linf norm attack

[jimo17]

Hi and thanks for open source. I am very interested in your paper. I have a question. If I want to make PPBA perform linf norm attack, how do I need to modify the code?

[theFool32]

Thanks for your interest. Please kindly refer to

PPBA/gcv.py

Line 88 in 9db2e7d

.clamp(-16 / 255, 16 / 255) # Norm constraint

which is an example of performing the linf norm attack with 16. You should also remove the code for l2 norm like

PPBA/main.py

Line 121 in 9db2e7d

uz = uz * np.minimum(1, 5 / uz_l2).reshape(-1, 1)

[jimo17]

Thanks a lot for your answer. The l2 norm in your code is used directly on uz. Can the linf norm be used directly on uz as well?
For example, when the linf norm is 16:
uz=uz.clamp(-16 / 255, 16 / 255)

[theFool32]

Actually, no.
Multiplying with the projection matrix does not change the l2 norm of uz. So it is the same to restrict on uz or the final noise.
But it is different for linf norm

[theFool32]

$$|\delta|_2 = |A^Tz|_2 = tr((A^T z)^TA^T z) = tr(z^TAA^T z) = tr(z^Tz) = |z|_2 $$

[jimo17]

I see.Thank you very much for your answer.