Gamma in JSMA attack

[Abhishek2271]

Hi,

I have a question regarding the JSMA implementation in ART. In the JSMA paper Gamma is the total number of pixels allowed to be distorted which for a greyscale MNIST image is 28x28. However, how is this computed in similar manner for images with RGB channels (% of pixels or % of total features in an image)?

So for instance, for CIFAR the image dim is 32x32x3 then when I say gamma is 0.1 then does this mean 10% of (3072)?
From the ART document, gamma is described as "Maximum fraction of features to be perturbed (between 0 and 1)". So I would assume it is 10% of 3072 and not flat pixel count (10% of 32x32).
From code also this seems to be the case since
dims = list(x.shape[1:]) # for an image batch of (1000,32,32,3) this will give (32,32,3)
self._nb_features = np.product(dims)

I just want to confirm that gamma here is percent features and not percent pixels.

[beat-buesser]

Hi @Abhishek2271 Yes, that is also my understanding of ART's JSMA implementation. For the example of CIFAR-10 the total number of features would be 32x32x3=3072 and Gamma would describe the fraction of this total number of features that can be modified. This means that each color channel of a pixel is changed and counted separately.

[Abhishek2271]

Hi @beat-buesser. Thank you very much for the prompt reply. The way the code is structured and commented in each attack in ART, it is relatively easy to understand and modify the implementation. I just wanted to confirm since in some cases channel-wise changes to a single pixel can be computed differently.
Thank you again for the reply.