Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness
Under review as a conference paper at ICLR 2025

ENSEMBLE EVERYTHING EVERYWHERE: MULTI-
SCALE AGGREGATION FOR ADVERSARIAL ROBUST-
NESS

Anonymous authors
Paper under double-blind review

ABSTRACT

Adversarial examples pose a signiﬁcant challenge to the robustness, reliability and
alignment of deep neural networks. We propose a novel, easy-to-use approach to
achieving high-quality representations that lead to adversarial robustness through
the use of multi-resolution input representations and dynamic self-ensembling of
intermediate layer predictions. We demonstrate that intermediate layer predictions
exhibit inherent robustness to adversarial attacks crafted to fool the full classiﬁer,
and propose a robust aggregation mechanism based on Vickrey auction that we
call CrossMax to dynamically ensemble them. By combining multi-resolution
inputs and robust ensembling, we achieve signiﬁcant adversarial robustness on
CIFAR-10 and CIFAR-100 datasets without any adversarial training or extra data,
reaching an adversarial accuracy of ≈72% (CIFAR-10) and ≈48% (CIFAR-100)
on the RobustBench AutoAttack suite (L∞ = 8/255) with a ﬁnetuned ImageNet-
pretrained ResNet152. This represents a result comparable with the top three
models on CIFAR-10 and a +5 % gain compared to the best current dedicated
approach on CIFAR-100. Adding simple adversarial training on top, we get
≈78% on CIFAR-10 and ≈51% on CIFAR-100, improving SOTA by 5 % and
9 % respectively and seeing greater gains on the harder dataset. We validate our
approach through extensive experiments and provide insights into the interplay
between adversarial robustness, and the hierarchical nature of deep representations.
We show that simple gradient-based attacks against our model lead to human-
interpretable images of the target classes as well as interpretable image changes.
As a byproduct, using our multi-resolution prior, we turn pre-trained classiﬁers and
CLIP models into controllable image generators and develop successful transferable
attacks on large vision language models.

Figure 1: We use a multi-resolution decomposition (a) of an input image and a partial decorrelation of
predictions of intermediate layers (b) to build a classiﬁer (c) that has, by default, adversarial robustness
comparable or exceeding state-of-the-art (f), even without any adversarial training. Optimizing inputs
against it leads to interpretable changes (d) and images generated from scratch (e).

1

000

001
002
003
004
005
006

007
008
009
010
011

012
013
014
015
016
017

018
019
020
021
022
023

024
025
026
027
028
029

030
031
032
033
034

035
036
037
038
039
040

041
042
043
044
045
046

047
048
049
050
051
052

053

70% dog99% dog50% dog+65% dog99% car48% dog“car”Optimize towards: “A photo of the Prague Castle in spring”+Stochastic multi-resolution expansionStandard classiﬁer backboneCrossMax top-k ensemblingImage to classifyBackbone aloneSelf-ensemble+=99% @ c=23 “cloud”perturbation99% @ c=49 “mountain”(a)Multi-resolution prior(b)Layer decoupling(c)Multi-resolution self-ensemble(d)Cloud → Mountain attack(e)Attacks towards apple, oak and girl(f)SOTA results on RobustBenchUnder review as a conference paper at ICLR 2025

1

INTRODUCTION

Our objective is to take a step towards aligning the way machines perceive visual information – as
expressed by the learned computer vision classiﬁcation function – and the way people perceive visual
information – as represented by the inaccessible, implicit human vision classiﬁcation function. The
signiﬁcant present-day mismatch between the two is best highlighted by the existence of adversarial
attacks that affect machine models but do not transfer to humans. Our aim is to develop a vision
model with high-quality, natural representations that agree with human judgment not only under static
perturbations, such as noise or dataset shift, but also when exposed to active, motivated attackers
trying to dynamically undermine their accuracy. While adversarial robustness serves as our primary
case study, the broader implications of this alignment extend to aspects such as interpretability, image
generation, and the security of closed-source models, underscoring its importance.

Adversarial examples in the domain of image classiﬁcation are small, typically human-imperceptible
perturbations P to an image X that nonetheless cause a classiﬁer, f : X → y, to misclassify the
perturbed image X + P as a target class t chosen by the attacker, rather than its correct, ground
truth class. This is despite the perturbed image X + P still looking clearly like the ground truth
class to a human, highlighting a striking and consistent difference between machine and human
vision (ﬁrst described by Szegedy et al. (2013)). Adversarial vulnerability is ubiquitous in image
classiﬁcation, from small models and datasets (Szegedy et al., 2013) to modern large models such
CLIP (Radford et al., 2021), and successful attacks transfer between models and architectures to
a surprising degree (Goodfellow et al., 2015) without comparable transfer to humans. In addition,
adversarial examples exist beyond image classiﬁcation, for example in out-of-distribution detection,
where otherwise very robust systems fall prey to such targeted attacks (Chen et al., 2021; Fort, 2022),
and language modeling (Guo et al., 2021; Zou et al., 2023).

We hypothesize that the existence of adversarial attacks is due to the signiﬁcant yet subtle mismatch
between what humans do when they classify objects and how they learn such a classiﬁcation in
the ﬁrst place (the implicit classiﬁcation function in their brains), and what is conveyed to a neural
network classiﬁer explicitly during training by associating ﬁxed pixel arrays with discrete labels (the
learned machine classiﬁcation function). It is often believed that by performing such a training we are
communicating to the machine the implicit human visual classiﬁcation function, which seems to be
borne by their agreement on the training set, test set, behaviour under noise, and recently even their
robustness to out-of-distribution inputs at scale (Fort et al., 2021b). We argue that while these two
functions largely agree, the implicit human and learned machine functions are not exactly the same,
which means that their mismatch can be actively exploited by a motivated, active attacker, purposefully
looking for such points where the disagreement is large (for similar exploits in reinforcement learning
see (Leike et al., 2017)). This highlights the difference between agreement on most cases, usually
probed by static evaluations, and an agreement in all cases, for which active probing is needed.

In this paper, we take a step towards aligning the implicit human and explicit machine classiﬁcation
functions, and consequently observe very signiﬁcant gains in adversarial robustness against standard
attacks as a result of a few, simple, well-motivated changes, and without any explicit adversarial
training. While, historically, the bulk of improvement on robustness metrics came from adversarial
training (Chakraborty et al., 2018), comparably little attention has been dedicated to improving the
model backbone, and even less to rethinking the training paradigm itself. Our method can also be
easily combined with adversarial training, further increasing the model’s robustness cheaply. Beyond
benchmark measures of robustness, we show that if we optimize an image against our models directly,
the resulting changes are human interpretable.

We operate under what what we call the Interpretability-Robustness Hypothesis: A model whose
adversarial attacks typically look human-interpretable will also be adversarially robust. The aim
of this paper is to support this hypothesis and to construct ﬁrst versions of such robust classiﬁers,
without necessarily reaching their peak performance via extensive hyperparameter tuning.

Firstly, inspired by biology, we design an active adversarial defense by constructing and training a
classiﬁer whose input, a standard H × W × 3 image, is stochastically turned into a H × W × (3N )
channel-wise stack of multiple downsampled and noisy versions of the same image. The classiﬁer
itself learns to make a decision about these N versions at once, mimicking the effect of microsaccades
in the human (and mammal) vision systems. Secondly, we show experimentally that hidden layer
features of a neural classiﬁer show signiﬁcant de-correlation between their representations under

2

054

055
056
057
058
059
060

061
062
063
064
065

066
067
068
069
070
071

072
073
074
075
076
077

078
079
080
081
082
083

084
085
086
087
088

089
090
091
092
093
094

095
096
097
098
099
100

101
102
103
104
105
106

107

Under review as a conference paper at ICLR 2025

108

109
110
111
112
113
114

115
116
117
118
119

120
121
122
123
124
125

126
127
128
129
130
131

132
133
134
135
136
137

138
139
140
141
142

143
144
145
146
147
148

149
150
151
152
153
154

155
156
157
158
159
160

161

Figure 2: Combining channel-wise stacked augmented and down-sampled versions of the input image
with robust intermediate layer class predictions via CrossMax self-ensemble. The resulting model
gains a considerable adversarial robustness without any adversarial training or extra data.

adversarial attacks – an attack fooling a network to see a dog as a car does not fool the intermediate
representations, which still see a dog. We aggregate intermediate layer predictions into a self-
ensemble dynamically, using a novel ensembling technique that we call a CrossMax ensemble.
Thirdly, we show that our Vickrey-auction-inspired CrossMax ensembling yields very signiﬁcant
gains in adversarial robustness when ensembling predictors as varied as 1) independent brittle models,
2) predictions of intermediate layers of the same model, 3) predictions from several checkpoints of
the same model, and 4) predictions from several self-ensemble models. We use the last option to
gain ≈ 5% in adversarial accuracy at the L∞ = 8/255 RobustBench’s AutoAttack on top of the best
models on CIFAR-100. When we add light adversarial training on top, we outperform current best
models by ≈ 5% on CIFAR-10, and by ≈ 9% on CIFAR-100, showing a promising trend where the
harder the dataset, the more useful our approach compared to brute force adversarial training (see
Figure 6).

2 KEY OBSERVATIONS AND TECHNIQUES

In this section we will describe the three key methods that we use in this paper. In Section 2.1
we introduce the idea of multi-resolution inputs, in Section 2.2 we introduce our robust CrossMax
ensembling method, and in Section 2.3 we showcase the de-correlation between adversarially induced
mistakes at different layers of the network and how to use it as an active defense.

2.1 THE MULTI-RESOLUTION PRIOR

Figure 3: An image input being split into N progressively lower resolution versions that are then
stacked channel-wise, forming a 3N -channel image input to a classiﬁer.

