Questions about SplitBatchNorm

[sab148]

I have some questions if you can answer me please,

1. In the paper of AdvProp section 4.3 they said

For each clean mini-batch, we first attack the network using the auxiliary BNs to generate its adversarial counterpart;

Using your code do we have to generate by ourselves the adversarial examples by ading noise to the clean images ? Because it seems that in the paper adversarial examples are generated by the CNN.

2. Also about the calculation of the loss function, it seems like you calculate only one loss for both clean and adversarial examples and not calculate one for each and sum up like in the paper. Is these two ways are equivalent ?

Thank you for your time

[rwightman]

going to answer in #68