Independent Reproduction of the Results

[josueortc]

Hello, I was trying to independently reproduce the results in the paper. Specifically, the results on Drand and Ddet, I was able to reproduce the results for Drand but for Ddet I found that the networks overfit to the training set and have bad performance on the original test set. I saw on the paper that it says that no data augmentation was done and the parameters that I used were not enough to regularize the network. Any ideas why this is happening?

[andrewilyas]

Hm, sounds like some kind of training misconfiguration but it is hard to tell. You might be interested in our newly released robustness library, which facilitates training neural networks easily with custom datasets/parameters: https://github.com/MadryLab/robustness. This is exactly the library we used for our work.

Also I would make sure that you are (a) letting training run for enough epochs and (b) using the hyperparameters from Appendix C in the paper.

In case you are just interested in the reproducibility, several independent researchers were able to replicate both D_rand and D_det with L_2 and L_inf attacks here: https://distill.pub/2019/advex-bugs-discussion/ ("Successful Replications" section)

[eghbalz]

Hi,
thank you for your insightful paper, and for releasing the dataset.
I have a question regarding the value range of the images (used for training the classifiers) and the hyperparameters of the attacks (epsilon, etc).

As it appears, you use the following transforms:

TRAIN_TRANSFORMS_DEFAULT = lambda size: transforms.Compose([
            transforms.RandomCrop(size, padding=4),
            transforms.RandomHorizontalFlip(),
            transforms.ColorJitter(.25,.25,.25),
            transforms.RandomRotation(2),
            transforms.ToTensor(),
        ])
TEST_TRANSFORMS_DEFAULT = lambda size:transforms.Compose([
        transforms.Resize(size),
        transforms.CenterCrop(size),
        transforms.ToTensor()
    ])

I think the term transforms.ToTensor() changes the values from [0, 255] to [0,1] .
From the paper (Table 6 in the appendix) the hyperparams of PGD are as follows:
epsilon=0.5
step size=0.1
iterations=100

Is this the setup you used for your adversarial attacks as well? Are these values based on [0,1] normalized images or [0, 255]?

In the following link, I have a simple implementation of the PGD and FGSM attacks, applied on a simple architecture*:

https://gist.github.com/eghbalz/20ecfba8abbddc4577e83aadb257623d

Based on the adversarial error I am getting, the performance of the model trained on robust features is not better than the model trained on the standard training set.
I would really appreciate it if you could have a look and tell me your opinion about it, perhaps I am missing something here?

*: l also trained a resnet18 architecture and the results were similar
**: UPDATE: After changing epsilon=0.5/255 and step size=0.1/255 the results make more sense (but still the PGD attack doesn't cause the accuracy to go down as low as in the paper using a resnet architecture). Would be great if you can confirm this adaptation is correct!

[andrewilyas]

Hi, the values are actually normalized to [0, 1]---but we are using the L2 norm in our paper, so the right thing to do is to use l2-gradient ascent (x_t = x_{t-1} + step_size * grad / ||grad||_2), and the projection is to the l2 ball of radius 0.5 around the original images.

It looks like the code you attached is using l-infinity? In which case a different epsilon/set of hyperparameters is probably more reasonable.

[yuanzheshanggou]

Hello, I was trying to independently reproduce the results in the paper. Specifically, the results on Drand and Ddet, I was able to reproduce the results for Drand but for Ddet I found that the networks overfit to the training set and have bad performance on the original test set. I saw on the paper that it says that no data augmentation was done and the parameters that I used were not enough to regularize the network. Any ideas why this is happening?

Hello! I'm trying to reproduce the result of Drand on CIFAR10. However, the standard accuracy I reproduce is just 25%, far less than the the result of 80% shown on the paper. Could you please provide any suggestions? I would appreciate it if you could share the code with me.

[Anurag14]

Hi, I am trying to reproduce the results on Ddet, the generalization accuracy on CIFAR 10 is ~4% instead of ~44% as reported in the paper and the model overfits the data. I am able to reproduce the results on Dr, Dnr and Drand but not on Ddet. Any help is really appreciated :)

[Anurag14]

Is it possible that Ddet released by the lab is the dataset that was constructed from training on a robust model? D.5 Accuracy curves (from the paper Appendix) are very similar to the training curves I have obtained independently.