def warmup(self, **kwargs):
args = self.args
if args.layerbndalg == "spectral":
spectral_bound(self.weights, self.biases, 0, 1, self.inputs[0],
self.preds[0], self.numlayer, self.activation,
args.norm, not self.targeted)
else:
compute_bounds(self.weights,
self.biases,
0,
1,
self.inputs[0],
self.preds[0],
self.numlayer,
args.norm,
0.01,
args.layerbndalg,
args.jacbndalg,
untargeted=not self.targeted,
use_quad=args.quad,
activation=self.activation,
activation_param=self.activation_param,
bounded_input=self.bounded_input)
def summary(self, **kwargs):
if self.args.layerbndalg == "spectral":
lips_stats = "avg_global_lipschitz = {:.5f}".format(
self.sum_all_lipschitz[self.args.eps] / self.n_points)
else:
s = []
for current in self.values:
s.append("avg_lipschitz[{:.5f}] = {:.5f}".format(
current, self.sum_all_lipschitz[current] / self.n_points))
lips_stats = ", ".join(s)
if self.force_label:
_, lipschitz_const = spectral_bound(self.weights, self.biases,
self.force_label, -1,
self.inputs[0], self.preds[0],
self.numlayer, self.activation,
self.args.norm,
not self.targeted)
print(
"[L0] model = {}, numimage = {}, {}, opnorm_global_lipschitz = {:.4f}"
.format(self.modelfile, self.n_points, lips_stats,
lipschitz_const))
else:
print("[L0] model = {}, numimage = {}, {}".format(
self.modelfile, self.n_points, lips_stats))
def run_single(self, i):
args = self.args
weights = self.weights
biases = self.biases
inputs = self.inputs
preds = self.preds
steps = args.steps
eps = args.eps
self.Nsamp += 1
predict_label = np.argmax(self.true_labels[i])
target_label = np.argmax(self.targets[i])
start = time.time()
# Spectral bound: no binary search needed
if args.layerbndalg == "spectral":
robustness_lb, _ = spectral_bound(weights, biases, predict_label,
target_label, inputs[i],
preds[i], self.numlayer,
self.activation, args.norm,
not self.targeted)
elif args.jacbndalg != "disable":
def binary_search_cond(current_eps):
robustness_lb = compute_bounds_integral(
weights,
biases,
predict_label,
target_label,
inputs[i],
preds[i],
self.numlayer,
args.norm,
current_eps,
args.lipsteps,
args.layerbndalg,
args.jacbndalg,
untargeted=not self.targeted,
activation=self.activation,
activation_param=self.activation_param,
lipsdir=args.lipsdir,
lipsshift=args.lipsshift)
return robustness_lb == current_eps, robustness_lb
# Using local Lipschitz constant to verify robustness.
# perform binary search to adaptively find a good eps
robustness_lb = binary_search(binary_search_cond,
eps,
max_steps=steps)
else:
# use linear outer bounds to verify robustness
def binary_search_cond(current):
gap_gx, _, _, _ = compute_bounds(
weights,
biases,
predict_label,
target_label,
inputs[i],
preds[i],
self.numlayer,
args.norm,
current,
args.layerbndalg,
"disable",
untargeted=not self.targeted,
use_quad=args.quad,
activation=self.activation,
activation_param=self.activation_param,
bounded_input=self.bounded_input)
return gap_gx >= 0, gap_gx
# perform binary search
robustness_lb = binary_search(binary_search_cond,
eps,
max_steps=steps)
self.robustness_lb_sum += robustness_lb
if robustness_lb < eps - 1e-5:
self.robust_error += 1
# get the gradient at this data point
gradients = self.model.get_gradient(inputs[i:i + 1])
obj_grad = gradients[predict_label] - gradients[target_label]
q = int(1.0 / (1.0 - 1.0 / args.norm)) if args.norm != 1 else np.inf
grad_norm = np.linalg.norm(obj_grad.flatten(), ord=q)
predictions = self.model.model.predict(inputs[i:i + 1])
margin = predictions[0][predict_label] - predictions[0][target_label]
print(
"[L1] model = {}, seq = {}, id = {}, true_class = {}, target_class = {}, info = {}, robustness_lb = {:.5f}, avg_robustness_lb = {:.5f}, margin = {:.4f}, grad_norm = {:.4f}, time = {:.4f}"
.format(self.modelfile, i, self.true_ids[i], predict_label,
target_label, self.img_info[i], robustness_lb,
self.robustness_lb_sum / self.Nsamp, margin, grad_norm,
time.time() - start))
def run_single(self, i):
args = self.args
weights = self.weights
biases = self.biases
inputs = self.inputs
preds = self.preds
eps = args.eps
self.n_points += 1
predict_label = np.argmax(self.true_labels[i])
# use this class only
target_label = -1
start = time.time()
self.all_lipschitz = defaultdict(float)
self.min_lipschitz = np.inf
self.max_lipschitz = 0.0
if args.layerbndalg == "spectral":
_, lipschitz_const = spectral_bound(weights, biases, predict_label,
target_label, inputs[i],
preds[i], self.numlayer,
self.activation, args.norm,
not self.targeted)
self._update_stats(eps, lipschitz_const)
# compute worst case bound
# no need to pass in sess, model and data
# just need to pass in the weights, true label, norm, x0, prediction of x0, number of layer and eps
else:
for current in self.values:
print('[L2] current = {}'.format(current))
_, _, lipschitz_const, _ = compute_bounds(
weights,
biases,
predict_label,
target_label,
inputs[i],
preds[i],
self.numlayer,
args.norm,
current,
args.layerbndalg,
args.jacbndalg,
untargeted=not self.targeted,
use_quad=args.quad,
activation=self.activation,
activation_param=self.activation_param,
lipsdir=args.lipsdir,
lipsshift=args.lipsshift)
self._update_stats(current, lipschitz_const[0])
s = []
for current in self.values:
s.append("lipschitz[{:.5f}] = {:.5f}".format(
current, self.all_lipschitz[current]))
print("[L1] " + ", ".join(s))
# get the gradient at this data point
gradients = self.model.get_gradient(inputs[i:i + 1])
obj_grad = gradients[predict_label]
q = int(1.0 / (1.0 - 1.0 / args.norm)) if args.norm != 1 else np.inf
grad_norm = np.linalg.norm(obj_grad.flatten(), ord=q)
predictions = self.model.model.predict(inputs[i:i + 1])
margin = predictions[0][predict_label]
print(
"[L1] model = {}, seq = {}, id = {}, true_class = {}, target_class = {}, info = {}, lipschitz_min = {:.5f}, lipschitz_max = {:.5f}, margin = {:.4f}, grad_norm = {:.4f}, time = {:.4f}"
.format(self.modelfile, i, self.true_ids[i], predict_label,
target_label, self.img_info[i], self.min_lipschitz,
self.max_lipschitz, margin, grad_norm,
time.time() - start))
# check results
if args.layerbndalg != "spectral":
assert (np.allclose(grad_norm, self.min_lipschitz))