search

google-research / selfstudy-adversarial-robustness

Apache License 2.0
117 stars 22 forks source link

Blurring function in blur defense? #3

Open dxoigmn opened 3 years ago

dxoigmn commented 3 years ago

It looks like the blur function in the blur defense and training code, https://github.com/google-research/selfstudy-adversarial-robustness/blob/15d1c0126e3dbaa205862c39e31d4e69afc08167/training/train_blur.py#L41-L45

, is functionally equivalent to:

np.pad(x, [(0, 0), (1, 0), (1, 0), (0, 0)]) / 4

At least, x_pad[:, :1] and x_pad[:, :, :1] are the zero vectors. I assume this was meant to be a box blur and those offsets should be changed accordingly.

carlini commented 3 years ago

You're completely correct. The intent was to have

x_pad = (x_pad[:, 1:] + x_pad[:, :-1])/2

instead of

x_pad = (x_pad[:, :1] + x_pad[:, :-1])/2

which would actually do a blur, instead of whatever weird no-op this current thing does.