Validation on adversarial samples for OOD detection about deep_mahalanobis_detector HOT 1 OPEN

I also have some questions about this experiment ("Comparison of robustness" part of Section 3.1):

1. At this point should we assume that the M(x) models have already been "trained" in that we have already computed $\mu_c$ and $\Sigma$ for each layer using only Cifar10-Train-Clean data?

2. When training the feature ensemble weights do you use Cifar10-Test-Clean as the positive samples and Cifar10-Test-FGSM as the negative samples? Or, do you train the ensemble weights using Cifar10-Train-Clean and Cifar10-Train-FGSM data?

3. What epsilon do you use for FGSM step?

4. How critical is the input preprocessing step to this method? Is the performance of the feature ensemble still pretty good when we do validation on FGSM samples but do not do the input preprocessing step?

Thanks in advance.

from deep_mahalanobis_detector.