When I run fgsm to attack the model with defense-GAN, I found that defense-GAN indeed defend the attack. However, the distortion between benign images and adversarial images is zero, which means that the adversarial examples are the same as benign examples. Is there something wrong? Or fgsm could not get the gradient because the existence of defense-GAN?
When I run fgsm to attack the model with defense-GAN, I found that defense-GAN indeed defend the attack. However, the distortion between benign images and adversarial images is zero, which means that the adversarial examples are the same as benign examples. Is there something wrong? Or fgsm could not get the gradient because the existence of defense-GAN?