinard, M. Exploiting verified neural networks via floating point numerical error. In Proc. of the 28th International Symposium on Static Analysis (SAS), pp. 191-205. Springer, 2021.
Chen, P.. Zhang, H., Sharma, Y., Yi, J., and Hsich, C. ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proc. the 10th ACM Workshop on Artificial Intelligence and Security (AISec), pp. 15-26. ACM, 2017.
Jin, J., McMurtry, E., Rubinstein, B. I,, and Ohrimenko, O.
Are we there yet? timing and floating-pon attacks on differential privacy systems. In 2022 IEFE Symposium on Security and Privacy (SP), pp. 473-488, 2022.
Jin, J., Ohrimenko, O., and Rubinstein, B. I. Getting a-round guarantees: Floating-poii attacks on certified robustness. Pruc. of the 17th ACM Workshop on Security and Artificial Intelligence (AlSec), 2024.
Deng, J., Dong, W., Socher, R., R,, L., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pp. Computer Society, 2009.
IEEE
Kahan, W. M. Pracniques: further remarks on reducing truncation errors. Commun. ACM, 8(1):00, January 1965.
Dongarra, J. J., Du Croz, J., Hammarling, S., and Duff, I. S. A set of level basic linear algebra subprograms. ACM Transactions on Mathematical Software (TOMS), 16(1):
Krizhevsky, A., Nair, V., and Hinton, G. Cifar- 10 (Canadian Institute for Advanced Research), 2009. URL ht / //www. www.ccs.cc toronto............... edw/ c ci..a.tml....
1-17, 1990.
Lawson, C. L., Hanson, R. J., Kincaid, D. R., and Krogh, F. T. Basic Linear Algebra Subprograms for Fortran Us- age. ACM Trans. Math. Softw., 5(3):308 323,, September 1979.
Gao, R., Wang, J., Zhou, K., Liu, F., Xie, B., Niu, G., Han, B., and Cheng, J. Fast and reliable evaluation of adversarial robustness with minimum-margin attack. In Proc. of the International Conference on Machine Learning (ICML), pp. 7 7144-7163, 2022.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant adversarial attacks. In Proc. of the International Conference on Learning Representations (ICLR), 2018.
Goldberg, D. What every computer scientist should know about floating point arithmetic. ACM computing surveys (CSUR), 23(1):5-48, 1991.
10

---

Adversarial Inputs for Lincar Algebra Backends
Moosavi-Dezfoole S., Fawzi, A., Fawzi, O., and Frossard, P. Universal adversarial perturbations. In 2017 IEEE Conference Computer Vision and Pattern Recognition, CVPR, pp. 36-94. IEEE Computer Society, 2017.
Xiao, H., Rasul, K., and Vollgraf, R. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms. CoRR, abs/1 7778077777 2017.
Yu, J., Wang, Z.., Vasudevan, V., Yeung, L.., Seyedhosseini, M., and Wu, Y. Coca: Contrastive captioners are image- text foundation models. Trans. Mach. Learn. Res., 2022, 2022.
NVIDIA. Cuda, 2020. URL https::///// developer. idia. com/ cudaatoolat......
Papernot, N., McDaniel, P. D., Jha, S., Fredrikson, M., Celik, Z. B., and Swami, A. The limitations of deep learning in adversarial settings. In IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372-387. IEEE, 2016.
Zhang, C., Foerster, H., Mullins, R. D., Zhao, Y., and Shumailov, I. Hardware and software platform inference. CoRR, abs/2411.05199 2024.
Pierazzi, F., Pendlebury, F., Cortellazzi, J., and Cavallaro, L. Intriguing properties of adversarial ml attacks in the
A. Adversarial Training as Defense
problem space, In Proc. of the IEEE Symposium on Security and Privacy, pp. 1332-1349, 2020.
Adversarial training (Goodfellow et al., 2015; Madry et al., 2018) is defense that increases the robustness of models by incorporating knowledge about adversarial examples in the training process. Because of their close relation Chimera examples, perform experiment to assess the effective- ness of adversarial training against our attack. Since training is performed on a single backend only, incorporating our attack into adversarial training is conceptually infeasible. As a remedy, we generate regular adversarial examples using projected gradient descent (Madry et al., 2018). We conduct this experiment on the FMNIST and CIFAR datasets.
Schlögl, A., Kupek, T., and Böhme, innformant: Bound- ary samples as telltale watermarks. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pp. 81 81-86, 2021.
Schlögl, A., Hofer, N., and Böhme, R. Causes and effects of unanticipated numerical deviations neural network inference frameworks. Advances in Neural Information Processing Systems, 36, 2024.
Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In 3rd International Conference Leurning Representations (ICLR), 2015.
We observe that the success rate of our attack is reduced by 30-40 % across the backends when adversarial training is employed. This is a moderate improvement but not as effective as our defense (see Section 5). We attribute this drop to our attack's initialization step, which leverages an adversarial example to reach the decision boundary and hence is obstructed by adversarial training. By increasing the number of iterations in this initial step, however, can improve the attack's 's performance again. This highlights an interesting property of our attack: it initially behaves like a standard adversarial example to reach the decision boundary but then searches for Chimera examples its vicinity.