Drawing inspiration from biology, we use multiple versions of the same image at once, down-sampled
to lower resolutions and augmented with stochastic jitter and noise. We train a model to classify this
channel-wise stack of images simultaneously. We show that this by default yields gains in adversarial
robustness without any explicit adversarial training.

Classifying many versions of the same object at once. The human visual system has to recognize
an object, e.g. a cat, from all angles, distances, under various blurs, rotations, illuminations, contrasts
and similar such transformations that preserve the semantic content of whatever a person is looking
at while widely changing the ”pixel” values of the image projected on the retina.

A classiﬁcation decision is not performed on a single frame but rather on a long stream of such
frames that come about due to changing physical conditions under which an object is viewed as well
as the motion of the eyes and changing properties of the retina (resolution, color sensitivity) at a
place where the object is projected. We hypothesize that this is a key difference between the human
visual system and a standard approach to image classiﬁcation, where still, high-resolution frames

3

Stochastic multi-resolution expansionStandard classiﬁer backboneCrossMax top-k ensemblingImage to classifyBackbone aloneSelf-ensembleUnder review as a conference paper at ICLR 2025

162

163
164
165
166
167
168

169
170
171
172
173

174
175
176
177
178
179

180
181
182
183
184
185

186
187
188
189
190
191

192
193
194
195
196

197
198
199
200
201
202

203
204
205
206
207
208

209
210
211
212
213
214

215

are associated with discrete labels. We believe that bridging this gap will lead to better alignment
between the implicit human classiﬁcation function, and the explicit machine classiﬁcation function.

Augmentations that preserve the semantic content of images while increasing their diversity have
historically been used in machine learning, for an early example see (LeCun et al., 1998). However,
typically, a particular image X appears in a single pass through the training set (an epoch) a single
time, in its augmented form X (cid:48). The next occurrence takes place in the following epoch, with a
different augmentation X (cid:48)(cid:48). In (Havasi et al., 2021), multiple images are fed into the network at
once through independent subnetworks. In (Fort et al., 2021a), the same image X is augmented N
times within the same batch, leading to faster training and higher ﬁnal performance, likely due to the
network having to learn a more transformation-invariant notion of the object at once. In this paper,
we take this process one step further, presenting different augmentations as additional image channels
at the same time. This can be viewed as a very direct form of ensembling.

Biological eye saccades. Human eyes (as well as the eyes of other animals with foveal vision)
perform small, rapid, and involuntary jitter-like motion called microsaccades (cf. (Martinez-Conde
et al., 2004) for details). The amplitude of such motion ranges from approximately 2 arcminutes to
100 arcminutes. In the center of the visual ﬁeld where the human eye has the highest resolution, it is
able to resolve up to approximately 1 arcminute. That means that even the smallest microsaccade
motion moves the image projected on the retina by at least one pixel in amplitude. The resolution
gradually drops towards the edges of the visual ﬁeld to about 100 arcminutes (Wandell, 1995). Even
there the largest amplitude macrosaccades are sufﬁcient to move the image by at least a pixel. The
standard explanation is that these motions are needed to refresh the photosensitive cells on the retina
and prevent the image from fading (Martinez-Conde et al., 2004). However, we hypothesize that an
additional beneﬁt is an increase in the robustness of the visual system. We draw inspiration from
this aspect of human vision and add deterministically random jitter to different variants of the image
passed to our classiﬁer. Apart from the very rapid and small amplitude microsaccades, the human eye
moves around the visual scene in large motions called macrosaccades or just saccades. Due to the
decreasing resolution of the human eye from the center of the visual ﬁeld, a particular object being
observed will be shown with different amounts of blur.

Multi-resolution input to a classiﬁer. We turn an input image X of full resolution R × R and
3 channels (RGB) into its N variations of different resolutions r × r for r ∈ ρ. For CIFAR-10
and CIFAR-100, we are (arbitrarily) choosing resolutions ρ = {32, 16, 8, 4} and concatenating the
resulting image variations rescaleR (rescaler(X)) channel-wise to a R × R × (3|ρ|) augmented
image ¯X. This is shown in Figure 3. Similar approaches have historically been used to represent
images, such as Gaussian pyramids introduced in (Burt & Adelson, 1983). To each variant we add
1) random noise both when downsampled and at the full resolution R × R (in our experiments of
strength 0.1 out of 1.0), 2) a random jitter in the x − y plane (±3 in our experiments), 3) a small,
random change in contrast, and 4) a small, random color-grayscale shift. This can also be seen as an
effective reduction of the input space dimension available to the attacker, as discussed in (Fort, 2023).

2.2 CrossMax ROBUST ENSEMBLING

Robust aggregation methods, Vickrey auctions and load balancing. The standard way of en-
sembling predictions of multiple networks is to either take the mean of their logits, or the mean of
their probabilities. This increases both the accuracy as well as predictive uncertainty estimates of
the ensemble (Lakshminarayanan et al., 2017; Ovadia et al., 2019). Such aggregation methods are,
however, susceptible to being swayed by an outlier prediction by a single member of the ensemble or
its small subset. This produces a single point of failure. The pitfalls of uncertainty estimation and
ensembling have been highlighted in (Ashukha et al., 2021), while the effect of ensembling on the
learned classiﬁcation function was studied by Fort et al. (2022).

With the logit mean in particular, an attacker can focus all their effort on fooling a single network’s
prediction strongly enough towards a target class t. Its high logit can therefore dominate the full
ensemble, in effect confusing the aggregate prediction. An equivalent and even more pronounced
version of the effect would appear were we to aggregate by taking a max over classiﬁers per class.
The calibration of individual members vs their ensemble is theoretically discussed in (Wu & Gales,
2021).

4

Under review as a conference paper at ICLR 2025

Our goal is to produce an aggregation method that is robust against an active attacker trying to
exploit it, which is a distinct setup from being robust against e.g. untargeted perturbations. In fact,
methods very robust against out-of-distribution inputs (Fort et al., 2021b) are still extremely brittle
against targeted attacks (Fort, 2022). Generally, this observation, originally stated as ”Any observed
statistical regularity will tend to collapse once pressure is placed upon it for control purposes” in
Goodhart (1981), is called Goodhart’s law, and our goal is to produce an anti-Goodhart ensemble.

We draw our intuition from Vickrey auctions (Wilson, 1977) which are designed to incentivize truthful
bidding. Viewing members of ensembles as individual bidders, we can limit the effect of wrong,
yet overconﬁdent predictions by using the 2nd highest, or generally kth highest prediction per class.
This also produces a cat-and-mouse-like setup for the attacker, since which classiﬁer produces the
kth highest prediction for a particular class changes dynamically as the attacker tries to increase that
prediction. A similar mechanism is used in balanced allocation (Azar et al., 1999) and speciﬁcally in
the k random choices algorithm for load balancing (Mitzenmacher et al., 2001).

Our CrossMax aggregation works a follows: For logits Z of the shape [B, N, C], where B is the
batch size, N the number of predictors, and C the number of classes, we ﬁrst subtract the max
per-predictor max(Z, axis = 1) to prevent Goodhart-like attacks by shifting the otherwise-arbitrary
overall constant offset of a predictor’s logits. This prevents a single predictor from dominating. The
second, less intuitive step, is subtracting the per-class max to encourage the winning class to win via
a consistent performance over many predictors rather than an outlier. This is to prevent any class
from spuriously dominating. We aggregate such normalized logits via a per-class topk function for
our self-ensembles and median for ensembles of equivalent models, as shown in Algorithm 1.

Algorithm 1 CrossMax = An Ensembling Algorithm with Improved Adversarial Robustness

Require: Logits Z of shape [B, N, C], where B is the batch size, N the number of predictors, and

C the number of classes
Ensure: Aggregated logits
1: ˆZ ← Z −max(Z, axis = 2) {Subtract the max per-predictor over classes to prevent any predictor

from dominating}

2: ˆZ ← ˆZ − max( ˆZ, axis = 1) {Subtract the per-class max over predictors to prevent any class

from dominating}

3: Y ← median( ˆZ, axis = 1) {Choose the median (or kth highest for self-ensemble) logit per

class}
4: return Y

We use this aggregation for intermediate layer predictions (changing median to top3) as well and see
similar, transferable gains. We call this setup a self-ensemble.

2.3 ONLY PARTIAL OVERLAP BETWEEN THE ADVERSARIAL SUSCEPTIBILITY OF

INTERMEDIATE LAYERS

Figure 4: The impact of adversarial attacks (L∞ = 8/255, 128 attacks) against the full classiﬁer on
the accuracy and probabilities at all intermediate layers for an ImageNet-1k pretrained ResNet152
ﬁnetuned on CIFAR-10 via trained linear probes.

