val-iisc / gama-gat Goto Github PK

The Guided_Attack() function is not correct for multi step attacks (step>1).
Between steps, one has to clamp x_adv between (x_natural - eps, x_natural + eps).

I propose to add:

def Guided_Attack(model,loss,image, **natural_image**, target,eps=8/255,bounds=[0,1],steps=1,P_out=[],l2_reg=10,alt=1): 
    tar = Variable(target.cuda())
    img = image.cuda()
    eps = eps/steps 
    for step in range(steps):
        img = Variable(img,requires_grad=True)
        zero_gradients(img) 
        out  = model(img)
        R_out = nn.Softmax(dim=1)(out)
        cost = loss(out,tar) + alt*l2_reg*(((P_out - R_out)**2.0).sum(1)).mean(0) 
        cost.backward()
        per = eps * torch.sign(img.grad.data)
        adv = img.data + per.cuda()
        **img = torch.min(torch.max(adv, natural_image - eps), natural_image + eps)**
        img = torch.clamp(adv,bounds[0],bounds[1])
    return img

1. The used ResNet is is different from the previous work, it has an extra layer ReLU?
2. Whether the results reported in the paper are optimal or final checkpoints?

Hi,
Do you have any plans to share your wideresnet-34-10 network codes.

i have downloaded your pretrained wrn-34-10 .pkl but can not load successfully due to the mismatching keys.

so can you share your wrn-34-10 network files?

Hi, I find there is something confusing in the implementation of GAT.
As shown in the Algorithm S1 of the original paper, the single-step attack focuses on the combination of the CE loss and the regularzation loss, but in the implementation code, the single-step attack only focuses on the CE loss, i.e., the function FGSM_Attack_step used in training.