About transferring to images of large size

[WindVChen]

Hi,

It is a nice work. Have you ever tried it on the images of large size? I tried the method on 224*224 images and found that the gap between clean images and adversarial ones hard to enlarge. For example, I set the adv_lamda to 0.6 for the first layer while clean_lamda to 0.1, but after training, the adv_energy can only reach about 0.23 while clean_energy about 0.11. Based on it, I then train the second and third layer with adv_lamda set to 1.0 and 2.0 respectively, the final adv_energy is about 0.7, while the clean_energy about 0.3.

I wonder if different configurations should be taken for the images of large size.

What else, I'm also curious about the detection transferability between different attacks, such as the detector trained on PGD can also detect the Square attack, which is mentioned in your paper, but it seems there are no further experiments on that?

Looking forward to your reply, thanks.

[vinits5]

Hi @WindVChen,
If possible can you please share your code that you tried with 224x224. I am also interested to try experiments with higher resolution images. Appreciate your help. Thanks.
My email for contact: vinitsarode5@gmail.com

[WindVChen]

@vinits5 Sorry for my late reply. I didn't actually make much changes to the original code. Here is my training code. I changed the loss function slightly: clean image for computing clean MSELoss and attack image for computing adv MSELoss (original code seems to use all samples to compute each loss).

I also reviewed the results above. It seems that the energy distributions of clean and adv are not much different and cannot be separated. Maybe there are some mistakes in my code :(
anomaly_training.zip

[MoitraAbhi]

Hi @WindVChen. Sorry for my late reply. I have recently added the code to evaluate the detector performance across different adversarial attacks such as square attacks. The code is in evaluate_different_attacks.py. To run the code, use the run_evaluate.sh code.

Unfortunately, I did not run experiments on larger image sizes such as 224x224. Can you try using one or more max pooling layers in between the detector layers? Maybe reducing the feature size using maxpooling can improve the energy separation. Hope this helps. Let me know if you have any other questions.

[WindVChen]

@MoitraAbhi Hi, I have re-implemented on larger image (224*224) with the current code version, and it works. I guess maybe the previous failure comes from the mixture of my adversarial training data, as I generated from many types of attacks, or something else. Thanks for your good work.

I have another question that if there exists any adversarial detection method not relying on generated adversarial samples? It seems a bit troublesome that every time I want to do adversarial detection, I have to first generate adversarial samples. I have searched a lot but it seems most work need adversarial samples for training. Maybe I have missed something, and looking forward to your reply.