zhuchen03 / convexpolytopeposioning Goto Github PK

Hi,

Thanks in advance for your time.

We try to reproduce your results in the ''end-to-end'' learning scenario, and unlike "transfer learning", the numbers are very different to what you have put in the paper, and the performance we get is very low. I guess I'm doing something wrong. Something should not be right into the place. Maybe I'm missing a point. I exactly do the following I just pulled your code and ran launch/attack-end2end.sh for target indices from 1 to 10. Only for one target, and only for one victim network, the misclassification happens. Since it's very resource consuming, I just wanted to double check with you, and then run the attack for all 50 targets. It would be great if you help us with this issue. We appreciate that.

Hi, thank you for opening source your code! But here I encounter a problem as the image shown above, so I am wondering that how can I run the attack-transfer.sh in order to poison the data. Should I train the model first to get the check point file? Or where can I find the check point file somewhere?

Hi,

First of all, I want to thank you a lot for open sourcing your project. That means a lot!

I have a question. I'm kind of confused with the name of models. As far as I understood from your paper, in your experiments, the victim models are trained with a different seed than the substitute models. Now, I'm looking at "launch/attack-transfer.sh" script, and for dropouts 0.2, and 0.25, it seems you're using seed1226, but for dropout 0.3, the seed is not specified in the name. For the victim, also the seed is not included in the name of the victim's model. Would you please clarify this? Also, in general,

1. If the seed is not in the name of the model, what does it mean? it's a random seed?
2. You said in the paper, that you used 18 substitute networks for Figure 5. Can you please give me the exact script you used for that? The current script selects 12 subs. networks, so for sure, it is not producing Figure 5. I just want to be sure, what substitute models you exactly used and what victim models you exactly used? That helps me to understand the seeding situation well.

In general, I don't know when I select model x as a subs. net, and model y as the victim, how I become sure that these models are trained with different seeds?

Thanks for your time.

In you source code ConvexPolytopePosioning/trainer.py, when you solve the spectral radius of the Matrix A'A in function least_squares_simplex(). I notice you didn't use the exact definition of spectral radius to solve it which spectral radius is the the largest absolute eigenvalue of matrix A'A.

# Estimate the spectral radius of the Matrix A'A
y = torch.normal(0, torch.ones(n,1)).to(device)
lipschitz = torch.norm(A.t().mm(A.mm(y)))/torch.norm(y)

Is it for faster computation or some reasons else？ And what does lipschitz here mean?
Thanks for your time.