About random restart about mnist_challenge HOT 2 CLOSED

During training we perform random start, i.e. we add a random perturbation before the first PGD step. During eval, we test PGD from multiple random starts and keep the worst. That is we run a full PGD attack from (say) 20 different random starts and consider an classifier successful only if it was not fooled by any of these 20 attacks. As you can see, an attack that uses a bunch of restarts reduces the robust accuracy by a few percent compared to a single start attack. Using a random start during training is not essential, you can set random_start to false and you will get comparable results.

from mnist_challenge.

Thanks!

from mnist_challenge.