A key question of both scientiﬁc and immediately practical interest is whether an adversarially
modiﬁed image X (cid:48) that looks like the target class t to a classiﬁer f : X → y also has intermediate

5

216

217
218
219
220
221
222

223
224
225
226
227

228
229
230
231
232
233

234
235
236
237
238
239

240
241
242
243
244
245

246
247
248
249
250

251
252
253
254
255
256

257
258
259
260
261
262

263
264
265
266
267
268

269

01020304050Affected layer 0.00.20.40.60.81.0ProbabilityAfter attacktruth classtarget class01020304050Affected layer 0.00.20.40.60.81.0ProbabilityBefore attacktruth classtarget class01020304050Affected layer 0.00.20.40.60.81.0AccuracyAccuraciesclean imagesattacked imagesUnder review as a conference paper at ICLR 2025

270

271
272
273
274
275
276

277
278
279
280
281

282
283
284
285
286
287

288
289
290
291
292
293

294
295
296
297
298
299

300
301
302
303
304

305
306
307
308
309
310

311
312
313
314
315
316

317
318
319
320
321
322

323

Figure 5: Transfer of adversarial attacks (L∞ = 8/255, 512 attacks) against the activations of layer α
on the accuracy of layer β for α = 0, 10, 27, 43, 53 on ImageNet-1k pretrained ResNet152 ﬁnetuned
on CIFAR-10 via trained linear probes. Each panel shows the effect of designing a pixel-level attack
to confuse the linear probe at a particular layer. For more details, see Figure 23.

layer representations that look like that target class. In (Olah et al., 2017), it is shown via feature
visualization that neural networks build up their understanding of an image hierarchically starting
from edges, moving to textures, simple patterns, all the way to parts of objects and full objects
themselves. This is further explored by Carter et al. (2019). Does an image of a car that has been
adversarially modiﬁed to look like a tortoise to the ﬁnal layer classiﬁer carry the intermediate features
of the target class tortoise (e.g. the patterns on the shell, the legs, a tortoise head), of the original
class car (e.g. wheels, doors), or something else entirely? We answer this question empirically.

To investigate this phenomenon, we ﬁx a trained network f : X → y and use its intermediate layer
activations h1(X), h2(X), · · · , hL(X) to train separate trained linear probes (afﬁne layers) that map
the activation of the layer l into classiﬁcation logits zi as gi : hi(X) → yi. An image X generates
intermediate representations (h1, h2, . . . , hL) that in turn generate L different sets of classiﬁcation
logits (z1, z2, . . . , zL). In Figure 4 we showcase this effect using an ImageNet-pretrained ResNet152
(He et al., 2015) ﬁnetuned on CIFAR-10. Images attacked to look like some other class than their
ground truth (to the ﬁnal layer classiﬁcation) do not look like that to intermediate layers, as shown by
the target class probability only rising in the very last layers (see Figure 4). We can therefore conﬁrm
that indeed the activations of attacked images do not look like the target class in the intermediate
layers, which offers two immediate use cases: 1) as a warning ﬂag that the image has been tempered
with and 2) as an active defense, which is strictly harder.

This setup also allows us not only to investigate what the intermediate classiﬁcation decision would
be for an adversarially modiﬁed image X (cid:48) that confuses the network’s ﬁnal layer classiﬁer, but also to
generally ask what the effect of confusing the classiﬁer at layer α would do to the logits at a layer β.
The results are shown in Figure 5 for 6 selected layers to attack, and the full attack layer × read-out
layer is show in Figure 23.

We ﬁnd that attacks designed to confuse early layers of a network do not confuse its middle and
late layers. Attacks designed to fool middle layers do not fool early nor late layers, and attacks
designed to fool late layers do not confuse early or middle layers. In short, there seems to be roughly
a 3-way split: early layers, middle layers, and late layers. Attacks designed to affect one of these do
not generically generalize to others. We call this effect the adversarial layer de-correlation. This
de-correlation allows us to create a self-ensemble from a single model, aggregating the predictions
resulting from intermediate layer activations.

3 TRAINING AND EXPERIMENTAL RESULTS

In this section we present in detail how we combine the previously described methods and techniques
into a robust classiﬁer on CIFAR-10 and CIFAR-100. We start both with a pretrained model and
ﬁnetune it, as well as with a freshly initialized model.

Model and training details. The pretrained models we use are the ImageNet (Deng et al., 2009)
trained ResNet18 and ResNet152 (He et al., 2016). Our hyperparameter search was very minimal
and we believe that additional gains are to be had with a more involved search easily. The only
architectural modiﬁcation we make is to change the number of input channels in the very ﬁrst
convolutional layer from 3 to 3N , where N is the number of channel-wise stacked down-sampled
images we use as input. We also replaced the ﬁnal linear layer to map to the correct number of classes

6

Under review as a conference paper at ICLR 2025

(10 for CIFAR-10 and 100 for CIFAR-100). Both the new convolutional layer as well as the ﬁnal
linear layer are initialized at random. The batch norm (Ioffe & Szegedy, 2015) is on for ﬁnetuning a
pretrained model (although we did not ﬁnd a signiﬁcant effect beyond the speed of training).

We focused on the CIFAR-* datasets (Krizhevsky, 2009; Krizhevsky et al.) that comprise 50,000
32 × 32 × 3 images. We arbitrarily chose N = 4 and the resolutions we used are 32 × 32, 16 × 16,
8 × 8, 4 × 4 (see Figure 3). We believe it is possible to choose better combinations, however, we
did not run an exhaustive hyperparameter search there. The ResNets we used expect 224 × 224
inputs. We therefore used a bicubic interpolation to upsample the input resolution for each of
the 12 channels independently. To each image (the 32 × 32 × 3 block of RGB channels) we add a
random jitter in the x − y plane in the ±3 range. We also add a random noise of standard deviation
0.2 (out of 1.0). All training is done using the Adam (Kingma & Ba, 2015) optimizer at a ﬂat learning
rate η that we always specify. Optimization is applied to all trainable parameters and the batch norm
is turned on in case of ﬁnetuning, but turned off for training from scratch. Linear probes producing
predictions at each layer are just single linear layers that are trained on top of the pre-trained and
frozen backbone network, mapping from the number of hidden neurons in that layer (ﬂattened to a
single dimension) to the number of classes (10 for CIFAR-10 and 100 for CIFAR-100). We trained
them using the same learning rate as the full network for 1 epoch each.

Adversarial vulnerability evaluation. To make sure we are using as strong an attack suite as
possible to measure our networks’ robustness and to be able to compare our results to other approaches,
we use the RobustBench (Croce et al., 2020) library and its AutoAttack method, which runs
a suite of four strong, consecutive adversarial attacks on a model in a sequence and estimates its
if the attacked images were fed back to the network, what would be
adversarial accuracy (e.g.
the classiﬁcation accuracy with respect to their ground truth classes). For faster evaluation during
development, we used the ﬁrst two attacks of the suite (APGD-CE and APGD-T) that are particularly
strong and experimentally we see that they are responsible for the majority of the accuracy loss under
attack. For full development evaluation (but still without the rand ﬂag) we use the full set of four
tests: APGD-CE, APGD-T, FAB-T and SQUARE. Finally, to evaluate our models using the hardest
method possible, we ran the AutoAttack with the rand ﬂag that is tailored against models using
randomness. The results without adversarial training are shown in Table 1 and with adversarial
training at Table 2. The visual representation of the results is presented in Figure 6.

Table 1: Randomized (strongest) RobustBench AutoAttack adversarial attack suite results at the
L∞ = 8/255 strength. In this table we show the results of attacking our multi-resolution ResNet152
models ﬁnetuned on CIFAR-10 and CIFAR-100 from an ImageNet pretrained state without any
adversarial training or extra data for 20 epochs with Adam at η = 3.3 × 10−5. We use our CrossMax
ensembling on the model itself (self-ensemble), the ﬁnal 3 epochs (3-ensemble), and on self-ensembles
from 3 different runs (3-ensemble of self-ensembles). We also include results for a ResNet18 trained
from scratch on CIFAR-10. Additional adversarial training helps, as shown in Table 2.

Dataset

Adv. Model
train

Method

#

Test
acc

Adv
acc

APGD APGD
CE→ DLR

rand AutoAttack
L∞ = 8/255 (%)

CIFAR-10

CIFAR-10
CIFAR-10

CIFAR-10

CIFAR-10

CIFAR-100

CIFAR-100

CIFAR-100

CIFAR-100

×

×
×

×
(cid:88)

×

×

×
(cid:88)

ResNet18*

Self-ensemble

1024

76.94

64.06

ResNet152 Multires backbone
ResNet152

ResNet152

[3]

Self-ensemble
3-ensemble of
self-ensembles
SOTA #1

ResNet152 Multires backbone

ResNet152

Self-ensemble

ResNet152

[48]

3-ensemble of
self-ensembles
SOTA #1

7

89.17
87.14

41.44
53.12

90.20

71.88

128
128

128

128

512

65.70

65.71

512

67.71

73.71

25.00
46.29
±2.36
48.16
±2.65
42.67

51.56

32.81
50.00

68.75

21.88
34.77
±2.09
40.63
±2.11

44.53

21.88
43.75

68.75

13.28
30.08
±2.13
37.32
±1.98

324

325
326
327
328
329
330

331
332
333
334
335

336
337
338
339
340
341

342
343
344
345
346
347

348
349
350
351
352
353

354
355
356
357
358

359
360
361
362
363
364

365
366
367
368
369
370

371
372
373
374
375
376

377

Under review as a conference paper at ICLR 2025

378

379
380
381
382
383
384

385
386
387
388
389

390
391
392
393
394
395

396
397
398
399
400
401

402
403
404
405
406
407

408
409
410
411
412

413
414
415
416
417
418

419
420
421
422
423
424

425
426
427
428
429
430

431

(a) CIFAR-10

(b) CIFAR-100

Figure 6: Adversarial robustness evaluation for ﬁnetuned ResNet152 models under L∞ = 8/255
attacks of RobustBench AutoAttack (rand version = stronger against our models). On CIFAR-10, a
CrossMax 3-ensemble of our self-ensemble multi-resolution models reaches #3 on the leaderboard,
while on CIFAR-100 a 3-ensemble of our multi-resolution models is #1, leading by ≈+5 % in
adversarial accuracy. When we add light adversarial training, our models surpass SOTA on CIFAR-10
by ≈+5 % and on CIFAR-100 by a strong ≈+9 %.

