search

Harry24k / adversarial-attacks-pytorch

PyTorch implementation of adversarial attacks [torchattacks].
https://adversarial-attacks-pytorch.readthedocs.io/en/latest/index.html
MIT License
1.79k stars 337 forks source link

[BUG] The implementation of eps-ball in MI-FGSM #182

Closed ZhongliangGuo closed 2 months ago

ZhongliangGuo commented 2 months ago

✨ Short description of the bug [tl;dr]

whether use eps-ball for MI-FGSM

💬 Detailed code and results

I just double checked with the pseudo code of the MI-FGSM and other implementaion, it seems like the MI-FGSM didn't use a clamp in eps-ball, but in the implementation of this repo used it.

delta = torch.clamp(adv_images - images, min=-self.eps, max=self.eps)

rikonaka commented 2 months ago

Hi @ZhongliangGuo , I have just checked the MI-FGSM code, and according to the code link given in the original paper, it embodies this clamp process in the code

https://github.com/dongyp13/Non-Targeted-Adversarial-Attacks/blob/5c68162e05de7afed2e3d33115df43e2a7a1c3da/attack_iter.py#L211

https://github.com/dongyp13/Non-Targeted-Adversarial-Attacks/blob/5c68162e05de7afed2e3d33115df43e2a7a1c3da/attack_iter.py#L188

the essence of this is to restrict the adversarial samples to natural samples within epsilon, and the code in torchattacks is actually do the same job as original code.

But the mi-fgsm code does have some problems with the code logic, which I've changed.