Familiarity-Based Open-Set Recognition Under Adversarial Attacks

Venue: NLDL_org_2025_Conference
Published: 2024-09-04 12:16:15

Abstract: Open-set recognition (OSR), the identification of novel categories, can be a critical component when deploying classification models in real-world applications. Recent work has shown that familiarity-based scoring rules such as the Maximum Softmax Probability (MSP) or the Maximum Logit Score (MLS) are strong baselines when the closed-set accuracy is high. However, one of the potential weaknesses of familiarity-based OSR are adversarial attacks. Here, we present gradient-based adversarial attacks on familiarity scores for both types of attacks, False Familiarity and False Novelty attacks, and evaluate their effectiveness in informed and uninformed settings on TinyImageNet. 
   Furthermore, we explore how novel and familiar samples react to adversarial attacks and formulate the adversarial reaction score as an alternative OSR scoring rule, which shows a high correlation with the MLS familiarity score.

Main paper: 
 introduction: 
 In many real-world applications of machine learning models, it is crucial to understand the models' limitations and the trustworthiness of their predictions in novel situations. Thus, we investigate openset recognition (OSR) [1] , which can be seen as a special case of out-of-distribution (OOD) detection [2] , where the task is to identify novel categories at test time, which were not included in the training dataset. Recently, Vaze et al. [3] have demonstrated that the progress in OSR performance over the past years is not necessarily due to advancement in OSR approaches, but is correlated with improved performance on the closed-set categories, i.e. the classification of categories included in the training dataset. With this observation, simple baseline scoring rules such as the Maximum Softmax Probability (MSP) [4] and the Maximum Logit Score (MLS) [3, 5] are competitive and perform on par withor even outperform-more dedicated approaches such as ARPL and ARPL+CS [6] , OSRCI [7] , and OpenHybrid [8] . At the same time, Dietterich & Guyer [9] have proposed the Familiarity Hypothesis, stating that such familiarity-based scoring rules identify novel categories by measuring the absence of familiar features instead of actively recognizing the presence of novel features. They investigated Increase the score of known categories. In other words, this prediction states that it might 061 be trivial to compute adversarial perturbations that 062 amplify familiar features to cause a false familiarity, 063 but it might be harder to hide (all) familiar fea-064 tures to yield a false novelty (See Fig. 1 ). While 065 it has been shown that the OSR approach Open-Max [11] is vulnerable to adversarial attacks [12, 13] ,we study the vulnerability of familiarity-based OSR approaches to gradient-based adversarial white-box attacks (i.e., the model parameters are given). Finally, we explore whether these adversarial attacks can be used to design an alternative OSR score.Liang et al. [14] found that OOD detection was enhanced by preprocessing inputs with an adversarial perturbation:" In open-set recognition (OSR) a set N of novel categories is additionally considered and a test set containing inputs from both novel and familiar classes is used to evaluate the OSR performance: 123D test-csr = {(x i , y i )} M i=1 ⊂ X × F thatD test-osr = {(x i , y i )} M i=1 ⊂ X × (F ∪ N ). AS MSP (y ∈ F | x) = max y σ(f θ (x)) y (1) 124and the Maximum Logit Score (MLS) [3, 9] 125 A simple and effective method for generating ad-131 versarial inputs is the Fast Gradient Sign Method 132 (FGSM) which was first described by [10] . The 133 FGSM generates an adversarial input, x adv , using 134 the following equation: [15] applies the FGSM up-153 date iteratively by setting Step(L, θ, x adv n , y) = 154 α sign(∇ x L(θ, x adv n , y)) . In this method, the step 155 size α and the number of iterations can be adjusted 156 to get the desired trade-off between run-time and 157 performance. Alternative approaches are inspired 158 by gradient-based optimizers using momentum to 159 improve performance [16] . We investigate an itera-160 tive approach using RPROP [17] [18] [19] set recognition [20] . We investigate three objective 182 functions to achieve this attack:EQUATIONEQUATION) i = 151 min(max(z i , x i -ε), x i + ε). The Basic Itera-152 tive Method (BIM)EQUATION185EQUATION186The log-MSP loss has been proposed in the ODIN 198EQUATION)199The 2-norm encourages reducing non-maximum log-200 its while still prioritizing the max logit. However,201one limitation of the 2-norm is that it is non-negative.Since logits are unnormalized and can be negative,it would be preferable if the objective function also 1 While this is not further investigated in this work, our OSR experiments did not confirm an improvement of the MSP score as also mentioned in other independent work [9] . 
uninformed vs. informed attacks: 
