"One in- teresting finding is that, when attacking digit recognition model trained on MNIST, GMI generates images that can be successfully recognized as the target digits by the target classifier but cannot be predicted into the target digits by the evaluation classifier and the average attack accuracy is close to 0. "
According to your setup and your recovery code, I got the complete opposite conclusion. For GMI attack, acc evaluated by Evaluator is about 0.6, but for your DMI attack, acc evaluated by Evaluator is near 0. I found all fake image generated by G is almost 6~9.
In your paper, you said
"One in- teresting finding is that, when attacking digit recognition model trained on MNIST, GMI generates images that can be successfully recognized as the target digits by the target classifier but cannot be predicted into the target digits by the evaluation classifier and the average attack accuracy is close to 0. "
According to your setup and your recovery code, I got the complete opposite conclusion. For GMI attack, acc evaluated by Evaluator is about 0.6, but for your DMI attack, acc evaluated by Evaluator is near 0. I found all fake image generated by G is almost 6~9.
Can you explain some potential issues?
Look forward to hearing from you.