Perturbation doesn't match eps about adversarial-face-attack HOT 3 CLOSED

If you think there is a bug, please provide steps to reproduce it and the logs showing such issues.

from adversarial-face-attack.

I follow the steps and run attack

./face_attack.py --data /path/to/lfw_mtcnnpy_160 \ 
	--attack images/clean-JCJ.png \   
	--target Arnold_Schwarzenegger \
	--output JCJ-to-Schwarzenegger.png

And I run this code to simply get the perturbation.

from PIL import Image
import numpy as np

np.set_printoptions(threshold=np.inf)

im = np.array(Image.open("/Adversarial-Face-Attack/images/clean-JCJ.png"),dtype='int16')
attack_im = np.array(Image.open("/Adversarial-Face-Attack/JCJ-to-Schwarzenegger.png"),dtype='int16')
diff = im - attack_im
print (diff)

The value of some pixels is larger than 16.

from adversarial-face-attack.

I'm able to reproduce the issue in this way. It turns out that the generated perturbation is within eps, but it is generated on top of a resized face, therefore within eps w.r.t that resized face, but when resized back, it may go out of eps w.r.t. the original image.

I'll add an extra clip operation in the end. A better fix would be to perform the initial resize operation in the graph so the attack can propagate through it.

from adversarial-face-attack.