def plot_histogram(self, plot_file, values):
"""
Plot distances.
"""
try:
plot.histogram(plot_file, values, 100)
log('[Detection] wrote %s' % plot_file)
except ValueError as e:
log('[Detection] plotting not possible: %s' % str(e), LogLevel.WARNING)
latex.histogram(plot_file + '.tex', values, 100)
log('[Detection] wrote %s.tex' % plot_file)
latex.histogram(plot_file + '.normalized.tex', values, 100, None, True)
log('[Detection] wrote %s.normalized.tex' % plot_file)
def compute_statistics(self):
"""
Compute statistics based on distances.
"""
num_attempts = self.perturbations.shape[0]
perturbations = numpy.swapaxes(self.perturbations, 0, 1)
perturbations = perturbations.reshape(
(perturbations.shape[0] * perturbations.shape[1],
perturbations.shape[2]))
success = numpy.swapaxes(self.success, 0, 1)
success = success.reshape((success.shape[0] * success.shape[1]))
probabilities = numpy.swapaxes(self.probabilities, 0, 1)
probabilities = probabilities.reshape(
(probabilities.shape[0] * probabilities.shape[1], -1))
confidences = numpy.max(probabilities, 1)
perturbation_probabilities = self.test_probabilities[:self.success.
shape[1]]
perturbation_probabilities = numpy.repeat(perturbation_probabilities,
num_attempts,
axis=0)
perturbation_confidences = numpy.max(perturbation_probabilities, 1)
probability_ratios = confidences / perturbation_confidences
raw_overall_success = success >= 0
log('[Testing] %d valid attacks' % numpy.sum(raw_overall_success))
# For off-manifold attacks this should not happen, but save is save.
if not numpy.any(raw_overall_success):
for type in [
'raw_success', 'raw_iteration', 'raw_roc',
'raw_confidence_weighted_success', 'raw_confidence',
'raw_ratios'
]:
self.results[type] = 0
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
log('[Testing] no successful attacks found, no plots')
return
#
# We compute some simple statistics:
# - raw success rate: fraction of successful attack without considering epsilon
# - corrected success rate: fraction of successful attacks within epsilon-ball
# - raw average perturbation: average distance to original samples (for successful attacks)
# - corrected average perturbation: average distance to original samples for perturbations
# within epsilon-ball (for successful attacks).
# These statistics can also be computed per class.
# And these statistics are computed with respect to three norms.
if self.args.plot_directory and utils.display():
iterations = success[raw_overall_success]
x = numpy.arange(numpy.max(iterations) + 1)
y = numpy.bincount(iterations)
plot_file = os.path.join(self.args.plot_directory, 'iterations')
plot.bar(plot_file,
x,
y,
title='Distribution of Iterations of Successful Attacks',
xlabel='Number of Iterations',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
plot_file = os.path.join(self.args.plot_directory, 'probabilities')
plot.histogram(plot_file, confidences[raw_overall_success], 50)
log('[Testing] wrote %s' % plot_file)
plot_file = os.path.join(self.args.plot_directory,
'probability_ratios')
plot.histogram(plot_file, probability_ratios, 50)
log('[Testing] wrote %s' % plot_file)
plot_file = os.path.join(self.args.plot_directory,
'test_probabilities')
plot.histogram(
plot_file, self.test_probabilities[
numpy.arange(self.test_probabilities.shape[0]),
self.test_codes], 50)
log('[Testing] wrote %s' % plot_file)
y_true = numpy.concatenate(
(numpy.zeros(confidences.shape[0]),
numpy.ones(perturbation_confidences.shape[0])))
y_score = numpy.concatenate((confidences, perturbation_confidences))
roc_auc_score = sklearn.metrics.roc_auc_score(y_true, y_score)
self.results['raw_roc'] = roc_auc_score
self.results['raw_confidence_weighted_success'] = numpy.sum(
confidences[raw_overall_success]) / numpy.sum(
perturbation_confidences)
self.results['raw_confidence'] = numpy.mean(
probabilities[raw_overall_success])
self.results['raw_ratios'] = numpy.mean(
probability_ratios[raw_overall_success])
self.results['raw_success'] = numpy.sum(
raw_overall_success) / success.shape[0]
self.results['raw_iteration'] = numpy.average(
success[raw_overall_success])
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
def compute_statistics(self):
"""
Compute statistics based on distances.
"""
# That's the basis for all computation as we only want to consider successful attacks
# on test samples that were correctly classified.
raw_overall_success = numpy.logical_and(self.success >= 0, self.accuracy)
# Important check, for on-manifold attack this will happen if the manifold is small and the model very accurate!
if not numpy.any(raw_overall_success):
for n in range(len(self.norms)):
for type in ['raw_success', 'raw_iteration', 'raw_average', 'raw_image']:
self.results[n][type] = 0
for type in ['raw_class_success', 'raw_class_average', 'raw_class_image']:
self.results[n][type] = numpy.zeros((self.N_class))
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
return
#
# Compute nearest neighbor statistics in image space.
#
if self.args.plot_directory and self.args.plot_manifolds and utils.display():
log('[Testing] computing nearest neighbor ...')
nearest_neighbors_indices = self.compute_nearest_neighbors(self.perturbation_images[raw_overall_success])
pure_perturbations = self.test_images[raw_overall_success] - self.perturbation_images[raw_overall_success]
pure_perturbations_norm = numpy.linalg.norm(pure_perturbations, ord=2, axis=1)
for k in range(10):
direction = self.perturbation_images[raw_overall_success] - self.train_images[nearest_neighbors_indices[:, k]]
direction_norm = numpy.linalg.norm(direction, ord=2, axis=1)
dot_products = numpy.einsum('ij,ij->i', direction, pure_perturbations)
dot_product_norms = numpy.multiply(pure_perturbations_norm, direction_norm)
dot_products, dot_product_norms = dot_products[dot_product_norms > 10**-8], dot_product_norms[dot_product_norms > 10**-8]
dot_products /= dot_product_norms
dot_products = numpy.degrees(numpy.arccos(dot_products))
# matplotlib's hsitogram plots give weird error if there are NaN values, so simple check:
if dot_products.shape[0] > 0 and not numpy.any(dot_products != dot_products):
plot_file = os.path.join(self.args.plot_directory, 'dot_products_nn%d' % k)
plot.histogram(plot_file, dot_products, 100, xmin=numpy.min(dot_products), xmax=numpy.max(dot_products),
title='Dot Products Between Adversarial Perturbations and Direction to Nearest Neighbor %d' % k,
xlabel='Dot Product', ylabel='Count')
log('[Testing] wrote %s' % plot_file)
#
# We compute some simple statistics:
# - raw success rate: fraction of successful attack without considering epsilon
# - corrected success rate: fraction of successful attacks within epsilon-ball
# - raw average perturbation: average distance to original samples (for successful attacks)
# - corrected average perturbation: average distance to original samples for perturbations
# within epsilon-ball (for successful attacks).
# These statistics can also be computed per class.
# And these statistics are computed with respect to three norms.
if self.args.plot_directory and utils.display():
iterations = self.success[raw_overall_success]
x = numpy.arange(numpy.max(iterations) + 1)
y = numpy.bincount(iterations)
plot_file = os.path.join(self.args.plot_directory, 'iterations')
plot.bar(plot_file, x, y,
title='Distribution of Iterations of Successful Attacks', xlabel='Number of Iterations', ylabel='Count')
log('[Testing] wrote %s' % plot_file)
reference_perturbations = numpy.zeros(self.perturbations.shape)
if self.args.N_theta > 4:
reference_perturbations[:, 4] = 1
for n in range(len(self.norms)):
norm = self.norms[n]
delta = numpy.linalg.norm(self.perturbations - reference_perturbations, norm, axis=1)
image_delta = numpy.linalg.norm(self.test_images - self.perturbation_images, norm, axis=1)
if self.args.plot_directory and utils.display():
plot_file = os.path.join(self.args.plot_directory, 'distances_l%g' % norm)
plot.histogram(plot_file, delta[raw_overall_success], 50, title='Distribution of $L_{%g}$ Distances of Successful Attacks' % norm,
xlabel='Distance', ylabel='Count')
log('[Testing] wrote %s' % plot_file)
debug_accuracy = numpy.sum(self.accuracy) / self.accuracy.shape[0]
debug_attack_fraction = numpy.sum(raw_overall_success) / numpy.sum(self.success >= 0)
debug_test_fraction = numpy.sum(raw_overall_success) / numpy.sum(self.accuracy)
log('[Testing] attacked mode accuracy: %g' % debug_accuracy)
log('[Testing] only %g of successful attacks are valid' % debug_attack_fraction)
log('[Testing] only %g of correct samples are successfully attacked' % debug_test_fraction)
N_accuracy = numpy.sum(self.accuracy)
self.results[n]['raw_success'] = numpy.sum(raw_overall_success) / N_accuracy
self.results[n]['raw_iteration'] = numpy.average(self.success[raw_overall_success])
self.results[n]['raw_average'] = numpy.average(delta[raw_overall_success]) if numpy.any(raw_overall_success) else 0
self.results[n]['raw_image'] = numpy.average(image_delta[raw_overall_success]) if numpy.any(raw_overall_success) else 0
raw_class_success = numpy.zeros((self.N_class, self.perturbation_codes.shape[0]), bool)
corrected_class_success = numpy.zeros((self.N_class, self.perturbation_codes.shape[0]), bool)
self.results[n]['raw_class_success'] = numpy.zeros((self.N_class))
self.results[n]['raw_class_average'] = numpy.zeros((self.N_class))
self.results[n]['raw_class_image'] = numpy.zeros((self.N_class))
for c in range(self.N_class):
N_samples = numpy.sum(self.accuracy[self.perturbation_codes == c].astype(int))
if N_samples <= 0:
continue;
raw_class_success[c] = numpy.logical_and(raw_overall_success, self.perturbation_codes == c)
self.results[n]['raw_class_success'][c] = numpy.sum(raw_class_success[c]) / N_samples
if numpy.any(raw_class_success[c]):
self.results[n]['raw_class_average'][c] = numpy.average(delta[raw_class_success[c].astype(bool)])
if numpy.any(corrected_class_success[c]):
self.results[n]['raw_class_image'][c] = numpy.average(image_delta[raw_class_success[c].astype(bool)])
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
def compute_latent_statistics(self):
"""
Compute latent statistics.
"""
N_class = numpy.max(self.test_codes) + 1
num_attempts = self.perturbations.shape[0]
perturbations = numpy.swapaxes(self.perturbations, 0, 1)
perturbations = perturbations.reshape(
(perturbations.shape[0] * perturbations.shape[1],
perturbations.shape[2]))
success = numpy.swapaxes(self.success, 0, 1)
success = success.reshape((success.shape[0] * success.shape[1]))
accuracy = numpy.repeat(self.accuracy, num_attempts, axis=0)
# Raw success is the base for all statistics, as we need to consider only these
# attacks that are successful and where the classifier originally was correct.
raw_overall_success = numpy.logical_and(success >= 0, accuracy)
# For off-manifold attacks this should not happen, but save is save.
if not numpy.any(raw_overall_success):
for n in range(len(self.norms)):
for type in [
'raw_success', 'raw_iteration', 'raw_average',
'raw_latent'
]:
self.results[n][type] = 0
for type in [
'raw_class_success', 'raw_class_average',
'raw_class_latent'
]:
self.results[n][type] = numpy.zeros((N_class))
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
log('[Testing] no successful attacks found, no plots')
return
perturbation_images = numpy.repeat(self.perturbation_images,
num_attempts,
axis=0)
perturbation_codes = numpy.repeat(self.perturbation_codes,
num_attempts,
axis=0)
#
# Compute nearest neighbors for perturbations and test images,
# to backproject them into the latent space.
# Also compute the dot product betweenm perturbations and a local
# plane approximation base don the three nearest neighbors.
#
log('[Testing] computing nearest neighbor ...')
nearest_neighbors_indices = self.compute_nearest_neighbors(
perturbation_images)
nearest_neighbors = self.train_theta[nearest_neighbors_indices[:, 0]]
perturbation_nearest_neighbor_indices = self.compute_nearest_neighbors(
perturbations)
perturbation_nearest_neighbor = self.train_theta[
perturbation_nearest_neighbor_indices[:, 0]]
# Compute statistics over the perturbation with respect to the plane
# defined by the three nearest neighbors of the corresponding test sample.
if self.args.plot_directory and self.args.plot_manifolds and utils.display(
):
pure_perturbations = perturbations[
raw_overall_success] - perturbation_images[raw_overall_success]
pure_perturbations_norm = numpy.linalg.norm(pure_perturbations,
ord=2,
axis=1)
for k in range(10):
direction = perturbation_images[
raw_overall_success] - self.train_images[
nearest_neighbors_indices[:, k][raw_overall_success]]
direction_norm = numpy.linalg.norm(direction, ord=2, axis=1)
dot_products = numpy.einsum('ij,ij->i', direction,
pure_perturbations)
dot_product_norms = numpy.multiply(pure_perturbations_norm,
direction_norm)
dot_product_norms[dot_product_norms == 0] = 1
dot_products /= dot_product_norms
dot_products = numpy.degrees(numpy.arccos(dot_products))
# matplotlib's hsitogram plots give weird error if there are NaN values, so simple check:
if dot_products.shape[0] > 0 and not numpy.any(
dot_products != dot_products):
plot_file = os.path.join(self.args.plot_directory,
'dot_products_nn%d' % k)
plot.histogram(
plot_file,
dot_products,
100,
title=
'Dot Products Between Adversarial Perturbations and Direction to Nearest Neighbor %d'
% k,
xlabel='Dot Product (Between Normalized Vectors)',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
#
# We compute some simple statistics:
# - raw success rate: fraction of successful attack without considering epsilon
# - corrected success rate: fraction of successful attacks within epsilon-ball
# - raw average perturbation: average distance to original samples (for successful attacks)
# - corrected average perturbation: average distance to original samples for perturbations
# within epsilon-ball (for successful attacks).
# These statistics can also be computed per class.
# And these statistics are computed with respect to three norms.
if self.args.plot_directory and utils.display():
iterations = success[raw_overall_success]
x = numpy.arange(numpy.max(iterations) + 1)
y = numpy.bincount(iterations)
plot_file = os.path.join(self.args.plot_directory, 'iterations')
plot.bar(plot_file,
x,
y,
title='Distribution of Iterations of Successful Attacks',
xlabel='Number of Iterations',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
for n in range(len(self.norms)):
norm = self.norms[n]
delta = numpy.linalg.norm(perturbation_images - perturbations,
norm,
axis=1)
latent_delta = numpy.linalg.norm(nearest_neighbors -
perturbation_nearest_neighbor,
norm,
axis=1)
if self.args.plot_directory and utils.display():
plot_file = os.path.join(self.args.plot_directory,
'distances_l%g' % norm)
plot.histogram(
plot_file,
delta[raw_overall_success],
50,
title=
'Distribution of $L_{%g}$ Distances of Successful Attacks'
% norm,
xlabel='Distance',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
#debug_accuracy = numpy.sum(accuracy) / accuracy.shape[0]
#debug_attack_fraction = numpy.sum(raw_overall_success) / numpy.sum(success >= 0)
#debug_test_fraction = numpy.sum(raw_overall_success) / numpy.sum(accuracy)
#log('[Testing] attacked model accuracy: %g' % debug_accuracy)
#log('[Testing] only %g of successful attacks are valid' % debug_attack_fraction)
#log('[Testing] only %g of correct samples are successfully attacked' % debug_test_fraction)
N_accuracy = numpy.sum(accuracy)
self.results[n]['raw_success'] = numpy.sum(
raw_overall_success) / N_accuracy
self.results[n]['raw_iteration'] = numpy.average(
success[raw_overall_success])
self.results[n]['raw_average'] = numpy.average(
delta[raw_overall_success]) if numpy.any(
raw_overall_success) else 0
self.results[n]['raw_latent'] = numpy.average(
latent_delta[raw_overall_success]) if numpy.any(
raw_overall_success) else 0
raw_class_success = numpy.zeros(
(N_class, perturbation_images.shape[0]), bool)
self.results[n]['raw_class_success'] = numpy.zeros((N_class))
self.results[n]['raw_class_average'] = numpy.zeros((N_class))
self.results[n]['raw_class_latent'] = numpy.zeros((N_class))
for c in range(N_class):
N_samples = numpy.sum(
numpy.logical_and(accuracy, perturbation_codes == c))
if N_samples <= 0:
continue
raw_class_success[c] = numpy.logical_and(
raw_overall_success, perturbation_codes == c)
self.results[n]['raw_class_success'][c] = numpy.sum(
raw_class_success[c]) / N_samples
if numpy.any(raw_class_success[c]):
self.results[n]['raw_class_average'][c] = numpy.average(
delta[raw_class_success[c].astype(bool)])
if numpy.any(raw_class_success[c]):
self.results[n]['raw_class_latent'][c] = numpy.average(
latent_delta[raw_class_success[c].astype(bool)])
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
def compute_statistics(self):
"""
Compute statistics based on distances.
