Nicholas Carlini

Reading my message I realize that above I essentially repeated the comment from #2, when I meant to say something different. Sorry about that -- the argument I meant to...

So we agree that your choice of 32 is at least twice as large as is reasonable and studied in other work. No other paper studies exclusively 32/256 on CIFAR-10....

Yeah, it's important to note that all of these other papers study a range of values. And it's good that they do: especially in defense work it is useful to...

It's great that you do measure this for the attacks against the undefended model. But I still care about how well targeted attacks work even when considering defended models from...

Right, that's the correct way to interpret these numbers. My concern is that we are going to see someone say "LLC was found to be a stronger attack against defended...

If you read the original paper that proposes R+FGSM it defines alpha as the initial step size that's taken randomly, and then (epsilon-alpha) as the gradient step size. So clearly...

Because the DeepSec paper doesn't give a definition of R+FGSM and cites Tramer et al., the only way to interpret what epsilon and alpha mean is by referring to their...

Alright, here's what I did. First train the MNIST conv net and run the candidates selection process to get 1000 examples. ``` python train_mnist.py python CandidatesSelection.py --dataset MNIST ``` Start...

1. To compute the variance properly, you can't fix both the model and dataset subset and repeat a deterministic computation multiple times. Clearly the variance of a deterministic computation should...

The difference is that my implementation is just the numerically stable way to implement softmax. It's still the same function, just numerically stable. See Section 4.1 of the Deep Learning...