An evasion run driven from an adversarial-robustness library finishes and reports zero successful adversarial examples at the configured perturbation bound. Before you write 'the model is robust', what checks do you run on the attack configuration and the model wrapper itself?

### Two failure modes, one output A robustness evaluation has exactly two ways to report zero successful adversarial examples: the model held, or your instrument never fired. The library cannot distinguish them for you. A gradient that never reached the input, a loss pushed in the wrong direction, a label array misaligned with the batch, and a genuinely hard target all return the same empty result set. The second class of cause is far more common than the first in a freshly written harness, so a zero is treated as a bug report against your own setup until it has survived a ladder of deliberate attempts to make the attack succeed. ### 1. Force a success Relax the bound to an absurd value, or run an unconstrained attack, on ten or twenty examples. A working evasion setup drives almost everything to misclassification when the perturbation is effectively unlimited. If it does not, the model is not robust — it is unreachable, and the fault is plumbing. Suspects, in the order they usually bite: gradients not flowing to the input, because the wrapper broke the graph or the input tensor never had gradients enabled; the objective being maximised in the wrong direction, or against labels misaligned with the batch; and the model left in training mode, so dropout and batch-norm running statistics make every call nondeterministic. This check costs seconds to minutes on a handful of examples — the cheapest rung on the ladder, and the one most often skipped. ### 2. Check the wrapper contract These libraries reach your model through an adapter that declares what space the attack is operating in. In ART, `PyTorchClassifier` takes `clip_values`, which fixes the valid input range, and `preprocessing`, a mean-and-standard-deviation pair the wrapper applies itself. Get the division of labour wrong and the bound is enforced in a space your report does not describe: the attack perturbs an already-normalised tensor while your epsilon was quoted in raw pixel units, or it perturbs raw input that your own pipeline then rescales, shrinking the perturbation away before the model ever sees it. Either way, the effective search is not the one written up. Verify empirically, not by reading code: take a produced example, subtract the original, and measure the difference **in the units and the norm your threat model uses**. It should sit at or just under the configured epsilon. Orders of magnitude off in either direction is a wrapper-contract mismatch, not a modelling result. ### 3. Sweep the effort Raise iterations and restarts together on a subset and plot success against effort. A curve still climbing at your original configuration means the number you were about to publish measured your compute budget. Note that with ART's `num_random_init` at its default of zero you never had a random restart at all, so the original run was a single deterministic draw. ### 4. Cross-check with an attack that uses no gradients Attack the same examples at the same bound with something that never touches a gradient: random perturbations sampled at the bound, or examples crafted against a different model and transferred. If the gradient-free baseline beats your gradient attack, the gradient signal is not usable on this model. That is a finding about your evaluation instrument, and it belongs in the report as such — escalated to the specialists who study that class of defence behaviour — rather than being written up as a safe model. ### What the ladder costs All four rungs run on a subset, typically tens of examples, so the whole ladder is a small fraction of the headline run's compute — usually well under an hour of engineer-supervised GPU time. The expensive part is the effort sweep, and even that is bounded by running it on a subset rather than the full evaluation sample. Against that, the cost of skipping it is a published robustness claim that a reviewer can overturn by re-running with one extra flag. ### What the surviving zero is then allowed to say Even a zero that clears every rung is narrow. It says: *this attack family, at this effort, at this bound and norm, on this sample of inputs, through this wrapper, found nothing.* Write it in exactly those terms and attach the forced-success artefact, because that artefact is the only evidence anyone has that the instrument was capable of firing. A negative result whose instrument was never tested is not a weak result — it is not a result.