I'm trying to load the models in PyTorch.
from torchvision import models
model_load = models.resnet50()
model_robust = torch.load('robust_imagenet_models/imagenet_linf_8.pt')['model']
model_load.load_state_dict(model_robust, strict=False)
Upon doing so, I get the following error.
_IncompatibleKeys(missing_keys=['conv1.weight', 'bn1.weight', 'bn1.bias', 'bn1.running_mean', 'bn1.running_var', 'layer1.0.conv1.weight', 'layer1.0.bn1.weight', 'layer1.0.bn1.bias', 'layer1.0.bn1.running_mean', 'layer1.0.bn1.running_var', 'layer1.0.conv2.weight', 'layer1.0.bn2.weight', 'layer1.0.bn2.bias', 'layer1.0.bn2.running_mean', 'layer1.0.bn2.running_var', 'layer1.0.conv3.weight', 'layer1.0.bn3.weight', 'layer1.0.bn3.bias', 'layer1.0.bn3.running_mean', 'layer1.0.bn3.running_var', 'layer1.0.downsample.0.weight', 'layer1.0.downsample.1.weight', 'layer1.0.downsample.1.bias', 'layer1.0.downsample.1.running_mean', 'layer1.0.downsample.1.running_var', 'layer1.1.conv1.weight', 'layer1.1.bn1.weight', 'layer1.1.bn1.bias', 'layer1.1.bn1.running_mean', 'layer1.1.bn1.running_var', 'layer1.1.conv2.weight', 'layer1.1.bn2.weight', 'layer1.1.bn2.bias', 'layer1.1.bn2.running_mean', 'layer1.1.bn2.running_var', 'layer1.1.conv3.weight', 'layer1.1.bn3.weight', 'layer1.1.bn3.bias', 'layer1.1.bn3.running_mean', 'layer1.1.bn3.running_var', 'layer1.2.conv1.weight', 'layer1.2.bn1.weight', 'layer1.2.bn1.bias', 'layer1.2.bn1.running_mean', 'layer1.2.bn1.running_var', 'layer1.2.conv2.weight', 'layer1.2.bn2.weight', 'layer1.2.bn2.bias', 'layer1.2.bn2.running_mean', 'layer1.2.bn2.running_var', 'layer1.2.conv3.weight', 'layer1.2.bn3.weight', 'layer1.2.bn3.bias', 'layer1.2.bn3.running_mean', 'layer1.2.bn3.running_var', 'layer2.0.conv1.weight', 'layer2.0.bn1.weight', 'layer2.0.bn1.bias', 'layer2.0.bn1.running_mean', 'layer2.0.bn1.running_var', 'layer2.0.conv2.weight', 'layer2.0.bn2.weight', 'layer2.0.bn2.bias', 'layer2.0.bn2.running_mean', 'layer2.0.bn2.running_var', 'layer2.0.conv3.weight', 'layer2.0.bn3.weight', 'layer2.0.bn3.bias', 'layer2.0.bn3.running_mean', 'layer2.0.bn3.running_var', 'layer2.0.downsample.0.weight', 'layer2.0.downsample.1.weight', 'layer2.0.downsample.1.bias', 'layer2.0.downsample.1.running_mean', 'layer2.0.downsample.1.running_var', 'layer2.1.conv1.weight', 'layer2.1.bn1.weight', 'layer2.1.bn1.bias', 'layer2.1.bn1.running_mean', 'layer2.1.bn1.running_var', 'layer2.1.conv2.weight', 'layer2.1.bn2.weight', 'layer2.1.bn2.bias', 'layer2.1.bn2.running_mean', 'layer2.1.bn2.running_var', 'layer2.1.conv3.weight', 'layer2.1.bn3.weight', 'layer2.1.bn3.bias', 'layer2.1.bn3.running_mean', 'layer2.1.bn3.running_var', 'layer2.2.conv1.weight', 'layer2.2.bn1.weight', 'layer2.2.bn1.bias', 'layer2.2.bn1.running_mean', 'layer2.2.bn1.running_var', 'layer2.2.conv2.weight', 'layer2.2.bn2.weight', 'layer2.2.bn2.bias', 'layer2.2.bn2.running_mean', 'layer2.2.bn2.running_var', 'layer2.2.conv3.weight', 'layer2.2.bn3.weight', 'layer2.2.bn3.bias', 'layer2.2.bn3.running_mean', 'layer2.2.bn3.running_var', 'layer2.3.conv1.weight', 'layer2.3.bn1.weight', 'layer2.3.bn1.bias', 'layer2.3.bn1.running_mean', 'layer2.3.bn1.running_var', 'layer2.3.conv2.weight', 'layer2.3.bn2.weight', 'layer2.3.bn2.bias', 'layer2.3.bn2.running_mean', 'layer2.3.bn2.running_var', 'layer2.3.conv3.weight', 'layer2.3.bn3.weight', 'layer2.3.bn3.bias', 'layer2.3.bn3.running_mean', 'layer2.3.bn3.running_var', 'layer3.0.conv1.weight', 'layer3.0.bn1.weight', 'layer3.0.bn1.bias', 'layer3.0.bn1.running_mean', 'layer3.0.bn1.running_var', 'layer3.0.conv2.weight', 'layer3.0.bn2.weight', 'layer3.0.bn2.bias', 'layer3.0.bn2.running_mean', 'layer3.0.bn2.running_var', 'layer3.0.conv3.weight', 'layer3.0.bn3.weight', 'layer3.0.bn3.bias', 'layer3.0.bn3.running_mean', 'layer3.0.bn3.running_var', 'layer3.0.downsample.0.weight', 'layer3.0.downsample.1.weight', 'layer3.0.downsample.1.bias', 'layer3.0.downsample.1.running_mean', 'layer3.0.downsample.1.running_var', 'layer3.1.conv1.weight', 'layer3.1.bn1.weight', 'layer3.1.bn1.bias', 'layer3.1.bn1.running_mean', 'layer3.1.bn1.running_var', 'layer3.1.conv2.weight', 'layer3.1.bn2.weight', 'layer3.1.bn2.bias', 'layer3.1.bn2.running_mean', 'layer3.1.bn2.running_var', 'layer3.1.conv3.weight', 'layer3.1.bn3.weight', 'layer3.1.bn3.bias', 'layer3.1.bn3.running_mean', 'layer3.1.bn3.running_var', 'layer3.2.conv1.weight', 'layer3.2.bn1.weight', 'layer3.2.bn1.bias', 'layer3.2.bn1.running_mean', 'layer3.2.bn1.running_var', 'layer3.2.conv2.weight', 'layer3.2.bn2.weight', 'layer3.2.bn2.bias', 