 We call an attack informed if the adversary has access to the binary set-labels of the input, i.e. closedset vs. open-set, and uninformed if that information is not available [22] . In the uninformed setting, either an FP or FN attack is applied to all images, disregarding whether an image is novel or familiar. For informed adversaries, FN attacks are only performed on novel images to make the classifier falsely predict that the inputs are familiar, leaving all familiar images unchanged. In contrast, FP attacks are only performed on familiar images to make the classifier wrongly assume novel inputs, leaving all novel images unchanged.The idea that novel and familiar inputs could react differently to adversarial attacks is motivated by the findings in [14] as discussed in the introduction and by our own analyses of the behaviour of scores before and after adversarial perturbation (See Fig. 3 ). Here, we present the concept of an Adversarial Reaction Score (ARS) as an alternative OSR score. The ARS measures the reaction to an adversarial attack applied to a given input. We define the ARS as the signed difference between the MLS (or MSP) before and after the adversarial attack:S adv (y ∈ F | x) = max y f θ (x adv ) y -max y f θ (x) y (9)Note that this can lead to the comparison of scores coming from different categories for the original and adversarial version. 
experimental results: 
 We experiment with the TinyImageNet dataset [23] , described as one of the most challenging benchmarks used in the OSR literature [3] . Here we use the openset split presented in Vaze et al. [3] and follow their experimental setup. TinyImageNet consists of a subset of 200 ImageNet categories [24] , whereas 20 classes are used as the closed-set training dataset and 180 classes as the open-set. The CNN architecture used is a VGG322 , a lightweight version of the VGG architecture [25] . This results in a reproduced closedset accuracy of 84.2% averaged over five class splits.We report the OSR performance of the MLS for the first of the five splits with the area under the Receiver-Operator curve (AUROC). The AUROC is a threshold-less metric that evaluates the ranking from open-set to closed-set samples. As a higher AUROC means better OSR performance, adversarial attacks aim to lower the AUROC. ROC is rather preserved (Fig. 2(a) ). Hence, the FN 280 attacks not only increase the familiarity (i.e.; MLS) of the novel but also of the familiar samples, which preserves the ranking (See also Fig. 3(a) ). In contrast, FP attacks cannot decrease the median MLS below the 1st percentile of the original test scores (Fig. 2(d) ), but the ranking (AUROC) is effectively destroyed (Fig. 2(b) ). This suggests that FP attacks tend to decrease the scores of the closed-set more than the scores of the open-set. Our experiments confirm the prediction of Dietterich & Guyer [9] that it is very easy to raise the logit score, which only leads to effective FN attacks in the informed setting. However, our results reveal that for uninformed attacks the ability to easily raise the logit score is not the key to attack the ranking of familiarity-based OSR approaches.While some objective functions are able to perform both types of attacks by swapping the sign, no objective is clearly best for both FN and FP attacks (Fig. 2 (a), 2(b)). FGSM FN attacks achieve lowest AUROC using the Log-MSP loss and second lowest FGSM vs. iterative attacks. Informed iterative attacks are able to decrease the AUROC by an order of magnitude compared to informed FGSM attacks using the same or even smaller ε (Fig. 4 ).The AUROC for FP attacks is decreased from 0.34 (FGSM) to 0.06 (iterative) and for FN attack from 0.12 (FGSM) to 0.01 (iterative).Informed attacks reverse the ranking almost perfectly. To study the OSR performance in the informed setting, we use the loss functions that performed best in the uninformed setting, i.e. the 2norm loss for FP and the max loss for FN attacks. In Fig. 2 (c),2(d), we see that these loss functions alter the median MLS the most. While for the FN attack the median MLS of the adversarial samples even exceeds the 99th percentile of the test dataset, for the FP attacks it is not possible to decrease the me-324 dian below the 1st percentile. However, as expected, 325 informed FGSM attacks can improve substantially 326 over uninformed attacks (See Fig. 4 ). Informed 327 FGSM and iterative attacks are able to reverse the 328 ranking of novel and familiar images almost per-329 fectly when using both FP attacks on familiar and 330 FN attacks on novel samples together (Fig. 4 ).Can adversarial reaction scores be used for 332 OSR? We calculated the ARS as in Eq. 9 by obtain-333 ing x adv with the FGSM using all combinations of 334 loss-functions ( 5)-( 8), attack types (i.e. FN and FP) 335 and ε-values. While all combinations exhibit similar 336 behaviour, we focus only on the combination that 337 achieved the best result. We found this to be the 338 MLS based ARS using FP FGSM with the 2-norm 339 loss and ε = 0.051. This resulted in an AUROC 340 of 0.81 compared to the 0.83 obtained by the MLS 341 scoring rule. Statistics from the evaluation of our 342 best ARS are shown in Fig. 5 . We use the model weights published on: https://github. com/sgvaze/osr_closed_set_all_you_need (accessed 2023-05-23). 
 
