def _loss_cw(self, img_0_1, target, shape, c): # ,img_input_entrance,softmax_entrance,logits_entrance #### # use layerhelper to init w self.helper = LayerHelper("Jay") # name a name for later to take it out self.param_attr = ParamAttr(name="parameter") # add this perturbation on w space, then, reconstruct as an image within (0,1) self.ad_perturbation = self.helper.create_parameter( attr=self.param_attr, shape=[1, 28, 28], dtype='float32', is_bias=False) self.y = 2 * img_0_1 - 1 # compute arctan for y to get w self.xplus1 = 1 + self.y self.xminus1 = 1 - self.y self.ln = fluid.layers.log(self.xplus1 / self.xminus1) self.w = fluid.layers.scale(x=self.ln, scale=0.5) self.w_ad = self.w + self.ad_perturbation self.tanh_w = fluid.layers.tanh(self.w_ad) self.constrained = 0.5 * (self.tanh_w + 1) self.softmax, self.logits = mnist_cnn_model(self.constrained) self.sub = fluid.layers.elementwise_sub(img_0_1, self.constrained) self.squared = fluid.layers.elementwise_mul(self.sub, self.sub) self.distance_L2 = fluid.layers.reduce_sum(self.squared) self.negetive_screen_nontarget_logit = fluid.layers.scale(target, scale=-1.0) self.screen_target_logit = self.negetive_screen_nontarget_logit.__add__( fluid.layers.ones(shape=[10], dtype="float32")) self.logits_i_not_t = fluid.layers.elementwise_mul( self.screen_target_logit, self.logits) self.logit_target = fluid.layers.elementwise_mul(target, self.logits) self.maxlogit_i_not_t = fluid.layers.reduce_max(self.logits_i_not_t) self.maxlogit_target = fluid.layers.reduce_sum(self.logit_target) self.difference_between_two_logits = self.maxlogit_i_not_t - self.maxlogit_target self.f6 = fluid.layers.relu(self.difference_between_two_logits) self.loss = c * self.f6 + self.distance_L2 return self.maxlogit_i_not_t, self.maxlogit_target, self.loss, self.logits_i_not_t, self.constrained # distance_L2
def main(): """ Advbox demo which demonstrate how to use advbox. """ TOTAL_NUM = 50 IMG_NAME = 'img' LABEL_NAME = 'label' img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32') # gradient should flow img.stop_gradient = False label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64') logits = mnist_cnn_model(img) #logits = vgg_bn_drop(img) #logits = resnet_cifar10(img,32) cost = fluid.layers.cross_entropy(input=logits, label=label) avg_cost = fluid.layers.mean(x=cost) # use CPU place = fluid.CPUPlace() # use GPU #place = fluid.CUDAPlace(0) exe = fluid.Executor(place) BATCH_SIZE = 1 test_reader = paddle.batch(paddle.reader.shuffle( paddle.dataset.mnist.test(), buf_size=128 * 10), batch_size=BATCH_SIZE) fluid.io.load_params(exe, "mnist/", main_program=fluid.default_main_program()) # advbox demo m = PaddleModel(fluid.default_main_program(), IMG_NAME, LABEL_NAME, logits.name, avg_cost.name, (-1, 1), channel_axis=1) #attack = FGSM(m) attack = FGSMT(m) attack_config = {"epsilons": 0.3} # use test data to generate adversarial examples total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 adversary = Adversary(data[0][0], data[0][1]) # FGSM non-targeted attack #adversary = attack(adversary, **attack_config) # FGSMT targeted attack tlabel = 8 adversary.set_target(is_targeted_attack=True, target_label=tlabel) adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 print( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count)) adversarial_example = adversary.adversarial_example #print adversarial_example #原始数据归一化到(-1,1)之间了 需要还原到(0,255) adversarial_example /= 2. adversarial_example += 0.5 adversarial_example *= 255. adversarial_example = adversarial_example.astype(np.uint8) #print adversarial_example adversarial_example = np.reshape(adversarial_example, (28, 28)) im = Image.fromarray(adversarial_example) filename = "original-%d-adversarial-%d-targeted-by-fgsm.jpg" % ( data[0][1], adversary.adversarial_label) im.save("output/" + filename) else: print('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("fgsmt attack done")
