def test_data_range(self):
x = np.arange(5)
preproc = FeatureSqueezing()
squeezed_x = preproc(x, bit_depth=2, clip_values=(0, 4))
self.assertTrue(np.array_equal(x, np.arange(5)))
self.assertTrue(
np.allclose(squeezed_x, [0, 1.33, 2.67, 2.67, 4], atol=1e-1))
def test_random(self):
m, n = 1000, 20
x = np.random.rand(m, n)
x_zero = np.where(x < 0.5)
x_one = np.where(x >= 0.5)
preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=1)
x_squeezed, _ = preproc(x)
self.assertTrue((x_squeezed[x_zero] == 0.).all())
self.assertTrue((x_squeezed[x_one] == 1.).all())
preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=2)
x_squeezed, _ = preproc(x)
self.assertFalse(np.logical_and(0. < x_squeezed, x_squeezed < 0.33).any())
self.assertFalse(np.logical_and(0.34 < x_squeezed, x_squeezed < 0.66).any())
self.assertFalse(np.logical_and(0.67 < x_squeezed, x_squeezed < 1.).any())
def test_random(self):
m, n = 1000, 20
x = np.random.rand(m, n)
x_zero = np.where(x < 0.5)
x_one = np.where(x >= 0.5)
preproc = FeatureSqueezing(bit_depth=1)
squeezed_x, _ = preproc(x)
self.assertTrue((squeezed_x[x_zero] == 0.).all())
self.assertTrue((squeezed_x[x_one] == 1.).all())
preproc = FeatureSqueezing(bit_depth=2)
squeezed_x, _ = preproc(x)
self.assertFalse(np.logical_and(0. < squeezed_x, squeezed_x < 0.33).any())
self.assertFalse(np.logical_and(0.34 < squeezed_x, squeezed_x < 0.66).any())
self.assertFalse(np.logical_and(0.67 < squeezed_x, squeezed_x < 1.).any())
def _parse_defences(self, defences):
"""Apply defences to the classifier
:param defences: (string) names of the defences to add, supports "featsqueeze[1-8]" and "labsmooth"
"""
self.defences = defences
if defences:
pattern = re.compile("featsqueeze[1-8]?")
for d in defences:
# Add feature squeezing
if pattern.match(d):
try:
bit_depth = int(d[-1])
self.feature_squeeze = FeatureSqueezing(
bit_depth=bit_depth)
except:
raise ValueError(
"You must specify the bit depth for feature squeezing: featsqueeze[1-8]"
)
# Add label smoothing
if d == "labsmooth":
self.label_smooth = LabelSmoothing()
def test_ones(self):
m, n = 10, 2
x = np.ones((m, n))
for depth in range(1, 50):
preproc = FeatureSqueezing()
squeezed_x = preproc(x, bit_depth=depth)
self.assertTrue((squeezed_x == 1).all())
def test_ones(self):
m, n = 10, 2
x = np.ones((m, n))
for depth in range(1, 50):
preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=depth)
x_squeezed, _ = preproc(x)
self.assertTrue((x_squeezed == 1).all())
def test_ones(self):
m, n = 10, 2
x = np.ones((m, n))
for depth in range(1, 50):
with self.subTest("bit depth = {}".format(depth)):
preproc = FeatureSqueezing()
squeezed_x = preproc(x, depth)
self.assertTrue((squeezed_x == 1).all())
def test_tf_feature_squeezing(self):
# With tensors
m, n = 10, 2
sess = tf.Session()
x = tf.ones((m, n))
fs = FeatureSqueezing()
for depth in range(1, 10):
with self.subTest("bit depth = {}".format(depth)):
squeezed_x = sess.run(fs._tf_predict(x, depth))
self.assertTrue((squeezed_x == 1).all())
# With placeholders
x = np.ones((m, n))
x_op = tf.placeholder(tf.float32, shape=[None, 2])
for depth in range(1, 10):
with self.subTest("bit depth = {}".format(depth)):
squeezed_x = sess.run(fs._tf_predict(x_op, depth),
feed_dict={x_op: x})
self.assertTrue((squeezed_x == 1).all())
def defenses(model, X, adv_X, FS=False, SS=False, targeted=False):
if FS:
fs = FeatureSqueezing(bit_depth=1)(adv_X, clip_values=(-1, 1))
succ_rate, _ = evaluate(model, X, fs, targeted=targeted)
print("\nAfter FS %s success rate: %.2f%%" %
(targeted, succ_rate * 100))
if SS:
ss = SpatialSmoothing(channel_index=1,
window_size=20)(adv_X, clip_values=(-1, 1))
succ_rate, _ = evaluate(model, X, ss, targeted=targeted)
print("\nAfter SS %s success rate: %.2f%%" %
(targeted, succ_rate * 100))
return 0
def main(argv=None): X = np.load(FLAGS.load_data) fs = FeatureSqueezing(bit_depth=8) squeezed_values = fs(X) np.save(FLAGS.dump_data, squeezed_values)