Unable to reproduce kernel smoothing results

[paulgavrikov]

Dear Authors,

We are trying to reproduce the results in your CVPR 2020 Paper "High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks". Congratulations to such a great publication!

Our understanding is, that using your method we can improve the robustness of non-adversarially trained models after training by simply blurring the convolution kernels in the first convolution layer.

However, when we apply the kernel smoothing to our pre-trained models we consequently get worse adversarial robustness than before. Contrary to the results in your paper, the robustness drops the larger we choose "rho". We have tested multiple networks without any success.
To replicate, I have prepared a small Google Colab code using a pretrained ResNet-20: https://colab.research.google.com/drive/1OV3ha7b6_0_rnwa-znkr_BwWl7dwLbDE?usp=sharing

Could you kindly take a look and help us spot any mistakes?