steps_per_epoch=7500 // batch_size, validation_steps=2500 // batch_size, callbacks=[tensorboard_callback]) for images, labels in ds_train.take(1): # only take first element of dataset images_ex = ep.astensors(images) labels_ex = ep.astensors(labels) fmodel = fb.TensorFlowModel(baseline_model, bounds=(0, 1)) attacks = [ fa.FGSM(), fa.LinfPGD(), fa.LinfBasicIterativeAttack(), fa.LinfAdditiveUniformNoiseAttack(), fa.LinfDeepFoolAttack(), ] attacks_names = [ "FGSM", "LinfPGD", "LinfBasicIterativeAttack", "LinfAdditiveUniformNoiseAttack", "LinfDeepFoolAttack" ] epsilons = [ 0.0, 0.0005, 0.001, 0.0015, 0.002, 0.003, 0.005, 0.01, 0.02, 0.03, 0.1, 0.3, 0.5, 1.0 ] transfer_methods = [ #"Transfer With Last Layer", #"Transfer With No Last Layer",
AttackTestTarget(FGSM_GE(), Linf(100.0)), AttackTestTarget(fa.FGM(), L2(100.0), uses_grad=True), AttackTestTarget(fa.L1FastGradientAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.GaussianBlurAttack(steps=10), uses_grad=True, requires_real_model=True), AttackTestTarget( fa.GaussianBlurAttack(steps=10, max_sigma=224.0), uses_grad=True, requires_real_model=True, ), AttackTestTarget(fa.L2DeepFoolAttack(steps=50, loss="logits"), uses_grad=True), AttackTestTarget(fa.L2DeepFoolAttack(steps=50, loss="crossentropy"), uses_grad=True), AttackTestTarget(fa.LinfDeepFoolAttack(steps=50), uses_grad=True), AttackTestTarget(fa.BoundaryAttack(steps=50)), AttackTestTarget( fa.BoundaryAttack( steps=110, init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50), update_stats_every_k=1, )), AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50), None, uses_grad=True), AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, uses_grad=True), AttackTestTarget(fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None), AttackTestTarget(fa.L2AdditiveGaussianNoiseAttack(), 2500.0),
True, False, ), (fa.NewtonFoolAttack(steps=20), None, True, False), (fa.VirtualAdversarialAttack(steps=50, xi=1), 10, True, False), (fa.PGD(), Linf(1.0), True, False), (fa.L2PGD(), L2(50.0), True, False), (fa.LinfBasicIterativeAttack(abs_stepsize=0.2), Linf(1.0), True, False), (fa.L2BasicIterativeAttack(), L2(50.0), True, False), (fa.FGSM(), Linf(100.0), True, False), (fa.FGM(), L2(100.0), True, False), (fa.GaussianBlurAttack(steps=10), None, True, True), (fa.GaussianBlurAttack(steps=10, max_sigma=224.0), None, True, True), (fa.L2DeepFoolAttack(steps=50, loss="logits"), None, True, False), (fa.L2DeepFoolAttack(steps=50, loss="crossentropy"), None, True, False), (fa.LinfDeepFoolAttack(steps=50), None, True, False), (fa.BoundaryAttack(steps=50), None, False, False), ( fa.BoundaryAttack( steps=110, init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50), update_stats_every_k=1, ), None, False, False, ), (fa.SaltAndPepperNoiseAttack(steps=50), None, True, False), (fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, True, False), (fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None, False, False), (fa.L2AdditiveGaussianNoiseAttack(), 2500.0, False, False),