 Appendix:  


Decision: ## Paper Summary

The paper investigates the vulnerability of Open-Set Recognition (OSR) systems to adversarial attacks of two distinct types: 1) False Familiarity (or False Negative), when the objective is to lower the logit scores of familiar classes; and 2) False Novelty (or False Positive), which aims for an increasing on the logits of the novel class so that it is regarded as familiar to an OSR system. The authors also explore different ways of generating adversarial inputs (based on the Fast Gradient Sign Method and an iterative approach), as well as whether the attack is informed or uniformed, meaning that the OSR system may or may not know _a priori_ which type of attack it will deal with. Experiments conducted on the TinyImageNet dataset with diverse levels of adversarial perturbation showed that the logits can be easily increased with those adversarial perturbations, which leads to a higher effectiveness of FN attacks in the informed scenario. On the other hand, for the uninformed scenario, it was shown that FP attacks were more effective, as they destroy the original classification rankings by hiding familiar features, corroborating the Familiarity Hypothesis postulated by Dietterich & Guyer. Although there is no conclusion about which scenario (informed or uninformed) is better, the authors showed that iterative attacks are more effective than FGSM, which opens the door to further investigations on this specific modality. Finally, the authors proposed and dicussed an alternative metric for OSR systems called Adversarial Reaction Score (ARS), analyzing its potential correlations against well-established OSR score metrics, such as the Maximum Logit Score (MLS) and the Maximum Softmax Probability (MSP).

## General Comments

The paper looks well-written, with clear research questions and showcases a substantial variety of test scenarios, seeming to be pretty hard to make them fit in a 6-page manuscript. Even though the proposed ARS metric has not shown a significant improvement, some important questions have been raised about the possibilities of adversarial attacks and their respective effects under an open-set scenario, which could inspire other researchers in the field to explore new possibilities. Nevertheless, I believe the authors did a great job, especially after having addressed all the reviewers' suggestions. I hereby recommend the acceptance of this paper.

## Strengths

* Great paper organization, with very informative illustrations and examples, especially Figures 1 and 2;
* High variety of research questions, which were properly addressed along the manuscript;
* Highlights the potential perils of adversarial attacks based on image perturbations, which incentivates the research for more robust OSR methods.

## Weaknesses

* The concepts presented in the paper are not much novel;
* Absence of comparison against other networks, having only conducted tests on the VGG32 architecture;
* Adoption of ARS as a new OSR metric is still questionable, although there is room for improvements;

Reviews: review: title: title: Interesting experimental analysis into (a) best practices for and (b) comparisons between adversarial attacks for open set recognition.
paper_summary: paper_summary: This paper performs an analysis into adversarial attacks for open set recognition (OSR)†, that is methods that can trick ML classification systems into either believing an in-distribution class is actually out-of-distribution (called a false novelty or FP attack) or vice versa (called a false familiarity or FN attack). This paper first introduces these concepts (section 1) and attack methods (mainly variants of existing adversarial attack methods; section 2), before then performing experiments (section 3) assessing the following aspects of OSR attacks:    
1. Whether it's easier to perform an FP attack or FN attack (Figures 2–3), which is perhaps linked to how the OSR approach actually works (i.e., whether it looks for the presence of "unusual features" or the absence of "usual features").    
_results: FN attacks are easier (when the attacker knows whether the image belongs to closed or open set)._
2. How iterative attacks compare to single step attacks (e.g., FGSM [10]) in effectiveness (Figure 3).  
_results: iterative attacks are found to be more effective and almost able to perfectly attack the classifier under consideration._
3. How uninformed attacks compare against informed attacks (an uninformed attacker does not know whether the input image is currently in or out of distribution, or in other words part of the closed set).  
_results: an attacker can do much better in an informed attack (as expected), but perhaps more surprisingly this affects FN attacks more than FP attacks._
4. Can downstream effects of adversarial attacks be used as an OSR method (Section 2.6 and Figure 4).  
_results: yes, but not sufficiently better than the max logit approach, which is a much simpler method._