Strassen, V. Gaussian elimination is not optimal. Nu- merische Mathematik, 13(4):354-33) -366, Aug 1969.
Tan, M. and Le, Q. V. Efficientmetv2: Smaller models and faster training. In Proceedings of the 38th International Conference Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 10096-10106. PMLR, 2021.
Tian, Y., Suya, F., Xu, F., and Evans, D. Stealthy back- doors as compression artifacts. IEEE Transactions on Information Forensics and Security, 17:1372-1387, 2022.
B. Dataset and Model Details
The evaluation of Chimera examples requires balancing resource-intente intensive model training with the need for exper- imentation across different hardware platforms, including less efficient CPU-based backends. Therefore, we select FaShionMNNIT (FMNIST) and CIFAR-10 (CIFAR) as our initial datasets for evaluation.
Van Zee, F. G. and van de Geijn, R. A. BLIS: A framework for rapidly instantiating BLAS functionality. ACM Trans- actions on Mathematical Software, 11:1:334:,,,:33, June 2015.
Voráček, V. and Hein, M. Sound randomized smoothing in Boating-point arithmetic. In Proc. of the International Conference on Machine Learning (ICML), 2023.
FMNIST (Xiao et al., 2017) is an improved alternative to the original MNIST benchmark and serves our first evaluation dataset. It consists of 60,000 grayscale 28 x 28
Xianyi, Z., Qian, W., and Yunquan, Z. Model-driven level 3 blas performance optimization on loongson 3a processor. In IEEE 18th international conference on parallel and distributed systems, pp. 684-691, 2012.

---

Adversarial Inputs for Lincar Algebra Backends
images of fashion items for training and 10,000 for testing. For this dataset, employ neural network with fully connected layers, each containing 128 neurons and separated by ReLU activation function. The resulting model achieves an accuracy of 82.32% and comprises a total of 101,770 parameters.
Table A1. Our VGG-based architecture for CIFAR. Inputs of shape (b x 32 x 32 x 3) where b is the batch size and the last dimension the number color channels.
Layer
Output Shape
Parameters
Conv2D + BN ReLU
[b, 128, 32, 321
3,840
VGG Block
Conv2D BN ReLU
[b, 128. 32]
147,840
CIFAR-10 10 (Krizhevsky al., 2009) is benchmark dataset consisting of color images of size 32 32 pixels, with 50,000 images for training and 10,000 for testing. We adopt VGG-based model similar to variant B in (Simonyan &
MaxPool2D
[b. 128, 10, 10]
0
Conv21) + BN ReL.U
[b. 128. 10, 10]
147,840
VGG Block Conv2D) MaxPool2D
[b. 128, 10, 10]
[b, 128. 3.
0
Conv2D> BN ReI.U
[b, 128. 3.3]
147,840
Zisserman, 2015) for our experiments. Each convolutional block in our model consists of two 3 x 3 convolutional layers with padding and stride of one, followed by batch normalization, ReLUU activation, and a 2D max-pooling layer. The model includes three such blocks, followed by three fully connected layers with 512 neurons each, ReLU activations, and dropout (p 0.5). In total, the architecture contains 1,076,874 parameters and implements 9 of the original 13 parameterized layers from the VGG design- an appropriate scale for the relatively small dataset. After training for 10 epochs, the model achieves an accuracy of 80.75% on the test set.
VGG Block Comv2D + BN ReLU
bb, 128, 3,
147,840
MaxPool2D)
[b, 128,
Flatien
[b, 128]
0
Lincar ReLU Dropout Linear
[b. 5121
66,048
Classilier
Dropout
[b. 10]
5,1.0
Total Paramelers:
1,076,874
Table A2. Our DNN architecture for FMNIST. The (bx 28 x imputs are flattened and passed through a series of fully connected layers with batch size b.
As more realistic benchmark, additionally consider ImageNet (Deng et al., 2009), large-scale dataset con- taining over 1.2 million images across 1,000 classes. For this setting, we conduct our experiments using a pre-trained EfficientNerV2-S model (Tan Le, 2021), as summarized in Table A3. This architecture processes inputs through series of bottleneck blocks, significantly reducing the number of trainable parameters. All inputs resized consistent shape of [b, 3, 224, 224] for inference. For clarity, Table A3 reports only the output shapes and parameter counts per block; we refer interested readers to the original paper (Tan & Le, 2021) for full architectural details. The model achieves top-1 accuracy of 84.2% on the test set, placing it in the range of state-of-the the-arr models, such as CoCo, which reaches up 91% % accuracy (Yu al., 2022).
Block
Layer
Output Shape
Parameters
Flatten
[b. 784]
0
Linear Rel.U Lincar
[b. 128]
100,480
Linear Block
[b, 10]
1,290
Total Parameters:
101,770
Table A3. EfficientNet122 architecture for Imagenet.