'layer3.2.bn2.running_mean', 'layer3.2.bn2.running_var', 'layer3.2.conv3.weight', 'layer3.2.bn3.weight', 'layer3.2.bn3.bias', 'layer3.2.bn3.running_mean', 'layer3.2.bn3.running_var', 'layer3.3.conv1.weight', 'layer3.3.bn1.weight', 'layer3.3.bn1.bias', 'layer3.3.bn1.running_mean', 'layer3.3.bn1.running_var', 'layer3.3.conv2.weight', 'layer3.3.bn2.weight', 'layer3.3.bn2.bias', 'layer3.3.bn2.running_mean', 'layer3.3.bn2.running_var', 'layer3.3.conv3.weight', 'layer3.3.bn3.weight', 'layer3.3.bn3.bias', 'layer3.3.bn3.running_mean', 'layer3.3.bn3.running_var', 'layer3.4.conv1.weight', 'layer3.4.bn1.weight', 'layer3.4.bn1.bias', 'layer3.4.bn1.running_mean', 'layer3.4.bn1.running_var', 'layer3.4.conv2.weight', 'layer3.4.bn2.weight', 'layer3.4.bn2.bias', 'layer3.4.bn2.running_mean', 'layer3.4.bn2.running_var', 'layer3.4.conv3.weight', 'layer3.4.bn3.weight', 'layer3.4.bn3.bias', 'layer3.4.bn3.running_mean', 'layer3.4.bn3.running_var', 'layer3.5.conv1.weight', 'layer3.5.bn1.weight', 'layer3.5.bn1.bias', 'layer3.5.bn1.running_mean', 'layer3.5.bn1.running_var', 'layer3.5.conv2.weight', 'layer3.5.bn2.weight', 'layer3.5.bn2.bias', 'layer3.5.bn2.running_mean', 'layer3.5.bn2.running_var', 'layer3.5.conv3.weight', 'layer3.5.bn3.weight', 'layer3.5.bn3.bias', 'layer3.5.bn3.running_mean', 'layer3.5.bn3.running_var', 'layer4.0.conv1.weight', 'layer4.0.bn1.weight', 'layer4.0.bn1.bias', 'layer4.0.bn1.running_mean', 'layer4.0.bn1.running_var', 'layer4.0.conv2.weight', 'layer4.0.bn2.weight', 'layer4.0.bn2.bias', 'layer4.0.bn2.running_mean', 'layer4.0.bn2.running_var', 'layer4.0.conv3.weight', 'layer4.0.bn3.weight', 'layer4.0.bn3.bias', 'layer4.0.bn3.running_mean', 'layer4.0.bn3.running_var', 'layer4.0.downsample.0.weight', 'layer4.0.downsample.1.weight', 'layer4.0.downsample.1.bias', 'layer4.0.downsample.1.running_mean', 'layer4.0.downsample.1.running_var', 'layer4.1.conv1.weight', 'layer4.1.bn1.weight', 'layer4.1.bn1.bias', 'layer4.1.bn1.running_mean', 'layer4.1.bn1.running_var', 'layer4.1.conv2.weight', 'layer4.1.bn2.weight', 'layer4.1.bn2.bias', 'layer4.1.bn2.running_mean', 'layer4.1.bn2.running_var', 'layer4.1.conv3.weight', 'layer4.1.bn3.weight', 'layer4.1.bn3.bias', 'layer4.1.bn3.running_mean', 'layer4.1.bn3.running_var', 'layer4.2.conv1.weight', 'layer4.2.bn1.weight', 'layer4.2.bn1.bias', 'layer4.2.bn1.running_mean', 'layer4.2.bn1.running_var', 'layer4.2.conv2.weight', 'layer4.2.bn2.weight', 'layer4.2.bn2.bias', 'layer4.2.bn2.running_mean', 'layer4.2.bn2.running_var', 'layer4.2.conv3.weight', 'layer4.2.bn3.weight', 'layer4.2.bn3.bias', 'layer4.2.bn3.running_mean', 'layer4.2.bn3.running_var', 'fc.weight', 'fc.bias'], unexpected_keys=['module.normalizer.new_mean', 'module.normalizer.new_std', 'module.model.conv1.weight', 'module.model.bn1.weight', 'module.model.bn1.bias', 'module.model.bn1.running_mean', 'module.model.bn1.running_var', 'module.model.bn1.num_batches_tracked', 'module.model.layer1.0.conv1.weight', 'module.model.layer1.0.bn1.weight', 'module.model.layer1.0.bn1.bias', 'module.model.layer1.0.bn1.running_mean', 'module.model.layer1.0.bn1.running_var', 'module.model.layer1.0.bn1.num_batches_tracked', 'module.model.layer1.0.conv2.weight', 'module.model.layer1.0.bn2.weight', 'module.model.layer1.0.bn2.bias', 'module.model.layer1.0.bn2.running_mean', 'module.model.layer1.0.bn2.running_var', 'module.model.layer1.0.bn2.num_batches_tracked', 'module.model.layer1.0.conv3.weight', 'module.model.layer1.0.bn3.weight', 'module.model.layer1.0.bn3.bias', 'module.model.layer1.0.bn3.running_mean', 'module.model.layer1.0.bn3.running_var', 'module.model.layer1.0.bn3.num_batches_tracked', 'module.model.layer1.0.downsample.0.weight', 'module.model.layer1.0.downsample.1.weight', 'module.model.layer1.0.downsample.1.bias', 'module.model.layer1.0.downsample.1.running_mean', 'module.model.layer1.0.downsample.1.running_var', 'module.model.layer1.0.downsample.1.num_batches_tracked', 'module.model.layer1.1.conv1.weight', 'module.model.layer1.1.bn1.weight', 'module.model.layer1.1.bn1.bias', 'module.model.layer1.1.bn1.running_mean', 'module.model.layer1.1.bn1.running_var', 'module.model.layer1.1.bn1.num_batches_tracked', 'module.model.layer1.1.conv2.weight', 'module.model.layer1.1.bn2.weight', 'module.model.layer1.1.bn2.bias', 'module.model.layer1.1.bn2.running_mean', 'module.model.layer1.1.bn2.running_var', 'module.model.layer1.1.bn2.num_batches_tracked', 'module.model.layer1.1.conv3.weight', 'module.model.layer1.1.bn3.weight', 'module.model.layer1.1.bn3.bias', 