Open jS5t3r opened 2 years ago
Looks fine to me. As sanity check you can run apgd-ce
as last attack by modifying the order in the self.attacks_to_run
list.
On page 4 of this publication: https://arxiv.org/abs/2112.01601 Figure 3 shows an examination where the classifier is trained on 1000 classes. (standard configuration: https://github.com/adverML/auto-attack/blob/aec817234bc565004fe3e9bee9afe41e931ca9ad/autoattack/autoattack.py#L277) Figure 4 shows an examination where the classifier is trained on 4 classes. I used this configuration: https://github.com/adverML/auto-attack/blob/aec817234bc565004fe3e9bee9afe41e931ca9ad/autoattack/autoattack.py#L293
I am just wondering, that the plots should look more similar.
Follow up from https://github.com/fra31/auto-attack/issues/76
Since I have a model trained in only 4 classes I adapted the number of targets
t
.I changed this block: https://github.com/fra31/auto-attack/blob/6482e4d6fbeeb51ae9585c41b16d50d14576aadc/autoattack/autoattack.py#L265 to
where
t = classes - 1 = 4 - 1 = 3
, so that I dont get any warning.It seems that APGD-CE is creating most perturbations.
Well, I think that I am not doing something wrong, right?