Adversarial patch size for evaluating certified patch robustness on ImageNet

[HashmatShadab]

Hi

Can you please verify the adversarial patch size used for evaluating ImageNet trained models (b=19) in Table 1 of paper: 1% pixels: 23x23 2% pixels: 32x32 3% pixels: 39x39

[HashmatShadab]

kindly provide an update on this when you get the time. And if you can specify the arguments used to reproduce results in Table using the pre-trained weights.

[Hadisalman]

Apologies for late reply. Yes this is correct!

Here is an example script to evaluate ViT-B (b=19) against 32x32 patches (2% pixels):

python src/main.py \
      --dataset imagenet \
      --data /tmp \
      --arch deit_base_k19 \
      --out-dir OUTDIR \
      --exp-name demo \
      --batch-size 128 \
      --adv-train 0 \
      --freeze-level -1 \
      --resume \
      --eval-only 1 \
      --certify \
      --certify-out-dir OUTDIR_CERT \
      --certify-mode col \
      --certify-ablation-size 19 \
      --certify-patch-size 32