Investigate gradients that conceal accessible failures

Quantization makes an input-output map piecewise constant. Inside a quantization cell, an exact derivative can be zero even though a small feasible move crosses the next cell boundary and changes the decision. A straight gradient step starting strictly inside the cell may then remain stationary. This is a limitation of that search mechanism, not a contradiction in calculus. The local derivative describes an infinitesimal change; the threat may permit a finite move beyond the flat cell.

Numerical saturation produces another failure mode. A softmax or exponential calculation may round into a region where a particular loss gradient is unhelpful even though the underlying logit margin still changes. Inspect stable logit-based objectives and finite values before accepting a plateau. Also verify that the model wrapper has not accidentally detached its input or disabled gradients. An evaluator should be able to reproduce a simple known gradient through the same execution path before trusting a large attack benchmark.

Compare one-step and iterative variants, multiple losses, step-size sweeps, random restarts, transfer candidates, and an appropriate gradient-free search. A stronger-capability white-box test that consistently underperforms a simpler transfer test is a reason to inspect the gradient path, although finite optimization budgets can also explain it. A finite random search finding a valid failure is decisive for that example; random search finding nothing is only limited search evidence.

Vary the distortion budget carefully. The exact feasible sets are nested as epsilon grows, so true worst-case robust accuracy cannot increase when the classifier and validity definition stay fixed. Independently rerun finite attacks can nevertheless produce nonmonotone estimates because they search different candidates. Preserve prior feasible candidates at larger budgets to make the aggregate evidence monotone where set inclusion applies. Do not attribute every jagged attack curve to masking without ruling out candidate bookkeeping and sampling variability.

For each newly found failure, check the original norm, input domain, output rule, label, and model version. A derivative workaround that silently bypasses the defense cannot establish failure of the defended pipeline. Conversely, a valid forward-evaluated failure needs no accurate gradient to be a counterexample. Separate feasibility errors from search errors in the report so a successful-looking but invalid candidate cannot contaminate the claimed robust-accuracy bound.

Document diagnostic results as evidence rather than a binary masking verdict. Useful records include finite-difference probes, gradient norms, loss scaling, best-so-far attack traces, and differences between exact and approximate backward paths. Avoid concluding that a defense is robust simply because common masking symptoms were absent. A smooth well-behaved gradient can still lead a finite attack to a poor local optimum, and a nonsmooth model can have genuine robustness under a separately proved certificate.