† The OSR is done here by looking at the magnitudes of the logits of a classifier. However, the paper also investigates whether one can use downstream effects of adversarial attacks as an OSR method itself (Section 2.6 of paper and point 4 above).
main_review: main_review: Having read the rebuttal and the other reviews, I still hold similar views to my original review. I thought the analysis into adversarial attacks for OSR was interesting, although limited in the OSR methods assessed (authors also acknowledge this). I thought the authors did a good job with the rebuttal and answered several of my questions, also promising to provide more information on the more interesting informed attacks. It was good to see one of the other reviewer's concerns seemingly resolved as a typo. I've gone with a lower confidence score due my familiarity with some of the related work.
strength_weakness: strength_weakness: ###  W1 More focus currently on uninformed attacks versus informed attacks 
More focus seems to be on the uninformed attacks (figure 2) rather than the informed attacks (figure 3). This means that there is less relative space to analyze the informed attacks, which I think are the more interesting of the two. For instance, the difference between using different objective functions for the informed attacks is not shown in the paper's figures, which would have been nice to include.

### W2 Missing analysis into how attack's objective interacts with OSR method
Currently the different attacks are evaluated against only one OSR method (MLS). It is unclear whether the presented findings would apply to other methods (e.g., the mentioned MSP or even techniques using separate classifiers such as [7]), and so somewhat reduces the potential significance of the paper.



### Misc. Other Questions
Q1. Line 309 says "max loss" is better for FN attacks; however, from Figure 2a I would have thought Log-MSP is actually slightly better?    
Q2: For FN attacks does the L2 Norm loss not have a similar limitation as to when it is used in the FP setting, which is explained on line 198 (i.e., that you can make a logit negative to increase this score without this affecting the MLS score and subsequent classification as not part of the closed set)?   
Q3: I was a little confused that the MLS went back down in Figure 2c or back up in Figure 2d as $\epsilon$ increased, even though the AUROC continued to go down (i.e., the attack worked better from the attacker's perspective). Is there any intuition for this result? Is the same effect seen with the iterative attacks?   
Q4: Figure 2c & d only show the median of the max logit score. What do the distributions of these scores look like? Presumably they are somewhat bimodal (due to the images from both the familiar and novel classes being included)?

### Minor typos (does not affect my score/review)
* line 104: "evaluate" -> "evaluated"
* Figure 2 captions on subplots: "advesarial" -> "adversarial"
* line 267: "uniformed" -> "uninformed"
title: title: First Review
paper_summary: paper_summary: The authors investigated the concept of adversarial Out-of-Distribution (OOD) examples [1]. More in detail, the paper focuses on two OOD detection methods (Maximum Softmax Probability (MSP) and Maximum Logit Score (MLS)) and gradient-based adversarial attacks (FGSM and BIM). The aim is generating adversarial In-Distribution examples (false negatives), wrongly accepted by an OOD detector, and adversarial OOD examples (false positives), with the reverse effect. The authors proposed different definitions of attack towards either ID or OOD samples, and also validated strategy is best when an attacker does not know if a sample is ID or OOD. Last, the adversarial OOD attack was suggested as a strategy to improve OOD detection, however the benchmark did not improve over the baseline (MLS).


