def _attackerL1Classification(x0, c0, noise_rel, yadv_init=None):
# compute noiseless measurements
y0 = OpA(x0)
if noise_rel == 0.0:
return y0, y0, y0
# compute absolute noise levels
noise_level = noise_rel * y0.norm(p=2, dim=(-2, -1), keepdim=True)
# compute noisy measurements for reference
yref = noise_ref(OpA(x0), noise_level)
# attack parameters
adv_init_fac = 3.0 * noise_level
adv_param = {
"codomain_dist": carlini_wagner(threshold=0.0),
"domain_dist": None,
"weights": (1.0, 1.0),
"optimizer": PAdam,
"projs": [lambda y: proj_l2_ball(y, y0, noise_level)],
"iter": 100,
"stepsize": 5e-1,
}
# compute good start values for _reconstructL1_adv
_, c0_adv, y0_adv = primaldual(y0,
OpA,
OpTVSynth,
iter=50000,
c0=torch.zeros(config.n, ).to(device),
y0=torch.zeros(config.m, ).to(device),
eta=noise_level,
silent=True,
**rec_params)
# compute initialization
yadv = y0.clone().detach() + (
adv_init_fac / np.sqrt(np.prod(y0.shape[-2:]))) * torch.randn_like(y0)
if yadv_init is not None:
yadv[0:yadv_init.shape[0], ...] = yadv_init.clone()
yadv = yadv.requires_grad_(True)
# perform attack
yadv = untargeted_attack(lambda y: convnet(
_reconstructL1_adv(y, noise_level, c0_adv, y0_adv).view(-1, 1, 28, 28)
),
yadv,
y0,
t_out_ref=c0,
**adv_param).detach()
return yadv, yref, y0
def _reconstructL1_adv(y, noise_level, c0, y0):
x, _, _ = primaldual(y,
OpA,
OpTVSynth,
iter=2000,
c0=c0,
y0=y0,
eta=noise_level,
silent=True,
**rec_params)
return x
def _reconstructL1(y, noise_level):
x, _, _ = primaldual(y,
OpA,
OpTVSynth,
iter=50000,
c0=torch.zeros(config.n, ).to(device),
y0=torch.zeros(config.m, ).to(device),
eta=noise_level,
silent=True,
**rec_params)
return x