def _test_backend_mnist(self, classifier):
# Get MNIST
(x_train, y_train), (x_test, y_test) = self.mnist
# Test PGD with np.inf norm
attack = ProjectedGradientDescent(classifier, eps=1, eps_step=0.1)
x_train_adv = attack.generate(x_train)
x_test_adv = attack.generate(x_test)
self.assertFalse((x_train == x_train_adv).all())
self.assertFalse((x_test == x_test_adv).all())
train_y_pred = get_labels_np_array(classifier.predict(x_train_adv))
test_y_pred = get_labels_np_array(classifier.predict(x_test_adv))
self.assertFalse((y_train == train_y_pred).all())
self.assertFalse((y_test == test_y_pred).all())
acc = np.sum(
np.argmax(train_y_pred, axis=1) == np.argmax(
y_train, axis=1)) / y_train.shape[0]
logger.info('Accuracy on adversarial train examples: %.2f%%',
acc * 100)
acc = np.sum(
np.argmax(test_y_pred, axis=1) == np.argmax(
y_test, axis=1)) / y_test.shape[0]
logger.info('Accuracy on adversarial test examples: %.2f%%', acc * 100)
def test_iris_k_unbounded(self):
(_, _), (x_test, y_test) = self.iris
classifier, _ = get_iris_classifier_kr()
# Recreate a classifier without clip values
classifier = KerasClassifier(model=classifier._model,
use_logits=False,
channel_index=1)
attack = ProjectedGradientDescent(classifier, eps=1, eps_step=0.2)
x_test_adv = attack.generate(x_test)
self.assertFalse((x_test == x_test_adv).all())
self.assertTrue((x_test_adv > 1).any())
self.assertTrue((x_test_adv < 0).any())
preds_adv = np.argmax(classifier.predict(x_test_adv), axis=1)
self.assertFalse((np.argmax(y_test, axis=1) == preds_adv).all())
acc = np.sum(preds_adv == np.argmax(y_test, axis=1)) / y_test.shape[0]
logger.info('Accuracy on Iris with PGD adversarial examples: %.2f%%',
(acc * 100))
def GetAttackers(classifier, x_test, attacker_name):
"""
Function:
Load classifier and generate adversarial samples
"""
t_start = time.time()
if attacker_name == "FGSM":
attacker = FastGradientMethod(classifier=classifier, eps=0.3)
elif attacker_name == "Elastic":
attacker = ElasticNet(classifier=classifier, confidence=0.5)
elif attacker_name == "BasicIterativeMethod":
attacker = BasicIterativeMethod(classifier=classifier, eps=0.3)
elif attacker_name == "NewtonFool":
attacker = NewtonFool(classifier=classifier, max_iter=20)
elif attacker_name == "HopSkipJump":
attacker = HopSkipJump(classifier=classifier, max_iter=20)
elif attacker_name == "ZooAttack":
attacker = ZooAttack(classifier=classifier, max_iter=20)
elif attacker_name == "VirtualAdversarialMethod":
attacker = VirtualAdversarialMethod(classifier=classifier, max_iter=20)
elif attacker_name == "UniversalPerturbation":
attacker = UniversalPerturbation(classifier=classifier, max_iter=20)
elif attacker_name == "AdversarialPatch":
attacker = AdversarialPatch(classifier=classifier, max_iter=20)
elif attacker_name == "Attack":
attacker = Attack(classifier=classifier)
elif attacker_name == "BoundaryAttack":
attacker = BoundaryAttack(classifier=classifier,
targeted=False,
epsilon=0.05,
max_iter=20) #, max_iter=20
elif attacker_name == "CarliniL2":
attacker = CarliniL2Method(classifier=classifier,
confidence=0.5,
learning_rate=0.001,
max_iter=15)
elif attacker_name == "CarliniLinf":
attacker = CarliniLInfMethod(classifier=classifier,
confidence=0.5,
learning_rate=0.001,
max_iter=15)
elif attacker_name == "DeepFool":
attacker = DeepFool(classifier)
elif attacker_name == "SMM":
attacker = SaliencyMapMethod(classifier=classifier, theta=2)
elif attacker_name == "PGD":
attacker = ProjectedGradientDescent(classifier=classifier,
norm=2,
eps=1,
eps_step=0.5)
else:
raise ValueError("Please get the right attacker's name for the input.")
