pytorch gradient attack

[dongshuhao]

foolbox/foolbox/models/pytorch.py

Line 114 in 021f02a

grad = self._process_gradient(grad)

Why do we need to have the grad divided by the std? I do not think it is necessary.

[wielandbrendel]

self._process_gradient simply backprops the gradient through the preprocessing step (subtraction of the mean, scaling).

[dongshuhao]

This line is for backprops.

foolbox/foolbox/models/pytorch.py

Line 98 in 021f02a

loss.backward()

The point it is why do we need:

foolbox/foolbox/models/base.py

Line 75 in 021f02a

result = gradient / pdiv

Based on:

foolbox/foolbox/attacks/gradient.py

Line 30 in 021f02a

perturbed = image + gradient * epsilon

The estimated grad is applied to the original image. Why do we need to do the preprocessing on the grad then?

[wielandbrendel]

See, the processing pipeline is this: original image -> preprocessed image -> model output. Most importantly, the model only sees the preprocessed image! Hence, loss.backward() gives you the gradient with respect to the preprocessed image. self._process_gradient takes this gradient and returns the gradient with respect to the original image. If there is no preprocessing then the two are identical.

[dongshuhao]

@wielandbrendel I got it! Thanks!