Input format of attack images

[yi-sun]

During the contest itself, what will be the required input format of the attack images? The current images in bird-or-bicycle are 299 x 299 .jpg files.

1. Will this be the required dimension?
2. It may be more convenient for attackers to generate .png attacks, without changing the spirit of the contest. Will .jpg be required?

[carlini]

I think 299x299x3 PNG would be a perfectly fine format, but I don't think we've settled on those details.

Note that I don't think PNG/JPG/GIF actually changes much for attackers -- a defense could just as well apply these compression approaches as a pre-processing function, so it seems about as easy or hard for an attacker regardless of the input format.