l2 norm PGD attack about fast_adversarial HOT 1 CLOSED

Hey Abhishek, and thanks for reaching out! Sorry for the delay, but to give your question a proper response I went ahead and just tried it out (FGSM training with an L2 perturbation) since it wasn't in the main experiments of the paper.

Long story short, it also seems to work pretty much exactly the same way it worked in the Linf case. Some specifics that follow:

• I took an L2 adversary with radius eps=128/255, and ran it with the FGSM adversarial training with step size 1.25*eps (same step size as in Linf training).
• Random initialization is again key to getting competitive results! I randomly sampled a direction unit vector (sampling from a random normal distribution and normalizing to have unit norm), and a random radius (sampling from a uniform distribution from [0,epsilon]). I did try another random initialization (e.g. this one https://github.com/MadryLab/robustness/blob/master/robustness/attack_steps.py#L134) but it was not diverse enough and catastrophically overfit.
• The final model gets 69.56% robust accuracy on a ResNet18, which seems comparable to other results that I've seen at this threshold. This is with respect to a single restart PGD adversary with 50 iterations, and step size 3/255

from fast_adversarial.