Why did the tensor representing the perturbation usually becoming nan during attack?

[LuckyChocolate]

[CraHdz]

Change r = torch.ones_like(pert_a) in line 110 of the util.py file to pert_a = torch.ones_like(pert_a)

[LuckyChocolate]

It can solve this problem. But then the adversarial attack would fail to distort the output image in the expected manner.

[ZOMIN28]

you can change the codes in utils.py as:
pert_a = (torch.zeros(X_nat.shape[0], 2, X_nat.shape[2], X_nat.shape[3])+ 0.01).cuda().requires_grad_()

[LuckyChocolate]

you can change the codes in utils.py as: pert_a = (torch.zeros(X_nat.shape[0], 2, X_nat.shape[2], X_nat.shape[3])+ 0.01).cuda().requires_grad_()

It can partially solve the problem, but also results in bad performance which is incompatible with that in the original paper.

[ZOMIN28]

I think I've found the problem. I print the value of pert_a in every attack_iter. In the first iteration, after performing gradient descent, some values in the tensor pert_a will become nan. In my opinion, it should be that the all-0 initialization is problematic for the optimization process. This problem can be solved if a small value is set for the perturbation during initialisation.
So I tried to use 0.01 to initialize the perturbation and that did help.
I wish the author of this paper would give his initialization values.