Block
Layer
Output Shape
Parameters
Conv2D BN + SiLU
696
Stem
(Coav2D + BN SILU)
[b, 24. 112. 112]
10,464
Conv2D BN SiLU + Conv2D + BN
25.632
Block
(Comv2D
SiLU
124,416
+ Conv2D + BN) x3
[b. 48, 56,
277,920
Conv2D BN SiLU
Couv2D + BN
95,744
Block 2
(Conv2D BN SiLU
Conv2D + BN) x3
[b. 28, 28]
493,440
Conv2D BN SiLU
55,296
MB.
Conv2D BN + SILU
165,888
Blocks
AvgPonI2D Conv2d + Conv2d + SiLU Sigmoid
1-30
Conv2d
[b.
18.597.752
Conv2D BN + Adapiive-AgPooolID
[b, 1280, 7, 7]
330,240
Head
[b. 1280,
0
Drupout(0.2)
1280] [h. 1000]
0
Classifier
Linear
1,281,000
Total Parameters:
21.458,488
12


Reviews:
[{"review_id": "dv0CbIfls1", "reviewer": "Reviewer_ava8", "summary": "This paper claims that the implementations of linear algebra used by popular frameworks such as PyTorch and TensorFlow are not exactly consistent. The difference between these implementations can be quantified using a term called ULP (Unit in the Last Place). The authors demonstrate that this small gap is enough to produce adversarial examples specific to a given backend.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback on our paper! \n\n**Chimera vs. adversarial examples.** We are sorry that a key distinction between Chimera examples and adversarial examples did not come across clearly. Constructing a Chimera example always requires considering at least two backends simultaneously. If only a single backend is attacked, the resulting adversarial example is likely to transfer to other backends as well—and thus does not qualify as a Chimera example. This is why standard algorithms for generating adversarial examples are typically unable to produce Chimera examples. As shown in Table 2, for instance, the attack by Carlini & Wagner (labeled Adv. Examples) failed to find a single Chimera example for the CPU-only backend pairs. We will clarify this point in the revised version of the paper.\n\n**Robust Accuracy.** We have considered different metrics for our evaluation but ultimately decided against using robust accuracy, as our focus is not on measuring changes in model robustness but on assessing the attack surface of backend pairs. Nonetheless, the presented attack success rate—shown in Figure 5 for different backend pairs—can be interpreted as a normalized version of (1 - robust accuracy). Since we introduce a new attack, we present this success rate, as it better highlights the efficacy of the attack rather than the resulting degradation in model performance.\n\n**Adversarial Training.** Thanks for this suggestion. Indeed, we had not considered adversarial training as a potential defense. However, this concept cannot be directly applied in our setting, as it would require training the same model across multiple backends simultaneously. Nonetheless, we conducted two experiments to investigate this defense in slightly different settings.\nFirst, we added Chimera examples to the training data of the considered models, which corresponds to a simplistic form of adversarial training. In this setting, however, we observe no impact on the success of our attack.\nSecond, we performed adversarial training using a standard method for generating adversarial examples (PGD). Interestingly, this reduces the success rate of our attack by 30–40%. We attribute this drop to our attack’s initialization step, which leverages an adversarial example to reach the decision boundary. By increasing the number of iterations in this initial step, we can improve the attack’s performance again. This highlights an interesting property of our attack: it initially behaves like a standard adversarial example to reach the decision boundary but then searches for Chimera examples in its vicinity.\nWe will include this additional experiment in the revised version of the paper. Still, our defense (Section 5) is capable of completely eliminating the attack without affecting model performance, unlike adversarial training.\n\n**Quantization and reparameterization.** The quantization function $q$ maps a vector $x$ in the feature space to the nearest element in a discrete set $S$ forming the input space. For instance, in the case of 8-bit images, it converts floating-point values in the feature space back to 8-bit pixel values. Similarly, reparameterization is a technique used to enforce box constraints on the input, ensuring that all pixel values remain within the valid range [0, 255]. This approach is derived from the Carlini-Wagner attack. We will clarify this in the paper.\n(Infeasible regions) Infeasible regions arise from the mismatch in granularity between the input space (e.g., 8-bit pixels) and the feature space (e.g., 32-bit floats). While Chimera examples may exist for certain combinations of 32-bit floating-point values, these may not necessarily be reachable using 8-bit inputs, hence lying in an infeasible region. We will clarify this difference and provide a more formal definition of this problem using the quantization function $q$.\n\n**Key differences.** Our attack differs from the classic PGD attack in two key aspects. First, we calculate the gradient from a quantized input in every iteration. Quantization is necessary because we want to elicit a Chimera example from a feasible (discrete) input. Second, the perturbation is computed from multiple linear algebra backends with conflicting loss functions. Each backend aims to push the input toward a different class—like in a tug-of-war scenario.\n\n**Defense effectiveness.** Our defense remains effective even when gradients are approximated or accumulated. It is effective because Chimera examples lie in extremely narrow regions of the feature space. As a result, adding noise with a magnitude larger than these regions during inference makes it very unlikely to discover them. As this noise is fixed for each input $x$ (keyed), it cannot be averaged out through repeated computations. Consequently, the computed gradients may move around the regions of Chimera examples but can only locate them by chance.\n\n**Drop-out layers.