'module.model.layer1.1.bn3.running_mean', 'module.model.layer1.1.bn3.running_var', 'module.model.layer1.1.bn3.num_batches_tracked', 'module.model.layer1.2.conv1.weight', 'module.model.layer1.2.bn1.weight', 'module.model.layer1.2.bn1.bias', 'module.model.layer1.2.bn1.running_mean', 'module.model.layer1.2.bn1.running_var', 'module.model.layer1.2.bn1.num_batches_tracked', 'module.model.layer1.2.conv2.weight', 'module.model.layer1.2.bn2.weight', 'module.model.layer1.2.bn2.bias', 'module.model.layer1.2.bn2.running_mean', 'module.model.layer1.2.bn2.running_var', 'module.model.layer1.2.bn2.num_batches_tracked', 'module.model.layer1.2.conv3.weight', 'module.model.layer1.2.bn3.weight', 'module.model.layer1.2.bn3.bias', 'module.model.layer1.2.bn3.running_mean', 'module.model.layer1.2.bn3.running_var', 'module.model.layer1.2.bn3.num_batches_tracked', 'module.model.layer2.0.conv1.weight', 'module.model.layer2.0.bn1.weight', 'module.model.layer2.0.bn1.bias', 'module.model.layer2.0.bn1.running_mean', 'module.model.layer2.0.bn1.running_var', 'module.model.layer2.0.bn1.num_batches_tracked', 'module.model.layer2.0.conv2.weight', 'module.model.layer2.0.bn2.weight', 'module.model.layer2.0.bn2.bias', 'module.model.layer2.0.bn2.running_mean', 'module.model.layer2.0.bn2.running_var', 'module.model.layer2.0.bn2.num_batches_tracked', 'module.model.layer2.0.conv3.weight', 'module.model.layer2.0.bn3.weight', 'module.model.layer2.0.bn3.bias', 'module.model.layer2.0.bn3.running_mean', 'module.model.layer2.0.bn3.running_var', 'module.model.layer2.0.bn3.num_batches_tracked', 'module.model.layer2.0.downsample.0.weight', 'module.model.layer2.0.downsample.1.weight', 'module.model.layer2.0.downsample.1.bias', 'module.model.layer2.0.downsample.1.running_mean', 'module.model.layer2.0.downsample.1.running_var', 'module.model.layer2.0.downsample.1.num_batches_tracked', 'module.model.layer2.1.conv1.weight', 'module.model.layer2.1.bn1.weight', 'module.model.layer2.1.bn1.bias', 'module.model.layer2.1.bn1.running_mean', 'module.model.layer2.1.bn1.running_var', 'module.model.layer2.1.bn1.num_batches_tracked', 'module.model.layer2.1.conv2.weight', 'module.model.layer2.1.bn2.weight', 'module.model.layer2.1.bn2.bias', 'module.model.layer2.1.bn2.running_mean', 'module.model.layer2.1.bn2.running_var', 'module.model.layer2.1.bn2.num_batches_tracked', 'module.model.layer2.1.conv3.weight', 'module.model.layer2.1.bn3.weight', 'module.model.layer2.1.bn3.bias', 'module.model.layer2.1.bn3.running_mean', 'module.model.layer2.1.bn3.running_var', 'module.model.layer2.1.bn3.num_batches_tracked', 'module.model.layer2.2.conv1.weight', 'module.model.layer2.2.bn1.weight', 'module.model.layer2.2.bn1.bias', 'module.model.layer2.2.bn1.running_mean', 'module.model.layer2.2.bn1.running_var', 'module.model.layer2.2.bn1.num_batches_tracked', 'module.model.layer2.2.conv2.weight', 'module.model.layer2.2.bn2.weight', 'module.model.layer2.2.bn2.bias', 'module.model.layer2.2.bn2.running_mean', 'module.model.layer2.2.bn2.running_var', 'module.model.layer2.2.bn2.num_batches_tracked', 'module.model.layer2.2.conv3.weight', 'module.model.layer2.2.bn3.weight', 'module.model.layer2.2.bn3.bias', 'module.model.layer2.2.bn3.running_mean', 'module.model.layer2.2.bn3.running_var', 'module.model.layer2.2.bn3.num_batches_tracked', 'module.model.layer2.3.conv1.weight', 'module.model.layer2.3.bn1.weight', 'module.model.layer2.3.bn1.bias', 'module.model.layer2.3.bn1.running_mean', 'module.model.layer2.3.bn1.running_var', 'module.model.layer2.3.bn1.num_batches_tracked', 'module.model.layer2.3.conv2.weight', 'module.model.layer2.3.bn2.weight', 'module.model.layer2.3.bn2.bias', 'module.model.layer2.3.bn2.running_mean', 'module.model.layer2.3.bn2.running_var', 'module.model.layer2.3.bn2.num_batches_tracked', 'module.model.layer2.3.conv3.weight', 'module.model.layer2.3.bn3.weight', 'module.model.layer2.3.bn3.bias', 'module.model.layer2.3.bn3.running_mean', 'module.model.layer2.3.bn3.running_var', 'module.model.layer2.3.bn3.num_batches_tracked', 'module.model.layer3.0.conv1.weight', 'module.model.layer3.0.bn1.weight', 'module.model.layer3.0.bn1.bias', 'module.model.layer3.0.bn1.running_mean', 'module.model.layer3.0.bn1.running_var', 'module.model.layer3.0.bn1.num_batches_tracked', 'module.model.layer3.0.conv2.weight', 'module.model.layer3.0.bn2.weight', 'module.model.layer3.0.bn2.bias', 'module.model.layer3.0.bn2.running_mean', 'module.model.layer3.0.bn2.running_var', 'module.model.layer3.0.bn2.num_batches_tracked', 