test_adv = attacker.generate(x_test)
dt = time.time() - t_start
return test_adv, dt
def test_iris_pt(self):
(_, _), (x_test, y_test) = self.iris
classifier = get_iris_classifier_pt()
# Test untargeted attack
attack = ProjectedGradientDescent(classifier, eps=1, eps_step=0.1)
x_test_adv = attack.generate(x_test)
self.assertFalse((x_test == x_test_adv).all())
self.assertTrue((x_test_adv <= 1).all())
self.assertTrue((x_test_adv >= 0).all())
preds_adv = np.argmax(classifier.predict(x_test_adv), axis=1)
self.assertFalse((np.argmax(y_test, axis=1) == preds_adv).all())
acc = np.sum(preds_adv == np.argmax(y_test, axis=1)) / y_test.shape[0]
logger.info('Accuracy on Iris with PGD adversarial examples: %.2f%%',
(acc * 100))
# Test targeted attack
targets = random_targets(y_test, nb_classes=3)
attack = ProjectedGradientDescent(classifier,
targeted=True,
eps=1,
eps_step=0.1)
x_test_adv = attack.generate(x_test, **{'y': targets})
self.assertFalse((x_test == x_test_adv).all())
self.assertTrue((x_test_adv <= 1).all())
self.assertTrue((x_test_adv >= 0).all())
preds_adv = np.argmax(classifier.predict(x_test_adv), axis=1)
self.assertTrue((np.argmax(targets, axis=1) == preds_adv).any())
acc = np.sum(preds_adv == np.argmax(targets, axis=1)) / y_test.shape[0]
logger.info('Success rate of targeted PGD on Iris: %.2f%%',
(acc * 100))
def save_adversarial_examples_batch(clean_dir, params=[0.01, 0.002, 20]):
"""
Scripts for pre-computing and saving adversarial examples with IBM-ART
:param clean_dir: root directory of the legitimate clean data
:param params: parameters used for customizing attacks
:return: None
"""
batch_size = 16
adv_dir = os.path.dirname(clean_dir) + "_adv_resnet152_pgd-{0}-{1}-{2}".format(params[0], params[1], params[2])
# Load pretrained model
model = models.resnet152(pretrained=True).cuda().eval()
# Build crafter for adversarial examples
mean = np.array([0.485, 0.456, 0.406]).reshape((3, 1, 1))
std = np.array([0.229, 0.224, 0.225]).reshape((3, 1, 1))
classifier = PyTorchClassifier((0.0, 1.0), model=model, preprocessing=(mean, std),
loss=torch.nn.modules.loss.CrossEntropyLoss(),
optimizer= 'hello-world', # torch.optim.Adam, # doesn't really matter for pretrained networks
input_shape=(3, 224, 224), nb_classes=1000)
adv_crafter = ProjectedGradientDescent(classifier,
eps=params[0], eps_step=params[1], max_iter=params[2])
image_paths = sorted(glob(clean_dir + '/**/*.JPEG', recursive=True))
count = 0
for start in range(0, len(image_paths), batch_size):
end = min(start + batch_size, len(image_paths))
image_batch_paths = image_paths[start:end]
images = load_image_batch(image_batch_paths)
adv_images = adv_crafter.generate(x=images)
assert len(adv_images) == len(images)
print("start: %d, end: %d" % (start, end))
for (image_path, adv_image) in zip(image_batch_paths, adv_images):
output_path = os.path.join(adv_dir, image_path[len(clean_dir):])
save_array_to_image(adv_image, output_path)
count += 1
print(count)
print('\nMetrics:%.2f, %.2f, %.3f, %.3f' % (measure[0:4]))
if Defense:
defenses(model, X, FEA_X, FS=True, SS=True)
if Transfer:
transfer(X, FEA_X)
if Show:
FEA_X = (FEA_X + 1) / 2
grid_visual(
np.swapaxes(
np.reshape(
FEA_X,
(10, FEA_X.shape[0] // 10, img_rows, img_cols, nchannels)),
0, 1))
if 'PGD_art' in attacks:
pgd = PGD_art(art)
if NORM == 2:
pgd_params = {
'eps': 10.,
'eps_step': EPS,
'max_iter': MAX_ITER,
'norm': 2,
# 'batch_size': 1,
}
elif NORM == np.inf:
pgd_params = {
'eps': 10.,
'eps_step': EPS,
'max_iter': MAX_ITER,
'norm': np.inf,
# 'batch_size': 1,
mnist_classifier = PyTorchClassifier(clip_values=(0, 1), model=model, loss=criterion, optimizer=optimizer,
input_shape=(1, 28, 28), nb_classes=10)
# Train the classifier
# mnist_classifier.fit(x_train, y_train, batch_size=64, nb_epochs=50)
# torch.save(model.state_dict(), "./minst.pt")
model.load_state_dict(torch.load("../checkpoints/model-nn-epoch100.pt"))
