Inquiry Regarding Reproducing the Results of the Paper's Code

[Wyx20250824]

Dear Author,

Hello!

After carefully studying your paper and code, I attempted to reproduce the results you reported on the MVTec dataset. I have strictly followed the configuration instructions and code you provided. However, I have observed some discrepancies between my reproduced results and those reported in the paper. My training hyperparameters (learning rate, batch size, optimizer, etc.) were all set to be consistent with the default values in your code.

The specific differences I observed are as follows: When using the weights you provided for testing, the performance in the adversarial environment is worse than reported in the paper.

As I am very keen to understand and reproduce the excellent results of your work, may I take the liberty to ask a few questions?

1. Are there any critical hyperparameters or training techniques (such as a specific random seed, learning rate warm-up strategy, gradient clipping, etc.) that are not fully reflected in the code's default settings but significantly impact the results?
2. In the data preprocessing or loading pipeline, are there any details that might require special attention which I could have overlooked?
3. Could you please provide your environment configuration details?
4. Alternatively, have you encountered similar issues before, and do you have any suggestions for troubleshooting directions?

I apologize for any inconvenience and truly appreciate you taking the time to read this. Thank you once again for your outstanding work and for generously sharing it. I look forward to your reply; even brief hints would be of great help to me.

Best regards,

[mojtaba-nafez]

Update on Training Configuration and Checkpoints

Hi,

Sorry for the late reply, and thank you again for the careful effort you put into reproducing our results.

After re-checking our training pipeline and the released checkpoints, we discovered an inconsistency between the paper and the final released code:

• The currently released checkpoints were trained with PGD-10 adversarial training and are robust up to PGD-10.
• However, when evaluated with more PGD steps (e.g., PGD-1000), they become vulnerable.
• In the final experiments reported in the paper, we actually used PGD-50 for adversarial training.
  The paper mistakenly states that the models were trained with PGD-10.

We are now releasing a new set of checkpoints trained with PGD-50 for 1000 epochs.
(Unfortunately, we no longer have the exact checkpoints used for the results reported in the paper.)

There is some variance at the per-class level on MVTec, so individual class results may differ slightly from the paper.
However, the average performance across all MVTec classes remains consistent with the reported numbers.

🔗 MVTec – New Checkpoints

📁 https://drive.google.com/drive/folders/1zZ2A0e9CDmWoM7CfwpCRakHu7p-prtBu

If you would like to obtain stronger robustness in your own training runs, we recommend using more PGD steps than PGD-10, as this consistently leads to improved adversarial robustness in our experiments.
In most cases, PGD-30 is sufficient and more time-efficient.

Thank you again for your interest in our work and for bringing this issue to our attention.
We hope this clarification helps, and please feel free to reach out if you have any further questions.

Best regards,

[Wyx20250824]

Thanks for your reply. So, the results reported in the paper were achieved under the condition of using PGD-50 for training and PGD-1000 for testing, is that correct?

[Wyx20250824]

Dear Authors,
Hello! Thank you very much for taking the time to reply to my question regarding the reproduction of PatchGuard earlier. I also appreciate your team for open-sourcing this excellent research achievement — the adversarial robust anomaly detection and localization method you proposed has extremely high application value in industrial and medical scenarios.

Following your previous prompt that "there are errors in the parameters in the paper", I have re-adjusted the key parameters (using PGD-50 during training, PGD-1000 during testing, adjusted the number of epochs to 1000, etc.) and used your publicly available code for reproduction. However, the reproduction results still have a significant gap with those reported in the paper: in the AD task of MVTec AD, the AUROC of the adversarial scenario I reproduced is only 64.9%, which is much lower than the 71.1% reported in the paper; the gap in the AL task is also obvious (specific data: 61.2% vs. 73.8% in the paper).

Considering that there may still be uncaught key implementation details in the reproduction process (such as loss function calculation details, PGD attack parameters for adversarial training, patch-level anomaly score fusion logic, etc.), I sincerely hope you can provide:

1. The revised complete parameter configuration file, or clearly mark the correct values of the incorrect parameters in the paper;

2. The final runnable code that ensures reproducibility;

3. Key precautions during the training process (such as specific details of learning rate scheduling, the actual effective value of batch size, the initialization method of the pre-trained model, etc.).

Your help will greatly promote the subsequent research and application of this work. Thank you again for paying attention to this matter in your busy schedule! Looking forward to your reply.

Best regards,