Does all found x_final with dist <= self.epsilon is attacked successfully?

[machanic]

I notice you only use dist <= self.epsilon to indicate the success boolean. However, imaging a situation that the distance/distortion between self.x_final and original image is below predefined epsilon, but it is classified correctly by the classifier!
Are you sure this code can deal with this situation.
https://github.com/uclaml/RayS/blob/master/RayS.py#L77

[jinghuichen]

Please note that self.x_final is initialized far away from the original (dist = infty) and is only been updated when a successful attack is founded. Therefore your imagined case never happens.