'module.model.layer3.0.conv3.weight', 'module.model.layer3.0.bn3.weight', 'module.model.layer3.0.bn3.bias', 'module.model.layer3.0.bn3.running_mean', 'module.model.layer3.0.bn3.running_var', 'module.model.layer3.0.bn3.num_batches_tracked', 'module.model.layer3.0.downsample.0.weight', 'module.model.layer3.0.downsample.1.weight', 'module.model.layer3.0.downsample.1.bias', 'module.model.layer3.0.downsample.1.running_mean', 'module.model.layer3.0.downsample.1.running_var', 'module.model.layer3.0.downsample.1.num_batches_tracked', 'module.model.layer3.1.conv1.weight', 'module.model.layer3.1.bn1.weight', 'module.model.layer3.1.bn1.bias', 'module.model.layer3.1.bn1.running_mean', 'module.model.layer3.1.bn1.running_var', 'module.model.layer3.1.bn1.num_batches_tracked', 'module.model.layer3.1.conv2.weight', 'module.model.layer3.1.bn2.weight', 'module.model.layer3.1.bn2.bias', 'module.model.layer3.1.bn2.running_mean', 'module.model.layer3.1.bn2.running_var', 'module.model.layer3.1.bn2.num_batches_tracked', 'module.model.layer3.1.conv3.weight', 'module.model.layer3.1.bn3.weight', 'module.model.layer3.1.bn3.bias', 'module.model.layer3.1.bn3.running_mean', 'module.model.layer3.1.bn3.running_var', 'module.model.layer3.1.bn3.num_batches_tracked', 'module.model.layer3.2.conv1.weight', 'module.model.layer3.2.bn1.weight', 'module.model.layer3.2.bn1.bias', 'module.model.layer3.2.bn1.running_mean', 'module.model.layer3.2.bn1.running_var', 'module.model.layer3.2.bn1.num_batches_tracked', 'module.model.layer3.2.conv2.weight', 'module.model.layer3.2.bn2.weight', 'module.model.layer3.2.bn2.bias', 'module.model.layer3.2.bn2.running_mean', 'module.model.layer3.2.bn2.running_var', 'module.model.layer3.2.bn2.num_batches_tracked', 'module.model.layer3.2.conv3.weight', 'module.model.layer3.2.bn3.weight', 'module.model.layer3.2.bn3.bias', 'module.model.layer3.2.bn3.running_mean', 'module.model.layer3.2.bn3.running_var', 'module.model.layer3.2.bn3.num_batches_tracked', 'module.model.layer3.3.conv1.weight', 'module.model.layer3.3.bn1.weight', 'module.model.layer3.3.bn1.bias', 'module.model.layer3.3.bn1.running_mean', 'module.model.layer3.3.bn1.running_var', 'module.model.layer3.3.bn1.num_batches_tracked', 'module.model.layer3.3.conv2.weight', 'module.model.layer3.3.bn2.weight', 'module.model.layer3.3.bn2.bias', 'module.model.layer3.3.bn2.running_mean', 'module.model.layer3.3.bn2.running_var', 'module.model.layer3.3.bn2.num_batches_tracked', 'module.model.layer3.3.conv3.weight', 'module.model.layer3.3.bn3.weight', 'module.model.layer3.3.bn3.bias', 'module.model.layer3.3.bn3.running_mean', 'module.model.layer3.3.bn3.running_var', 'module.model.layer3.3.bn3.num_batches_tracked', 'module.model.layer3.4.conv1.weight', 'module.model.layer3.4.bn1.weight', 'module.model.layer3.4.bn1.bias', 'module.model.layer3.4.bn1.running_mean', 'module.model.layer3.4.bn1.running_var', 'module.model.layer3.4.bn1.num_batches_tracked', 'module.model.layer3.4.conv2.weight', 'module.model.layer3.4.bn2.weight', 'module.model.layer3.4.bn2.bias', 'module.model.layer3.4.bn2.running_mean', 'module.model.layer3.4.bn2.running_var', 'module.model.layer3.4.bn2.num_batches_tracked', 'module.model.layer3.4.conv3.weight', 'module.model.layer3.4.bn3.weight', 'module.model.layer3.4.bn3.bias', 'module.model.layer3.4.bn3.running_mean', 'module.model.layer3.4.bn3.running_var', 'module.model.layer3.4.bn3.num_batches_tracked', 'module.model.layer3.5.conv1.weight', 'module.model.layer3.5.bn1.weight', 'module.model.layer3.5.bn1.bias', 'module.model.layer3.5.bn1.running_mean', 'module.model.layer3.5.bn1.running_var', 'module.model.layer3.5.bn1.num_batches_tracked', 'module.model.layer3.5.conv2.weight', 'module.model.layer3.5.bn2.weight', 'module.model.layer3.5.bn2.bias', 'module.model.layer3.5.bn2.running_mean', 'module.model.layer3.5.bn2.running_var', 'module.model.layer3.5.bn2.num_batches_tracked', 'module.model.layer3.5.conv3.weight', 'module.model.layer3.5.bn3.weight', 'module.model.layer3.5.bn3.bias', 'module.model.layer3.5.bn3.running_mean', 'module.model.layer3.5.bn3.running_var', 'module.model.layer3.5.bn3.num_batches_tracked', 'module.model.layer4.0.conv1.weight', 'module.model.layer4.0.bn1.weight', 'module.model.layer4.0.bn1.bias', 'module.model.layer4.0.bn1.running_mean', 'module.model.layer4.0.bn1.running_var', 'module.model.layer4.0.bn1.num_batches_tracked', 'module.model.layer4.0.conv2.weight', 'module.model.layer4.0.bn2.weight', 'module.model.layer4.0.bn2.bias', 'module.model.layer4.0.bn2.running_mean', 