Multi-resolution ﬁnetuning of a pretrained model. In this section we discuss ﬁnetuning a standard
pretrained model using our multi-resolution inputs. We demonstrate that this quickly leads to very
signiﬁcant adversarial robustness that matches and in some cases (CIFAR-100) signiﬁcantly improves
upon current best, dedicated approaches, without using any extra data or adversarial training. We
see stronger gains on CIFAR-100 rather than CIFAR-10, suggesting that its edge might lie at harder
datasets, which is a very favourable scaling compared to brute force adversarial training.

We show that we can easily convert a pre-trained model into a robust classiﬁer without any data
augmentation or adversarial training in a few epochs of standard training on the target downstream
dataset. The steps we take are as follows: 1) Take a pretrained model (in our case ResNet18 and
ResNet152 pretrained on ImageNet). 2) Replace the ﬁrst layer with a fresh initialization that can
take in 3N instead of 3 channels. 3) Replace the ﬁnal layer with a fresh initialization to project to 10
(for CIFAR-10) or 100 (for CIFAR-100) classes. 4) Train the full network with a small (this is key)
learning rate for a few epochs

We ﬁnd that using a small learning rate is key, which could be connected to the effects described for
example in Thilak et al. (2022) and Fort et al. (2020). While the network might reach a good clean
test accuracy for high learning rates as well, only for small learning rates will it also get signiﬁcantly
robust against adversarial attacks, as shown in Figure 20.

In Table 1 we present our results of ﬁnetuning an ImageNet pretrained ResNet152 on CIFAR-10
and CIFAR-100 for 10 epochs at the constant learning rate of 3.3 × 10−5 with Adam followed by 3
epochs at 3.3 × 10−6. We ﬁnd that even a simple 10 epoch ﬁnetuning of a pretrained model using our
multi-resolution input results in a signiﬁcant adversarial robustness. When using the strongest rand
ﬂag for models using randomized components in the RobustBench AutoAttack without any tuning
against, we show signiﬁcant adversarial robustness, as shown in Tab 1. On CIFAR-10, our results
are comparable to the top three models on the leaderboard, despite never using any extra data or
adversarial training. On CIFAR-100, our models actually lead by +5% over the current best model.

In Figure 6 we can see the gradual increase in adversarial accuracy as we add layers of robustness.
First, we get to ≈ 40% by using multi-resolution inputs. An additional ≈ 10% is gained by combining
intermediate layer predictions into a self-ensemble. An additional ≈ 20% on top is then gained by
using CrossMax ensembling to combining 3 different self-ensembling models together. Therefore, by
using three different ensembling methods at once, we reach approximately 70% adversarial accuracy
on CIFAR-10. The gains on CIFAR-100 are roughly equally split between the multi-resolution input
and self-ensemble, each contributing approximately half of the robust accuracy.

Training from scratch. We train a ResNet18 from scratch on CIFAR-10 as a backbone, and then
train additional linear heads for all of its intermediate layers to form a CrossMax self-ensemble. We
ﬁnd that, during training, augmenting our input images X with an independently drawn images X (cid:48)
with a randomly chosen mixing proportion p as (1 − p)X + pX (cid:48) increases the robustness of the

8

StandardMulti-resbackboneMulti-resself-ensembleEnsemble of multi-res self-ensembles020406080Accuracy (%)0.0%41.4%46.9%53.1%68.0%71.9%78.1%Clean test accuracy 90.2%#1 SOTA 73.7%Finetuned ResNet152 on CIFAR-10 under L=8/255 attacksAdversarialtrainingOriginaltrain setStandardMulti-resbackboneMulti-resself-ensembleEnsemble of multi-res self-ensembles010203040506070Accuracy (%)0.0%25.0%37.5%46.3%47.9%48.2%51.3%Clean test accuracy 67.7%#1 SOTA 42.7%Finetuned ResNet152 on CIFAR-100 under L=8/255 attacksAdversarialtrainingOriginaltrain setUnder review as a conference paper at ICLR 2025

trained model. This simple augmentation technique is known as mixup and is described in Zhang
et al. (2018). The results on the full RobustBench AutoAttack suite of attacks for CIFAR-10 are
shown in Table 1 for self-ensemble constructed on top of the multi-resolution ResNet18 backbone
(the linear heads on top of each layer were trained for 2 epochs with Adam at 10−3 learning rate).

Adversarial ﬁnetuning. Adversarial training,
which adds attacked images with their correct,
ground truth labels back to the training set, is a
standard brute force method for increasing mod-
els’ adversarial robustness. (Chakraborty et al.,
2018) It is ubiquitous among the winning sub-
missions on the RobustBench leader board, e.g.
in Cui et al. (2023) and Wang et al. (2023). To
verify that our technique does not only some-
how replace the need for dedicated adversarial
training, but rather that it can be productively
combined with it for even stronger adversarial
robustness, we re-ran all our ﬁnetuning experiments solely on adversarially modiﬁed batches of input
images generated on the ﬂy.

Figure 7: An example of a L∞ = 64/255 Ro-
bustBench AutoAttack on our model, changing a
bicycle into a snake in an interpretable way.

For each randomly drawn batch, we used the single-step fast gradient sign method from Goodfellow
et al. (2015) to increase its cross-entropy loss with respect to its ground truth labels. We used the
L∞ = 8/255 for all attacks. In Table 2 we show the detailed adversarial robustness of the resulting
models. Figure 6 shows a comparison of the standard training and adversarial training for all models
on CIFAR-10 and CIFAR-100. In all cases, we see an additive beneﬁt of adversarial training on top
of our techniques. In particular, for CIFAR-10 we outperform current SOTA by approximately 5
% while on CIFAR-100 and by approximately 9 % on CIFAR-100, which is a very large increase.
The fact that our techniques beneﬁt even from a very small amount of additional adversarial training
(units of epochs of a single step attack) shows that our multi-resolution inputs and intermediate layer
aggregation are a good prior for getting broadly robust networks.

(a) Pear to apple

(b) Cloud to mountain

Figure 8: Examples of an adversarial attack on an image towards a target label. We use simple
gradient steps with respect to our multi-resolution ResNet152 ﬁnetuned on CIFAR-100. The resulting
attacks use the underlying features of the original image and make semantically meaningful, human-
interpretable changes to it. Additional examples available in Figure 24.

Visualizing attacks against multi-resolution
models. We wanted to visualize the attacks
against our multi-resolution models. In Figure 8
we start with a test set image of CIFAR-100 (a
pear, cloud, camel and elephant) and over 400
steps with SGD and η = 1 minimize the loss
with respect to a target class (apple, mountain,
rabbit and dinosaur). We allow for large pertur-
bations, up to L∞ = 128/255, to showcase the
alignment between our model and the implicit
human visual system classiﬁcation function. In
case of the pear, the perturbation uses the un-
derlying structure of the fruit to divide it into 2
apples by adding a well-placed edge. The result-
ing image is very obviously an apple to a human as well as the model itself. In case of the cloud, its
white color is repurposed by the attack to form the snow of a mountain, which is drawn in by a dark

Figure 9: Examples of adversarial attacks on our
multi-resolution ResNet152 ﬁnetuned on CIFAR-
100 (left), the previous best model on CIFAR-
100 L∞ = 8/255 on RubustBench from Wang
et al. (2023) (middle), and standard ResNet152
ﬁnetuned on CIFAR-100

9

432

433
434
435
436
437
438

439
440
441
442
443

444
445
446
447
448
449

450
451
452
453
454
455

456
457
458
459
460
461

462
463
464
465
466

467
468
469
470
471
472

473
474
475
476
477
478

479
480
481
482
483
484

485

+=99% ”bicycle”RobustBench perturbation86% “snake”+=99% @ c=57 “pear”perturbation98% @ c=0 “apple”+=99% @ c=23 “cloud”perturbation99% @ c=49 “mountain”Under review as a conference paper at ICLR 2025

sharp contour. In case of the elephant, it is turned into a dinosaur by being recolored to green and
made spikier – all changes that are very easily interpretable to a human.

(a) apple

(b) girl

(c) man

(d) maple

(e) mountain

Figure 10: Examples of adversarial attacks on our multi-resolution ResNet152 ﬁnetuned on CIFAR-
100. The attacks are generated by starting from a uniform image (128,128,128) and using gradient
descent of the cross-entropy loss with SGD at η = 1 for 400 steps towards the target label. For
standard models, these look like noise (Figure 9).

In Figure 10 we start with a uniform gray image of color (128, 128, 128) and by changing it to
maximize the probability of a target class with respect to our model, we generate an image. The
resulting images are very human-interpretable. This can be directly contrasted with the results in
Figure 9 that one gets running the same procedure on a brittle model (noise-like patterns) and a
current best, adversarially trained CIFAR-100 model ((Wang et al., 2023); suggestive patterns, but
not real images). We also generated 4 examples per CIFAR-100 class for all 100 classes in Figure 26
to showcase that we do not cherrypick the images shown.

Figure 25 shows 6 examples of successfully attacked CIFAR-100 test set images for an ensemble of 3
self-ensemble models – our most adversarially robust model. When looking at the misclassiﬁcations
caused, we can easily see human-plausible ways in which the attacked image can be misconstrued
as the most probable target class. Figure 7 shows a successful L∞ = 64/255 (much larger than the
standard 8/255 perturbations) RobustBench AutoAttack on a test image of a bicycle converting it, in
a human-interpretable way, to a snake by re-purposing parts of the bicycle frame as the snake body.

