[BUG] The implementation of eps-ball in MI-FGSM

[ZhongliangGuo]

✨ Short description of the bug [tl;dr]

whether use eps-ball for MI-FGSM

💬 Detailed code and results

I just double checked with the pseudo code of the MI-FGSM and other implementaion, it seems like the MI-FGSM didn't use a clamp in eps-ball, but in the implementation of this repo used it.

delta = torch.clamp(adv_images - images, min=-self.eps, max=self.eps)

[rikonaka]

Hi @ZhongliangGuo , I have just checked the MI-FGSM code, and according to the code link given in the original paper, it embodies this clamp process in the code

https://github.com/dongyp13/Non-Targeted-Adversarial-Attacks/blob/5c68162e05de7afed2e3d33115df43e2a7a1c3da/attack_iter.py#L211

https://github.com/dongyp13/Non-Targeted-Adversarial-Attacks/blob/5c68162e05de7afed2e3d33115df43e2a7a1c3da/attack_iter.py#L188

the essence of this is to restrict the adversarial samples to natural samples within epsilon, and the code in torchattacks is actually do the same job as original code.

But the mi-fgsm code does have some problems with the code logic, which I've changed.