Does all found x_final with dist <= self.epsilon is attacked successfully?
machanic opened this issue · comments
Chen Ma commented
I notice you only use dist <= self.epsilon
to indicate the success boolean. However, imaging a situation that the distance/distortion between self.x_final
and original image is below predefined epsilon, but it is classified correctly by the classifier!
Are you sure this code can deal with this situation.
https://github.com/uclaml/RayS/blob/master/RayS.py#L77
PSU Trustworthy Machine Learning Lab commented
Please note that self.x_final is initialized far away from the original (dist = infty) and is only been updated when a successful attack is founded. Therefore your imagined case never happens.