# Test the classifier
predictions = mnist_classifier.predict(test_dataset_array)
# print(predictions)
accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(y_test)
print('Accuracy before attack: {}%'.format(accuracy * 100))
# Craft the adversarial examples
epsilon = 0.2 # Maximum perturbation
# adv_crafter = AdversarialPatch(mnist_classifier, batch_size=16, max_iter=10)
# adv_crafter = FastGradientMethod(mnist_classifier, eps=epsilon)
# adv_crafter = CarliniL2Method(mnist_classifier)
adv_crafter = ProjectedGradientDescent(mnist_classifier)
# adv_crafter = DeepFool(mnist_classifier, epsilon=epsilon, max_iter=10)
x_test_adv = adv_crafter.generate(x=x_test)
# Test the classifier on adversarial exmaples
print(x_test_adv)
predictions = mnist_classifier.predict(x_test_adv)
accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(y_test)
print('Accuracy after attack: {}%'.format(accuracy * 100))
print('Accuracy before attack: {}%'.format(accuracy * 100))
# Craft the adversarial examples
# PGD-20
# adv_crafter_pgd_40 = ProjectedGradientDescent(mnist_classifier, eps=epsilon, max_iter=40, batch_size=batch_size)
#
# x_test_adv = adv_crafter_pgd_40.generate(x=test_dataset_array)
# Test the classifier on adversarial exmaples
# predictions = mnist_classifier.predict(x_test_adv)
# accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(test_label_dataset_array)
# print('Accuracy after PGD-20 attack: {}%'.format(accuracy * 100))
# PGD-100
adv_crafter_pgd_100 = ProjectedGradientDescent(mnist_classifier, max_iter=100, batch_size=batch_size)
x_test_adv = adv_crafter_pgd_100.generate(x=test_dataset_array)
# Test the classifier on adversarial exmaples
predictions = mnist_classifier.predict(x_test_adv)
accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(test_label_dataset_array)
print('Accuracy after PGD-100 attack: {}%'.format(accuracy * 100))
# FGSM
adv_crafter_fgsm = FastGradientMethod(mnist_classifier, eps=epsilon, batch_size=batch_size)
x_test_adv = adv_crafter_fgsm.generate(x=test_dataset_array)
# Test the classifier on adversarial exmaples
predictions = mnist_classifier.predict(x_test_adv)
accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(test_label_dataset_array)
# Craft the adversarial examples
# # PGD-20
# adv_crafter_pgd_20 = ProjectedGradientDescent(cifar_classifier, eps=epsilon, eps_step=0.01, max_iter=20, batch_size=batch_size)
#
# x_test_adv = adv_crafter_pgd_20.generate(x=test_dataset_array)
#
# # Test the classifier on adversarial exmaples
# predictions = cifar_classifier.predict(x_test_adv)
# accuracy = np.sum(np.argmax(predictions, axis=1) == test_label_dataset_array) / len(test_label_dataset_array)
# print('Accuracy after PGD-20 attack: {}%'.format(accuracy * 100))
# PGD-100
adv_crafter_pgd_100 = ProjectedGradientDescent(cifar_classifier,
eps=epsilon,
eps_step=0.01,
max_iter=100,
batch_size=batch_size)
x_test_adv = adv_crafter_pgd_100.generate(x=test_dataset_array)
# Test the classifier on adversarial exmaples
predictions = cifar_classifier.predict(x_test_adv)
accuracy = np.sum(
np.argmax(predictions, axis=1) == test_label_dataset_array) / len(
test_label_dataset_array)
print('Accuracy after PGD-100 attack: {}%'.format(accuracy * 100))
# FGSM
adv_crafter_fgsm = FastGradientMethod(cifar_classifier,
eps=epsilon,
begin_time = time.time()
robust_classifier_model = load_model("./model/adv_model")
robust_classifier = KerasClassifier((0., 1.), robust_classifier_model)
# ==================================2-1.准备对抗训练的攻击方法 =============================== #
"""
The `ratio` determines how many of the clean samples in each batch are replaced with their adversarial counterpart.
warning: Both successful and unsuccessful adversarial samples are used for training. In the case of unbounded attacks
(e.g., DeepFool), this can result in invalid (very noisy) samples being included.
