Closed CNOCycle closed 1 year ago
Hi,
thanks for the detailed analysis, I think I never used it for non-squared images. I'd say that the minimal change to handle such case could be clipping the value of s
, e.g. s = min(s, min(h, w))
. This would preserve the square-shaped updates and be compatible with the rest of the algorithm.
The drawback could be that if e.g. $h \ll w$ only updates with small area are allowed, meaning a slower progress of the optimization at the beginning of the algorithm. Then, another option could be to roughly preserve the number of pixels $s^2$ with a rectangular update (for example mimicking the aspect ratio of the image), but this would require a bigger change in the code.
Would the first solution work for you?
Hi,
Thanks for your quick reply. Since function p_selection
will decrease p
gradually, the constraint I mentioned generally appears at the beginning. Currently, my workaround is as same as your first proposed solution. However, if huge modifications are not allowable, I will suggest that square attack should give a aspect ratio warning to users when detecting non-square images.
Hi authors,
I encountered an unexpected error when I was running L-2 version of Square attack. After my detail investigation, I would guess that the problem may be caused by an improper configuration
s
.The parameter
s
is configured at line line 250, 335 and 435 for L-inf, L-2 and L-1 version respectively.Then, square attack randomly selects
vh
andvw
immediately.The function
random_init
is defined around line 117:The parameter
high
should be larger thanlow
literally. However, this case may not always be true.If $s>h$, then
low > high
. The following is the detailed explanation: Without loss of generality, we assume thatw > h
, , wherew
andh
are the given image's input size. Sincep=0.8
by default andn_features = c * h * w
, we know that $s=int(round((\sqrt{0.8wh}))$.The equation $s>h$ can be simplified as follows: $s>h$ -> $\sqrt{0.8wh}>h$ -> $0.8w>h$
Or we can assume that
w=500
. We immediately have a constraint $int(round((\sqrt{0.8*500h})) > h$ -> $20\sqrt{h} > h$ -> $400 > h$.This result suggests that square attack only works for images have specific aspect ratio. For CIFAR10 and CIFAR100, the above constraint does not hold, but images on ImageNet have vary aspect ratio.
The following is the minimal test case:
The following is the output for a normal case (command
python test_square_attack.py --img_w 401
):The following is the output for an invalid case (command
python test_square_attack.py --img_w 375)
:The following is the output for a corner case (command
python test_square_attack.py --img_w 400)
: