AttackTestTarget(
fa.BoundaryAttack(
steps=110,
init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50),
update_stats_every_k=1,
)),
AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50),
None,
uses_grad=True),
AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1),
None,
uses_grad=True),
AttackTestTarget(fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None),
AttackTestTarget(fa.L2AdditiveGaussianNoiseAttack(), 2500.0),
AttackTestTarget(fa.L2ClippingAwareAdditiveGaussianNoiseAttack(), 500.0),
AttackTestTarget(fa.LinfAdditiveUniformNoiseAttack(), 10.0),
AttackTestTarget(
fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False), 1000.0),
AttackTestTarget(
fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(
check_trivial=False),
200.0,
),
AttackTestTarget(fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0),
AttackTestTarget(fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(),
200.0),
AttackTestTarget(fa.L2RepeatedAdditiveUniformNoiseAttack(), 1000.0),
AttackTestTarget(fa.L2ClippingAwareRepeatedAdditiveUniformNoiseAttack(),
200.0),
AttackTestTarget(fa.LinfRepeatedAdditiveUniformNoiseAttack(), 3.0),
]
(fa.BoundaryAttack(steps=50), None, False, False),
(
fa.BoundaryAttack(
steps=110,
init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50),
update_stats_every_k=1,
),
None,
False,
False,
),
(fa.SaltAndPepperNoiseAttack(steps=50), None, True, False),
(fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, True, False),
(fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None, False, False),
(fa.L2AdditiveGaussianNoiseAttack(), 2500.0, False, False),
(fa.LinfAdditiveUniformNoiseAttack(), 10.0, False, False),
(
fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False),
1000.0,
False,
False,
),
(fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0, False, False),
(fa.L2RepeatedAdditiveUniformNoiseAttack(), 1000.0, False, False),
(fa.LinfRepeatedAdditiveUniformNoiseAttack(), 3.0, False, False),
]
@pytest.mark.parametrize("attack_eps_grad_real", attacks, ids=get_attack_id)
def test_untargeted_attacks(
fmodel_and_data_ext_for_attacks: Tuple[Tuple[fbn.Model, ep.Tensor,
validation_data=ds_test,
steps_per_epoch=7500 // batch_size,
validation_steps=2500 // batch_size,
callbacks=[tensorboard_callback])
for images, labels in ds_train.take(1): # only take first element of dataset
images_ex = ep.astensors(images)
labels_ex = ep.astensors(labels)
fmodel = fb.TensorFlowModel(baseline_model, bounds=(0, 1))
attacks = [
fa.FGSM(),
fa.LinfPGD(),
fa.LinfBasicIterativeAttack(),
fa.LinfAdditiveUniformNoiseAttack(),
fa.LinfDeepFoolAttack(),
]
attacks_names = [
"FGSM", "LinfPGD", "LinfBasicIterativeAttack",
"LinfAdditiveUniformNoiseAttack", "LinfDeepFoolAttack"
]
epsilons = [
0.0, 0.0005, 0.001, 0.0015, 0.002, 0.003, 0.005, 0.01, 0.02, 0.03, 0.1,
0.3, 0.5, 1.0
]
transfer_methods = [
#"Transfer With Last Layer",
AttackTestTarget(
fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1),
None,
uses_grad=True,
stochastic_attack=True,
),
AttackTestTarget(
fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None, stochastic_attack=True
),
AttackTestTarget(
fa.L2AdditiveGaussianNoiseAttack(), 3000.0, stochastic_attack=True
),
AttackTestTarget(
fa.L2ClippingAwareAdditiveGaussianNoiseAttack(), 500.0, stochastic_attack=True
),
AttackTestTarget(fa.LinfAdditiveUniformNoiseAttack(), 10.0, stochastic_attack=True),
AttackTestTarget(
fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False),
1000.0,
stochastic_attack=True,
),
AttackTestTarget(
fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(check_trivial=False),
200.0,
stochastic_attack=True,
),
AttackTestTarget(
fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0, stochastic_attack=True
),
AttackTestTarget(
fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(),