def main(): """ Advbox demo which demonstrate how to use advbox. """ TOTAL_NUM = 500 IMG_NAME = 'img' LABEL_NAME = 'label' img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32') # gradient should flow img.stop_gradient = False label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64') logits = mnist_cnn_model(img) cost = fluid.layers.cross_entropy(input=logits, label=label) avg_cost = fluid.layers.mean(x=cost) # use CPU place = fluid.CPUPlace() # use GPU # place = fluid.CUDAPlace(0) exe = fluid.Executor(place) BATCH_SIZE = 1 train_reader = paddle.batch(paddle.reader.shuffle( paddle.dataset.mnist.train(), buf_size=128 * 10), batch_size=BATCH_SIZE) test_reader = paddle.batch(paddle.reader.shuffle( paddle.dataset.mnist.test(), buf_size=128 * 10), batch_size=BATCH_SIZE) fluid.io.load_params(exe, "./mnist/", main_program=fluid.default_main_program()) # advbox demo m = PaddleModel(fluid.default_main_program(), IMG_NAME, LABEL_NAME, logits.name, avg_cost.name, (-1, 1), channel_axis=1) attack = DeepFoolAttack(m) attack_config = {"iterations": 100, "overshoot": 9} # use train data to generate adversarial examples total_count = 0 fooling_count = 0 for data in train_reader(): total_count += 1 adversary = Adversary(data[0][0], data[0][1]) # DeepFool non-targeted attack adversary = attack(adversary, **attack_config) # DeepFool targeted attack # tlabel = 0 # adversary.set_target(is_targeted_attack=True, target_label=tlabel) # adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 print( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count)) # plt.imshow(adversary.target, cmap='Greys_r') # plt.show() # np.save('adv_img', adversary.target) else: print('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TRAIN_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break # use test data to generate adversarial examples total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 adversary = Adversary(data[0][0], data[0][1]) # DeepFool non-targeted attack adversary = attack(adversary, **attack_config) # DeepFool targeted attack # tlabel = 0 # adversary.set_target(is_targeted_attack=True, target_label=tlabel) # adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 print( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count)) # plt.imshow(adversary.target, cmap='Greys_r') # plt.show() # np.save('adv_img', adversary.target) else: print('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("deelfool attack done")
def main(use_cuda): """ Advbox demo which demonstrate how to use advbox. """ TOTAL_NUM = 500 IMG_NAME = 'img' LABEL_NAME = 'label' img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32') # gradient should flow img.stop_gradient = False label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64') logits = mnist_cnn_model(img) cost = fluid.layers.cross_entropy(input=logits, label=label) avg_cost = fluid.layers.mean(x=cost) #根据配置选择使用CPU资源还是GPU资源 place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace() exe = fluid.Executor(place) BATCH_SIZE = 1 test_reader = paddle.batch( paddle.reader.shuffle( paddle.dataset.mnist.test(), buf_size=128 * 10), batch_size=BATCH_SIZE) fluid.io.load_params( exe, "./mnist/", main_program=fluid.default_main_program()) # advbox demo m = PaddleModel( fluid.default_main_program(), IMG_NAME, LABEL_NAME, logits.name, avg_cost.name, (-1, 1), channel_axis=1) #使用静态FGSM epsilon不可变 attack = FGSM_static(m) attack_config = {"epsilon": 0.01} # use test data to generate adversarial examples total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 adversary = Adversary(data[0][0], data[0][1]) # FGSM non-targeted attack adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 #print( # 'attack success, original_label=%d, adversarial_label=%d, count=%d' # % (data[0][1], adversary.adversarial_label, total_count)) else: logger.info('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("fgsm attack done without any defence") #使用FeatureFqueezingDefence # advbox FeatureFqueezingDefence demo n = PaddleFeatureFqueezingDefenceModel( fluid.default_main_program(), IMG_NAME, LABEL_NAME, logits.name, avg_cost.name, (-1, 1), channel_axis=1,preprocess=None, bit_depth=1, clip_values=(-1, 1) ) attack_new = FGSM_static(n) attack_config = {"epsilon": 0.01} total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 #不设置y 会自动获取 adversary = Adversary(data[0][0], None) # FGSM non-targeted attack adversary = attack_new(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 logger.info( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count) ) else: logger.info('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("fgsm attack done with FeatureFqueezingDefence")
