LBFGS image quality about foolbox

[wielandbrendel]

@neale thanks for the report! Did you check that it's not just channel flipping? The resnet expects channels to be BGR (not RGB as usual), that's why we are feeding image[:,:,::-1] to the attack. As a result, the adversarial you get should also invert channel ordering before using plotting them. Also, is the size of the perturbations really different? If yes, may I ask you to provide us with the images as numpy arrays (i.e. original image and the perturbations you get with foolbox lbfgs and the other lbfgs implementation)?

[neale]

I tried just changing it back to RGB, and I get a difference, though not what I think we're looking for.
I just applied adversarial = adversarial[:, :, ::-1] before plotting. I get this image

I hope its something embarrassingly simple on my end. I know everyone (scipy, the other implementation) is using an old Fortran lib for LBFGS so I don't think anything is different there.

I'll update this with the numpy arrays when I get them.

[neale]

I got it. There isn't any difference if you take the norm of the perturbations. The nice looking image from the paper implementation is a gradient map taken from different layers, not a per-pixel distance that you have.
For future reference, the LBFGS adversarials sometimes look better (http://imgur.com/a/lM5Px) if you perform adversarial[:,:,::-1]/255, but sometimes they look fine anyway.
Thanks a lot for the help,

[wielandbrendel]

I am glad you could solve this issue - thanks for digging! 👍