Stumbled upon 2 issues regarding the implementation of the momentum for Fast Gradient Method adversarial attack:

• The momentum is not computed the right way (see [FIX Enhancement] FGM and PGD: fix L1 and extend to Lp #2382 (comment));
• The implementation relies on in-place modification of the momentum variable as a side effect, which doesn't always seem to work as expected (see [FIX Enhancement] FGM and PGD: fix L1 and extend to Lp #2382 (comment)). As such, I believe that the current momentum iterative attack is actually only BIM!

The first issue should be fixed by #2382, while the second should be independently investigated and fixed, as it may require some refactoring. Furthermore, it could be well-advised to add a test for a different decay value.

Edit: It looks like the tensorflow framework doesn't work with the in-place modification.