4 DISCUSSION AND CONCLUSION

In this paper, we introduced a novel approach to bridging the gap between machine and human
vision systems. Our techniques lead to higher-quality, natural representations that improve the
adversarial robustness of neural networks by leveraging multi-resolution inputs and a robust (self-
)ensemble aggregation method we call CrossMax. Our method approximately matches state-of-the-art
adversarial accuracy on CIFAR-10 and exceeds it on CIFAR-100 without relying on any adversarial
training or extra data at all. When light adversarial training is added, it sets a new best performance
on CIFAR-10 by ≈ 5% and by a signiﬁcant ≈ 9% on CIFAR-100, taking it from ≈ 40% to ≈ 50%.
Key contributions of our work include: 1) Demonstrating the effectiveness of multi-resolution inputs
as an active defense mechanism against adversarial attacks and a design principle for higher-quality,
robust classiﬁers. 2) Introducing the CrossMax ensemble aggregation method for robust prediction
aggregation. 3) Providing insights into the partial robustness of intermediate layer features to
adversarial attacks. 4) Supporting the Interpretability-Robustness Hypothesis through empirical
evidence. 5) Discovering a method to turn pre-trained classiﬁers and CLIP models into controllable
image generators. 6) Generating the ﬁrst transferable image attacks on closed-source large vision
language models which can be viewed as early, simple versions of jailbreaks.

We believe that our ﬁndings not only advance the ﬁeld of adversarial robustness but also provide
valuable insights into the nature of neural network representations and their vulnerability to adversarial
perturbations. The connection between interpretability and robustness highlighted in this work also
opens up new research directions for developing more reliable and explainable AI systems.

486

487
488
489
490
491
492

493
494
495
496
497

498
499
500
501
502
503

504
505
506
507
508
509

510
511
512
513
514
515

516
517
518
519
520

521
522
523
524
525
526

527
528
529
530
531
532

533
534
535
536
537
538

539

10

Under review as a conference paper at ICLR 2025

REFERENCES

Arsenii Ashukha, Alexander Lyzhov, Dmitry Molchanov, and Dmitry Vetrov. Pitfalls of in-domain

uncertainty estimation and ensembling in deep learning, 2021.

Yossi Azar, Andrei Z Broder, Anna R Karlin, and Eli Upfal. Balanced allocations. SIAM Journal on

Computing, 29:180–200, 1999.

Brian R. Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura. Adversarial

robustness limits via scaling-law and human-alignment studies, 2024.

P. Burt and E. Adelson. The laplacian pyramid as a compact image code. IEEE Transactions on

Communications, 31(4):532–540, 1983. doi: 10.1109/TCOM.1983.1095851.

Shan Carter, Zan Armstrong, Ludwig Schubert, Ian Johnson, and Chris Olah. Activation atlas. Distill,

2019. doi: 10.23915/distill.00015. https://distill.pub/2019/activation-atlas.

Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopad-
hyay. Adversarial attacks and defences: A survey, 2018. URL https://arxiv.org/abs/
1810.00069.

Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Robust out-of-distribution detection

for neural networks, 2021.

Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade
Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for
contrastive language-image learning. In Proceedings of the IEEE/CVF Conference on Computer
Vision and Pattern Recognition, pp. 2818–2829, 2023.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble

of diverse parameter-free attacks, 2020.

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam-
marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial
robustness benchmark, 2020.

Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled
kullback-leibler divergence loss, 2023. URL https://arxiv.org/abs/2305.13948.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale
hierarchical image database. In Computer Vision and Pattern Recognition, 2009. CVPR 2009.
IEEE Conference on, pp. 248–255. IEEE, 2009. URL https://ieeexplore.ieee.org/
abstract/document/5206848/.

Stanislav Fort.

regime and their semantic generalization,
io/2021/01/12/OpenAI CLIP adversarial examples. html, 2021a.

Adversarial examples for the openai clip in its zero-shot classiﬁcation
jan 2021b. URL https://stanislavfort. github.

Stanislav Fort.

text: Attacking the openai clip model with text
patches and adversarial pixel perturbations. URL https://stanislavfort. github. io/blog/Ope-
nAI CLIP stickers and adversarial examples, 2021b.

Pixels still beat

Stanislav Fort. Adversarial vulnerability of powerful near out-of-distribution detection, 2022.

Stanislav Fort. Scaling laws for adversarial attacks on language model activations, 2023.

Stanislav Fort, Gintare Karolina Dziugaite, Mansheej Paul, Sepideh Kharaghani, Daniel M. Roy,
and Surya Ganguli. Deep learning versus kernel learning: an empirical study of loss landscape
geometry and the time evolution of the neural tangent kernel, 2020. URL https://arxiv.
org/abs/2010.15110.

Stanislav Fort, Andrew Brock, Razvan Pascanu, Soham De, and Samuel L. Smith. Drawing multiple

augmentation samples per image during training efﬁciently decreases test error, 2021a.

11

540

541
542
543
544
545
546

547
548
549
550
551

552
553
554
555
556
557

558
559
560
561
562
563

564
565
566
567
568
569

570
571
572
573
574

575
576
577
578
579
580

581
582
583
584
585
586

587
588
589
590
591
592

593

Under review as a conference paper at ICLR 2025

594

595
596
597
598
599
600

601
602
603
604
605

606
607
608
609
610
611

612
613
614
615
616
617

618
619
620
621
622
623

624
625
626
627
628

629
630
631
632
633
634

635
636
637
638
639
640

641
642
643
644
645
646

647

Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution

detection, 2021b.

Stanislav Fort, Ekin Dogus Cubuk, Surya Ganguli, and Samuel S. Schoenholz. What does a deep
neural network conﬁdently perceive? the effective dimension of high certainty class manifolds and
their low conﬁdence boundaries, 2022. URL https://arxiv.org/abs/2210.05546.

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial

examples, 2015. URL https://arxiv.org/abs/1412.6572.

Charles Goodhart. Problems of monetary management: The u.k. experience. In Anthony S. Courakis
(ed.), Inﬂation, Depression, and Economic Policy in the West, pp. 116. Barnes and Noble Books,
Totowa, New Jersey, 1981. ISBN 0-389-20144-8.

Chuan Guo, Alexandre Sablayrolles, Herv´e J´egou, and Douwe Kiela. Gradient-based adversarial
attacks against text transformers. In Proceedings of the 2021 Conference on Empirical Methods in
Natural Language Processing. Association for Computational Linguistics, 2021. doi: 10.18653/v1/
2021.emnlp-main.464. URL http://dx.doi.org/10.18653/v1/2021.emnlp-main.
464.

Marton Havasi, Rodolphe Jenatton, Stanislav Fort, Jeremiah Zhe Liu, Jasper Snoek, Balaji Laksh-
minarayanan, Andrew M. Dai, and Dustin Tran. Training independent subnetworks for robust
prediction, 2021. URL https://arxiv.org/abs/2010.06610.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image

recognition, 2015.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Im-
age Recognition. In Proceedings of 2016 IEEE Conference on Computer Vision and Pattern
Recognition, CVPR ’16, pp. 770–778. IEEE, June 2016. doi: 10.1109/CVPR.2016.90. URL
http://ieeexplore.ieee.org/document/7780459.

Kurt Hornik, Maxwell Stinchcombe, and Halbert White. Multilayer feedforward networks are

universal approximators. Neural Networks, 2(5):359–366, 1989.

Gabriel Ilharco, Mitchell Wortsman, Ross Wightman, Cade Gordon, Nicholas Carlini, Rohan Taori,
Achal Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali
Farhadi, and Ludwig Schmidt. Openclip, July 2021. URL https://doi.org/10.5281/
zenodo.5143773. If you use this software, please cite it as below.

Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by

reducing internal covariate shift, 2015.

Robert G Keys. Cubic convolution interpolation for digital image processing. IEEE Transactions on

Acoustics, Speech, and Signal Processing, 29(6):1153–1160, 1981.

Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International

Conference on Learning Representations (ICLR), San Diega, CA, USA, 2015.

Alex Krizhevsky. Learning multiple layers of features from tiny images. pp. 32–33, 2009. URL
https://www.cs.toronto.edu/˜kriz/learning-features-2009-TR.pdf.

Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-100 (canadian institute for advanced

research). URL http://www.cs.toronto.edu/˜kriz/cifar.html.

Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive

uncertainty estimation using deep ensembles, 2017.

Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document

recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998. doi: 10.1109/5.726791.

Jan Leike, Miljan Martic, Victoria Krakovna, Pedro A. Ortega, Tom Everitt, Andrew Lefrancq,

Laurent Orseau, and Shane Legg. Ai safety gridworlds, 2017.

12

Under review as a conference paper at ICLR 2025

Susana Martinez-Conde, Stephen L Macknik, and David H Hubel. The role of ﬁxational eye

movements in visual perception. Nature reviews neuroscience, 5(3):229–240, 2004.

Michael Mitzenmacher, Andrea W. Richa, and Ramesh Sitaraman. The power of two random choices:

A survey of techniques and results. Harvard University, 2001.

Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill, 2017. doi:

10.23915/distill.00007. https://distill.pub/2017/feature-visualization.

Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, D Sculley, Sebastian Nowozin, Joshua V. Dillon,
Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model’s uncertainty? evaluating
predictive uncertainty under dataset shift, 2019.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal,
Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever.
Learning transferable visual models from natural language supervision, 2021.

Herbert Robbins and Sutton Monro. A stochastic approximation method. The Annals of Mathematical

Statistics, 22(3):400–407, 1951.

Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Crist´obal Eyzaguirre, Zane Durante, Joe
Benton, Brando Miranda, Henry Sleight, John Hughes, Rajashree Agrawal, Mrinank Sharma, Scott
Emmons, Sanmi Koyejo, and Ethan Perez. When do universal image jailbreaks transfer between
vision-language models?, 2024. URL https://arxiv.org/abs/2407.15211.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow,

and Rob Fergus. Intriguing properties of neural networks, 2013.

Vimal Thilak, Etai Littwin, Shuangfei Zhai, Omid Saremi, Roni Paiss, and Joshua Susskind. The
slingshot mechanism: An empirical study of adaptive optimizers and the grokking phenomenon,
2022.