'module.model.layer4.0.bn2.running_var', 'module.model.layer4.0.bn2.num_batches_tracked', 'module.model.layer4.0.conv3.weight', 'module.model.layer4.0.bn3.weight', 'module.model.layer4.0.bn3.bias', 'module.model.layer4.0.bn3.running_mean', 'module.model.layer4.0.bn3.running_var', 'module.model.layer4.0.bn3.num_batches_tracked', 'module.model.layer4.0.downsample.0.weight', 'module.model.layer4.0.downsample.1.weight', 'module.model.layer4.0.downsample.1.bias', 'module.model.layer4.0.downsample.1.running_mean', 'module.model.layer4.0.downsample.1.running_var', 'module.model.layer4.0.downsample.1.num_batches_tracked', 'module.model.layer4.1.conv1.weight', 'module.model.layer4.1.bn1.weight', 'module.model.layer4.1.bn1.bias', 'module.model.layer4.1.bn1.running_mean', 'module.model.layer4.1.bn1.running_var', 'module.model.layer4.1.bn1.num_batches_tracked', 'module.model.layer4.1.conv2.weight', 'module.model.layer4.1.bn2.weight', 'module.model.layer4.1.bn2.bias', 'module.model.layer4.1.bn2.running_mean', 'module.model.layer4.1.bn2.running_var', 'module.model.layer4.1.bn2.num_batches_tracked', 'module.model.layer4.1.conv3.weight', 'module.model.layer4.1.bn3.weight', 'module.model.layer4.1.bn3.bias', 'module.model.layer4.1.bn3.running_mean', 'module.model.layer4.1.bn3.running_var', 'module.model.layer4.1.bn3.num_batches_tracked', 'module.model.layer4.2.conv1.weight', 'module.model.layer4.2.bn1.weight', 'module.model.layer4.2.bn1.bias', 'module.model.layer4.2.bn1.running_mean', 'module.model.layer4.2.bn1.running_var', 'module.model.layer4.2.bn1.num_batches_tracked', 'module.model.layer4.2.conv2.weight', 'module.model.layer4.2.bn2.weight', 'module.model.layer4.2.bn2.bias', 'module.model.layer4.2.bn2.running_mean', 'module.model.layer4.2.bn2.running_var', 'module.model.layer4.2.bn2.num_batches_tracked', 'module.model.layer4.2.conv3.weight', 'module.model.layer4.2.bn3.weight', 'module.model.layer4.2.bn3.bias', 'module.model.layer4.2.bn3.running_mean', 'module.model.layer4.2.bn3.running_var', 'module.model.layer4.2.bn3.num_batches_tracked', 'module.model.fc.weight', 'module.model.fc.bias', 'module.attacker.normalize.new_mean', 'module.attacker.normalize.new_std', 'module.attacker.model.conv1.weight', 'module.attacker.model.bn1.weight', 'module.attacker.model.bn1.bias', 'module.attacker.model.bn1.running_mean', 'module.attacker.model.bn1.running_var', 'module.attacker.model.bn1.num_batches_tracked', 'module.attacker.model.layer1.0.conv1.weight', 'module.attacker.model.layer1.0.bn1.weight', 'module.attacker.model.layer1.0.bn1.bias', 'module.attacker.model.layer1.0.bn1.running_mean', 'module.attacker.model.layer1.0.bn1.running_var', 'module.attacker.model.layer1.0.bn1.num_batches_tracked', 'module.attacker.model.layer1.0.conv2.weight', 'module.attacker.model.layer1.0.bn2.weight', 'module.attacker.model.layer1.0.bn2.bias', 'module.attacker.model.layer1.0.bn2.running_mean', 'module.attacker.model.layer1.0.bn2.running_var', 'module.attacker.model.layer1.0.bn2.num_batches_tracked', 'module.attacker.model.layer1.0.conv3.weight', 'module.attacker.model.layer1.0.bn3.weight', 'module.attacker.model.layer1.0.bn3.bias', 'module.attacker.model.layer1.0.bn3.running_mean', 'module.attacker.model.layer1.0.bn3.running_var', 'module.attacker.model.layer1.0.bn3.num_batches_tracked', 'module.attacker.model.layer1.0.downsample.0.weight', 'module.attacker.model.layer1.0.downsample.1.weight', 'module.attacker.model.layer1.0.downsample.1.bias', 'module.attacker.model.layer1.0.downsample.1.running_mean', 'module.attacker.model.layer1.0.downsample.1.running_var', 'module.attacker.model.layer1.0.downsample.1.num_batches_tracked', 'module.attacker.model.layer1.1.conv1.weight', 'module.attacker.model.layer1.1.bn1.weight', 'module.attacker.model.layer1.1.bn1.bias', 'module.attacker.model.layer1.1.bn1.running_mean', 'module.attacker.model.layer1.1.bn1.running_var', 'module.attacker.model.layer1.1.bn1.num_batches_tracked', 'module.attacker.model.layer1.1.conv2.weight', 'module.attacker.model.layer1.1.bn2.weight', 'module.attacker.model.layer1.1.bn2.bias', 'module.attacker.model.layer1.1.bn2.running_mean', 'module.attacker.model.layer1.1.bn2.running_var', 'module.attacker.model.layer1.1.bn2.num_batches_tracked', 'module.attacker.model.layer1.1.conv3.weight', 'module.attacker.model.layer1.1.bn3.weight', 'module.attacker.model.layer1.1.bn3.bias', 'module.attacker.model.layer1.1.bn3.running_mean', 'module.attacker.model.layer1.1.bn3.running_var', 