** We use drop-out layers only during training and not inference.", "claims_and_evidence": "The contribution of this paper is somewhat unclear. Typically, the robustness of a model is measured by its accuracy against adversarial examples, which is often referred to as robust accuracy. However, this metric can fluctuate across different hardware, mathematical libraries, and objective functions. For example, AutoAttack and RobustBench use 11 different objective functions (one untargeted attack and ten targeted attacks) to generate adversarial examples. A model is considered robust only if it can defend against adversarial examples produced by all of these objective functions. This is a well-known observation in the field.\n\nGiven this, the authors should clarify (a) why the standard robust accuracy metric is not used in this paper, and (b) whether any specific backend exhibits a significant drop in robust accuracy compared to others. If no such drop is observed, the purpose of generating these adversarial examples remains unclear. I believe that the inconsistency of adversarial examples across various backends is not inherently problematic, as long as they adhere to standard definitions of adversarial examples. In other words, adversarial examples are not unique; multiple valid adversarial examples are an acceptable scenario.", "methods_and_evaluation_criteria": "* As mentioned in the Summary section, robust accuracy is not reported in this paper. If this metric is not applicable, the authors should provide a convincing explanation to justify its exclusion to the reviewers and readers.\n\n* I compared Algorithm 1 with the PGD attack proposed by Madry [1]. The first step projects the images onto a constrained set, and the second step calculates the efficient gradient by accumulating the gradients from each implementation. I would appreciate further clarification on whether there are any significant improvements in this approach compared to existing methods.\n\n* The authors did not explain the reasoning behind the reparameterization of the input (line 180, right column). Could an adaptive attack achieve the same goal?\n\n* The most important aspect of Algorithm 1 seems to be missing: the authors did not provide a clear definition of the projection function $\\hat(x)_k = q(x_k)$. This should be clearly stated.\n\n* The experimental configurations, including the radius of the epsilon ball, are not fully detailed. Providing more information on these settings would be beneficial.", "theoretical_claims": "The paper lacks theoretical proofs. The concept of the infeasible area shown in Figure 3 appears overly simplistic. I would suggest that the authors provide a clear, formal mathematical definition of this area to strengthen the theoretical foundations of their work.", "experimental_designs_or_analyses": "* As mentioned earlier, the paper does not provide any experimental results on robust accuracy. Without these results, it is difficult to understand the significance of the adversarial examples presented by the authors.\n\n* In Table 2, if I understand correctly, the attack success rates (ASR) refer to the ratio of \"chimera\" examples (not ordinary adversarial examples). It is unclear whether the term \"Adv. example\" in the last row refers to adversarial examples generated by the method described in the paper or by other means. Clarification is needed.\n\n* Additionally, the target model used in the experiments is naturally trained, not adversarially trained. This suggests that generating adversarial examples should be relatively easy. In this context, the significance of these adversarial examples proposed by the authors remains uncertain.\n\n* As shown in Table A1, Dropout layers are involved. Dropout is a stochastic process and should not be used during inference, as this would overestimate the robust accuracy.\n\n* The proposed defensive algorithm appears to be ineffective. One can approximate the gradient through accumulation in the same way as described in the equation on line 167. For further details, please refer to the paper by [2].", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "[1] Towards Deep Learning Models Resistant to Adversarial  \n\n[2] Obfuscated Gradients Give a False Sense of Security", "other_strengths_and_weaknesses": "A major weakness is the lack of adversarially trained models in the experiments.", "other_comments_or_suggestions": "*Please number all equations for clarity.\n\n* In conclusion, I strongly suggest rejecting this paper due to unclear contributions and insufficient supporting evidence. The modifications required to meet the acceptance criteria seem substantial. However, I encourage the authors to provide more compelling evidence to support their claims. I would reconsider my recommendation if convincing revisions are made.", "questions_for_authors": "N/A", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "glwz2nqpaU", "reviewer": "Reviewer_WNoZ", "summary": "The paper presents a method that exploits differences in the numerical computation implementations of linear algebra backends that power the major ML frameworks to construct adversarial examples.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback on our paper! \n\n**Experiments with larger models.** We have extended our evaluation to include the ImageNet dataset, using the more complex architectures ResNet18 (Top-1 Accuracy: 69.7%) and EfficientNetV2S (Top-1 Accuracy: 84.2%). For these experiments, we used a reduced backend set (OpenBLAS, MKL, BLIS, and cuBLAS) and a smaller sample size of 128. In these new experiments, our attack achieves a 100% success rate for CPU-GPU backend combinations on both models. For CPU-CPU backends, we observe success rates of approximately 29% for ResNet18 and 22% for EfficientNetV2S. We will include these results in the paper.\n\n**Other defense strategies.