def main(use_cuda): """ Advbox demo which demonstrate how to use advbox. """ TOTAL_NUM = 500 IMG_NAME = 'img' LABEL_NAME = 'label' img = fluid.layers.data(name=IMG_NAME, shape=[1,28, 28], dtype='float32') # gradient should flow img.stop_gradient = False label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64') logits = mnist_cnn_model(img) cost = fluid.layers.cross_entropy(input=logits, label=label) avg_cost = fluid.layers.mean(x=cost) #根据配置选择使用CPU资源还是GPU资源 place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace() exe = fluid.Executor(place) BATCH_SIZE = 1 test_reader = paddle.batch( paddle.reader.shuffle( paddle.dataset.mnist.test(), buf_size=128 * 10), batch_size=BATCH_SIZE) fluid.io.load_params( exe, "./mnist/", main_program=fluid.default_main_program()) # advbox demo # advbox demo 黑盒攻击 直接传入测试版本的program m = PaddleBlackBoxModel( fluid.default_main_program().clone(for_test=True), IMG_NAME, LABEL_NAME, logits.name, (0, 255), channel_axis=0) #形状为[1,28,28] channel_axis=0 形状为[28,28,1] channel_axis=2 attack = SinglePixelAttack(m) attack_config = {"max_pixels": 28*28} # use test data to generate adversarial examples total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 img=data[0][0] img=np.reshape(img,[1,28,28]) adversary = Adversary(img, data[0][1]) #adversary = Adversary(data[0][0], data[0][1]) # SinglePixelAttack non-targeted attack adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 print( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count)) else: print('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("SinglePixelAttack attack done")
def main(use_cuda): """ Advbox demo which demonstrate how to use advbox. """ TOTAL_NUM = 500 IMG_NAME = 'img' LABEL_NAME = 'label' img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32') # gradient should flow img.stop_gradient = False label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64') logits = mnist_cnn_model(img) cost = fluid.layers.cross_entropy(input=logits, label=label) avg_cost = fluid.layers.mean(x=cost) #根据配置选择使用CPU资源还是GPU资源 place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace() exe = fluid.Executor(place) BATCH_SIZE = 1 test_reader = paddle.batch(paddle.reader.shuffle( paddle.dataset.mnist.test(), buf_size=128 * 10), batch_size=BATCH_SIZE) fluid.io.load_params(exe, "./mnist/", main_program=fluid.default_main_program()) # advbox demo m = PaddleModel( fluid.default_main_program(), IMG_NAME, LABEL_NAME, logits.name, avg_cost.name, (-1, 1), channel_axis=1, preprocess=(-1, 2)) # x within(0,1) so we should do some transformation attack = CW_L2(m, learning_rate=0.1) ####### # change parameter later ####### attack_config = { "nb_classes": 10, "learning_rate": 0.1, "attack_iterations": 50, "epsilon": 0.5, "targeted": True, "k": 0, "noise": 2 } # use test data to generate adversarial examples total_count = 0 fooling_count = 0 for data in test_reader(): total_count += 1 adversary = Adversary(data[0][0], data[0][1]) # CW_L2 targeted attack tlabel = 0 adversary.set_target(is_targeted_attack=True, target_label=tlabel) adversary = attack(adversary, **attack_config) if adversary.is_successful(): fooling_count += 1 print( 'attack success, original_label=%d, adversarial_label=%d, count=%d' % (data[0][1], adversary.adversarial_label, total_count)) else: print('attack failed, original_label=%d, count=%d' % (data[0][1], total_count)) if total_count >= TOTAL_NUM: print( "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f" % (fooling_count, total_count, float(fooling_count) / total_count)) break print("CW attack done")