harry24k/aepw-pytorch

A pytorch implementation of "Adversarial Examples in the Physical World"

AEPW-pytorch

A pytorch implementation of "Adversarial Examples in the Physical World"

Summary

This code is a pytorch implementation of basic iterative method(known as I-FGSM) and iterative least-likely class method.
In this code, I used above methods to fool Inception v3.
'Giant Panda' used for an example.
You can add other pictures with a folder with the label name in the 'data/imagenet'.

Also, this code shows adversarial attack is possible with a photo if an adversarial image.

Requirements

• python==3.6
• numpy==1.14.2
• pytorch==1.0.0

Important results not in the code

• This paper proposed new metric(called destruction rate) to measure the influence of arbitrary trasnfromations. (p.6)
  • Destruction rate is the fraction of adversarial images which are no longer misclassified after the transformations.
  • Adversarial examples generated by the FGSM are the most robust to transformations.
  • Iterative least-likely method is the least robust.
  • Blur, noise and JPEG encoding have a higher destruction rate than brightness and contrast.
• Paper shows that, to obtain very high confidence, iterative methods are weak to survive photo transformation. (p.8-9)
  • prefiltered case(clean image correctly classified, adversarial image confidently incorrectly classified) couldn't fool the model after transformations unlike average case(randomly chosen images)

Notice

• This Repository won't be updated.
• Please check the package of adversarial attacks in pytorch

aepw-pytorch's Issues

Is the Alpha value 1/255 or 1?

Hello, I am trying to reproduce the results from the paper also.
I came to realize that you were using alpha = 1 here. But the paper mentioned:

In our experiments we used α = 1, i.e. we changed the value of each pixel only by 1 on each step.

From my understanding, the α in the paper should be transformed according to the scale of the image. And since you have scaled the image, α should at the same time transformed as 1/255.

Could you explain a bit about the reason of using alpha = 1? Or did I misunderstand some part of the code?

Thank you in advance!