First of all, nice written code. Thank you.
-
https://github.com/tribhuvanesh/prediction-poisoning/blob/master/defenses/adversary/jacobian.py#L126
I'm confused here. Why do we need to reinitialize the model at each iteration?
-
In the paper, you mention that victims and attackers use the same architectures and the number of parameters of VGG is 100M+. If that's the case, then I assume the attackers use ImageNet version of VGG because the CIFAR10 version has only 14M+ params. However, the victim models you released use CIFAR10 version, but the pretrained model in the code is ImageNet version.
I assume you used this function to load pretrained models: https://github.com/tribhuvanesh/knockoffnets/blob/master/knockoff/models/zoo.py#L52
So for attackers, do we load the CIFAR10 version VGG and only load those CNN weights from the ImageNet pre-trained VGG?
Or, we should resize the input, which doesn't sound right to me.
First of all, nice written code. Thank you.
https://github.com/tribhuvanesh/prediction-poisoning/blob/master/defenses/adversary/jacobian.py#L126
I'm confused here. Why do we need to reinitialize the model at each iteration?
In the paper, you mention that victims and attackers use the same architectures and the number of parameters of VGG is 100M+. If that's the case, then I assume the attackers use ImageNet version of VGG because the CIFAR10 version has only 14M+ params. However, the victim models you released use CIFAR10 version, but the pretrained model in the code is ImageNet version.
I assume you used this function to load pretrained models: https://github.com/tribhuvanesh/knockoffnets/blob/master/knockoff/models/zoo.py#L52
So for attackers, do we load the CIFAR10 version VGG and only load those CNN weights from the ImageNet pre-trained VGG?
Or, we should resize the input, which doesn't sound right to me.