Blurring function in blur defense?

[dxoigmn]

It looks like the blur function in the blur defense and training code,

selfstudy-adversarial-robustness/training/train_blur.py

Lines 41 to 45 in 15d1c01

	def blur(x):
	x_pad = np.pad(x, [(0, 0), (1, 1), (1, 1), (0, 0)])
	x_pad = (x_pad[:, :1] + x_pad[:, :-1])/2
	x_pad = (x_pad[:, :, :1] + x_pad[:, :, :-1])/2
	return x_pad

, is functionally equivalent to:

np.pad(x, [(0, 0), (1, 0), (1, 0), (0, 0)]) / 4

At least, x_pad[:, :1] and x_pad[:, :, :1] are the zero vectors. I assume this was meant to be a box blur and those offsets should be changed accordingly.

[carlini]

You're completely correct. The intent was to have

x_pad = (x_pad[:, 1:] + x_pad[:, :-1])/2

instead of

x_pad = (x_pad[:, :1] + x_pad[:, :-1])/2

which would actually do a blur, instead of whatever weird no-op this current thing does.