# A Note on Implementation Errors in Recent Adaptive Attacks Against Multi-Resolution Self-Ensembles

arXiv: https://arxiv.org/abs/2501.14496 · HTML: https://mlsanity.com/paper/2501.14496/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 4 references that are in the map.
- First posted on arXiv 24 Jan 2025.

## Builds on (most cited first, 2 of 2)

- [Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness](https://mlsanity.com/paper/2408.05446/) (2024)
- [Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense](https://mlsanity.com/paper/2411.14834/) (2024)

## Abstract (arXiv)

This note documents an implementation issue in recent adaptive attacks (Zhang et al. [2024]) against the multi-resolution self-ensemble defense (Fort and Lakshminarayanan [2024]). The implementation allowed adversarial perturbations to exceed the standard L_∞ = 8/255 bound by up to a factor of 20×, reaching magnitudes of up to L_∞ = 160/255. When attacks are properly constrained within the intended bounds, the defense maintains non-trivial robustness. Beyond highlighting the importance of careful validation in adversarial machine learning research, our analysis reveals an intriguing finding: properly bounded adaptive attacks against strong multi-resolution self-ensembles often align with human perception, suggesting the need to reconsider how we measure adversarial robustness.