Closed XiaoYaoYouUSTC closed 1 year ago
您好,您的邮件已收到!
Hi,
I think the issue comes from the fact that the images are normalized when loaded. The attacks expect input in [0, 1], and any normalization should be included in the forward pass (see also https://github.com/fra31/auto-attack/issues/13).
Hope this helps!
您好,您的邮件已收到!
Hi, @fra31 , really nice job! Thanks for releasing the code for adversarial attack. Recently, I'm using your code to generate adversarial examples and the code is below.
As you can see, when I using AutoAttack,I set the epsilon to 1 and set the norm to Linf. However, I get the result like this and the max Linf perturbation is 2.42907, larger than the epsilon I set. Counld you please give me some suggestions? Is this because I normalize the dataset and the input space is not [0,1]?