snu-mllab / parsimonious-blackbox-attack Goto Github PK

I am confused a problem related to the number of queries computation.
Because you feed a batch of images with batch size of bend-bstart to the target model, located in https://github.com/snu-mllab/parsimonious-blackbox-attack/blob/master/cifar10/attacks/local_search_helper.py#L238

However, the number queries is calculated based on num_queries += success_indices[0] + 1, rather than num_queries += bend - bstart, which is located in https://github.com/snu-mllab/parsimonious-blackbox-attack/blob/master/cifar10/attacks/local_search_helper.py#L246
Why? Is this bug?

I cannot find the code where the generated adversarial image must be resided inside epsilon-ball.
How do you implement that?

I check your code, it seems that this code only support attack a single image, and if I have 1000 images in total. I have to attack them one by one, this is slow.
Does the code support attacking a mini-batch of images at the same time?

I notice your paper only writes the experiment of L-inf norm attack? Does this attack algorithm limit to L-inf norm?

Wonderful code! I have a small question that why another batch is used in local_search_helper.py:

It seems this isn't mentioned in the paper. Is this for not making priority_queue too big that too many queries will be needed for local search on one batch?