'module.attacker.model.layer1.1.bn3.num_batches_tracked', 'module.attacker.model.layer1.2.conv1.weight', 'module.attacker.model.layer1.2.bn1.weight', 'module.attacker.model.layer1.2.bn1.bias', 'module.attacker.model.layer1.2.bn1.running_mean', 'module.attacker.model.layer1.2.bn1.running_var', 'module.attacker.model.layer1.2.bn1.num_batches_tracked', 'module.attacker.model.layer1.2.conv2.weight', 'module.attacker.model.layer1.2.bn2.weight', 'module.attacker.model.layer1.2.bn2.bias', 'module.attacker.model.layer1.2.bn2.running_mean', 'module.attacker.model.layer1.2.bn2.running_var', 'module.attacker.model.layer1.2.bn2.num_batches_tracked', 'module.attacker.model.layer1.2.conv3.weight', 'module.attacker.model.layer1.2.bn3.weight', 'module.attacker.model.layer1.2.bn3.bias', 'module.attacker.model.layer1.2.bn3.running_mean', 'module.attacker.model.layer1.2.bn3.running_var', 'module.attacker.model.layer1.2.bn3.num_batches_tracked', 'module.attacker.model.layer2.0.conv1.weight', 'module.attacker.model.layer2.0.bn1.weight', 'module.attacker.model.layer2.0.bn1.bias', 'module.attacker.model.layer2.0.bn1.running_mean', 'module.attacker.model.layer2.0.bn1.running_var', 'module.attacker.model.layer2.0.bn1.num_batches_tracked', 'module.attacker.model.layer2.0.conv2.weight', 'module.attacker.model.layer2.0.bn2.weight', 'module.attacker.model.layer2.0.bn2.bias', 'module.attacker.model.layer2.0.bn2.running_mean', 'module.attacker.model.layer2.0.bn2.running_var', 'module.attacker.model.layer2.0.bn2.num_batches_tracked', 'module.attacker.model.layer2.0.conv3.weight', 'module.attacker.model.layer2.0.bn3.weight', 'module.attacker.model.layer2.0.bn3.bias', 'module.attacker.model.layer2.0.bn3.running_mean', 'module.attacker.model.layer2.0.bn3.running_var', 'module.attacker.model.layer2.0.bn3.num_batches_tracked', 'module.attacker.model.layer2.0.downsample.0.weight', 'module.attacker.model.layer2.0.downsample.1.weight', 'module.attacker.model.layer2.0.downsample.1.bias', 'module.attacker.model.layer2.0.downsample.1.running_mean', 'module.attacker.model.layer2.0.downsample.1.running_var', 'module.attacker.model.layer2.0.downsample.1.num_batches_tracked', 'module.attacker.model.layer2.1.conv1.weight', 'module.attacker.model.layer2.1.bn1.weight', 'module.attacker.model.layer2.1.bn1.bias', 'module.attacker.model.layer2.1.bn1.running_mean', 'module.attacker.model.layer2.1.bn1.running_var', 'module.attacker.model.layer2.1.bn1.num_batches_tracked', 'module.attacker.model.layer2.1.conv2.weight', 'module.attacker.model.layer2.1.bn2.weight', 'module.attacker.model.layer2.1.bn2.bias', 'module.attacker.model.layer2.1.bn2.running_mean', 'module.attacker.model.layer2.1.bn2.running_var', 'module.attacker.model.layer2.1.bn2.num_batches_tracked', 'module.attacker.model.layer2.1.conv3.weight', 'module.attacker.model.layer2.1.bn3.weight', 'module.attacker.model.layer2.1.bn3.bias', 'module.attacker.model.layer2.1.bn3.running_mean', 'module.attacker.model.layer2.1.bn3.running_var', 'module.attacker.model.layer2.1.bn3.num_batches_tracked', 'module.attacker.model.layer2.2.conv1.weight', 'module.attacker.model.layer2.2.bn1.weight', 'module.attacker.model.layer2.2.bn1.bias', 'module.attacker.model.layer2.2.bn1.running_mean', 'module.attacker.model.layer2.2.bn1.running_var', 'module.attacker.model.layer2.2.bn1.num_batches_tracked', 'module.attacker.model.layer2.2.conv2.weight', 'module.attacker.model.layer2.2.bn2.weight', 'module.attacker.model.layer2.2.bn2.bias', 'module.attacker.model.layer2.2.bn2.running_mean', 'module.attacker.model.layer2.2.bn2.running_var', 'module.attacker.model.layer2.2.bn2.num_batches_tracked', 'module.attacker.model.layer2.2.conv3.weight', 'module.attacker.model.layer2.2.bn3.weight', 'module.attacker.model.layer2.2.bn3.bias', 'module.attacker.model.layer2.2.bn3.running_mean', 'module.attacker.model.layer2.2.bn3.running_var', 'module.attacker.model.layer2.2.bn3.num_batches_tracked', 'module.attacker.model.layer2.3.conv1.weight', 'module.attacker.model.layer2.3.bn1.weight', 'module.attacker.model.layer2.3.bn1.bias', 'module.attacker.model.layer2.3.bn1.running_mean', 'module.attacker.model.layer2.3.bn1.running_var', 'module.attacker.model.layer2.3.bn1.num_batches_tracked', 'module.attacker.model.layer2.3.conv2.weight', 'module.attacker.model.layer2.3.bn2.weight', 'module.attacker.model.layer2.3.bn2.bias', 'module.attacker.model.layer2.3.bn2.running_mean', 'module.attacker.model.layer2.3.bn2.running_var', 'module.attacker.model.layer2.3.bn2.num_batches_tracked', 