[1] "Adversarial OOD examples are constructed w.r.t the OOD detector, which is different from the standard notion of adversarial examples (constructed w.r.t the classification model).", from Chen, Jiefeng, et al. "Atom: Robustifying out-of-distribution detection using outlier mining." Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13–17, 2021, Proceedings, Part III 21. Springer International Publishing, 2021.
main_review: main_review: As I mentioned in my original review, I believe the paper has a clear presentation. Initially, I had concerns regarding existing frameworks for ID/OOD adversarial examples. However, I reconsidered this given that the authors specifically focused on Open Set Recognition (OSR), whereas prior work concentrated mostly on OOD. My second concern was on the significance of the results, that the authors have improved (or will improve in the camera-ready) by better explaining the experiments and by including additional analysis (Novel vs Familiar MLS, multiple $\epsilon$-values for the informed attack). My final opinion is inclined toward accepting the work.
strength_weakness: strength_weakness: - The main weakness is that the concept of adversarial ID/OOD is not novel [1,2,5], therefore the authors should reference and address existing baselines. In [1,2] adversarial OOD/ID have been defined for both softmax and distance based OOD detectors, with stronger white- and black-box attacks, by also introducing approaches to make detection more reliable.
- The authors proposed a white-box attack, therefore it seems to me an unrealistic constraint to suppose that the attacker has access to the model weights but not the ID/OOD label (that the attacker can compute given the OOD output).
- The ARS does not improve over the baseline, even in a scenario where (correct me if I am wrong) ARS hyperparameters have been selected on the test set (instead of a validation set). In this regard, a previous similar approaches, considering the difference between normal and perturbed logits for detection, could help the authors improve their work [3].
- The experimental setup is quite limited (one model, one ID dataset).
- The literature review on generalized OOD detection should be updated with more recent benchmarks [4].

[1] Chen, Jiefeng, et al. "Atom: Robustifying out-of-distribution detection using outlier mining." Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13–17, 2021, Proceedings, Part III 21. Springer International Publishing, 2021.

[2] Chen, Jiefeng, et al. "Robust out-of-distribution detection for neural networks." arXiv preprint arXiv:2003.09711 (2020).

[3] Roth, Kevin, Yannic Kilcher, and Thomas Hofmann. "The odds are odd: A statistical test for detecting adversarial examples." International Conference on Machine Learning. PMLR, 2019.

[4] Zhang, Jingyang, et al. "Openood v1. 5: Enhanced benchmark for out-of-distribution detection." arXiv preprint arXiv:2306.09301 (2023).

[5] Azizmalayeri, Mohammad, et al. "Your out-of-distribution detection method is not robust!." Advances in Neural Information Processing Systems 35 (2022): 4887-4901.
title: title: Well motivated research, but there are concerns on the main claims
paper_summary: paper_summary: Open-set recognition (OSR) task is a special type of out-of-distribution (OOD) task. In OSR, we need to distinguish samples from novel classes (unseen during training) and familiar (known) classes. Recent works have demonstrated that familiarity-based scores can achieve competitive performances in OSR tasks. Familiarity-based scores use the maximum estimated probability of (known) classes (Maximum SoftMax Probability, MSP) or the maximum logit output of (known) classes (Maximum Logit Score, MLS). The hypothesis of Dietterich & Guyer can be summarized as "the logit score on only one class can be easily increased with an adversarial perturbation while it might be more difficult to decrease the logit score for all (known) classes." From this, the paper first speculates that it will be easier to cause false familiarity than to cause false novelty. 

This research investigated adversarial attacks on MLS. In uninformed attacks, where the attacker does not know if a sample is known or novel, false novelty (and false familiarity) attacks are applied on both known and novel samples to destroy the familiarity ranking of samples. In informed attacks, where the attacker knows if a sample is known or novel, a false familiarity (FN) attack is applied to novel samples to increase MLS values. A false novelty (FP) attack is applied to known samples to reduce MLS values. 

The analysis found that in uninformed settings, as shown in Fig. 2(a) and 2(b), the FP attack is more effective in destroying the rankings than the FN attack. From Fig. 2(c) and 2(d), the paper explained this result with the hypothesis of Dietterich & Guyer. FN attack might effectively increase MLS of both known and novel samples which preserves the familiarity ranking of samples. On the other hand, an FP attack might be more effective in decreasing the MLS of known samples which destroys the familiarity ranking of samples. In informed settings, the research found that the FN attack is more effective in destroying the rankings (shown in Fig. 3). The paper concluded that the results confirm the hypothesis of Dietterich & Guyer.
main_review: main_review: The adversarial attacks on OSR are problems that are worth investigating. Moreover, investigating the Familiarity Hypothesis is also important research regarding OSR. The research tried to answer several questions about adversarial attacks on OSR.