** We initially considered different defense strategies but ultimately chose to randomize the inputs (rather than the weights) using keyed noise. This approach offers two advantages: First, the noise remains fixed for each input and, therefore, cannot be averaged out over multiple runs. Second, the runtime overhead of this defense does not depend on the model’s size and complexity. Note that we employ standard cryptographic libraries in our defense, which enables us to calculate thousands of inputs with keyed noise per second.\nAn alternative strategy would be to reject predictions near the decision boundaries to prevent classifications. However, this comes with drawbacks: First, the margin around the decision boundary would still need to be chosen based on the pocket sizes of the backends. Second, introducing such a margin effectively creates a new attack surface for Chimera examples—this time between “rejected” and “accepted” predictions.\n\n**Analysis of cuBLAS.** We have further investigated the differences in attack performance between CPU-based and GPU-based backends. We found that the considered CPU-based backends employ identical implementations for the convolution operator. Hence, the numerical differences between them stem from matrix multiplication only. In contrast, the GPU-based backend cuBLAS uses a fundamentally different implementation for convolutions. As a result, numerical deviations arise from both convolution and matrix operations.\nAs a result, we observe varying results for the FMNIST and CIFAR models. Since the FMNIST model consists solely of dense layers, the observed differences remain consistent across all backends. In contrast, the CIFAR (and ImageNet) models are largely composed of convolutional layers, which exhibit substantial variation when using cuBLAS. This variation makes it easier to identify Chimera examples in these models. We will include these results in our paper.", "claims_and_evidence": "Strengths:\n- In the space of constructing adversarial examples, this paper is very novel and creative, which is a major strength of this paper.\n- The result could potentially be used in areas of computer security that are normally not covered by adversarial examples, such as leaking which backend linear algebra implementation is being used just by querying predictions of the model.\n- Method is simple and easy to execute.\n- Results are sound.\n- Paper is clearly written\n\nWeaknesses:\n- Simple defenses would likely prevent the attack, such as a slight randomization of the weights, or rejection of predictions that are too close to the boundary.\n- Method is identical to the standard method for construction adversarial examples, but with a smaller step size, and thus the novelty of the  method is limited (but the application to attacking different linear algebra backends is novel).\n- Limited evaluation, just two simple datasets for simple architectures.\n- Appears to be most effective specifically when cuBLAS is used, and less effective for the other backends—what is special about cuBLAS?\n- Transferability of the adversarial examples to other neural networks isn't evaluated, but would likely be 0.\n\nOverall: I think the creativity of the submission plus the applicability to other areas of computer security I believe should lower the bar for its demonstrated applicability to real attack scenarios or the limited novelty of the actual method. For this reason, I am voting for acceptance.", "methods_and_evaluation_criteria": "See review.", "theoretical_claims": "See review.", "experimental_designs_or_analyses": "See review.", "relation_to_broader_scientific_literature": "See review.", "essential_references_not_discussed": "See review.", "other_strengths_and_weaknesses": "See review.", "other_comments_or_suggestions": "See review.", "questions_for_authors": "See review.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tWrSXNVRU1", "reviewer": "Reviewer_eV1D", "summary": "This paper investigates the vulnerability in neural network inference caused by minor discrepancies in linear algebra backends used by popular frameworks like TensorFlow and PyTorch. The authors introduce \"Chimera examples,\" which are specially crafted inputs that produce conflicting predictions depending on the backend (e.g., Intel MKL, Nvidia CUDA, Apple Accelerate). These inputs exploit the inherent non-associativity of floating-point arithmetic and backend-specific optimizations that affect calculations subtly but significantly. The paper provides a comprehensive analysis of this vulnerability across several backends and proposes a defense mechanism to mitigate potential adversarial attacks exploiting these discrepancies. The findings highlight a novel attack surface within the machine learning pipeline that has been overlooked previously, emphasizing the need for robustness in backend implementations.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback on our paper! \n\n**Experiments with larger models.** We have extended our evaluation to include the ImageNet dataset, using the more complex architectures ResNet18 (Top-1 Accuracy: 69.7%) and EfficientNetV2S (Top-1 Accuracy: 84.2%). For these experiments, we used a reduced backend set (OpenBLAS, MKL, BLIS, and cuBLAS) and a smaller sample size of 128. In these new experiments, our attack achieves a 100% success rate for CPU-GPU backend combinations on both models. For CPU-CPU backends, we observe success rates of approximately 29% for ResNet18 and 22% for EfficientNetV2S. We will include these results in the paper.\n\n**Efficiency and generality of our defense.** The computational complexity of the proposed defense depends only on the size of the input, not on the model itself. We leverage standard cryptographic libraries, which allow us to compute keyed noise for thousands of inputs per second. As a result, our defense adds less than 0.5% overhead to the overall inference process, making it practical for most application scenarios.\n\nIn our defense, we deliberately avoid making any assumptions about the design or functionality of the employed backends. The only parameter we rely on is the empirically measured size of the pockets containing Chimera examples. A practitioner with knowledge of the specific backends used for a model can measure this size and configure our defense accordingly.