The score threshold selection in train phase about evademl-zoo HOT 2 CLOSED

Update some new experiment result:

I use the Feature Squeezing on the vgg-face model with cw2 attack, and the result is 68% TPR on the median_filter_4_4. Better than the result bit_depth. It seems like normal.

But I encountered something strange, when I only use bit_depth_1 bit_depth_4 bit_depth_8 these three squeezer respectively. All of their threshold trained result is 0.000000. All the distance is 0 in the list returned from get_distance function.
Is that the zero threshold result is reasonable? Where did I give the wrong parameters?

from evademl-zoo.

Hi @stuking , thanks for your interest in our work.

The adversarial examples in the training set is not required, because we would select the threshold value using legitimate examples only. But there's no harm to include adversarial examples.

A threshold value is picked so that the false positive rate on legitimate examples in training set is not larger than a specified value, such as 5%. A zero threshold value usually means the squeezing method barely changes the model prediction on legitimate examples --less than 5% legitimate examples have distance >0. It would be a great squeezing method if the distance is large for adversarial examples. But it could be useless if the distance of adversarial examples is often zero (e.g. an identity function). Please read our paper for more details.

We have changed the name of filters at some point. Please use "median_filter_2_2" instead of "median_smoothing_2". You can find more examples of the filter names on this page: https://github.com/mzweilin/EvadeML-Zoo/blob/master/Reproduce_FeatureSqueezing.md

I believe we can close the issue now.

Best,
-Weilin

from evademl-zoo.