Fix shape bug.

fluid/adversarial/advbox/adversary.py

@@ -90,7 +90,8 @@ class Adversary(object):
         assert adversarial_example.shape == self.__original.shape
         ok = self._is_successful(adversarial_label)
         if ok:
-            self.__adversarial_example = adversarial_example
+            self.__adversarial_example = adversarial_example.reshape(
+                self.__original.shape)
             self.__adversarial_label = adversarial_label
         return ok
 

fluid/adversarial/advbox/attacks/gradientsign.py

@@ -44,8 +44,10 @@ class GradientSignAttack(Attack):
             gradient = self.model.gradient([(adversary.original,
                                              adversary.original_label)])
             gradient_sign = np.sign(gradient) * (max_ - min_)
+
+        adv_img = adversary.original.reshape(gradient_sign.shape)
         for epsilon in epsilons:
-            adv_img = adversary.original + epsilon * gradient_sign
+            adv_img = adv_img + epsilon * gradient_sign
             adv_img = np.clip(adv_img, min_, max_)
             adv_label = np.argmax(self.model.predict([(adv_img, 0)]))
             logging.info('epsilon = {:.3f}, pre_label = {}, adv_label={}'.

fluid/adversarial/advbox/attacks/iterator_gradientsign.py

@@ -35,7 +35,7 @@ class IteratorGradientSignAttack(Attack):
         min_, max_ = self.model.bounds()
 
         for epsilon in epsilons:
-            adv_img = adversary.original
+            adv_img = None
             for _ in range(steps):
                 if adversary.is_targeted_attack:
                     gradient = self.model.gradient([(adversary.original,
@@ -45,6 +45,8 @@ class IteratorGradientSignAttack(Attack):
                     gradient = self.model.gradient([(adversary.original,
                                                      adversary.original_label)])
                     gradient_sign = np.sign(gradient) * (max_ - min_)
+                if adv_img is None:
+                    adv_img = adversary.original.reshape(gradient_sign.shape)
                 adv_img = adv_img + gradient_sign * epsilon
                 adv_img = np.clip(adv_img, min_, max_)
                 adv_label = np.argmax(self.model.predict([(adv_img, 0)]))