search

DSE-MSU / DeepRobust

A pytorch adversarial library for attack and defense methods on images and graphs
MIT License
995 stars 192 forks source link

To normalize or not to normalize? #33

Closed mle-els closed 4 years ago

mle-els commented 4 years ago

Hi there, I'm reading test_PGD.py and notice that you don't normalize the input images. On the other hand, attack_params['PGD_CIFAR10'] contains {'clip_max': 2.514087988136431, 'clip_min': -2.4290657439446366, which look very much like the min and max values of normalized intensities. So, is it supposed to be normalized or not?

YaxinLi0-0 commented 4 years ago

Thanks for reading and reporting this issue to us. Since we haven't normalized the training data of the victim model ResNet18 used in test_PGD.py, to make the training data and test data consistent, it shouldn't be normalized here, I would fix the config. However, if you follow the original setting in the ResNet paper, it is better to have the input normalized.