JSMA Attack Implementation Questions

[ewjatho]

First, thank you for the ART library! A fantasticly useful resource. I have two questions regarding the ART implementation of the JSMA saliency_map evasion attack:

1.) In the generate function of the code, the attack stopping criteria appears to be when the fraction of changed input features is greater than gamma. However in alogorithm 1 of the paper referenced in the code, the gamma-based stopping criterion is greater than or equal to gamma. This results in different behavior in general. In the specific case of gamma = 1, the code's gamma-based stopping criterion is never met, so it will keep perturbing until the search-space or target criterion is met. Am I missing something here?

2.) In the code, saliency maps seem to be computed solely using the input gradients for the target logit. Whereas in the paper, the saliency map is instead computed using the input gradients for the target logit and the non-target logits. Is this correct? If so why is the code only using the input gradients for the target logit?

[beat-buesser]

Hi @ewjatho Thank you very much for you compliments for ART!

1.) I think you are right, a less than (<) instead of less than or equal (<=) condition line 185 of SaliencyMapMethod would be correct. Would you be interested to fix it with a pull request? I'm happy to help, but no pressure to sign up, if not we would fix it in an upcoming release.

2.) I'm not yet completely sure, but I think your question is not unreasonable. SaliencyMapMethod has been implemented quite a while ago and I wonder if the the focus on the class gradients of the target class only was to obtain the main gradients and save computation for the other non-target classes or if they just got forgotten. Are you running SaliencyMapMethod against one of the models in the paper? Do you obtain the same performance as reported in the paper?