Describe the bug
Hi! I noticed the following bug:
when checking if the clean inputs are adversarial the arguments are passed in the wrong order to the adv_example_finalizer function:
|
model, batched_x, torch.zeros_like(batched_x), batched_data_max, batched_data_min, batched_C_mat, batched_rhs_mat, or_spec_size |
batched_data_max is passed before batched_data_min while the function expects min before max:
|
data_min: torch.Tensor, data_max: torch.Tensor, |
This means in particular that the upper bounds used when clamping are actually data_min and that the adversarial inputs are the lower bounds instead of the original inputs (it is the pytorch clamp behaviour in this case).
Reproducing steps:
Run the file attached if needed, but the bug and fix should be clear enough.
reproduce.py
Describe the bug
Hi! I noticed the following bug:
when checking if the clean inputs are adversarial the arguments are passed in the wrong order to the adv_example_finalizer function:
alpha-beta-CROWN/complete_verifier/attack/attack_interface.py
Line 145 in e5c7e17
alpha-beta-CROWN/complete_verifier/attack/general_spec_attack.py
Line 133 in e5c7e17
This means in particular that the upper bounds used when clamping are actually data_min and that the adversarial inputs are the lower bounds instead of the original inputs (it is the pytorch clamp behaviour in this case).
Reproducing steps:
Run the file attached if needed, but the bug and fix should be clear enough.
reproduce.py