\nHowever, you are correct that the required magnitude of defense noise depends on the complexity of the model, as more complex models typically accumulate larger discrepancies between backends during inference. Therefore, the noise level must be empirically calibrated on a per-model basis. Nonetheless, this does not affect the efficiency of our defense\n\n**White-box access.**  It is correct that our attack hinges on white-box access to the model and knowledge of the employed linear algebra backends, as shown in our experiments. However, finding Chimera examples is tricky, even in the white-box setting. Black-box attacks are, therefore, likely to suffer from low performance in practice. Keeping models confidential might, therefore, seem like a possible defense. We would still argue, however, that this is not a reliable protection strategy, as it requires keeping information confidential that is typically not considered secret. Moreover, in standard machine learning frameworks and environments, the available backends might be known to the adversary by default. We will acknowledge this setting in our paper.", "claims_and_evidence": "See strengths and weaknesses.", "methods_and_evaluation_criteria": "See strengths and weaknesses.", "theoretical_claims": "See strengths and weaknesses.", "experimental_designs_or_analyses": "See strengths and weaknesses.", "relation_to_broader_scientific_literature": "See strengths and weaknesses.", "essential_references_not_discussed": "See strengths and weaknesses.", "other_strengths_and_weaknesses": "Strengths:\n1. Introducing the concept of Chimera examples that capitalize on backend-specific computational differences is a significant contribution to understanding security in machine learning systems. The paper extensively analyzes discrepancies across multiple major linear algebra backends, providing a broad view of the problem's scope.\n\n2. Demonstrates the practical implications of theoretical discrepancies in backend computations, directly linking them to potential security vulnerabilities in deployed machine learning systems. Employs a rigorous methodology for generating and detecting Chimera examples, including detailed algorithmic strategies and adjustments for backend-specific characteristics.\n\n3. Tests across a variety of platforms ensure that the findings are not limited to a specific hardware or software configuration, enhancing the generalizability of the results. Not only identifies a vulnerability but also proposes a novel defense mechanism, contributing both to the theoretical and practical aspects of machine learning security.\n\n4. Addresses an immediate and practical concern in contemporary machine learning deployments, making the research highly relevant and timely. The experimental setup is robust, using popular datasets and architectures to validate the findings, which strengthens the paper's claims through empirical evidence. Provides detailed results including success rates of attacks across different setups, offering clear insights into the effectiveness of the proposed attack and defense strategies.\n\nWeaknesses:\n1. While innovative, the proposed defense mechanism is complex and may be challenging to implement in practice without affecting the system's efficiency or usability. The attack and defense strategies might be too tailored to the specific backends tested, which could limit their applicability in a broader range of environments or against future backend updates.\n\n2. The threat model assumes white-box access to the model and backends, which might not always be practical in real-world scenarios, potentially limiting the applicability of the findings. The paper could benefit from a comparison with other types of adversarial attacks to position its contributions within the wider landscape of adversarial machine learning research.\n\n3. The methods for detecting and defending against Chimera examples are likely resource-intensive, which could be a barrier for adoption in resource-constrained environments. It is unclear how the proposed methods scale with increasingly complex models or larger datasets, which is critical for modern deep learning applications.\n\n4. The evaluation is somewhat limited to the datasets used (CIFAR-10 and FMNIST), and additional studies on different types of data might be necessary to fully understand the impacts. The paper does not fully explore how variations in experimental setups, such as different training regimes or model architectures, might affect the prevalence of Chimera examples.", "other_comments_or_suggestions": "See strengths and weaknesses.", "questions_for_authors": "See strengths and weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GWoBHD5dqX", "reviewer": "Reviewer_QJ8E", "summary": "The authors propose a white-box attack to construct \"Chimera examples\", or inputs to models that elicit conflicting predictions depending on the employed backend library, and proposed a PRNG-based defense against it.\n\n## update after rebuttal\n\nThe rebuttal addresses most of my concerns. In particular, I'm happy to see the authors running the experiment on ImageNet, demonstrating the scalability of their attack. I'm increasing my score.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback on our paper!\n\n**Experiments with larger models.** We have extended our evaluation to include the ImageNet dataset, using the more complex architectures ResNet18 (Top-1 Accuracy: 69.7%) and EfficientNetV2S (Top-1 Accuracy: 84.2%). For these experiments, we used a reduced backend set (OpenBLAS, MKL, BLIS, and cuBLAS) and a smaller sample size of 128. In these new experiments, our attack achieves a 100% success rate for CPU-GPU backend combinations on both models. For CPU-CPU backends, we observe success rates of approximately 29% for ResNet18 and 22% for EfficientNetV2S. We will include these results in the paper.\n\n**Loss function in our attack.