A van der Schaaf and J H van Hateren. Modelling the power spectra of natural images: Statistics and
information. Vision Research, 36(17):2759–2770, September 1996. ISSN 0042-6989. Relation:
http://www.rug.nl/informatica/organisatie/overorganisatie/iwi Rights: University of Groningen.
Research Institute for Mathematics and Computing Science (IWI).

Brian A Wandell. Foundations of vision. Sinauer Associates, 1995.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion
models further improve adversarial training, 2023. URL https://arxiv.org/abs/2302.
04638.

Robert B. Wilson. Counterspeculation, auctions, and competitive sealed tenders. Journal of Finance,

31(3):1106–1115, 1977.

Xixin Wu and Mark Gales. Should ensemble members be calibrated?, 2021.

Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical

risk minimization, 2018.

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal

and transferable adversarial attacks on aligned language models, 2023.

13

648

649
650
651
652
653
654

655
656
657
658
659

660
661
662
663
664
665

666
667
668
669
670
671

672
673
674
675
676
677

678
679
680
681
682

683
684
685
686
687
688

689
690
691
692
693
694

695
696
697
698
699
700

701

Under review as a conference paper at ICLR 2025

A ADDITIONAL INSIGHTS AND APPLICATIONS

We want to support our multi-resolution input choice as
an active defense by demonstrating that by reversing it
and representing an adversarial perturbation explicitly as
a sum of perturbations at different resolutions, we get
human-interpretable perturbations by default.

A.1 SINGLE-RESOLUTION ADVERSARIAL ATTACKS

Natural images contain information expressed on all fre-
quencies, with an empirically observed power-law scaling.
The higher the frequency, the lower the spectral power, as
∝ f −2 (van der Schaaf & van Hateren, 1996).

While having a single perturbation P of the full resolution
R × R theoretically sufﬁces to express anything, we ﬁnd
that this choice induces a speciﬁc kind of high frequency
prior. Even simple neural networks can theoretically ex-
press any function (Hornik et al., 1989), yet the speciﬁc
architecture matters for what kind of a solution we obtain
given our data, optimization, and other practical choices.
Similarly, we ﬁnd that an alternative formulation of the
perturbation P leads to more natural looking and human
interpretable perturbations despite the attacker having ac-
cess to the highest-resolution perturbation as well and could in principle just use that.

Figure 11: The image spectrum of gen-
erated multi-resolution attacks. The ad-
versarial attacks generated over multiple
resolutions at once end up showing very
white-noise-like distribution of powers
over frequencies (the slope for natural
images is ≈ −2). This is in contrast
with standard noise-like attacks.

A.2 MULTI-RESOLUTION ATTACKS

Figure 12: The result of expressing an image as a set of resolutions and optimizing it towards the
CLIP embedding of the text ’a photo of a nuclear explosion’. The plot shows the resulting sum of
resolutions (left panel, marked with ρ) and selected individual perturbations Pr of resolutions 2 × 2,
8 × 8, 32 × 32 and 128 × 128. The intensity of each is shifted and rescaled to ﬁt between 0 and 1 to
be recognizable visually, however, the pixel values in the real Pr fall of approximately as r−1.

We express the single, high resolution perturbation P as a sum of perturbations P =
(cid:80)
r∈ρ rescaleR(Pr), where Pr is of the resolution r × r speciﬁed by a set of resolutions ρ, and
the rescaleR function rescales and interpolates an image to the full resolution R × R. When we
jointly optimize the set of perturbations {Pr}r∈ρ, we ﬁnd that: a) the resulting attacked image
X + (cid:80)
r∈ρ rescaleR(Pr) is much more human-interpretable, b) the attack follows a power distribu-
tion of natural images.

When attacking a classiﬁer, we choose a target label t and optimize the cross-entropy loss of the
predictions stemming from the perturbed image as if that class t were ground truth. To add to
the robustness and therefore interpretability of the attack (as hypothesized in our Interpretability-
Robustness Hypothesis), we add random jitter in the x-y plane and random pixel noise, and design
the attack to work on a set of models.

An example of the multi-resolution sum is show in Figure 13. There we use a simple Stochastic
Gradient Descent (Robbins & Monro, 1951) optimization with the learning rate of 5 × 10−3 and
a cosine decay schedule over 50 steps. We add a random pixel noise of 0.6 (out of 1), jitter in the
x-y plane in the ±5 range and a set of all perturbations from 1 × 1 to 224 × 224 interpolated using
bicubic interpolation (Keys, 1981). In Figure 13 we see that despite the very limited expressiveness

14

702

703
704
705
706
707
708

709
710
711
712
713

714
715
716
717
718
719

720
721
722
723
724
725

726
727
728
729
730
731

732
733
734
735
736

737
738
739
740
741
742

743
744
745
746
747
748

749
750
751
752
753
754

755

+ … +=+ … ++ … +Under review as a conference paper at ICLR 2025

of the ﬁnal layer class label, we can still recover images that look like the target class to a human. We
also tested them using Gemini Advanced and GPT-4, asking what the AI model sees in the picture,
and got the right response in all 8 cases. To demonstrate that we can generate images beyond the

(a) c = 309 bee

(b) c = 37 box turtle

(c) c = 895 warplane

(d) c = 979 valley

(e) c = 974 geyser

(f) c = 975 lakeside

(g) c = 795 ski

(h) c = 980 volcano

Figure 13: Examples of images generated as attacks on ImageNet-trained classiﬁers. These images
were generated by minimizing the cross-entropy loss of seven pretrained classiﬁers with respect to
the target ImageNet class. Spatial jitter in the ±5 pixel range and pixel noise of standard deviation
0.6 were applied during SGD optimization with learning rate 5 × 10−3 over 50 steps with a cosine
schedule. The perturbation was expressed as a sum of perturbations at all resolutions from 1 × 1 to
224 × 224 that were optimized at once.

Figure 14: Optimizing towards a probability vector with a sliding scale between c = 974 geyser and
c = 975 lakeside. Optimizing against pretrained classiﬁers generated semantically blended image of
the two concepts.

original 1000 ImageNet classes, we experimented with setting the target label not as a one-hot vector,
but rather with target probability p on class t1 and 1 − p on t2. For classes c = 974 (geyser) and
c = 975 (lakeside) we show, in Figure 14 that we get semantically meaningful combinations of
the two concepts in the same image as we vary p from 0 to 1. p = 1/2 gives us a geyser hiding
beyond trees at a lakeside. This example demonstrates that in a limited way, classiﬁers can be used as
controllable image generators.

A.3 MULTI-RESOLUTION ATTACK ON CLIP

The CLIP-style (Radford et al., 2021) models map an image I to an embedding vector fI : I → vI
and a text T to an embedding vector fT : T → vT . The cosine between these two vectors corresponds
to the semantic similarity of the image and the text, cos(vI , vT ) = vI · vT /(|vI ||vT |). This gives us
score(I, T ) that we can optimize.

Adversarial attacks on CLIP can be thought of as starting with a human-understandable image X0 (or
just a noise), and a target label text T ∗, and optimizing for a perturbation P to the image that tries to

15

756

757
758
759
760
761
762

763
764
765
766
767

768
769
770
771
772
773

774
775
776
777
778
779

780
781
782
783
784
785

786
787
788
789
790

791
792
793
794
795
796

797
798
799
800
801
802

803
804
805
806
807
808

809

100% geyser    0% lakeside 75% geyser 25% lakeside 50% geyser 50% lakeside 25% geyser 75% lakeside    0% geyser100% lakesideUnder review as a conference paper at ICLR 2025

810

811
812
813
814
815
816

817
818
819
820
821

822
823
824
825
826
827

828
829
830
831
832
833

834
835
836
837
838
839

840
841
842
843
844

845
846
847
848
849
850

851
852
853
854
855
856

857
858
859
860
861
862

863

(a) Just a 224 × 224 per-
turbation alone.

(b) Adding random noise
to optimization.

(c) Adding random jitter
to optimization.

(d) Adding all resolutions
from 1 × 1 to 224 × 224.

Figure 15: The effect of adding noise, jitter, and a full set of resolutions to an adversarial attack on
CLIP towards the text ’a beautiful photo of the University of Cambridge, detailed’. While using just
a plain perturbation of the full resolution in Figure 15a, as is standard in the typical adversarial attack
setup, we get a completely noise-like image. Adding random noise to the pixels during optimization
leads to a glimpse of a structure, but still maintains a very noise-like pattern (Figure 15b). Adding
random jitter in the x-y plane on top, we can already see interpretable shapes of Cambridge buildings
in Figure 15c. Finally, adding perturbations of all resolutions, 1 × 1, 2 × 2, . . . , 224 × 224, we get a
completely interpretable image as a result in Figure 15d.

increase the score(X0 + P, T ∗) as much as possible. In general, ﬁnding such perturbations is easy,
however, they end up looking very noise-like and non-interpretable. (Fort, 2021b;a).

