search

Trustworthy-AI-Group / BPA

[NeurIPS 2023] Rethinking the Backward Propagation for Adversarial Transferability
MIT License
3 stars 2 forks source link

Something wrong with the attack success rate for target attacks based on ResNet-50 backbone #2

Closed callous-youth closed 6 months ago

callous-youth commented 7 months ago

Hi! First, thanks for publishing the official code for your excellent work! I have run the scripts to replicate the results in Table 4 with targeted attacks with the following parameters (as described in the paper): --epsilon 0.03 --sgm_lambda 1.0 --niters 300 --method max_relu_silu_pgd --batch_size 25 --save_dir data/imagenet/targeted_max_relu_silu_pgd_niter300_alpha0.0039 --device_id 0 --imagenet_val_dir E:/val --model_name resnet50 --alpha 1/255 --target_attack

Whereas, the success rates seem much too lower than the results in Table.4.

cuda:0 inceptionv3: 0.92 inception_resnet_v2: 1.52 densenet: 7.68 mobilenet: 2.98 pnasnet: 2.64 senet: 3.52 ens3_adv_inc_v3: 0.18 ens4_adv_inc_v3: 0.08 ens_adv_inception_resnet_v2: 0.04 source_model: 99.82

Do you have any idea about this problem? Or could you please provide the right scripts to replicate the results in Table.4?

xiaosen-wang commented 6 months ago

Unlike untargeted attacks, we adopt epsilon=16/255=0.06 for targeted attacks in our paper.