An attack with the perturbation budget removed still leaves a defended fraud model at 15% robust accuracy - what do you conclude?

## Why an unbounded run is a control and not an attack Every robustness number is quoted inside a perturbation set: a norm and a radius that together say how far an input is allowed to move. Most of the evaluation happens at a small radius, where the interesting question lives. The unbounded run exists for a different purpose: it is a **sanity check with a known answer**. If the attacker may change the input arbitrarily, the problem stops being adversarial at all. They can construct a transaction that is genuinely a decline - or genuinely an approve - and the model, being a reasonable classifier, will classify it that way. Success approaches total by construction. This is not a claim about any particular attack; it follows from the model being accurate on real inputs of the target class. So the unbounded row is the row you already know the answer to, and its value is entirely diagnostic: it tells you whether the harness can reach an answer it must be able to reach. ## Reading a residual 15% When 15% survives, the search failed to move the input into the target class even with unlimited freedom. There is no radius at which such a search is trustworthy, because the small-radius problem is strictly harder than the one it just failed. Two consequences follow, and the second is the one people miss: 1. The 15% is not robust accuracy. It is the fraction of inputs this optimiser could not move, at any distance. 2. **Every other number from the same harness is void**, including the impressive small-radius figure that prompted the review. They were produced by the same broken search. The conclusion to write down is about the evaluation, not the model. Reporting *the model retains 15% accuracy under unbounded attack* would be a serious error of direction: it attributes to the model a fact about the optimiser. ## What usually causes it The unbounded control fails for the same reasons the bounded runs did: the defence made the direction the search steers by uninformative. Concretely, a non-differentiable or discontinuous step in front of the model means the local reading no longer describes the composed function; a randomised step means each reading is a single draw and small differences drown in the spread; a step that saturates means the reading is numerically dead and the search does not move at all. It can also be a plain harness bug - an input clipped back into a valid feature range after every step, so the *unbounded* run was never unbounded. Rule that out first, because it is the cheapest explanation and it is common. ## The triage, in order 1. **Verify the control was really unconstrained.** Check for range clipping, validity constraints on categorical fields, or a projection step left enabled. A fraud model over tabular features has many places where a legitimate-looking constraint silently bounds the run. 2. **Vary seeds.** If the residual moves a lot between runs, there is randomness in the pipeline and the objective must be averaged over it before any number is read. 3. **Spend budget.** Ten times the steps and several restarts. Flat response confirms the direction is uninformative rather than the problem being hard. 4. **Run a strictly weaker adversary as a floor.** A search that never reads a gradient and only sees the returned decision. Whatever it achieves is a lower bound on the model's true failure rate, and if it exceeds the white-box row the ordering has inverted, which is the same diagnosis arriving by a second route. 5. **Re-run bounded, adaptively, and report that.** With the radius, the norm, the access assumption, the step and restart counts, and the seeds beside it. ## What you say to the room The uncomfortable part is that the review's output is *we cannot currently state a robustness number for this build*, which is less satisfying than either a good number or a bad one. It is also the only defensible output. The secondary finding - that the defence multiplies the cost of running an attack - can be stated honestly and separately, as cost, because that part is real: an adversary who has read the defence pays more evaluations to get where they were going. They pay it once. ## The general principle worth carrying An evaluation should include at least one run whose answer you already know. When that run returns the wrong answer, the finding is about the instrument, and no other number from the same instrument may be quoted until it is fixed. This is the ordinary discipline of a control, and adversarial robustness evaluation is unusually easy to run without one because the headline attack always produces a number that looks like a result.