If we again express P = rescale224(P1) + rescale224(P2) +
· · · + P224, where Pr is a resolution r × r image perturbation,
and optimize score(X0 + rescale224(P1) + rescale224(P2) +
· · · + P224, T ∗) by simultaneously updating all {Pr}r, the re-
sulting image X0 + (cid:80)
r∈[1,224] rescaleR(Pr) looks like the
target text T ∗ to a human rather than being just a noisy pattern.
Even though the optimizer could choose to act only on the full
resolution perturbation P224, it ends up optimizing all of them
jointly instead, leading to a more natural looking image. To
further help with natural-looking attacks, we introduce pixel
noise and the x-y plane jitter, the effect of which is shown in
Figure 15.
We use SGD at the learning rate of 5×10−3 for 300 steps with a
cosine decay schedule to maximize the cosine between the text
description and our perturbed image. We use the OpenCLIP
models (Ilharco et al., 2021; Cherti et al., 2023) (an open-source
replication of the CLIP model (Radford et al., 2021)). Examples of the resulting ”adversarial attacks”,
starting with a blank image with 0.5 in its RGB channels, and optimizing towards the embedding
of speciﬁc texts such as ”a photo of Cambridge UK, detailed, and ”a photo of a sailing boat on a
rough sea” are shown in Figure 18. The image spectra are shown in Figure 11, displaying a very
natural-image-like distribution of powers. The resulting images look very human-interpretable.

Figure 16: An attack on vision lan-
guage models. GPT-4 sees Rick Ast-
ley from his famous ”Never Gonna
Give You Up” music video tree. See
Table 21 and 22 for details.

Starting from a painting of Isaac Newton and optimizing towards the embeddings of ”Albert Einstein”,
”Queen Elizabeth” and ”Nikola Tesla”, we show that the attack is very semantically targeted,
effectively just changing the facial features of Isaac Newton towards the desired person. This
is shown in Figure 17. This is exactly what we would ideally like adversarial attacks to be – when
changing the content of what the model sees, the same change should apply to a human. We use a
similar method to craft transferable attacks (see Figure 16 for an example) against commercial, closed
source vision language models (GPT-4, Gemini Advanced, Claude 3 and Bing AI) in Table 21, in
which a turtle turns into a cannon, and in Table 22, where Stephen Hawking turns into the music video
Never Gonna Give You Up by Rick Astley. The attacks also transfer to Google Lens, demonstrating
that the multi-resolution prior also serves as a good transfer prior and forms an early version of a
transferable image vision language model jailbreak. This is a constructive proof to the contrary of the
non-transferability results in Schaeffer et al. (2024).

16

Under review as a conference paper at ICLR 2025

864

865
866
867
868
869
870

871
872
873
874
875

876
877
878
879
880
881

882
883
884
885
886
887

888
889
890
891
892
893

894
895
896
897
898

899
900
901
902
903
904

905
906
907
908
909
910

911
912
913
914
915
916

917

(a) Original

(b) Albert Einstein

(c) Queen Elizabeth

(d) Nikola Tesla

Figure 17: Starting with an image of Isaac Newton and optimizing a multi-resolution perturbation
towards text embeddings of Albert Einstein, Queen Elizabeth and Nikola Tesla leads to a change in the
face of the person depicted. This demonstrates how semantically well-targeted such multi-resolution
attacks are. All 4 images are recognizable as the target person to humans as well as GPT-4o and
Gemini Advanced.

(a) Ancient Rome

(b) Cambridge, UK

(c) Prague Castle in
spring

(d) Oxford, UK

(e) sailing ship on stormy
sea

(f) the Whirlpool Galaxy,
M51

(g) a large ship cannon ﬁr-
ing

(h) African savanna with
animals and trees

Figure 18: Examples of images generated with the multi-resolution prior, jitter and noise with the
OpenCLIP models. The text whose embedding the image optimizes to approach is of the form ’A
beautiful photo of [X], detailed’ for different values of [X].

A.4 CROSSMAX EXPERIMENTS

To demonstrate experimentally different characteristics of prediction aggregation among several
classiﬁers, we trained 10 ResNet18 models, starting from an ImageNet pretrained model, changing
their ﬁnal linear layer to output 10 classes of CIFAR-10. We then used the ﬁrst 2 attacks of the
RobustBench AutoAttack suite (APGD-T and APGD-CE; introduced by Croce & Hein (2020) as
particularly strong attack methods) and evaluated the robustness of our ensemble of 10 models under
adversarial attacks of different L∞ strength. The results are shown in Figure 19.

The aggregation methods we show are 1) our CrossMax (Algorithm 1) (using median since the 10
models are expected to be equally good), 2) a standard logit mean over models, 3) median over
models, and 4) the performance of the individual models themselves. While an ensemble of 10
models, either aggregated with a mean or median, is more robust than individual models at all
attack strengths, it nonetheless loses robust accuracy very fast with the attack strength L∞ and at the
standard level of L∞ = 8/255 it drops to ≈0%. Our CrossMax in Algorithm 1 provides > 0 robust
accuracy even to 10/255 attack strengths, and for 8/255 gives a 17-fold higher robust accuracy than
just plain mean or median.

17

Under review as a conference paper at ICLR 2025

918

919
920
921
922
923
924

925
926
927
928
929

930
931
932
933
934
935

936
937
938
939
940
941

942
943
944
945
946
947

948
949
950
951
952

953
954
955
956
957
958

959
960
961
962
963
964

965
966
967
968
969
970

971

(a) CIFAR-10

(b) CIFAR-100

Figure 19: The robust accuracy of different types of ensembles of 10 ResNet18 models under
increasing L∞ attack strength. Our robust median ensemble, CrossMax, gives very non-trivial
adversarial accuracy gains to ensembles of individually brittle models. For L∞ = 6/255, its CIFAR-
10 robust accuracy is 17-fold larger than standard ensembling, and for CIFAR-100 the factor is
12.

(a) Learning rate effects

(b) Epoch effect

(c) Accuracy vs robust accuracy

Figure 20: Finetuning a pretrained model with multi-resolution inputs. The left panel shows the
test accuracy and adversarial accuracy after the ﬁrst two attacks of RobustBench AutoAttack at
L∞ = 8/255 after 3 epochs of ﬁnetuning an ImageNet pretrained ResNet152. The middle panel
shows the effect of training epoch for a single ﬁnetuning run at the learning rate η = 1.7 × 10−5. The
right panel shows a hysteresis-like curve where high test accuracies are both compatible with low and
high adversarial accuracies. The test accuracies are over the full 10,000 images while the adversarial
accuracies are evaluated on 128 test images.

A.5 FINETUNING EFFECTS

A.6 DETAILS OF ADVERSARIAL FINETUNING

A.7 TRANSFER TO MASSIVE COMMERCIAL MODELS

In Table 21 we show the results of asking ”What do you see in this photo?” and adding the relevant
picture to four different, publicly available commercial AI models: GPT-41, Bing Copilot2, Claude
3 Opus3 and Gemini Advanced4. We ﬁnd that, with an exception of Gemini Advanced, even a

1chatgpt.com
2bing.com/chat
3claude.ai/
4gemini.google.com

18

0246810Attack strength L (out of 255)020406080Accuracy (%)1.6x7.5x17.0xstandard attack strength L=8/255CIFAR-10 | 10x ResNet18 modelsrobustmedian(z)mean(z)median(z)individual models0246810Attack strength L (out of 255)010203040506070Accuracy (%)1.7x2.5x12.0xstandard attack strength L=8/255CIFAR-100 | 10x ResNet18 modelsrobustmedian(z)mean(z)median(z)individual models106105104103Learning rate2030405060708090Accuracy (%)Clean testAdversarialL=8/255123456789Epoch405060708090Accuracy (%)Clean testAdversarialL=8/255Under review as a conference paper at ICLR 2025

972

973
974
975
976
977
978

979
980
981
982
983

984
985
986
987
988
989

990
991
992
993
994
995

996
997
998
999
1000
1001

1002
1003
1004
1005
1006

1007
1008
1009
1010
1011
1012

1013
1014
1015
1016
1017
1018

1019
1020
1021
1022
1023
1024

1025

Dataset

CIFAR-10
CIFAR-10

CIFAR-10

CIFAR-10

CIFAR-100

CIFAR-100

CIFAR-100

CIFAR-100

(cid:88)

(cid:88)

(cid:88)

(cid:88)

(cid:88)

(cid:88)

Method

Adv. Model
train
(cid:88)
(cid:88)

ResNet152 Multi-res backbone
ResNet152

ResNet152

[3]

Self-ensemble
3-ensemble of
self-ensembles
SOTA #1

Test
acc

87.19
84.58

#

128
128

128

87.00

78.13

ResNet152 Multi-res backbone

ResNet152

Self-ensemble

ResNet152

[48]

3-ensemble of
self-ensembles
SOTA #1

128

512

62.72

58.93

512

61.17

rand RobustBench AutoAttack
L∞ = 8/255 # samples (%)
APGD→ APGD
Adv
DLR
acc

CE

46.88
67.94

73.71

37.50
47.85
±2.66
51.28
±1.95
42.67

34.38
64.06

73.44

32.03
36.72
±3.01
44.60
±2.00

32.03
54.69

72.65

22.66
33.98
±2.72
43.04
±1.97

Table 2: Full randomized (=the strongest against our approach) RobustBench AutoAttack adversarial
attack suite results for 128 test samples at the L∞ = 8/255 strength. In this table we show the results
of attacking our multi-resolution ResNet152 models ﬁnetuned on CIFAR-10 and CIFAR-100 from an
ImageNet pretrained state with light adversarial training.

L∞ = 30/255 attack generated in approximately 1 minute on a single A100 GPU (implying a cost
at most in cents) fools these large models into seeing a cannon instead of a turtle. The attack also
transfers to Google Lens.

A.8 ATTACK TRANSFER BETWEEN LAYERS

B VISUALIZING ATTACKS ON MULTI-RESOLUTION MODELS

C ADDITIONAL EXPERIMENTS FOR CROSSMAX

D ADDITIONAL CROSSMAX VALIDATION

As an ablation, we tested variants of the CrossMax method. There are two normalization steps: A)
subtracting the per-predictor max, and B) subtracting the per-class max. We exhaustively experiment
with all combinations, meaning { , A, B, AB, BA}, (robust accuracies at 4/255 are {4, 4, 0, 22, 0}%)
and ﬁnd that performing A and then B, as in Algorithm 1, is by far the most robust method. We
perform a similar ablation for a robust, multi-resolution self-ensemble model in Table 3 and reach
the same verdict, in addition to conﬁrming that the algorithm is very likely not accidentally masking
gradients.

