For example, if the gold function is untargeted classification, this means that we need to search adversarial examples (x') that satisfy F(x') != F(x). Is it correct?
If so, how can you guarantee the semantic preservation of x', I mean how can you guarantee that x' has the same label with x?
If we can guarantee this, why need after-attack accuracy? The more the adversarial examples are generated, the lower the after-attack accuracy will be.
For example, if the gold function is untargeted classification, this means that we need to search adversarial examples (x') that satisfy F(x') != F(x). Is it correct? If so, how can you guarantee the semantic preservation of x', I mean how can you guarantee that x' has the same label with x? If we can guarantee this, why need after-attack accuracy? The more the adversarial examples are generated, the lower the after-attack accuracy will be.
Thanks.