"""
if adv_train_attack == "FGM":
attacks = FastGradientMethod(robust_classifier, eps=attack_par["epsilon"], norm=attack_par["norm_type"])
elif adv_train_attack == "BIM":
attacks = BasicIterativeMethod(robust_classifier, norm=attack_par["norm_type"], eps=attack_par["epsilon"],
eps_step=attack_par["epsilon_step"], max_iter=attack_par["max_iteration"])
elif adv_train_attack == "PGD":
attacks = ProjectedGradientDescent(robust_classifier, norm=attack_par["norm_type"], eps=attack_par["epsilon"],
eps_step=attack_par["epsilon_step"], max_iter=attack_par["max_iteration"])
elif adv_train_attack == "JSMA":
attacks = SaliencyMapMethod(robust_classifier, theta=attack_par["theta"], gamma=attack_par["gamma"])
elif adv_train_attack == "DeepFool":
attacks = DeepFool(robust_classifier, max_iter=attack_par["max_iteration"], epsilon=attack_par["epsilon"])
# ==================================2-2.开始对抗训练 =============================== #
trainer = AdversarialTrainer(robust_classifier, attacks, ratio=ratio_value)
trainer.fit(x_train, y_train, nb_epochs=adv_train_num, batch_size=128, verbose=2)
robust_classifier_model.save("./model/adv_model")
end_time = time.time()
model = load_model("./model/adv_model")
scores = model.evaluate(x_test, y_test, verbose=0)
# print('Test loss:', scores[0])
# print('Test accuracy:', scores[1])
optimizer=optimizer,
input_shape=(1, 28, 28),
nb_classes=10)
# Train the classifier
cifar_classifier.fit(x_train, y_train, batch_size=64, nb_epochs=10)
# Test the classifier
predictions = cifar_classifier.predict(x_test)
accuracy = np.sum(
np.argmax(predictions, axis=1) == np.argmax(y_test, axis=1)) / len(y_test)
print('Accuracy before attack: {}%'.format(accuracy * 100))
# Craft the adversarial examples
epsilon = 0.2 # Maximum perturbation
adv_crafter = ProjectedGradientDescent(cifar_classifier, eps=epsilon)
x_test_adv = adv_crafter.generate(x=x_test)
# Test the classifier on adversarial exmaples
predictions = cifar_classifier.predict(x_test_adv)
accuracy = np.sum(
np.argmax(predictions, axis=1) == np.argmax(y_test, axis=1)) / len(y_test)
print('Accuracy after attack: {}%'.format(accuracy * 100))
cifar_classifier.save('cifar_fgsm_state_dict', 'models')
preprocess = Autoencoder()
preprocess.load_state_dict(torch.load('models/conv_autoencoder.pth'))
x_test_adv = torch.from_numpy(x_test_adv)
x_test_denoised = preprocess(x_test_adv)
model.load_state_dict(torch.load(file))
# Test the classifier
predictions = mnist_classifier.predict(test_dataset_array)
accuracy = np.sum(
np.argmax(predictions, axis=1) == test_label_dataset_array) / len(
test_label_dataset_array)
print('Accuracy before attack: {}%'.format(accuracy * 100))
# Craft the adversarial examples
# PGD-40
adv_crafter_pgd_40 = ProjectedGradientDescent(
mnist_classifier,
eps=args.epsilon,
max_iter=40,
batch_size=args.batch_size)
x_test_adv = adv_crafter_pgd_40.generate(x=test_dataset_array)
# Test the classifier on adversarial exmaples
predictions = mnist_classifier.predict(x_test_adv)
accuracy = np.sum(
np.argmax(predictions, axis=1) == test_label_dataset_array) / len(
test_label_dataset_array)
print('Accuracy after PGD-40 attack: {}%'.format(accuracy * 100))
log_file.write("{} {}\n".format(e, accuracy))
log_file.close()
