Reproduce “Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness” on OpenResearch

About this paper

Stanislav Fort, Balaji Lakshminarayanan

The authors improve CIFAR robustness by feeding an ImageNet-pretrained ResNet152 noisy, jittered images at multiple resolutions and combining intermediate-layer predictions with CrossMax. On CIFAR-100, without adversarial training or synthetic data, they report 48.16 ± 2.65% adversarial accuracy under AutoAttack at an L-infinity limit of 8/255, versus a 42.67% leaderboard result; this is not a controlled comparison.

Key insights

• Adversarial attacks primarily confuse a network's final classification layer, leaving intermediate layer features relatively robust, a phenomenon termed "adversarial layer decorrelation".
• If adversarial attacks on a model produce human-interpretable changes, the model's representations are of higher quality and the model itself is more robust (the "Interpretability-Robustness Hypothesis").
• Combining multi-resolution inputs and robust self-ensembling can achieve high adversarial robustness inherently, which is further enhanced additively by light adversarial training.

Summary by alphaXiv.