Standard classifiers are expected to beat adversarially robust ones on clean images. We find clean ImageNet images where the opposite holds: the standard model is wrong and the robust model is right. On these natural jammers, high-frequency patterns tied to the image’s layout mislead the standard model. Removing them, or shifting the image slightly, brings the right answer back, yet the share of jammed images stays the same.
We run a standard ResNet-50 and an adversarially trained ResNet-50 on every ImageNet validation image and sort the images by which model is right.
| Robust model right | Robust model wrong | |
|---|---|---|
| Standard model right | Common33,071 (66.1%) | Spurious5,002 (10.0%) |
| Standard model wrong | Jammed2,140 (4.28%) | Uninformative9,787 (19.6%) |
Every robust model we tried finds jammed images, but each finds different ones. Across 17 robust models (ResNets, WideResNets and ViTs), the Jammed Set covers 3.1%–5.3% of the data. Between architectures, the jammed images overlap little (IoU typically below 0.15): which images are jammed depends on the model.
Less information, better answers. A low-pass filter raises accuracy on jammed images from 0% to 31.8% while Common images stay at 85.1%; spurious images, which rely on high-frequency shortcuts, collapse. Zooming in by a few percent has the same effect.
The cue only works in its own image. Grafting a jammer’s high frequencies onto a Common image passes on its wrong label in only 0.17% of cases, while reassembling the jammer from its own components keeps the wrong prediction 99.9% of the time. The misleading signal is not harmful by itself; it depends on being aligned with its host image.
Cropping a few pixels off the edges breaks many locks. If jamming were a defect of particular images, the Jammed Set should shrink. It does not.
| Edge crop | Jammed images | Overlap with the original set (IoU) |
|---|---|---|
| none (original) | 2,140 | 1.00 |
| 2% | 2,289 | 0.46 |
| 4% | 2,268 | 0.42 |
| 6% | 2,276 | 0.38 |
| 8% | 2,291 | 0.35 |
Individual jammers are fragile; jamming as a whole is not. A 2% crop moves about one third of the jammers out of the Jammed Set, and about as many new images take their place. The particular images change, but the share of jammed images stays about the same.
git clone https://github.com/jiamingzhang94/natural-jammers cd natural-jammers pip install -e . python download_weights.py --lens resnet50_l2_eps1 python build_partition.py --data /path/to/imagenet/val --lens resnet50_l2_eps1 python evaluate.py --data /path/to/imagenet/val --tasks lpf zoom graft substitution
The robust ResNets and WideResNets are the public MadryLab checkpoints; our robust ViTs are on Hugging Face.
@inproceedings{zhang2026natural,
title = {Natural Jammers: When Non-Robust Features
Become Antagonistic},
author = {Zhang, Jiaming and Zhang, Fuyao and
Xie, Pengjun and Lim, Wei Yang Bryan},
booktitle = {Advances in Neural Information Processing Systems},
year = {2026}
}