CarliniL0Method Not Returning L0 Optimized Adversarial Examples

[ClarktheDarkShark]

I am using the CarliniL0Method to generate L0 optimized adversarial examples, but it seems to be returning examples that are L2 optimized. The average L0 values that I get is Ave_L0 = 3,070 for CIFAR10. I tried with the default values, and tried increasing the max_iter value and decreasing the learning_rate, but I either get these L2 optimized results, or it fails to find an example.

[beat-buesser]

Hi @Christopher-d-clark5 Why do you think the examples are L2-optimized?

[ClarktheDarkShark]

When I run the attack, it returns adversarial examples where nearly every pixel is changed. Since the L0 goal is to minimize the number of pixels changed, it for sure is not returning L0 optimized examples. I believe the comments for the L0 class state that it uses the L2 attack first to identify pixels to be used in the L0 attack. My assumption is that something isn’t working correctly and it just returns the L2 examples.

[beat-buesser]

@Christopher-d-clark5 Sorry for my delayed response. Does you model return logins or probabilites?