uclaml/rays

RayS: A Ray Searching Method for Hard-label Adversarial Attack (KDD2020)

rays's Issues

Does all found x_final with dist <= self.epsilon is attacked successfully?

I notice you only use dist <= self.epsilon to indicate the success boolean. However, imaging a situation that the distance/distortion between self.x_final and original image is below predefined epsilon, but it is classified correctly by the classifier!
Are you sure this code can deal with this situation.
https://github.com/uclaml/RayS/blob/master/RayS.py#L77

RayS does not support targeted attack?

I set Linf-norm epsilon to 8/255 = 0.03137254901960784, and conduct experiments on ImageNet targeted attack on an InceptionV4 network.
The success rate is lower than 1% and the average distortion after 20000 queries is 0.9702016711235046.
Do I set something wrong? Or the RayS mainly supports untargeted attack?

Why stop_queries uses working_ind to update itself before updating working_ind?

Why line https://github.com/uclaml/RayS/blob/master/RayS.py#L63 is before https://github.com/uclaml/RayS/blob/master/RayS.py#L64, rather than after line 64?
It means the working_ind is not updated in updating stop_queries.

Does this algorithm divide into L2 norm version and Linf norm version?

I notice that you only use self.ord as a indicator to update the stop_queries. Does this algorithm divide into L2 norm version and Linf norm version?

Is this algorithm the same in L2 norm and Linf norm? The only difference lies in the count of queries and attack success rate?

Does KDD conference accept the paper of black-box adversarial attacks?

Dear Sir:
I have two papers about score-setting and hard-label(decision-based) black-box adversarial attack.
I usually submit my paper on CVPR but this year CVPR rejects them, I want to resubmit to KDD.
Does KDD conference accept this kind of paper? I found your RayS is published on KDD. Do you have suggestion?