Comments (5)
It doesn't really matter since each image leads to a separate optimization problem. We can share randomness (i.e. in this case: window position) over multiple optimization problems that are solved in parallel, that's totally fine.
from square-attack.
@max-andr Does it mean that L-inf norm attack can also sample the same window over different images inside a mini-batch, instead of sampling separately?
from square-attack.
Yes, that would be totally fine for the Linf attack as well.
However, note that we decided to have a separate loop for Linf attack over each image:
https://github.com/max-andr/square-attack/blob/master/attack.py#L226
since it can happen (especially at later stages of the optimization process when the squares are small) that we sample an update which doesn't change the perturbation, and thus we would waste a query for some images. To prevent this, we iterate over each image separately and resample the color of the square-shaped update until we ensure that it leads to a new perturbation. Since we anyway had to implement a loop here, we also sample separately the window position for each image. But this is anyway not an important part.
from square-attack.
@max-andr How to set epsilon in CIFAR-10 dataset (32x32x3) for L2 norm attack? Is the number of 5 too large?
from square-attack.
For L2-norm, eps=0.5 is a reasonable choice, e.g., see RobustBench: a standardized adversarial robustness benchmark: a standardly trained model has 0% robust accuracy under eps=0.5 perturbations.
from square-attack.
Related Issues (13)
- Where does this paper published on? HOT 4
- L2 targeted attack taking very much query with low success rate HOT 2
- Bugs when running Linf attack on pt_inception HOT 4
- 1.Hi, I would like to know what do you refer to as Rademacher distribution in A.4, and why HOT 2
- Why the value of epsilon in step 4 in Algorithm 2 needs to be multiplied by 2? HOT 3
- Can you provide the code of defensive model in your paper's section 5.2 for me? HOT 6
- Why do you use two windows in L2 norm attack? I don't understand the mass moving (Fig.2) HOT 10
- Why the loss type is margin_loss in untargeted attack, but cross_entropy loss in targeted attack. HOT 2
- Why the perturbation with its value equals the maximum bound of Linf and L2 attack should be used in update? HOT 4
- The Linf version HOT 2
- FileNotFoundError: '/scratch/maksym/imagenet/val_orig' HOT 1
- Results of MNIST and CIFAR10 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from square-attack.