Update README.md

README.md

@@ -50,38 +50,24 @@ The result is an image perceptually identical to the original, with a manipulate
 [stem → s1 → s2 → s3 → head, with channel dims]
 [BlurPool replaces strided conv — note this explicitly]
 
-## Training Statistics 
+### FIRST EVALUATION (Base)
 
-*first evaluation* on CIFAR-10 test set (10,000 images). All perturbations applied at inference
-the model never saw test distribution during training.
+The first evaluation was trained for clean classification performance without the robust training procedure described above.
 
-| Perturbation | Accuracy | Drop |
-|---|---|---|
+| Perturbation | Accuracy | Drop from clean |
+|---|---:|---:|
 | Clean | 91.95% | — |
 | Resize ×0.5 (bilinear) | 59.83% | −32.12% |
 | Resize ×0.25 (bilinear) | 24.82% | −67.13% |
 | Decimate ×2 | 30.03% | −61.92% |
-| Checkerboard ε=0.03 | 75.47% | −16.48% |
-| Checkerboard ε=0.05 | 44.99% | −46.96% |
+| Checkerboard \( \varepsilon = 0.03 \) | 75.47% | −16.48% |
+| Checkerboard \( \varepsilon = 0.05 \) | 44.99% | −46.96% |
 
-*second evaluation* on the CIFAR-10 test set (10,000 images). Perturbations applied at inference only.
+This model achieves high clean accuracy, but its performance collapses under resolution loss and aliasing-sensitive perturbations. In other words, it is accurate but fragile.
 
-The adversarially trained variant was trained from scratch under a modified data distribution. 
+### SECOND EVALUATION (Robust)
 
-| Perturbation | Accuracy | Δ from 1st eval |
-|---|---|---|
-| Clean | 89.42% | −2.53% |
-| Resize ×0.5 | 85.37% | +25.54% |
-| Resize ×0.25 | 71.80% | +46.98% |
-| Decimate ×2 | 85.02% | +54.99% |
-| Checkerboard ε=0.03 | 89.43% | +13.96% |
-| Checkerboard ε=0.05 | 89.39% | +44.40% |
-
-The adversarial variant trades 2.53% clean accuracy for substantial robustness across all tested perturbations.
-The checkerboard attack —a direct null-space exploit against stride-2 downsampling — drops from 44.99% to near-clean 89.39%.
-## Robust training under information-destroying transformations
-
-The robust variant of NULA was trained from scratch under a modified training distribution. 
+The second evaluation of NULA was trained from scratch under a modified training distribution. 
 
 During training, image were stochastically exposed to resolution-degrading transformations such as:
 
@@ -92,6 +78,27 @@ During training, image were stochastically exposed to resolution-degrading trans
 The objective becomes invariance learning.
 The model is forced to reduce sensitivity to unstable fine-scale structure and form representations that survive frequency loss and sampling artifacts.
 
+| Perturbation | Accuracy | Change vs. baseline |
+|---|---:|---:|
+| Clean | 89.42% | −2.53% |
+| Resize ×0.5 | 85.37% | +25.54% |
+| Resize ×0.25 | 71.80% | +46.98% |
+| Decimate ×2 | 85.02% | +54.99% |
+| Checkerboard \( \varepsilon = 0.03 \) | 89.43% | +13.96% |
+| Checkerboard \( \varepsilon = 0.05 \) | 89.39% | +44.40% |
+
+The robust variant trades 2.53 percentage points of clean accuracy for a substantial increase in robustness across all tested perturbations.
+
+Most notably, under the checkerboard perturbation with \( \varepsilon = 0.05 \), performance improves from 44.99% to 89.39%, which is nearly clean-level behavior.
+
+## Interpretation
+
+The baseline model seemingly relies on brittle high-frequency cues. When these cues are removed, aliased, or perturbed, classification performance degrades sharply.
+
+The robust variant instead learns representations that are much less sensitive to these fine-scale disturbances. It does not become perfectly invariant to severe information destruction, but it shifts the model toward more stable, lower-frequency, structurally meaningful features.
+
+This is the central result of NULA: not merely high clean accuracy, but a substantially better tradeoff between accuracy and robustness under downsampling-related perturbations.
+
 ## Usage
 
 Nula is hosted on the HuggingFace Hub and can be loaded directly via the transformers library. 
@@ -120,30 +127,19 @@ print(f"Label: {model.config.id2label[predicted_class]}")
 Input tensors should be shape (B, C, H, W).
 
 ## Architecture
+```
+stem → s1 → s2 → s3 → global pool → head
+```
 
-NULA uses the following structure:
-
-\[
-\text{stem} \rightarrow s_1 \rightarrow s_2 \rightarrow s_3 \rightarrow \text{global pool} \rightarrow \text{head}
-\]
-
-For the robust model reported here, the channel dimensions are:
-
-\[
-(128, 256, 512)
-\]
-
-with a classifier hidden dimension of:
-
-\[
-512
-\]
+| Component | Details |
+|---|---|
+| Stem | 3 → 128, Conv3×3, BatchNorm, SiLU |
+| Stage 1 | 128 → 128, residual, no downsample |
+| Stage 2 | 128 → 256, residual, BlurPool downsample |
+| Stage 3 | 256 → 512, residual, BlurPool downsample |
+| Head | GlobalAvgPool → Linear(512, 512) → SiLU → Dropout(0.3) → Linear(512, 10) |
 
-- **Stem:** \(3 \to 128\) convolution, BatchNorm, SiLU
-- **Stage 1:** residual block at constant spatial resolution
-- **Stage 2:** residual block with anti-aliased downsampling, \(128 \to 256\)
-- **Stage 3:** residual block with anti-aliased downsampling, \(256 \to 512\)
-- **Head:** global average pooling, linear layer, SiLU, dropout, final classifier
+SE blocks applied at each stage with reduction factor 16.
 
 ## Citation