Mass-center Attacks

[chinglamchoi]

Hello, thanks for the intriguing work. I'm reimplementing the IntegratedGradientsAttack in utils.py and referring to the paper but cannot get non-zero perturbations for mass-center attacks.

Referring to Algorithm 1, x^0 is initialised as x_t, the original test image. The first perturbation step is given by $$x^p = x^{p-1} + \alpha \cdot \textrm{sign}(\nabla_x \Vert C(x_t) - C(x^{p-1}) \Vert_2)$$ for p=1. So,
$$x^0 = x^t = x^{p-1}$$
Naturally, the gradient will be zero, then how will a perturbation be computed?

Looking forward to your response, thank you.