"""
N_class = numpy.max(self.test_codes) + 1
num_attempts = self.perturbations.shape[0]
perturbations = numpy.swapaxes(self.perturbations, 0, 1)
perturbations = perturbations.reshape(
(perturbations.shape[0] * perturbations.shape[1],
perturbations.shape[2]))
success = numpy.swapaxes(self.success, 0, 1)
success = success.reshape((success.shape[0] * success.shape[1]))
accuracy = numpy.repeat(self.accuracy, num_attempts, axis=0)
# Raw success is the base for all statistics, as we need to consider only these
# attacks that are successful and where the classifier originally was correct.
raw_overall_success = numpy.logical_and(success >= 0, accuracy)
log('[Testing] %d valid attacks' % numpy.sum(raw_overall_success))
# For off-manifold attacks this should not happen, but save is save.
if not numpy.any(raw_overall_success):
for n in range(len(self.norms)):
for type in [
'raw_success', 'raw_iteration', 'raw_average',
'raw_latent'
]:
self.results[n][type] = 0
for type in [
'raw_class_success', 'raw_class_average',
'raw_class_latent'
]:
self.results[n][type] = numpy.zeros((N_class))
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)
log('[Testing] no successful attacks found, no plots')
return
perturbation_images = numpy.repeat(self.perturbation_images,
num_attempts,
axis=0)
perturbation_codes = numpy.repeat(self.perturbation_codes,
num_attempts,
axis=0)
#
# We compute some simple statistics:
# - raw success rate: fraction of successful attack without considering epsilon
# - corrected success rate: fraction of successful attacks within epsilon-ball
# - raw average perturbation: average distance to original samples (for successful attacks)
# - corrected average perturbation: average distance to original samples for perturbations
# within epsilon-ball (for successful attacks).
# These statistics can also be computed per class.
# And these statistics are computed with respect to three norms.
if self.args.plot_directory and utils.display():
iterations = success[raw_overall_success]
x = numpy.arange(numpy.max(iterations) + 1)
y = numpy.bincount(iterations)
plot_file = os.path.join(self.args.plot_directory, 'iterations')
plot.bar(plot_file,
x,
y,
title='Distribution of Iterations of Successful Attacks',
xlabel='Number of Iterations',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
for n in range(len(self.norms)):
norm = self.norms[n]
delta = numpy.linalg.norm(perturbation_images - perturbations,
norm,
axis=1)
if self.args.plot_directory and utils.display():
plot_file = os.path.join(self.args.plot_directory,
'distances_l%g' % norm)
plot.histogram(
plot_file,
delta[raw_overall_success],
50,
title=
'Distribution of $L_{%g}$ Distances of Successful Attacks'
% norm,
xlabel='Distance',
ylabel='Count')
log('[Testing] wrote %s' % plot_file)
#debug_accuracy = numpy.sum(accuracy) / accuracy.shape[0]
#debug_attack_fraction = numpy.sum(raw_overall_success) / numpy.sum(success >= 0)
#debug_test_fraction = numpy.sum(raw_overall_success) / numpy.sum(accuracy)
#log('[Testing] attacked model accuracy: %g' % debug_accuracy)
#log('[Testing] only %g of successful attacks are valid' % debug_attack_fraction)
#log('[Testing] only %g of correct samples are successfully attacked' % debug_test_fraction)
N_accuracy = numpy.sum(accuracy)
self.results[n]['raw_success'] = numpy.sum(
raw_overall_success) / N_accuracy
self.results[n]['raw_iteration'] = numpy.average(
success[raw_overall_success])
self.results[n]['raw_average'] = numpy.average(
delta[raw_overall_success]) if numpy.any(
raw_overall_success) else 0
self.results[n]['raw_latent'] = 0
raw_class_success = numpy.zeros(
(N_class, perturbation_images.shape[0]), bool)
self.results[n]['raw_class_success'] = numpy.zeros((N_class))
self.results[n]['raw_class_average'] = numpy.zeros((N_class))
self.results[n]['raw_class_latent'] = numpy.zeros((N_class))
for c in range(N_class):
N_samples = numpy.sum(
numpy.logical_and(accuracy, perturbation_codes == c))
if N_samples <= 0:
continue
raw_class_success[c] = numpy.logical_and(
raw_overall_success, perturbation_codes == c)
self.results[n]['raw_class_success'][c] = numpy.sum(
raw_class_success[c]) / N_samples
if numpy.any(raw_class_success[c]):
self.results[n]['raw_class_average'][c] = numpy.average(
delta[raw_class_success[c].astype(bool)])
if self.args.results_file:
utils.write_pickle(self.args.results_file, self.results)
log('[Testing] wrote %s' % self.args.results_file)