RayS does not support targeted attack?

[machanic]

RayS does not support targeted attack?

[machanic]

I read your paper again, and you do not provide targeted attack's results in the paper either.

[jinghuichen]

We did not provide targeted attack results as modern defenses usually care about untargeted setting. The targeted attack for hard-label setting itself can be tricky. The mainstream hard-label attack methods all rely on finding the decision boundary. In untargeted setting, by initializing your attack far far away from the original point you always find a success perturbation while in targeted setting, such chances are low. That is why the other hard-label papers usually use an image from the targeted class as initialization to ensure the successful perturbation at the beginning. To me, this is kind of problematic and unrealistic in practice and thus we simply focused on the more popular untargeted setting.

[machanic]

@jinghuichen I want to add your RayS in my paper. However, my method is a L2 norm attack. I want to compare your RayS so much. What do you suggest? Do you suggest I use RayS code for L2 norm on untargeted attack setting. The untargeted atttack result of L2 norm seems pretty normal and can be used.

In imageNet , RayS targeted attack's success rate is so low almost 0%. It seems RayS does not support targeted attack in ImageNet. As you have mentioned.
Thank you.