HopSkipJump Attack Remark

[aliotopal]

HSJA works with two arguments (x,y) or with three arguments (x,y,x_adv_init). When running the HopSkipJump attack in ART with only (x, y) — i.e., without providing an initial adversarial example via x_adv_init — the attack consistently fails to generate adversarial images and terminates very quickly. We tested this behavior on 100 different correctly classified inputs x: In all cases, the attack ended early without creating any adversarial image and without showing any warning or error messages. This silent failure can mislead users into believing the attack succeeded when it did not. We recommend that future versions of ART add a warning or error to notify users when internal initialization fails to find a valid starting point x_adv_init.