Giters

Trusted-AI / adversarial-robustness-toolbox

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

Home Page:https://adversarial-robustness-toolbox.readthedocs.io/en/latest/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

`ActivationDefense` and `SpectralSignatures` expect flattened activations

f4str opened this issue · comments

commented

Describe the bug
The ActivationDefense and SpectralSignatures defenses call the get_activations() method on a classifier, but do not flatten it. In many cases, the final hidden layer is the output of a convolutional layer which is not flattened. This will cause the defense to only be run using the first channel of the convolution rather than the flattened output.

To Reproduce
Running either of these defenses using a PyTorch ResNet-18 model will use the final hidden layer output which is a convolution layer and therefore will only use the first channel.

Expected behavior
After calling the get_activations() method, both of these defenses should flatten the output before applying their respective algorithm.

Screenshots
N/A

commented

Hi @f4str Sounds good!