l0 not implemented correctly

[carlini]

l0 not implemented correctly

[carlini]

I believe this is what I want. If you have valid.shape == (pixels, channels) and you write valid[e] = 0 then numpy will perform the operation valid[e,:] = 0.

Did this code crash for you or somehow not give the solution?

[gehuangyi20]

I confirm that numpy will perform valid[e,:] = 0. Thanks!

Since I have added code to check whether the attack succeeds or not, I do not know whether the original code will crash or not. But, both l2 and li attack have the code to check whether the attack succeeds or not. I do not see any reason why not adding such code in l0 attack. Also, without checking, we do not know whether the found solution works or not.

[carlini]

Yeah, so for some reason I decided in the l0 attack that when it finds a valid solution, to restore the state which is known to be correct.

nn_robust_attacks/l0_attack.py

Lines 162 to 163 in d2067d5

	# it worked previously, restore the old value and finish
	self.sess.run(set_modifier, {assign_modifier: oldmodifier})

I don't remember why I did it this way, but because I do it, it's not necessary to insert the compare call. (Although putting it in definitely wouldn't be harmful.)

[gehuangyi20]

Thank you for your clarification. I think your assumption is if the loss value is small enough, then it implies the attack will be successful. I add the validation check in my code since I want to do the attack in parallel, and the validation check is a safeguard.