'module.attacker.model.layer2.3.conv3.weight', 'module.attacker.model.layer2.3.bn3.weight', 'module.attacker.model.layer2.3.bn3.bias', 'module.attacker.model.layer2.3.bn3.running_mean', 'module.attacker.model.layer2.3.bn3.running_var', 'module.attacker.model.layer2.3.bn3.num_batches_tracked', 'module.attacker.model.layer3.0.conv1.weight', 'module.attacker.model.layer3.0.bn1.weight', 'module.attacker.model.layer3.0.bn1.bias', 'module.attacker.model.layer3.0.bn1.running_mean', 'module.attacker.model.layer3.0.bn1.running_var', 'module.attacker.model.layer3.0.bn1.num_batches_tracked', 'module.attacker.model.layer3.0.conv2.weight', 'module.attacker.model.layer3.0.bn2.weight', 'module.attacker.model.layer3.0.bn2.bias', 'module.attacker.model.layer3.0.bn2.running_mean', 'module.attacker.model.layer3.0.bn2.running_var', 'module.attacker.model.layer3.0.bn2.num_batches_tracked', 'module.attacker.model.layer3.0.conv3.weight', 'module.attacker.model.layer3.0.bn3.weight', 'module.attacker.model.layer3.0.bn3.bias', 'module.attacker.model.layer3.0.bn3.running_mean', 'module.attacker.model.layer3.0.bn3.running_var', 'module.attacker.model.layer3.0.bn3.num_batches_tracked', 'module.attacker.model.layer3.0.downsample.0.weight', 'module.attacker.model.layer3.0.downsample.1.weight', 'module.attacker.model.layer3.0.downsample.1.bias', 'module.attacker.model.layer3.0.downsample.1.running_mean', 'module.attacker.model.layer3.0.downsample.1.running_var', 'module.attacker.model.layer3.0.downsample.1.num_batches_tracked', 'module.attacker.model.layer3.1.conv1.weight', 'module.attacker.model.layer3.1.bn1.weight', 'module.attacker.model.layer3.1.bn1.bias', 'module.attacker.model.layer3.1.bn1.running_mean', 'module.attacker.model.layer3.1.bn1.running_var', 'module.attacker.model.layer3.1.bn1.num_batches_tracked', 'module.attacker.model.layer3.1.conv2.weight', 'module.attacker.model.layer3.1.bn2.weight', 'module.attacker.model.layer3.1.bn2.bias', 'module.attacker.model.layer3.1.bn2.running_mean', 'module.attacker.model.layer3.1.bn2.running_var', 'module.attacker.model.layer3.1.bn2.num_batches_tracked', 'module.attacker.model.layer3.1.conv3.weight', 'module.attacker.model.layer3.1.bn3.weight', 'module.attacker.model.layer3.1.bn3.bias', 'module.attacker.model.layer3.1.bn3.running_mean', 'module.attacker.model.layer3.1.bn3.running_var', 'module.attacker.model.layer3.1.bn3.num_batches_tracked', 'module.attacker.model.layer3.2.conv1.weight', 'module.attacker.model.layer3.2.bn1.weight', 'module.attacker.model.layer3.2.bn1.bias', 'module.attacker.model.layer3.2.bn1.running_mean', 'module.attacker.model.layer3.2.bn1.running_var', 'module.attacker.model.layer3.2.bn1.num_batches_tracked', 'module.attacker.model.layer3.2.conv2.weight', 'module.attacker.model.layer3.2.bn2.weight', 'module.attacker.model.layer3.2.bn2.bias', 'module.attacker.model.layer3.2.bn2.running_mean', 'module.attacker.model.layer3.2.bn2.running_var', 'module.attacker.model.layer3.2.bn2.num_batches_tracked', 'module.attacker.model.layer3.2.conv3.weight', 'module.attacker.model.layer3.2.bn3.weight', 'module.attacker.model.layer3.2.bn3.bias', 'module.attacker.model.layer3.2.bn3.running_mean', 'module.attacker.model.layer3.2.bn3.running_var', 'module.attacker.model.layer3.2.bn3.num_batches_tracked', 'module.attacker.model.layer3.3.conv1.weight', 'module.attacker.model.layer3.3.bn1.weight', 'module.attacker.model.layer3.3.bn1.bias', 'module.attacker.model.layer3.3.bn1.running_mean', 'module.attacker.model.layer3.3.bn1.running_var', 'module.attacker.model.layer3.3.bn1.num_batches_tracked', 'module.attacker.model.layer3.3.conv2.weight', 'module.attacker.model.layer3.3.bn2.weight', 'module.attacker.model.layer3.3.bn2.bias', 'module.attacker.model.layer3.3.bn2.running_mean', 'module.attacker.model.layer3.3.bn2.running_var', 'module.attacker.model.layer3.3.bn2.num_batches_tracked', 'module.attacker.model.layer3.3.conv3.weight', 'module.attacker.model.layer3.3.bn3.weight', 'module.attacker.model.layer3.3.bn3.bias', 'module.attacker.model.layer3.3.bn3.running_mean', 'module.attacker.model.layer3.3.bn3.running_var', 'module.attacker.model.layer3.3.bn3.num_batches_tracked', 'module.attacker.model.layer3.4.conv1.weight', 'module.attacker.model.layer3.4.bn1.weight', 'module.attacker.model.layer3.4.bn1.bias', 'module.attacker.model.layer3.4.bn1.running_mean', 'module.attacker.model.layer3.4.bn1.running_var', 'module.attacker.model.layer3.4.bn1.num_batches_tracked', 'module.attacker.model.layer3.4.conv2.weight', 