), AttackTestTarget( fa.EADAttack(binary_search_steps=3, steps=20, decision_rule="L1", regularization=0), uses_grad=True, ), AttackTestTarget(fa.NewtonFoolAttack(steps=20), uses_grad=True), AttackTestTarget(fa.VirtualAdversarialAttack(steps=50, xi=1), 10, uses_grad=True), AttackTestTarget(fa.PGD(), Linf(1.0), uses_grad=True), AttackTestTarget(fa.L2PGD(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1PGD(), 5000.0, uses_grad=True), AttackTestTarget(fa.LinfBasicIterativeAttack(abs_stepsize=0.2), Linf(1.0), uses_grad=True), AttackTestTarget(fa.L2BasicIterativeAttack(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1BasicIterativeAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.SparseL1DescentAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.FGSM(), Linf(100.0), uses_grad=True), AttackTestTarget(FGSM_GE(), Linf(100.0)), AttackTestTarget(fa.FGM(), L2(100.0), uses_grad=True), AttackTestTarget(fa.L1FastGradientAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.GaussianBlurAttack(steps=10), uses_grad=True, requires_real_model=True), AttackTestTarget( fa.GaussianBlurAttack(steps=10, max_sigma=224.0), uses_grad=True,
epochs=1, validation_data=ds_test, steps_per_epoch=7500 // batch_size, validation_steps=2500 // batch_size, callbacks=[tensorboard_callback]) for images, labels in ds_train.take(1): # only take first element of dataset images_ex = ep.astensors(images) labels_ex = ep.astensors(labels) fmodel = fb.TensorFlowModel(baseline_model, bounds=(0, 1)) attacks = [ fa.FGSM(), fa.LinfPGD(), fa.LinfBasicIterativeAttack(), fa.LinfAdditiveUniformNoiseAttack(), fa.LinfDeepFoolAttack(), ] attacks_names = [ "FGSM", "LinfPGD", "LinfBasicIterativeAttack", "LinfAdditiveUniformNoiseAttack", "LinfDeepFoolAttack" ] epsilons = [ 0.0, 0.0005, 0.001, 0.0015, 0.002, 0.003, 0.005, 0.01, 0.02, 0.03, 0.1, 0.3, 0.5, 1.0 ] transfer_methods = [
AttackTestTarget( fa.NewtonFoolAttack(steps=20), uses_grad=True, requires_low_dimensional_input=True, ), AttackTestTarget( fa.VirtualAdversarialAttack(steps=50, xi=1), 10, uses_grad=True, requires_low_dimensional_input=True, ), AttackTestTarget(fa.PGD(), Linf(1.0), uses_grad=True), AttackTestTarget(fa.L2PGD(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1PGD(), 5000.0, uses_grad=True), AttackTestTarget( fa.LinfBasicIterativeAttack(abs_stepsize=0.2), Linf(1.0), uses_grad=True ), AttackTestTarget(fa.L2BasicIterativeAttack(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1BasicIterativeAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.AdamPGD(), Linf(1.0), uses_grad=True), AttackTestTarget(fa.L2AdamPGD(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1AdamPGD(), 5000.0, uses_grad=True), AttackTestTarget( fa.LinfAdamBasicIterativeAttack(abs_stepsize=0.2), Linf(1.0), uses_grad=True ), AttackTestTarget(fa.L2AdamBasicIterativeAttack(), L2(50.0), uses_grad=True), AttackTestTarget(fa.L1AdamBasicIterativeAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.SparseL1DescentAttack(), 5000.0, uses_grad=True), AttackTestTarget(fa.FGSM(), Linf(100.0), uses_grad=True), AttackTestTarget(FGSM_GE(), Linf(100.0)), AttackTestTarget(fa.FGM(), L2(100.0), uses_grad=True),
False, ), ( fa.EADAttack(binary_search_steps=3, steps=20, decision_rule="L1", regularization=0), None, True, False, ), (fa.NewtonFoolAttack(steps=20), None, True, False), (fa.VirtualAdversarialAttack(steps=50, xi=1), 10, True, False), (fa.PGD(), Linf(1.0), True, False), (fa.L2PGD(), L2(50.0), True, False), (fa.LinfBasicIterativeAttack(abs_stepsize=0.2), Linf(1.0), True, False), (fa.L2BasicIterativeAttack(), L2(50.0), True, False), (fa.FGSM(), Linf(100.0), True, False), (fa.FGM(), L2(100.0), True, False), (fa.GaussianBlurAttack(steps=10), None, True, True), (fa.GaussianBlurAttack(steps=10, max_sigma=224.0), None, True, True), (fa.L2DeepFoolAttack(steps=50, loss="logits"), None, True, False), (fa.L2DeepFoolAttack(steps=50, loss="crossentropy"), None, True, False), (fa.LinfDeepFoolAttack(steps=50), None, True, False), (fa.BoundaryAttack(steps=50), None, False, False), ( fa.BoundaryAttack( steps=110, init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50), update_stats_every_k=1, ),
def main(): """ Validate -> Attack -> Revalidate """ model = utils.load_trained_model( model_name="resnet", model_path=MODEL_RESNET_PATH, class_num=len(CLASS_NAMES) ) preprocessing = dict(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225], axis=-3) dataset_loader, dataset_size = utils.load_dataset( dataset_path=DATASET_PATH, dataset_image_len=DATASET_IMAGE_NUM ) # use GPU if available device = torch.device("cuda:0" if torch.cuda.is_available() else "cpu") model = model.to(device) fmodel = PyTorchModel(model, bounds=(0, 1), preprocessing=preprocessing) # * 1/3: Validate original images. model_validate(fmodel, device, dataset_loader, dataset_size) # * 2/3: Perform adversarial attack. # attack = fa.LinfFastGradientAttack() attack = fa.LinfBasicIterativeAttack() # attack = fa.L2CarliniWagnerAttack() # attack = fa.L2DeepFoolAttack() eps = [THRESHOLD] pbar = tqdm(dataset_loader) pbar.set_description("Att") dist = [] adversaries = [] for image, label in pbar: advs, _, _ = attack(fmodel, image.to(device), label.to(device), epsilons=eps) for i, (single_adv, single_img) in enumerate(zip(advs[0], image.to(device))): perturb = (single_adv - single_img).cpu() _l_p = norm(perturb.flatten(), np.inf if NORM == "inf" else 2) _dist = fd.linf(single_img, single_adv) # Todo: add condition to ignore fixed epsilon attacks if _l_p > THRESHOLD: # replace adversaries with perturbations larger than threshold with original # images (for attacks with minimization approaches: cw, deepfool) # _l_p = 0.0 advs[0][i] = single_img dist.append(_l_p) adversaries.append(advs[0]) dist = np.asarray(dist) plot_distances(dist, lp_norm=NORM) # np.save("cw_dist_lim_1.npy", dist) print( "L_{}: min {:.4f}, mean {:.4f}, max {:.4f}".format( NORM, dist.min(), np.median(dist), dist.max() ) ) time.sleep(0.5) # * 3/3: Validate generated adversarial examples. model_validate(fmodel, device, dataset_loader, dataset_size, adv=adversaries)