** Thank you for pointing out an issue in our presentation. Indeed, the description of the loss functions in Section 3.3 is imprecise, as it omits a key point: Following Definition 3.1, we define the target labels of the backends in opposition, such that always $y_i \\neq y_j$. This represents an important distinction from the standard search for adversarial examples. Moving the input towards $y_i$ usually moves it away from $y_j$, and vice versa. This “tug of war” between the target labels effectively pulls the input closer to the decision boundary. We will add the precise definition of the target labels to our paper.\n\n**Role of quantization function.** We performed an ablation study to assess the influence of the quantization function on our attack. In this experiment, we compute the gradient of our attack without applying quantization. We find that our attack performs worse in this setting. Quantization is particularly important for CPU-based backends, yielding approximately 2.2× more Chimera samples for CIFAR and between 1.1× and 7× more for FMNIST. For GPU-based backends, we observe no such benefit. In fact, quantization slightly reduces performance by about 1-2%. We will include these results in our paper.\n\n**Intuition of search algorithm.** Our search algorithm brings us close to the decision boundary and then proceeds by alternating back and forth using the conflicting loss functions described above. Theoretically, for every gradient direction we take, there exists a point that lies exactly on the decision boundary and hence is potentially close to a Chimera example. By alternating through these directions in a tug-of-war manner, we converge toward the region where numerical deviations effectively determine the final decision. \n\n**Improvement over baselines.** All baselines were given the same iteration budget of 3000 steps as our attack, except for binary search that ran until convergence. Despite the same budget, our attack outperforms the baselines for the following reasons:\n\n1. Although binary search can approach the decision boundary arbitrarily closely, it often lands in infeasible regions, making it impossible to elicit the required numerical differences from input samples.\n2. The Carlini & Wagner attack was designed to target a single backend and searches for a point close to—but still across—the decision boundary. In contrast, our method explicitly targets the decision boundary and seeks inputs that yield conflicting predictions across backends.\n3. The original boundary sample search, like binary search, was not designed to produce valid inputs. While it can find boundary points in feature space, the corresponding input samples often do not exist in the input domain.\n\n**Chimera examples in practice.** Chimera examples pose a threat whenever two different systems evaluate the same model on the same data. For instance, in forensic investigations, it is no longer sufficient to use only the same model and input to replicate an incident—such as a malware detection, the censoring of media content, or the decision of a hiring decision. Instead, the entire original system—including all backend libraries—must be fully replicated to ensure consistent and reliable results.\n\n**Noisy gradient descent.** When evaluating our defense, we already assume an attacker who is aware of the defense and uses noisy gradients. A key distinction of our defense is that the noise is deterministic and unique for each data point—that is, the noise remains fixed for the same input and key. As a result, an attacker cannot accumulate additional information by averaging over multiple runs. The noise creates a shattered view of the feature space, making fine-grained gradients ineffective except by chance. Our experiment in Section 5 shows that such chance-based success is too low to be practically viable.\n\n**Supplementary Material.** We have uploaded our source code to https://gitlab.com/anonymized-code/2025-icml and will make it available as open source to the community.\n\n**Image on first page.** You are absolutely right—this is a Chimera example with $n = 3$ only. We will replace it and plan to use an example from ImageNet to take advantage of the higher image resolution.", "claims_and_evidence": "1. It was claimed that Figure 1 contains Chimera examples, but the left figure has the same label \"Truck\" from BLIS and Apple Accelerate, which conflicts with the $\\forall i \\ne j$ requirement in Definition 1.\n2. In section 4.4, it's unclear how many iterations are used by alternative attacks. Perhaps these attacks fail simply because you are using fewer iterations, not because they are inferior?", "methods_and_evaluation_criteria": "Yes, it makes as much sense as prior works such as (Carlini & Wagner, 2017) and (Schlogl et al., 2021), on which this paper's method is based.", "theoretical_claims": "It is claimed that\n> If we dynamically adapt the step size $\\alpha$, this approach theoretically brings us infinitesimally close to the decision\nboundary, potentially leading to deviations among the backends.\n\nThis is not intuitive to me, so it would be great if the authors could provide a simple proof. I think the iteration should bring $x_n$ to a point with a large likelihood for $y_i$, instead of to the decision boundary.\n\nMoreover,\n> However, there is a catch: the generated points do not lie within $\\mathbb{S}$, and thus moving along their gradients may lead into infeasible regions, as demonstrated in Section 4.4. To address this problem, we map $x_k$ back to $\\mathbb{S}$ when computing its gradient, ensuring that the gradients reflect the view from $\\mathbb{S}$ while optimization occurs in $\\mathbb{F}$.\n\nIt is unclear to me how this address the problem, because we still have $x_{i+1} \\not\\in \\mathbb{S}$, as illustrated in Figure 4. An ablation experiment without mapping $x_k$ back to $\\mathbb{S}$ when computing its gradient would help clear some doubts.", "experimental_designs_or_analyses": "The experiment uses very simple network architectures, i.e. three VGG block + three dense layer for CIFAR-10 and two fully\nconnected layers for FMNIST. Moreover, the networks have poor discriminative performance as \"a test accuracy of 82.32% and 80.75%\" is barely acceptable for datasets as simple as CIFAR-10 and FMNIST. It is unclear whether the attack also applies to more complex datasets and networks.