Bottleneck ViTs for superposition-driven adversarial vulnerability

A replication study by Second Look Research, supervised by Zephaniah Roe.

80 vision transformers trained from scratch for an independent replication of Stevinson et al., Adversarial Vulnerability from Interference Between Features in Superposition (arXiv:2510.11709v2), Section 5.

The paper's claim is that adversarial attacks exploit interference between class features sharing a low-dimensional representation. The intervention is a linear bottleneck of width m in the classification head of a k-class model: as m/k falls, classes are forced into superposition, and input-space attack profiles come to track head interference (ρ̄). These checkpoints are the trained models behind that sweep, released so the geometry can be re-measured without retraining.

Contents

adv-train models share the bottleneck recipe but are trained with PGD adversarial training at ε=2/255, 7 steps.

<family>/<dataset>/m<M>/seed<N>/
    model.safetensors   # fp32 weights, 21.3M params
    config.json         # training recipe, final metrics, provenance
    history.json        # per-epoch lr / val_loss / val_acc (300 entries)

Architecture

ViT trained from scratch: patch 4, embed dim 384, depth 12, 6 heads, MLP dim 1536, CLS pooling. The head is encoder: Linear(384 → m) then decoder: Linear(m → k), both with bias. Decoder rows are the class vectors w_c whose pairwise cosines define the interference matrix.

Normalization is a module inside the model, so inputs are pixel-space [0,1] and ε is specified in /255 directly.

Loading

The weights need the model class from the replication repo (superposition-replication, commit 55f6f0e):

import json
from dataclasses import replace
from safetensors.torch import load_file

from img_classifiers.core.config import config_for
from img_classifiers.core.data import stats
from img_classifiers.core.model import build_bottleneck

d = "bottleneck/cifar10/m2/seed0"
cfg = json.load(open(f"{d}/config.json"))["recipe"]
model = build_bottleneck(replace(config_for(cfg["dataset"]), m=cfg["m"]),
                         *stats(cfg["dataset"]))
model.load_state_dict(load_file(f"{d}/model.safetensors"))
model.eval()

Clean test accuracy

Mean ± std over 5 seeds, in percent.

Adversarial training raises clean accuracy at tight bottlenecks (54.00 → 78.39 at m/k=0.2), inverting the usual robustness/accuracy tradeoff. At m/k=0.2 the standard model is capacity-starved and underfits; AT appears to act as a regulariser there. Treat this as an observation from these runs, not an established result.

Caveats

• STL-10 is deliberately absent. The paper's STL-10 rows are ResNet-50, not ViT (App. D.1: 5,000 labelled images are too few to train a ~30M-parameter ViT from scratch), and our from-scratch ViT configuration for that dataset was not reliable. Publishing those weights would invite an invalid comparison.
• These are replication artifacts, not the authors' models. The authors' code release does not publish checkpoints. Where our numbers and the paper's differ, neither is automatically the error.
• Tiny-ImageNet derives from ImageNet and carries its research-only terms. These weights are released as research artifacts.
• Accuracy is on each dataset's own test split; models are small and trained from scratch, so absolute numbers are well below pretrained baselines by design.

License

MIT, covering the weights and the accompanying code. The training datasets retain their own licenses and terms.

Attribution

These checkpoints were produced by Second Look Research, which conducts independent replications of published work, under the supervision of Zephaniah Roe. Please attribute the models to Second Look Research rather than to the original authors — the paper is the object of the replication, not its source.

The work being replicated is Stevinson, Prieto, Barsbey and Birdal, Adversarial Vulnerability from Interference Between Features in Superposition (arXiv:2510.11709); cite that paper for the claims, and this repository for the replication artifacts.