greentfrapp/boundary-attack

Implementation of the Boundary Attack algorithm as described in Brendel, Wieland, Jonas Rauber, and Matthias Bethge. "Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models." arXiv preprint arXiv:1712.04248 (2017).

boundary-attack's Issues

What does "sample[..., 0] += mean[0] ...sample = sample[..., ::-1].astype(np.uint8)" do in boundary-attack-resnet.py?

Why there is "
sample[..., 0] += mean[0]
sample[..., 1] += mean[1]
sample[..., 2] += mean[2]
sample = sample[..., ::-1].astype(np.uint8)
"
in line56-59 in boundary-attack-resnet.py?I can't understand.

the equation perturb[i] -= np.dot(perturb[i], channel) * channel? can i ask this meaning of this

the equation perturb[i] -= np.dot(perturb[i], channel) * channel. can i ask this meaning of this? Why does it get perturbations that are still on the sphere?

diff never reached to 1e-3

Hi,
I tried running the resnet based boundary attack, but I have a small question. According to the code the main loop should stop running, and finally it stops due to e_step > 500. When I checked the final adversarial image, it changed the image to eel, but the label for that image was not changed to sea lion (which is the aim of the attack). Can you explain why this issue is occurring?
Also, can you share whether your mean squared error value reduced to condition?

question about "reshape()" in funcion "orthogonal_perturbation" .

When I read line32-33 in funcion "orthogonal_perturbation" in boundary-attack-resnet.py, I find
"
diff = diff.reshape(3, 224, 224)
perturb = perturb.reshape(3, 224, 224),
"
why "reshape" is used, it will not simply change the order of channels.

In addition, I cannot undestand "perturb[i] -= np.dot(perturb[i], channel) * channel" in line35 in boundary-attack-resnet.py. I hope you can help me. Thank you very much.

Not the same height and width of image

In function 'orthogonal_perturbation',
for i, channel in enumerate(diff):
perturb[i] -= np.dot(perturb[i], channel) * channel
np.dot is matrix multiplication, if size of perturb[i] and channel is different, then came an error.

use for object detection

Hi! I know this algo is design for classification, but I wonder if this algorithm can successfully used to attack the object detector like ssd/yolo?

Thanks for answering.

question about get_diff error

I think you want to norm the perturbation according to channel. If so, in get_diff(), I think the reshape() should be changed by rollaxis(), because the reshape() cannot change channel last to channel first correctly. If I am wrong, can you tell me the reason of get_diff()? Thanks.

Is this boundary attack implementation made by the paper's author?

Is this boundary attack implementation exactly the same with the procedure of the original official implementation, so that I can use it in my paper to report results?

How to support targeted attack?

I notice the target_class = np.argmax(classifier.predict(target_sample)) defined in line 97 is never used. (https://github.com/greentfrapp/boundary-attack/blob/master/boundary-attack-resnet.py#L97)
How to modify this code to support targeted attack with predefined target label?

Trouble running boundary-attack-resnet.py

Hi,

I am having trouble running boundary-attack-resnet.py. The error is
"ValueError: Layer "resnet50" expects 1 input(s), but it received 10 input tensors."

Not so sure what to do.

Thanks