\n\nIn the same vein, the defense proposed in section 5.2 has \"no negative impact on the test accuracy of the evaluated models\". Probably this is because the test accuracy is unimpressive to begin with. I imagine it's much harder to keep the test accuracy at 99%.", "relation_to_broader_scientific_literature": "> So far, previous work has focused on floating-point imprecision arising from differences in CPU architectures, for\nexample, for fingerprinting systems (Schl ¨ogl et al., 2021; 2024) or breaking the certification of models (Jin et al.,\n2022; 2024; Vor´aˇcek & Hein, 2023). Our analysis of linear algebra backends builds on this work; yet, we aim to induce significantly larger changes that flip the prediction of a model given an adversarial input. While differences in CPU architecture may further exacerbate this issue, we demonstrate that Chimera examples also exist between backends on the same CPU architecture.\n\nThis work identified a new attack surface, i.e., the difference in software implementations of linear algebra libraries on the same hardware. Moreover, I believe the different number of threads on the same BLAS backend can also affect the order in which floating point values are accumulated, and thus induce numerical imprecision, despite the fact that the authors didn't mention this in the paper. Maybe even different CUDA versions can induce some disparity, but I'm less confident about that.", "essential_references_not_discussed": "It's probably worth citing \"Explaining and Harnessing Adversarial Examples\" published in ICLR 2015, since it's the paper the proposed the fast gradient sign method (FGSM).", "other_strengths_and_weaknesses": "**Strengths**:\n1. The attack surface is novel.\n1. The ablation study in section 4.5 is helpful in understanding the landscape of Chimera examples.\n\n**Weaknesses:**\n1. The gradient-based attack algorithm does not seem novel. While there is a mapping $q: \\mathbb{F}^d \\to \\mathbb{S}$, as I mentioned earlier there is no ablation experiments exploring its necessity.", "other_comments_or_suggestions": "Typos:\n1. Line 255, \"liberary\" should be \"library\"\n2. Line 322 and 324, \"\\mathbb{F}\" should be \"\\mathbb{F}^d\"\n3. Line 371, \"up\" should be \"ULP\"", "questions_for_authors": "1. On line 168, what's the motivation for averaging across multiple backends?\n2. On line 203, \"The starting point $x_1$ is obtained from 2000 iterations of our search on a single backend to move towards the proximity of the decision boundary first;\" why does this provide a good initialization?\n3. On line 255, \"To mitigate this effect, and to ensure the reproducibility of our experiments, we default to inference batches of size one.\" Why is the result deterministic when the batch size is 1? In that case, the backend/scheduler is still free to re-order computations due to the associative property of addition and multiplication.\n4. On line 298, what's your explanation of the superiority of your method over alternative baselines? Your work is derived from the \"Boundary sample search\", so one may expect a similar performance.\n5. In Figure 6, which dataset and network architecture are we talking about here?\n6. In section 5.2, what if an attacker use a noisy gradient descent? Since considerable-sized clusters of Chimera examples exist, I imagine the attacker has a non-negligible chance of stumbling upon a Chimera example once it's close enough, i.e., when $x_k$ converges to the noisy ball.\n7. It's surprising that Chimera examples exist, but it's unclear to me why they are harmful. Can you provide an example where they can be exploited to cause actual risk?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper investigates a highly novel attack in neural network inference by exploiting subtle numerical discrepancies arising from different linear algebra backends (e.g., Intel MKL, Nvidia CUDA, Apple Accelerate). Specifically, this work introduces the concept of "Chimera examples": inputs crafted to produce conflicting predictions across backends. Additionally, a defense mechanism is provided to mitigate these attacks. The empirical evaluation across several datasets and models is provided to support its claim.

Overall, the reviewers strongly appreciate the strong novelty of this paper, as it brings attention to an underexplored vulnerability caused by backend-specific floating point differences. Additionally, reviewers are happy to see its practical implications under different experiment settings. But meanwhile, some concerns are raised, including: 1) larger models should be analyzed; 2) some other defense strategies (e.g., weight randomization) should be considered; 3) further analysis about cuBLAS is needed; 4) some key components of this attack algorithm (e.g., reparameterization, project function) need further clarifications; 5) its technical part is not significantly novel compared to prior PGD-like attacks.

The rebuttal addressed many of these concerns. Three reviewers ultimately voted positively, while Reviewer ava8 expressed reservations regarding low VGG accuracy, the absence of evaluations with adversarially trained models, and perceived limited novelty in the discussion. However, these points were rebutted by Reviewer WNoZ, who argued that the VGG variant used was smaller than standard and underscored the significant novelty and practical security implications of the study.

The AC concurs with Reviewer WNoZ and the other positive reviewers, recognizing the study as a valuable contribution that sheds new light on robustness from the perspective of linear algebra backend dependencies. Therefore, the AC recommends accepting this submission.
Decision: Accept (poster)