def model_z(nb_filters=32, nb_classes=10, input_shape=(None, 28, 28, 1)):
layers = [
Conv2D(nb_filters, (3, 3), (1, 1), "SAME"),
ReLU(),
Conv2D(nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Conv2D(2 * nb_filters, (3, 3), (1, 1), "VALID"),
ReLU(),
Conv2D(2 * nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Conv2D(4 * nb_filters, (3, 3), (1, 1), "VALID"),
ReLU(),
Conv2D(4 * nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Flatten(),
Linear(600),
ReLU(),
Dropout(0.5),
Linear(600),
ReLU(),
Dropout(0.5),
Linear(nb_classes),
Softmax()
]
model = DefenseMLP(layers, input_shape)
return model
def make_basic_picklable_substitute(nb_filters=200,
nb_classes=2,
input_shape=(None, 28, 28, 1)):
"""The model for the picklable models tutorial.
"""
layers = [
Flatten(),
Linear(nb_filters),
ReLU(),
Linear(nb_filters),
ReLU(),
Linear(nb_classes),
Softmax()
]
model = MLP(layers, input_shape)
return model
def test_make_confidence_report_bundled():
"""
A very simple test that just makes sure make_confidence_report_bundled can run without crashing
"""
sess = tf.compat.v1.Session()
try:
nb_classes = 3
nb_features = 2
batch_size = 5
nb_test_examples = batch_size * 2
layer = Linear(num_hid=nb_classes)
model = MLP(layers=[layer], input_shape=(None, nb_features))
dataset = SimpleDataset(test_end=nb_test_examples, nb_classes=nb_classes)
model.dataset_factory = dataset.get_factory()
filepath = ".test_model.joblib"
with sess.as_default():
sess.run(tf.compat.v1.global_variables_initializer())
serial.save(filepath, model)
def recipe(sess, model, x, y, nb_classes, eps, clip_min,
clip_max, eps_iter, nb_iter,
report_path, eps_iter_small, batch_size):
"""
Mock recipe that just runs the Noise attack so the test runs fast
"""
attack_configs = [AttackConfig(Noise(model, sess), {'eps': eps})]
new_work_goal = {config: 1 for config in attack_configs}
goals = [Misclassify(new_work_goal=new_work_goal)]
bundle_attacks(sess, model, x, y, attack_configs, goals, report_path, attack_batch_size=batch_size,
eval_batch_size=batch_size)
make_confidence_report_bundled(filepath, test_end=nb_test_examples, recipe=recipe,
base_eps=.1, base_eps_iter=.01, batch_size=batch_size)
finally:
sess.close()
def model_c(nb_filters=64, nb_classes=10, input_shape=(None, 28, 28, 1)):
layers = [
Conv2D(nb_filters * 2, (3, 3), (1, 1), "SAME", use_bias=True),
ReLU(),
Conv2D(nb_filters, (5, 5), (2, 2), "VALID", use_bias=True),
ReLU(),
Flatten(),
Dropout(0.25),
Linear(128),
ReLU(),
Dropout(0.5),
Linear(nb_classes),
Softmax()
]
model = DefenseMLP(layers, input_shape)
return model
def make_basic_picklable_cnn(nb_filters=64,
nb_classes=10,
input_shape=(None, 32, 32, 3)):
"""The model for the picklable models tutorial.
"""
if VERSION == 1:
layers = [
Conv2D(nb_filters, (8, 8), (2, 2), "SAME"),
ReLU(),
Conv2D(nb_filters * 2, (6, 6), (2, 2), "VALID"),
ReLU(),
Conv2D(nb_filters * 2, (5, 5), (1, 1), "VALID"),
ReLU(),
Flatten(),
Linear(nb_classes),
Softmax()
]
model = MLP(layers, input_shape)
else:
layers = [
PerImageStandardize(),
Conv2D(nb_filters, (3, 3), (1, 1), "SAME"),
ReLU(),
ResidualWithInstanceNorm(nb_filters, 2),
ResidualWithInstanceNorm(nb_filters, 1),
ResidualWithInstanceNorm(nb_filters * 2, 2),
ResidualWithInstanceNorm(nb_filters * 2, 1),
ResidualWithInstanceNorm(nb_filters * 4, 2),
ResidualWithInstanceNorm(nb_filters * 4, 1),
ResidualWithInstanceNorm(nb_filters * 8, 2),
ResidualWithInstanceNorm(nb_filters * 8, 1),
GlobalAveragePool(),
Linear(nb_classes),
Softmax()
]
model = MLP(layers, input_shape)
return model
def model_train(file_name=FILE_NAME):
"""
Creates the joblib file of LeNet-5 trained over the MNIST dataset.
Parameters
----------
file_name: str, optional
The name of the joblib file.