Edit: Previously, I had concerns regarding the correctness of the claims (hypothesis of Dietterich & Guyer: the (maximum) logit score can be more easily increased with an adversarial perturbation than decreasing it, fairness of comparing FP and FN efficiency in the informed setting). The author(s) addressed these concerns through updates and responses. I am now leaning toward the acceptance of the work.
strength_weakness: strength_weakness: One of the major claims in the paper is that it confirmed the prediction of Dietterich & Guyer: it will be easier to familiarity score than to decrease it (as later requires changing logit/SoftMax of "all" known classes). In lines 268 to 286, the paper derived this from the uninformed attack situation. However, as uninformed attacks are applied on both novel and familiar samples, the majority of MLS change may occur in either novel or familiar samples (not both). While it is counterintuitive, it is still possible that when epsilon is small (around 0.2), most of the MLS increase in FN attacks happened only in familiar samples. In that case, the speculation in lines 271-274 makes less sense. (This speculation is likely correct, but the shown results do not "confirm" the hypothesis of Dietterich & Guyer.) Moreover, when epsilon was large (at least 0.8) in FN attack, Fig. 2(a) and 2(c) show a puzzling phenomenon where MLS was almost recovered while AUROC was low. This phenomenon seems to contradict the claim of ease in increasing the logit score. Because of these issues, we need MLS change plots for novel samples and the corresponding plots, separately, for familiar samples to properly conclude the claim. (Specificity and sensitivity plots for various epsilons can also be helpful. Less important figures like Fig. 2(e), 2(f), and Fig. 3 can be moved to the appendix instead.)

For the informed attack situation, the paper used only one epsilon value for each setting. Moreover, larger epsilon values were used for the FN attack than for the FP attack. Hence, it is hard to judge if the FN attack is more effective than the FP attack in informed attack settings. To compare the effectiveness of two attacks, it is better to show the results from at least 2 epsilon values with the same epsilon values for FP and FN attacks. 

While the paper intuitively explained (Fig. 1 and lines 61-65) that False Novelty attack might be harder as it requires to reduce logits (or SoftMax prediction) for "all (known) classes" (unlike False Familiarity attack where changing "one class" is enough), there is no experiment on the effect of the number of known (familiar) classes.

While it is not necessary, identifying the relationship between the number of known (familiar) classes and the relative efficiency of FP/FN attacks in the informed setting can greatly strengthen the paper. 

It can be confusing for the readers that MLS outperforms MSP in OSR performance (in lines 125 to 128) given their equivalence except for the magnitudes information in logits (as explained by Vaze et al.). It would be nicer if the paper briefly explained how MLS could outperform MSP. 

It would be nice if the goal of the attacks (destroying ranks of samples) were explained when uninformed attacks were first introduced (lines 210-212).

While the paper used a non-traditional approach (RPROP) for iterative adversarial attacks, the paper did not provide or mention any plan for releasing their code. Attack hyperparameters, such as the number of steps, are also missing. I would recommend releasing the code for reproducibility.

*Minor comment (not affect rating)
While the title and abstract (lines 11-12) seem to indicate that the paper analyzed both familiarity-based Open-Set Recognition (OSR) approaches (MSP+MLS), the paper only experimented with one (MLS) of them.

In line 139, there are two periods (typo).

The terms "False Familiarity (FN)" and "False Novelty (FP)" attacks are confusing, especially in uninformed settings, as these are applied to both novel and familiar (known) samples. For instance, applying a "False Novelty (FP)" attack on "a novel sample" might result in "a perturbed novel sample" (it is a novel sample, but not a "False novel" sample). Perhaps, terms like "Familiarity (F)" or "Novelty (N)" attacks might be more appropriate in uninformed settings. Personally, using "F" and "N" for abbreviations is less confusing than using "N" and "P".

The real class $y$ is actually not used in OSR attacks, unlike closed-set attacks. Hence, y can be removed from OSR attack losses. For instance, $L_{max}(\theta,x,y)$ can be written as $L_{max}(\theta,x)$.

The x-axis of Fig. 2(a), 2(b), 2(c), and 2(d) seems to represent the "relative size of epsilon" rather than the "(actual) size of epsilon".

In lines 311 to 315, it seems the author(s) mistakenly swapped "FP" and "FN" attacks. 

In equation (9), the shown formulation can use a different class for $f(x^{adv})$ and $f(x)$. Is it intended or a mistake (perhaps, intended for $f(x^{adv})\_{y^*}-f(x)\_{y^*}$ where $y^*$ is $\text{argmax}\_{y} f(x)$)? Which formulation was used in the implementation?

The changes in MLS are not monotonic in Fig. 2(c) and 2(d). Can the author(s) explain possible reasons for this? Perhaps due to linear attack (FGSM)?