Applying the loss (7) to (1), the final formulation of targeted caption method given a targeted caption S is We note that (Carlini and Wagner, 2017) has reported that in CNN-based image classification, using logits in the attack loss function can produce better adversarial examples than using probabilities, especially when the target network deploys some gradient masking schemes such as defensive distillation (Papernot et al., 2016b).
we provide both logit-based and probability-based attack loss functions for neural image captioning.