D.1 TRAINING FROM SCRATCH

For our ResNet18 model trained from scratch on CIFAR-10, we keep the pairs of images that are
mixed in mixup ﬁxed for 20 epochs at a time, producing a characteristic pattern in the training
accuracies. Every 5 epochs we re-draw the random mixing proportions in the [0, 1/2] range. We
trained the model for 380 epochs with the Adam optimizer (Kingma & Ba, 2015) at learning rate
10−3 and dropped it to 10−4 for another 120 epochs. The ﬁnal checkpoint is the weight average of
the last 3 epochs. The training batch size is 512. These choices are arbitrary and we did not run a
hyperparameter search over them.

19

Under review as a conference paper at ICLR 2025

Figure 21: Multi-resolution adversarial attacks of increasing L∞ using OpenCLIP on an image of a
sea turtle towards the text ”a cannon” tested on GPT-4, Bing Copilot (Balanced), Claude 3 Sonnet
and Gemini Advanced. All models we tested the images on were publicly available. The conversation
included a single message ”What do you see in this photo?” and an image. We chose the most
relevant parts of the response.

Aggregation fn

Method

Test acc
Adv acc

topk2
B

A

57.08
46.88

59.86
46.88

0.82
1.56

mean

BA

1.27
0.00

AB

58.92
57.81

A

60.31
40.62

59.89
48.44

B

1.1
0.00

BA

1.05
0.00

AB

57.23
39.06

Table 3: CrossMax algorithm ablation. The Algorithm 1 contains two subtraction steps: A = the
per-predictor max subtraction, and B = the per-class max subtraction. This Table shows the robust
accuracies of a self-ensemble model on CIFAR-100 trained with light adversarial training, whose
intermediate layer predictions were aggregated using different combinations and orders of the two
steps. We also look at the effect of using the ﬁnal topk2 aggregation vs just using a standard mean.
The best result is obtained by the Algorithm 1, however, we see that not using the topk does not
lead to a critical loss of robustness as might be expected if there were accidental gradient masking
happening.

20

1026

1027
1028
1029
1030
1031
1032

1033
1034
1035
1036
1037

1038
1039
1040
1041
1042
1043

1044
1045
1046
1047
1048
1049

1050
1051
1052
1053
1054
1055

1056
1057
1058
1059
1060

1061
1062
1063
1064
1065
1066

1067
1068
1069
1070
1071
1072

1073
1074
1075
1076
1077
1078

1079

Under review as a conference paper at ICLR 2025

Figure 22: Multi-resolution adversarial attacks of increasing L∞ using OpenCLIP on an image of
Stephen Hawking towards the embedding of an image from the famous Rick Astley’s song Never
Gonna Give You Up from the 1980s tested on GPT-4, Bing Copilot (Balanced), Claude 3 Sonnet and
Gemini Advanced. All models we tested the images on were publicly available. The conversation
included a single message ”What do you see in this photo?” and an image. We chose the most
relevant part of the response. Unfortunately, Gemini refused to answer, likely due to the presence of
a human face in the photo.

1080

1081
1082
1083
1084
1085
1086

1087
1088
1089
1090
1091

1092
1093
1094
1095
1096
1097

1098
1099
1100
1101
1102
1103

1104
1105
1106
1107
1108
1109

1110
1111
1112
1113
1114

1115
1116
1117
1118
1119
1120

1121
1122
1123
1124
1125
1126

1127
1128
1129
1130
1131
1132

1133

21

Under review as a conference paper at ICLR 2025

1134

1135
1136
1137
1138
1139
1140

1141
1142
1143
1144
1145

1146
1147
1148
1149
1150
1151

1152
1153
1154
1155
1156
1157

1158
1159
1160
1161
1162
1163

1164
1165
1166
1167
1168

1169
1170
1171
1172
1173
1174

1175
1176
1177
1178
1179
1180

1181
1182
1183
1184
1185
1186

1187

Figure 23: Attack transfer between layers of the ResNet154 model pre-trained on ImageNet-1k. The
individual linear heads were ﬁnetuned on CIFAR-10 on top of the frozen model.

(a) Bicycle to motorbike

(b) Lamp to mushroom

(c) Rocket to bottle

(d) Sea to bridge

Figure 24: Additional examples of an adversarial attack on an image towards a target label. We use
simple gradient steps with respect to our multi-resolution ResNet152 ﬁnetuned on CIFAR-100. The
resulting attacks use the underlying features of the original image and make semantically meaningful,
human-interpretable changes to it. Additional examples available in Figure 8.

22

+=99% @ c=8 “bicycle”perturbation92% @ c=48 “motorbike”+=73% @ c=40 “lamp”perturbation61% @ c=51 “mushroom”+=63% @ c=69 “rocket”perturbation98% @ c=9 “bottle”+=54% @ c=71 “sea”perturbation99% @ c=12 “bridge”Under review as a conference paper at ICLR 2025

1188

1189
1190
1191
1192
1193
1194

1195
1196
1197
1198
1199

1200
1201
1202
1203
1204
1205

1206
1207
1208
1209
1210
1211

1212
1213
1214
1215
1216
1217

1218
1219
1220
1221
1222

1223
1224
1225
1226
1227
1228

1229
1230
1231
1232
1233
1234

1235
1236
1237
1238
1239
1240

1241

Figure 25: Examples of successfully attacked CIFAR-100 images for an ensemble of self-ensembles –
our most robust model. We can see human-plausible ways in which the attack changes the perceived
class. For example, the skyscraper has a texture added to it to make it look tree-like.

23

70% sunﬂower30% palm tree100% palm tree80% pine tree10% skyscraper10% mountain80% skyscraper20% pine tree40% mushroom20% crab30% shrew10% ray90% crab90% ray80% clock20% bowl80% mushroom20% spider100% bowl100% spiderUnder review as a conference paper at ICLR 2025

1242

1243
1244
1245
1246
1247
1248

1249
1250
1251
1252
1253

1254
1255
1256
1257
1258
1259

1260
1261
1262
1263
1264
1265

1266
1267
1268
1269
1270
1271

1272
1273
1274
1275
1276

1277
1278
1279
1280
1281
1282

1283
1284
1285
1286
1287
1288

1289
1290
1291
1292
1293
1294

1295

Figure 26: Examples of optimizing towards all 100 CIFAR-100 classes against our multi-resolution
ResNet152 model, 4 examples for each. We use 400 simple gradient steps at learning rate η = 1 with
SGD with respect to the model, starting from all grey pixels (128,128,128). The resulting attacks are
easily recognizable as the target class to a human.

24

c=0 applec=1 aquarium fishc=2 babyc=3 bearc=4 beaverc=5 bedc=6 beec=7 beetlec=8 bicyclec=9 bottlec=10 bowlc=11 boyc=12 bridgec=13 busc=14 butterflyc=15 camelc=16 canc=17 castlec=18 caterpillarc=19 cattlec=20 chairc=21 chimpanzeec=22 clockc=23 cloudc=24 cockroachc=25 couchc=26 crabc=27 crocodilec=28 cupc=29 dinosaurc=30 dolphinc=31 elephantc=32 flatfishc=33 forestc=34 foxc=35 girlc=36 hamsterc=37 housec=38 kangarooc=39 keyboardc=40 lampc=41 lawn mowerc=42 leopardc=43 lionc=44 lizardc=45 lobsterc=46 manc=47 maple treec=48 motorcyclec=49 mountainc=50 mousec=51 mushroomc=52 oak treec=53 orangec=54 orchidc=55 otterc=56 palm treec=57 pearc=58 pickup truckc=59 pine treec=60 plainc=61 platec=62 poppyc=63 porcupinec=64 possumc=65 rabbitc=66 raccoonc=67 rayc=68 roadc=69 rocketc=70 rosec=71 seac=72 sealc=73 sharkc=74 shrewc=75 skunkc=76 skyscraperc=77 snailc=78 snakec=79 spiderc=80 squirrelc=81 streetcarc=82 sunflowerc=83 sweet pepperc=84 tablec=85 tankc=86 telephonec=87 televisionc=88 tigerc=89 tractorc=90 trainc=91 troutc=92 tulipc=93 turtlec=94 wardrobec=95 whalec=96 willow treec=97 wolfc=98 womanc=99 wormUnder review as a conference paper at ICLR 2025

1296

1297
1298
1299
1300
1301
1302

1303
1304
1305
1306
1307

1308
1309
1310
1311
1312
1313

1314
1315
1316
1317
1318
1319

1320
1321
1322
1323
1324
1325

1326
1327
1328
1329
1330

1331
1332
1333
1334
1335
1336

1337
1338
1339
1340
1341
1342

1343
1344
1345
1346
1347
1348

1349

(a) ResNet154 self-ensemble on CIFAR-10

(b) ViT-B/16 self-ensemble on CIFAR-10

Figure 27: The robust accuracy of different types of self-ensembles of ResNet152 and ViT-B/16 with
linear heads ﬁnetuned on CIFAR-10 under increasing L∞ attack strength.

25

012345Attack strength L (out of 255)020406080Accuracy (%)1.6x10.5xCIFAR-10 | ResNet154 self-ensemblerobustmedian(z)robusttop3(z)mean(z)final layer only012345Attack strength L (out of 255)020406080Accuracy (%)1.3x3.1x10.0xCIFAR-10 | ViT-B/16 self-ensemblerobustmedian(z)robusttop3(z)mean(z)final layer only