{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/ensemble-everything-everywhere-multi-scale","title":"Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness","arxiv_id":"2408.05446","date":"2024-08-08","proceeding":null,"authors":["Stanislav Fort","Balaji Lakshminarayanan"],"abstract":"Adversarial examples pose a significant challenge to the robustness, reliability and alignment of deep neural networks. We propose a novel, easy-to-use approach to achieving high-quality representations that lead to adversarial robustness through the use of multi-resolution input representations and dynamic self-ensembling of intermediate layer predictions. We demonstrate that intermediate layer predictions exhibit inherent robustness to adversarial attacks crafted to fool the full classifier, and propose a robust aggregation mechanism based on Vickrey auction that we call \\textit{CrossMax} to dynamically ensemble them. By combining multi-resolution inputs and robust ensembling, we achieve significant adversarial robustness on CIFAR-10 and CIFAR-100 datasets without any adversarial training or extra data, reaching an adversarial accuracy of $\\approx$72% (CIFAR-10) and $\\approx$48% (CIFAR-100) on the RobustBench AutoAttack suite ($L_\\infty=8/255)$ with a finetuned ImageNet-pretrained ResNet152. This represents a result comparable with the top three models on CIFAR-10 and a +5 % gain compared to the best current dedicated approach on CIFAR-100. Adding simple adversarial training on top, we get $\\approx$78% on CIFAR-10 and $\\approx$51% on CIFAR-100, improving SOTA by 5 % and 9 % respectively and seeing greater gains on the harder dataset. We validate our approach through extensive experiments and provide insights into the interplay between adversarial robustness, and the hierarchical nature of deep representations. We show that simple gradient-based attacks against our model lead to human-interpretable images of the target classes as well as interpretable image changes. As a byproduct, using our multi-resolution prior, we turn pre-trained classifiers and CLIP models into controllable image generators and develop successful transferable attacks on large vision language models.","url_abs":"https://arxiv.org/abs/2408.05446v1","url_pdf":"https://arxiv.org/pdf/2408.05446v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"ensemble-everything-everywhere-multi-scale","repo_url":"https://github.com/stanislavfort/ensemble-everything-everywhere","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"ensemble-everything-everywhere-multi-scale","repo_url":"https://github.com/ETH-DISCO/self-ensembling","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"}],"methods":[{"method_slug":"clip","method_name":"CLIP"}],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/adversarial-attack-on-cifar-10","task":"Adversarial Attack","dataset":"CIFAR-10","model":"3-ensemble of multi-resolution self-ensembles","rank_in_archive_order":4,"of":6,"metrics":{"Attack: AutoAttack":"78.13"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-attack-on-cifar-100","task":"Adversarial Attack","dataset":"CIFAR-100","model":"3-ensemble of multi-resolution self-ensembles","rank_in_archive_order":1,"of":2,"metrics":{"Attack: AutoAttack":"51.28"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-attack-on-cifar-100","task":"Adversarial Attack","dataset":"CIFAR-100","model":"multi-resolution self-ensembles","rank_in_archive_order":2,"of":2,"metrics":{"Attack: AutoAttack":"47.85"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2408.05446","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2408.05446"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/stanislavfort/ensemble-everything-everywhere","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ETH-DISCO/self-ensembling","reach":null}],"summary":{"ran_draft_wrong":2,"unverified":1},"by_repo_kind":{"listed":{"samples":1,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"2a80220dabcb742a","entry":"conv1x1","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"2a80220dabcb742a"}},{"code_sha256_prefix":"600ff2c45e0de056","entry":"conv3x3","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"600ff2c45e0de056"}},{"code_sha256_prefix":"0d4c870ca9878659","entry":"eval_model","repo":"ETH-DISCO/self-ensembling","repo_kind":"listed","path":"2-self-ensemble/self_ensemble.py","file_url":"https://github.com/ETH-DISCO/self-ensembling/blob/HEAD/2-self-ensemble/self_ensemble.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"AGPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"0d4c870ca9878659"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}