def IterativeGradSign_h1(x, epsilon, grad_th, sbst):
W1 = sbst['W1']
b1 = sbst['b1']
W2 = sbst['W2']
b2 = sbst['b2']
actfun = sbst['act']
nInp = len(x)
nHid, nCls = np.shape(W2)
X = np.array(x)
W1 = np.array(W1)
W2 = np.array(W2)
W2_trans = np.transpose(W2)
Z = np.dot(X, W1) + b1 # weighted sum of layer 1
Y = fun.act(Z, actfun) # sigmoid output of the hidden layer
S = np.dot(Y, W2) + b2 # weighted sum of layer 2
L = fun.softmax(S) # Likelihood of every class # softmax output vector
A = np.dot(np.multiply(np.multiply(Y, 1 - Y), W1), np.transpose(W2_trans))
out = np.zeros((nCls, nInp))
for c in range(nCls): # Craft samples for all target classes
T = np.zeros(nCls)
T[c] = 1
G = (1 - T) / (1 - L) - T / L
D = np.zeros(nCls)
for k in range(nCls):
if k == c:
D[k] = L[k] * (1 - L[c])
else:
D[k] = -L[k] * L[c]
D = np.repeat(np.array([D]), nCls, axis=0)
Gradient = np.dot(G, np.dot(D, np.transpose(A)))
for i in range(nInp):
if Gradient[i] <= grad_th and Gradient[i] >= -grad_th:
Gradient[i] = 0
out[c] = x + epsilon * np.sign(Gradient)
out = np.clip(out, 0, 256)
return out
def Opt_L_BFGS_h1(x, sbst, coeff): W1 = sbst['W1'] b1 = sbst['b1'] W2 = sbst['W2'] b2 = sbst['b2'] actfun = sbst['act'] nInp = len(x) nHid, nCls = np.shape(W2) W1 = np.array(W1) W2 = np.array(W2) out = np.zeros((nCls,nInp)) for c in range(nCls): # Craft samples for all target classes objfun = lambda x_adv: coeff * np.linalg.norm(x_adv-x) - np.log(fun.softmax(np.dot(fun.act(np.dot(x_adv,W1) + b1, actfun),W2) + b2)[c]) bnds = np.concatenate((np.zeros((nInp,1)),np.ones((nInp,1))), axis=1) optRes = minimize(objfun, x, method='L-BFGS-B', bounds=bnds) out[c] = optRes.x return out