Questions encountered when evaluating on adversarial images (by FGSM).

[EdyQiu]

Hello, I am writing codes to test models on adversarial images by FGSM, and I am not successful using either train or test modes.
Here is my modification (core part) of ImageClassifier to replace its "loss" function, and I choose the train mode:

def FGSM(self,
                inputs: torch.Tensor,
                data_samples: Optional[List[DataSample]] = None,
                **kwargs) -> List[DataSample]:
        eps=0.03
        x_val_min=-1
        x_val_max=1
# calculate the gradients
        inputs_adv = Variable(inputs, requires_grad=True)
        feats = self.extract_feat(inputs_adv) 
        cost = -self.head.loss(feats, data_samples)["loss"]
        if inputs_adv.grad is not None:
            inputs_adv.grad.data.fill_(0)
        self.zero_grad()
        cost.backward()
# generate the adversarial images
        inputs_adv.grad.sign_()
        inputs_adv = inputs_adv - eps*inputs_adv.grad
        inputs_adv = torch.clamp(inputs_adv, x_val_min, x_val_max)

# evaluate these images
        feats = self.extract_feat(inputs_adv)
        predictions = self.head.predict(feats, data_samples)

# save these results, because train mode will not do that 
        gt_temp,pl_temp  = [],[]
        for i in range(len(predictions)):
            gt_temp.append(predictions[i].get("gt_label").item())
            pl_temp.append(predictions[i].get("pred_label").item())
        gt_temp = np.array(gt_temp)
        pl_temp = np.array(pl_temp)
        gt_path = self.save_path + "/FGSM_gt.npy"
        pl_path = self.save_path  + "/FGSM_pl.npy" 

        gt, pl = np.load(gt_path),np.load(pl_path)
        gt, pl =np.append(gt,gt_temp),np.append(pl,pl_temp)
        np.save(gt_path, gt) 
        np.save(pl_path, pl) # these results will be used afterward for acc calculation
# return the loss, as required by the train mode, so that the code can run
        loss = self.head.loss(feats, data_samples)
        loss["loss"] =loss["loss"]*0
        return loss

I refer to these two webs for codes:
https://github.com/1Konny/FGSM/blob/master/adversary.py
https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/art/attacks/evasion/fast_gradient.py

Here are my questions:
1. Using test mode for evaluation seems natural, but the gradient seems not calculated( error in "cost.backward()"). When changing to train mode, this problem got solved. Therefore I am asking how to get "cost.backward()" work in the test model, this will be the easiest way to solve my problem.

here is the error:
_Traceback (most recent call last):
File "", line 1, in
File "/data/qiuxinkuan/anaconda3/envs/openmmlab/lib/python3.8/site-packages/torch/_tensor.py", line 488, in backward
torch.autograd.backward(
File "/data/qiuxinkuan/anaconda3/envs/openmmlab/lib/python3.8/site-packages/torch/autograd/init.py", line 197, in backward
Variable.execution_engine.run_backward( # Calls into the C++ engine to run the backward pass
RuntimeError: element 0 of tensors does not require grad and does not have a grad_fn

2. As mentioned above, I have to use the train mode, but I do not know how to prevent updating the model, because I want to evaluate a fixed model. I tried to set the learning rate to 0, but it seems the val acc are different for different iterations.
3. Any other suggestion to implement evaluation on adversarial images, since my implementation looks very ugly.