DEGRADE, THEN ATTACK: COMPOSITION ORDER IS PART OF THE THREAT MODEL

Inputs reach a deployed classifier after lossy transport or degradation, and may also have been attacked. Evaluating a model against both means composing two operators, which means choosing which comes first. Across 300 pairs of a CIFAR10 model and a corruption type, degrading an image and then attacking it leaves accuracy a median of 12.40 points below attacking it and then degrading it, with the sign consistent on all 20 models and all 15 corruption types. Splitting the difference isolates the one term whose sign is predictable in advance, a recovery of accuracy on inputs already attacked. At the severity we evaluate it is −1.73 points with a confidence interval excluding zero, and it falls further as the corruption strengthens, so its sign is a property of the strength rather than of degradation. The effect is carried by the other term, that a corrupted image is easier to attack, and it tracks boundary geometry rather than the frequency-band overlap that is a common account of this interaction. Most of the gap is attacker information: on the 5 differentiable corruption types, an attacker told the realised corruption but required to commit before it recovers 89.4% of the gap, or 70.3% dropping cells with an unstable small denominator. An exploratory split puts this at 95.2% for additive noise against 42.1% for contrast and blur, which contract the perturbation rather than translating it. An attacker optimising over the corruption distribution lands between the two orders, making degrading before attacking the conservative endpoint. On native 1000-way ImageNet the effect is +15.50 points across 10 robust models. The two orders are two threat models differing in when the attack happens and in what the attacker sees, so a robustness number for a composed threat is under-specified by 12 points unless it states which order it measured.