Deepfool generated perturbation pictures, but the categories have not changed about deepfool HOT 3 OPEN

The processed adversarial examples have been destroyed, no matter what method is used, the attack cannot be successful. The generated adversarial examples should not be add other operations.

from deepfool.

I got the same result with mengqid123, I think there should be some operations at the beginning of the test_deepfool.py, the operations will destroy the small change which can "fool" the image on the original image. If you set a very high overshoot in deepfool.py, you will get the same result.

from deepfool.

There may be a loss of accuracy in the normalization or inverse normalization operation, you can try to use the following operation in the inverse normalization:

tf = transforms.Compose([transforms.Normalize(mean=[-m/s for m, s in zip(mean, std)], std=[1/s for s in std]),
transforms.Lambda(clip),
transforms.ToPILImage(),
transforms.CenterCrop(224)])

from deepfool.