'module.attacker.model.layer3.4.bn2.weight', 'module.attacker.model.layer3.4.bn2.bias', 'module.attacker.model.layer3.4.bn2.running_mean', 'module.attacker.model.layer3.4.bn2.running_var', 'module.attacker.model.layer3.4.bn2.num_batches_tracked', 'module.attacker.model.layer3.4.conv3.weight', 'module.attacker.model.layer3.4.bn3.weight', 'module.attacker.model.layer3.4.bn3.bias', 'module.attacker.model.layer3.4.bn3.running_mean', 'module.attacker.model.layer3.4.bn3.running_var', 'module.attacker.model.layer3.4.bn3.num_batches_tracked', 'module.attacker.model.layer3.5.conv1.weight', 'module.attacker.model.layer3.5.bn1.weight', 'module.attacker.model.layer3.5.bn1.bias', 'module.attacker.model.layer3.5.bn1.running_mean', 'module.attacker.model.layer3.5.bn1.running_var', 'module.attacker.model.layer3.5.bn1.num_batches_tracked', 'module.attacker.model.layer3.5.conv2.weight', 'module.attacker.model.layer3.5.bn2.weight', 'module.attacker.model.layer3.5.bn2.bias', 'module.attacker.model.layer3.5.bn2.running_mean', 'module.attacker.model.layer3.5.bn2.running_var', 'module.attacker.model.layer3.5.bn2.num_batches_tracked', 'module.attacker.model.layer3.5.conv3.weight', 'module.attacker.model.layer3.5.bn3.weight', 'module.attacker.model.layer3.5.bn3.bias', 'module.attacker.model.layer3.5.bn3.running_mean', 'module.attacker.model.layer3.5.bn3.running_var', 'module.attacker.model.layer3.5.bn3.num_batches_tracked', 'module.attacker.model.layer4.0.conv1.weight', 'module.attacker.model.layer4.0.bn1.weight', 'module.attacker.model.layer4.0.bn1.bias', 'module.attacker.model.layer4.0.bn1.running_mean', 'module.attacker.model.layer4.0.bn1.running_var', 'module.attacker.model.layer4.0.bn1.num_batches_tracked', 'module.attacker.model.layer4.0.conv2.weight', 'module.attacker.model.layer4.0.bn2.weight', 'module.attacker.model.layer4.0.bn2.bias', 'module.attacker.model.layer4.0.bn2.running_mean', 'module.attacker.model.layer4.0.bn2.running_var', 'module.attacker.model.layer4.0.bn2.num_batches_tracked', 'module.attacker.model.layer4.0.conv3.weight', 'module.attacker.model.layer4.0.bn3.weight', 'module.attacker.model.layer4.0.bn3.bias', 'module.attacker.model.layer4.0.bn3.running_mean', 'module.attacker.model.layer4.0.bn3.running_var', 'module.attacker.model.layer4.0.bn3.num_batches_tracked', 'module.attacker.model.layer4.0.downsample.0.weight', 'module.attacker.model.layer4.0.downsample.1.weight', 'module.attacker.model.layer4.0.downsample.1.bias', 'module.attacker.model.layer4.0.downsample.1.running_mean', 'module.attacker.model.layer4.0.downsample.1.running_var', 'module.attacker.model.layer4.0.downsample.1.num_batches_tracked', 'module.attacker.model.layer4.1.conv1.weight', 'module.attacker.model.layer4.1.bn1.weight', 'module.attacker.model.layer4.1.bn1.bias', 'module.attacker.model.layer4.1.bn1.running_mean', 'module.attacker.model.layer4.1.bn1.running_var', 'module.attacker.model.layer4.1.bn1.num_batches_tracked', 'module.attacker.model.layer4.1.conv2.weight', 'module.attacker.model.layer4.1.bn2.weight', 'module.attacker.model.layer4.1.bn2.bias', 'module.attacker.model.layer4.1.bn2.running_mean', 'module.attacker.model.layer4.1.bn2.running_var', 'module.attacker.model.layer4.1.bn2.num_batches_tracked', 'module.attacker.model.layer4.1.conv3.weight', 'module.attacker.model.layer4.1.bn3.weight', 'module.attacker.model.layer4.1.bn3.bias', 'module.attacker.model.layer4.1.bn3.running_mean', 'module.attacker.model.layer4.1.bn3.running_var', 'module.attacker.model.layer4.1.bn3.num_batches_tracked', 'module.attacker.model.layer4.2.conv1.weight', 'module.attacker.model.layer4.2.bn1.weight', 'module.attacker.model.layer4.2.bn1.bias', 'module.attacker.model.layer4.2.bn1.running_mean', 'module.attacker.model.layer4.2.bn1.running_var', 'module.attacker.model.layer4.2.bn1.num_batches_tracked', 'module.attacker.model.layer4.2.conv2.weight', 'module.attacker.model.layer4.2.bn2.weight', 'module.attacker.model.layer4.2.bn2.bias', 'module.attacker.model.layer4.2.bn2.running_mean', 'module.attacker.model.layer4.2.bn2.running_var', 'module.attacker.model.layer4.2.bn2.num_batches_tracked', 'module.attacker.model.layer4.2.conv3.weight', 'module.attacker.model.layer4.2.bn3.weight', 'module.attacker.model.layer4.2.bn3.bias', 'module.attacker.model.layer4.2.bn3.running_mean', 'module.attacker.model.layer4.2.bn3.running_var', 'module.attacker.model.layer4.2.bn3.num_batches_tracked', 'module.attacker.model.fc.weight', 'module.attacker.model.fc.bias'])