Closed paullintilhac closed 2 years ago
this is done. It turns out we use the current label as a target, and set targeted=false in the carlini l2 attack class, which then uses the pre-softmax output in the constrained optimization as a measure of how close it is to misclassification.
this is done. It turns out we use the current label as a target, and set targeted=false in the carlini l2 attack class, which then uses the pre-softmax output in the constrained optimization as a measure of how close it is to misclassification.