"""
layers = [
Conv2D(20, (5, 5), (1, 1), "VALID"),
ReLU(),
MaxPooling2D((2, 2), (2, 2), "VALID"),
Conv2D(50, (5, 5), (1, 1), "VALID"),
ReLU(),
MaxPooling2D((2, 2), (2, 2), "VALID"),
Flatten(),
Linear(500),
ReLU(),
Linear(10),
Softmax()
]
model = MLP(layers, (None, 28, 28, 1))
mnist = MNIST(train_start=0, train_end=60000, test_start=0, test_end=10000)
x_train, y_train = mnist.get_set('train')
x_test, y_test = mnist.get_set('test')
model_training(model,
file_name,
x_train,
y_train,
x_test,
y_test,
nb_epochs=20,
batch_size=128,
learning_rate=0.001)
def model_e(input_shape=(None, 28, 28, 1), nb_classes=10):
"""
Defines the model architecture to be used by the substitute. Use
the example model interface.
:param img_rows: number of rows in input
:param img_cols: number of columns in input
:param nb_classes: number of classes in output
:return: tensorflow model
"""
# Define a fully connected model (it's different than the black-box).
layers = [
Flatten(),
Linear(200),
ReLU(),
Linear(200),
ReLU(),
Linear(nb_classes),
Softmax()
]
return DefenseMLP(layers, input_shape)
def get_model(self, scope):
"""The model for the picklable models tutorial.
"""
if self.dataset_name == 'MNIST':
nb_filters = 64
nb_classes = self.nb_classes
input_shape = (None, 28, 28, 1)
layers = [
Conv2D(nb_filters, (8, 8), (2, 2), "SAME"),
ReLU(),
Conv2D(nb_filters * 2, (6, 6), (2, 2), "VALID"),
ReLU(),
Conv2D(nb_filters * 2, (5, 5), (1, 1), "VALID"),
ReLU(),
Flatten(),
Linear(nb_classes),
Softmax()
]
model = MLP(layers, input_shape)
if self.dataset_name == 'SVHN':
nb_filters = 64
nb_classes = self.nb_classes
input_shape = (None, 32, 32, 3)
layers = [
Conv2D(nb_filters, (8, 8), (2, 2), "SAME"),
ReLU(),
Conv2D(nb_filters * 2, (6, 6), (2, 2), "VALID"),
ReLU(),
Conv2D(nb_filters * 2, (5, 5), (1, 1), "VALID"),
ReLU(),
Flatten(),
Linear(nb_classes),
Softmax()
]
model = MLP(layers, input_shape)
elif self.dataset_name == 'CIFAR10':
model = make_wresnet(scope=scope)
return model
def model_train(attack):
"""
Creates the joblib file of LeNet-5 trained over the augmented MNIST dataset.
Parameters
----------
attack: str
The augmented dataset used (either "jsma", "wjsma" or "tjsma").
"""
layers = [
Conv2D(20, (5, 5), (1, 1), "VALID"),
ReLU(),
MaxPooling2D((2, 2), (2, 2), "VALID"),
Conv2D(50, (5, 5), (1, 1), "VALID"),
ReLU(),
MaxPooling2D((2, 2), (2, 2), "VALID"),
Flatten(),
Linear(500),
ReLU(),
Linear(10),
Softmax()
]
model = MLP(layers, (None, 28, 28, 1))
mnist = MNIST(train_start=TRAIN_START, train_end=TRAIN_END, test_start=TEST_START, test_end=TEST_END)
x_train, y_train = mnist.get_set('train')
x_test, y_test = mnist.get_set('test')
x_add = np.load("defense/augmented/" + attack + "_x.npy")[:AUGMENT_SIZE]
y_add = np.load("defense/augmented/" + attack + "_y.npy")[:AUGMENT_SIZE]
x_train = np.concatenate((x_train, x_add.reshape(x_add.shape + (1,))), axis=0).astype(np.float32)
y_train = np.concatenate((y_train, y_add), axis=0).astype(np.float32)
model_training(model, "mnist_defense_" + attack + ".joblib", x_train, y_train, x_test, y_test, nb_epochs=NB_EPOCHS,
batch_size=BATCH_SIZE, learning_rate=LEARNING_RATE)
def model_y(nb_filters=64, nb_classes=10, input_shape=(None, 28, 28, 1)):
layers = [
Conv2D(nb_filters, (3, 3), (1, 1), "SAME"),
ReLU(),
Conv2D(nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Conv2D(2 * nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Conv2D(2 * nb_filters, (3, 3), (2, 2), "VALID"),
ReLU(),
Flatten(),
Linear(256),
ReLU(),
Dropout(0.5),
Linear(256),
ReLU(),
Dropout(0.5),
Linear(nb_classes),
Softmax()
]
model = DefenseMLP(layers, input_shape, feature_layer='ReLU13')
return model
def make_basic_picklable_cnn(nb_filters=64, nb_classes=10,
input_shape=(None, 28, 28, 1)):
"""The model for the picklable models tutorial.
"""
layers = [Conv2D(nb_filters, (8, 8), (2, 2), "SAME"),
ReLU(),
Conv2D(nb_filters * 2, (6, 6), (2, 2), "VALID"),
ReLU(),
Conv2D(nb_filters * 2, (5, 5), (1, 1), "VALID"),
ReLU(),
Flatten(),
Linear(nb_classes),
Softmax()]
model = MLP(layers, input_shape)
return model