def mnist_train(epoch_size, batch_size, lr, momentum): mnist_path = "../../dataset/MNIST" ds = generate_mnist_dataset(os.path.join(mnist_path, "train"), batch_size=batch_size, repeat_size=1) network = LeNet5() net_loss = nn.SoftmaxCrossEntropyWithLogits(sparse=True, reduction="mean") net_opt = nn.Momentum(network.trainable_params(), lr, momentum) config_ck = CheckpointConfig(save_checkpoint_steps=1875, keep_checkpoint_max=10) ckpoint_cb = ModelCheckpoint(prefix="checkpoint_lenet", directory="./trained_ckpt_file/", config=config_ck) model = Model(network, net_loss, net_opt, metrics={"Accuracy": Accuracy()}) LOGGER.info(TAG, "============== Starting Training ==============") model.train(epoch_size, ds, callbacks=[ckpoint_cb, LossMonitor()], dataset_sink_mode=False) LOGGER.info(TAG, "============== Starting Testing ==============") ckpt_file_name = "trained_ckpt_file/checkpoint_lenet-10_1875.ckpt" param_dict = load_checkpoint(ckpt_file_name) load_param_into_net(network, param_dict) ds_eval = generate_mnist_dataset(os.path.join(mnist_path, "test"), batch_size=batch_size) acc = model.eval(ds_eval, dataset_sink_mode=False) LOGGER.info(TAG, "============== Accuracy: %s ==============", acc)
def test_lenet_mnist_coverage(): # upload trained network ckpt_path = '../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) model = Model(net) # get training data data_list = "../common/dataset/MNIST/train" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size, sparse=True) train_images = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) train_images.append(images) train_images = np.concatenate(train_images, axis=0) # initialize fuzz test with training dataset model_fuzz_test = ModelCoverageMetrics(model, 10, 1000, train_images) # fuzz test with original test data # get test data data_list = "../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size, sparse=True) test_images = [] test_labels = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) test_images = np.concatenate(test_images, axis=0) test_labels = np.concatenate(test_labels, axis=0) model_fuzz_test.calculate_coverage(test_images) LOGGER.info(TAG, 'KMNC of this test is : %s', model_fuzz_test.get_kmnc()) LOGGER.info(TAG, 'NBC of this test is : %s', model_fuzz_test.get_nbc()) LOGGER.info(TAG, 'SNAC of this test is : %s', model_fuzz_test.get_snac()) # generate adv_data loss = SoftmaxCrossEntropyWithLogits(sparse=True) attack = FastGradientSignMethod(net, eps=0.3, loss_fn=loss) adv_data = attack.batch_generate(test_images, test_labels, batch_size=32) model_fuzz_test.calculate_coverage(adv_data, bias_coefficient=0.5) LOGGER.info(TAG, 'KMNC of this adv data is : %s', model_fuzz_test.get_kmnc()) LOGGER.info(TAG, 'NBC of this adv data is : %s', model_fuzz_test.get_nbc()) LOGGER.info(TAG, 'SNAC of this adv data is : %s', model_fuzz_test.get_snac())
def mnist_suppress_train(epoch_size=10, start_epoch=3, lr=0.05, samples=10000, mask_times=1000, sparse_thd=0.90, sparse_start=0.0, masklayers=None): """ local train by suppress-based privacy """ networks_l5 = LeNet5() suppress_ctrl_instance = SuppressPrivacyFactory().create( networks_l5, masklayers, policy="local_train", end_epoch=epoch_size, batch_num=(int)(samples / cfg.batch_size), start_epoch=start_epoch, mask_times=mask_times, lr=lr, sparse_end=sparse_thd, sparse_start=sparse_start) net_loss = nn.SoftmaxCrossEntropyWithLogits(sparse=True, reduction="mean") net_opt = nn.SGD(networks_l5.trainable_params(), lr) config_ck = CheckpointConfig(save_checkpoint_steps=(int)(samples / cfg.batch_size), keep_checkpoint_max=10) # Create the SuppressModel model for training. model_instance = SuppressModel(network=networks_l5, loss_fn=net_loss, optimizer=net_opt, metrics={"Accuracy": Accuracy()}) model_instance.link_suppress_ctrl(suppress_ctrl_instance) # Create a Masker for Suppress training. The function of the Masker is to # enforce suppress operation while training. suppress_masker = SuppressMasker(model=model_instance, suppress_ctrl=suppress_ctrl_instance) mnist_path = "./MNIST_unzip/" #"../../MNIST_unzip/" ds_train = generate_mnist_dataset(os.path.join(mnist_path, "train"), batch_size=cfg.batch_size, repeat_size=1, samples=samples) ckpoint_cb = ModelCheckpoint(prefix="checkpoint_lenet", directory="./trained_ckpt_file/", config=config_ck) print("============== Starting SUPP Training ==============") model_instance.train( epoch_size, ds_train, callbacks=[ckpoint_cb, LossMonitor(), suppress_masker], dataset_sink_mode=False) print("============== Starting SUPP Testing ==============") ds_eval = generate_mnist_dataset(os.path.join(mnist_path, 'test'), batch_size=cfg.batch_size) acc = model_instance.eval(ds_eval, dataset_sink_mode=False) print("============== SUPP Accuracy: %s ==============", acc) suppress_ctrl_instance.print_paras()
def test_lbfgs_attack(): """ LBFGS-Attack test for CPU device. """ # upload trained network ckpt_path = '../../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) # get test data data_list = "../../../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size=batch_size) # prediction accuracy before attack model = Model(net) batch_num = 3 # the number of batches of attacking samples test_images = [] test_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) pred_labels = np.argmax(model.predict(Tensor(images)).asnumpy(), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break predict_labels = np.concatenate(predict_labels) true_labels = np.concatenate(test_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %s", accuracy) # attacking is_targeted = True if is_targeted: targeted_labels = np.random.randint(0, 10, size=len(true_labels)).astype(np.int32) for i, true_l in enumerate(true_labels): if targeted_labels[i] == true_l: targeted_labels[i] = (targeted_labels[i] + 1) % 10 else: targeted_labels = true_labels.astype(np.int32) loss = SoftmaxCrossEntropyWithLogits(sparse=True) attack = LBFGS(net, is_targeted=is_targeted, loss_fn=loss) start_time = time.clock() adv_data = attack.batch_generate(np.concatenate(test_images), targeted_labels, batch_size=batch_size) stop_time = time.clock() pred_logits_adv = model.predict(Tensor(adv_data)).asnumpy() # rescale predict confidences into (0, 1). pred_logits_adv = softmax(pred_logits_adv, axis=1) pred_labels_adv = np.argmax(pred_logits_adv, axis=1) accuracy_adv = np.mean(np.equal(pred_labels_adv, true_labels)) LOGGER.info(TAG, "prediction accuracy after attacking is : %s", accuracy_adv) attack_evaluate = AttackEvaluate(np.concatenate(test_images).transpose(0, 2, 3, 1), np.eye(10)[true_labels], adv_data.transpose(0, 2, 3, 1), pred_logits_adv, targeted=is_targeted, target_label=targeted_labels) LOGGER.info(TAG, 'mis-classification rate of adversaries is : %s', attack_evaluate.mis_classification_rate()) LOGGER.info(TAG, 'The average confidence of adversarial class is : %s', attack_evaluate.avg_conf_adv_class()) LOGGER.info(TAG, 'The average confidence of true class is : %s', attack_evaluate.avg_conf_true_class()) LOGGER.info(TAG, 'The average distance (l0, l2, linf) between original ' 'samples and adversarial samples are: %s', attack_evaluate.avg_lp_distance()) LOGGER.info(TAG, 'The average structural similarity between original ' 'samples and adversarial samples are: %s', attack_evaluate.avg_ssim()) LOGGER.info(TAG, 'The average costing time is %s', (stop_time - start_time)/(batch_num*batch_size))
num_parallel_workers=num_parallel_workers) # apply DatasetOps buffer_size = 10000 ds1 = ds1.shuffle(buffer_size=buffer_size) ds1 = ds1.batch(batch_size, drop_remainder=True) ds1 = ds1.repeat(repeat_size) return ds1 if __name__ == "__main__": # This configure can run both in pynative mode and graph mode context.set_context(mode=context.GRAPH_MODE, device_target=cfg.device_target) network = LeNet5() net_loss = nn.SoftmaxCrossEntropyWithLogits(sparse=True, reduction="mean") config_ck = CheckpointConfig( save_checkpoint_steps=cfg.save_checkpoint_steps, keep_checkpoint_max=cfg.keep_checkpoint_max) ckpoint_cb = ModelCheckpoint(prefix="checkpoint_lenet", directory='./trained_ckpt_file/', config=config_ck) # get training dataset ds_train = generate_mnist_dataset(os.path.join(cfg.data_path, "train"), cfg.batch_size) if cfg.micro_batches and cfg.batch_size % cfg.micro_batches != 0: raise ValueError( "Number of micro_batches should divide evenly batch_size")
def test_pso_attack_on_mnist(): """ PSO-Attack test """ # upload trained network ckpt_path = '../../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) # get test data data_list = "../../../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size=batch_size) # prediction accuracy before attack model = ModelToBeAttacked(net) batch_num = 3 # the number of batches of attacking samples test_images = [] test_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) pred_labels = np.argmax(model.predict(images), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break predict_labels = np.concatenate(predict_labels) true_labels = np.concatenate(test_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %s", accuracy) # attacking attack = PSOAttack(model, bounds=(0.0, 1.0), pm=0.5, sparse=True) start_time = time.clock() success_list, adv_data, query_list = attack.generate( np.concatenate(test_images), np.concatenate(test_labels)) stop_time = time.clock() LOGGER.info(TAG, 'success_list: %s', success_list) LOGGER.info(TAG, 'average of query times is : %s', np.mean(query_list)) pred_logits_adv = model.predict(adv_data) # rescale predict confidences into (0, 1). pred_logits_adv = softmax(pred_logits_adv, axis=1) pred_labels_adv = np.argmax(pred_logits_adv, axis=1) accuracy_adv = np.mean(np.equal(pred_labels_adv, true_labels)) LOGGER.info(TAG, "prediction accuracy after attacking is : %s", accuracy_adv) test_labels_onehot = np.eye(10)[np.concatenate(test_labels)] attack_evaluate = AttackEvaluate(np.concatenate(test_images), test_labels_onehot, adv_data, pred_logits_adv) LOGGER.info(TAG, 'mis-classification rate of adversaries is : %s', attack_evaluate.mis_classification_rate()) LOGGER.info(TAG, 'The average confidence of adversarial class is : %s', attack_evaluate.avg_conf_adv_class()) LOGGER.info(TAG, 'The average confidence of true class is : %s', attack_evaluate.avg_conf_true_class()) LOGGER.info( TAG, 'The average distance (l0, l2, linf) between original ' 'samples and adversarial samples are: %s', attack_evaluate.avg_lp_distance()) LOGGER.info( TAG, 'The average structural similarity between original ' 'samples and adversarial samples are: %s', attack_evaluate.avg_ssim()) LOGGER.info(TAG, 'The average costing time is %s', (stop_time - start_time) / (batch_num * batch_size))
def test_similarity_detector(): """ Similarity Detector test. """ # load trained network ckpt_path = '../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) # get mnist data data_list = "../../common/dataset/MNIST/test" batch_size = 1000 ds = generate_mnist_dataset(data_list, batch_size=batch_size) model = ModelToBeAttacked(net) batch_num = 10 # the number of batches of input samples all_images = [] true_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] all_images.append(images) true_labels.append(labels) pred_labels = np.argmax(model.predict(images), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break all_images = np.concatenate(all_images) true_labels = np.concatenate(true_labels) predict_labels = np.concatenate(predict_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %s", accuracy) train_images = all_images[0:6000, :, :, :] attacked_images = all_images[0:10, :, :, :] attacked_labels = true_labels[0:10] # generate malicious query sequence of black attack attack = PSOAttack(model, bounds=(0.0, 1.0), pm=0.5, sparse=True, t_max=1000) success_list, adv_data, query_list = attack.generate( attacked_images, attacked_labels) LOGGER.info(TAG, 'pso attack success_list: %s', success_list) LOGGER.info(TAG, 'average of query counts is : %s', np.mean(query_list)) pred_logits_adv = model.predict(adv_data) # rescale predict confidences into (0, 1). pred_logits_adv = softmax(pred_logits_adv, axis=1) pred_lables_adv = np.argmax(pred_logits_adv, axis=1) accuracy_adv = np.mean(np.equal(pred_lables_adv, attacked_labels)) LOGGER.info(TAG, "prediction accuracy after attacking is : %g", accuracy_adv) benign_queries = all_images[6000:10000, :, :, :] suspicious_queries = model.get_queries() # explicit threshold not provided, calculate threshold for K encoder = Model(EncoderNet(encode_dim=256)) detector = SimilarityDetector(max_k_neighbor=50, trans_model=encoder) detector.fit(inputs=train_images) # test benign queries detector.detect(benign_queries) fpr = len(detector.get_detected_queries()) / benign_queries.shape[0] LOGGER.info(TAG, 'Number of false positive of attack detector is : %s', len(detector.get_detected_queries())) LOGGER.info(TAG, 'False positive rate of attack detector is : %s', fpr) # test attack queries detector.clear_buffer() detector.detect(suspicious_queries) LOGGER.info(TAG, 'Number of detected attack queries is : %s', len(detector.get_detected_queries())) LOGGER.info(TAG, 'The detected attack query indexes are : %s', detector.get_detected_queries())
def test_hsja_mnist_attack(): """ hsja-Attack test """ # upload trained network ckpt_path = '../../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) net.set_train(False) # get test data data_list = "../../../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size=batch_size) # prediction accuracy before attack model = ModelToBeAttacked(net) batch_num = 5 # the number of batches of attacking samples test_images = [] test_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) pred_labels = np.argmax(model.predict(images), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break predict_labels = np.concatenate(predict_labels) true_labels = np.concatenate(test_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %s", accuracy) test_images = np.concatenate(test_images) # attacking norm = 'l2' search = 'grid_search' target = False attack = HopSkipJumpAttack(model, constraint=norm, stepsize_search=search) if target: target_labels = random_target_labels(true_labels) target_images = create_target_images(test_images, predict_labels, target_labels) attack.set_target_images(target_images) success_list, adv_data, _ = attack.generate(test_images, target_labels) else: success_list, adv_data, _ = attack.generate(test_images, None) adv_datas = [] gts = [] for success, adv, gt in zip(success_list, adv_data, true_labels): if success: adv_datas.append(adv) gts.append(gt) if gts: adv_datas = np.concatenate(np.asarray(adv_datas), axis=0) gts = np.asarray(gts) pred_logits_adv = model.predict(adv_datas) pred_lables_adv = np.argmax(pred_logits_adv, axis=1) accuracy_adv = np.mean(np.equal(pred_lables_adv, gts)) mis_rate = (1 - accuracy_adv)*(len(adv_datas) / len(success_list)) LOGGER.info(TAG, 'mis-classification rate of adversaries is : %s', mis_rate)
def test_salt_and_pepper_attack_on_mnist(): """ Salt-and-Pepper-Attack test """ # upload trained network ckpt_path = '../../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) # get test data data_list = "../../../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size=batch_size) # prediction accuracy before attack model = ModelToBeAttacked(net) batch_num = 3 # the number of batches of attacking samples test_images = [] test_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) pred_labels = np.argmax(model.predict(images), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break LOGGER.debug( TAG, 'model input image shape is: {}'.format(np.array(test_images).shape)) predict_labels = np.concatenate(predict_labels) true_labels = np.concatenate(test_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %g", accuracy) # attacking is_target = False attack = SaltAndPepperNoiseAttack(model=model, is_targeted=is_target, sparse=True) if is_target: targeted_labels = np.random.randint(0, 10, size=len(true_labels)) for i, true_l in enumerate(true_labels): if targeted_labels[i] == true_l: targeted_labels[i] = (targeted_labels[i] + 1) % 10 else: targeted_labels = true_labels LOGGER.debug( TAG, 'input shape is: {}'.format(np.concatenate(test_images).shape)) success_list, adv_data, query_list = attack.generate( np.concatenate(test_images), targeted_labels) success_list = np.arange(success_list.shape[0])[success_list] LOGGER.info(TAG, 'success_list: %s', success_list) LOGGER.info(TAG, 'average of query times is : %s', np.mean(query_list)) adv_preds = [] for ite_data in adv_data: pred_logits_adv = model.predict(ite_data) # rescale predict confidences into (0, 1). pred_logits_adv = softmax(pred_logits_adv, axis=1) adv_preds.extend(pred_logits_adv) accuracy_adv = np.mean(np.equal(np.max(adv_preds, axis=1), true_labels)) LOGGER.info(TAG, "prediction accuracy after attacking is : %g", accuracy_adv) test_labels_onehot = np.eye(10)[true_labels] attack_evaluate = AttackEvaluate(np.concatenate(test_images), test_labels_onehot, adv_data, adv_preds, targeted=is_target, target_label=targeted_labels) LOGGER.info(TAG, 'mis-classification rate of adversaries is : %s', attack_evaluate.mis_classification_rate()) LOGGER.info(TAG, 'The average confidence of adversarial class is : %s', attack_evaluate.avg_conf_adv_class()) LOGGER.info(TAG, 'The average confidence of true class is : %s', attack_evaluate.avg_conf_true_class()) LOGGER.info( TAG, 'The average distance (l0, l2, linf) between original ' 'samples and adversarial samples are: %s', attack_evaluate.avg_lp_distance())
def test_nes_mnist_attack(): """ hsja-Attack test """ # upload trained network ckpt_path = '../../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) net.set_train(False) # get test data data_list = "../../../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size=batch_size) # prediction accuracy before attack model = ModelToBeAttacked(net) # the number of batches of attacking samples batch_num = 5 test_images = [] test_labels = [] predict_labels = [] i = 0 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) pred_labels = np.argmax(model.predict(images), axis=1) predict_labels.append(pred_labels) if i >= batch_num: break predict_labels = np.concatenate(predict_labels) true_labels = np.concatenate(test_labels) accuracy = np.mean(np.equal(predict_labels, true_labels)) LOGGER.info(TAG, "prediction accuracy before attacking is : %s", accuracy) test_images = np.concatenate(test_images) # attacking scene = 'Query_Limit' if scene == 'Query_Limit': top_k = -1 elif scene == 'Partial_Info': top_k = 5 elif scene == 'Label_Only': top_k = 5 success = 0 queries_num = 0 nes_instance = NES(model, scene, top_k=top_k) test_length = 32 advs = [] for img_index in range(test_length): # Initial image and class selection initial_img = test_images[img_index] orig_class = true_labels[img_index] initial_img = [initial_img] target_class = random_target_labels([orig_class], true_labels) target_image = create_target_images(test_images, true_labels, target_class) nes_instance.set_target_images(target_image) tag, adv, queries = nes_instance.generate(initial_img, target_class) if tag[0]: success += 1 queries_num += queries[0] advs.append(adv) advs = np.reshape(advs, (len(advs), 1, 32, 32)) adv_pred = np.argmax(model.predict(advs), axis=1) adv_accuracy = np.mean(np.equal(adv_pred, true_labels[:test_length])) LOGGER.info(TAG, "prediction accuracy after attacking is : %s", adv_accuracy)
def test_nad_method(): """ NAD-Defense test. """ mnist_path = "../../common/dataset/MNIST" batch_size = 32 # 1. train original model ds_train = generate_mnist_dataset(os.path.join(mnist_path, "train"), batch_size=batch_size, repeat_size=1) net = LeNet5() loss = SoftmaxCrossEntropyWithLogits(sparse=True) opt = nn.Momentum(net.trainable_params(), 0.01, 0.09) model = Model(net, loss, opt, metrics=None) model.train(10, ds_train, callbacks=[LossMonitor()], dataset_sink_mode=False) # 2. get test data ds_test = generate_mnist_dataset(os.path.join(mnist_path, "test"), batch_size=batch_size, repeat_size=1) inputs = [] labels = [] for data in ds_test.create_tuple_iterator(): inputs.append(data[0].asnumpy().astype(np.float32)) labels.append(data[1].asnumpy()) inputs = np.concatenate(inputs) labels = np.concatenate(labels) # 3. get accuracy of test data on original model net.set_train(False) acc_list = [] batchs = inputs.shape[0] // batch_size for i in range(batchs): batch_inputs = inputs[i * batch_size:(i + 1) * batch_size] batch_labels = labels[i * batch_size:(i + 1) * batch_size] logits = net(Tensor(batch_inputs)).asnumpy() label_pred = np.argmax(logits, axis=1) acc_list.append(np.mean(batch_labels == label_pred)) LOGGER.info(TAG, 'accuracy of TEST data on original model is : %s', np.mean(acc_list)) # 4. get adv of test data attack = FastGradientSignMethod(net, eps=0.3, loss_fn=loss) adv_data = attack.batch_generate(inputs, labels) LOGGER.info(TAG, 'adv_data.shape is : %s', adv_data.shape) # 5. get accuracy of adv data on original model acc_list = [] batchs = adv_data.shape[0] // batch_size for i in range(batchs): batch_inputs = adv_data[i * batch_size:(i + 1) * batch_size] batch_labels = labels[i * batch_size:(i + 1) * batch_size] logits = net(Tensor(batch_inputs)).asnumpy() label_pred = np.argmax(logits, axis=1) acc_list.append(np.mean(batch_labels == label_pred)) LOGGER.info(TAG, 'accuracy of adv data on original model is : %s', np.mean(acc_list)) # 6. defense ds_train = generate_mnist_dataset(os.path.join(mnist_path, "train"), batch_size=batch_size, repeat_size=1) inputs_train = [] labels_train = [] for data in ds_train.create_tuple_iterator(): inputs_train.append(data[0].asnumpy().astype(np.float32)) labels_train.append(data[1].asnumpy()) inputs_train = np.concatenate(inputs_train) labels_train = np.concatenate(labels_train) net.set_train() nad = NaturalAdversarialDefense(net, loss_fn=loss, optimizer=opt, bounds=(0.0, 1.0), eps=0.3) nad.batch_defense(inputs_train, labels_train, batch_size=32, epochs=10) # 7. get accuracy of test data on defensed model net.set_train(False) acc_list = [] batchs = inputs.shape[0] // batch_size for i in range(batchs): batch_inputs = inputs[i * batch_size:(i + 1) * batch_size] batch_labels = labels[i * batch_size:(i + 1) * batch_size] logits = net(Tensor(batch_inputs)).asnumpy() label_pred = np.argmax(logits, axis=1) acc_list.append(np.mean(batch_labels == label_pred)) LOGGER.info(TAG, 'accuracy of TEST data on defensed model is : %s', np.mean(acc_list)) # 8. get accuracy of adv data on defensed model acc_list = [] batchs = adv_data.shape[0] // batch_size for i in range(batchs): batch_inputs = adv_data[i * batch_size:(i + 1) * batch_size] batch_labels = labels[i * batch_size:(i + 1) * batch_size] logits = net(Tensor(batch_inputs)).asnumpy() label_pred = np.argmax(logits, axis=1) acc_list.append(np.mean(batch_labels == label_pred)) LOGGER.info(TAG, 'accuracy of adv data on defensed model is : %s', np.mean(acc_list))
def test_lenet_mnist_fuzzing(): # upload trained network ckpt_path = '../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) model = Model(net) mutate_config = [{'method': 'Blur', 'params': {'radius': [0.1, 0.2, 0.3], 'auto_param': [True, False]}}, {'method': 'Contrast', 'params': {'auto_param': [True]}}, {'method': 'Translate', 'params': {'auto_param': [True]}}, {'method': 'Brightness', 'params': {'auto_param': [True]}}, {'method': 'Noise', 'params': {'auto_param': [True]}}, {'method': 'Scale', 'params': {'auto_param': [True]}}, {'method': 'Shear', 'params': {'auto_param': [True]}}, {'method': 'FGSM', 'params': {'eps': [0.3, 0.2, 0.4], 'alpha': [0.1]}} ] # get training data data_list = "../common/dataset/MNIST/train" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size, sparse=False) train_images = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) train_images.append(images) train_images = np.concatenate(train_images, axis=0) neuron_num = 10 segmented_num = 1000 # initialize fuzz test with training dataset model_coverage_test = ModelCoverageMetrics(model, neuron_num, segmented_num, train_images) # fuzz test with original test data # get test data data_list = "../common/dataset/MNIST/test" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size, sparse=False) test_images = [] test_labels = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) test_images = np.concatenate(test_images, axis=0) test_labels = np.concatenate(test_labels, axis=0) initial_seeds = [] # make initial seeds for img, label in zip(test_images, test_labels): initial_seeds.append([img, label]) initial_seeds = initial_seeds[:100] model_coverage_test.calculate_coverage( np.array(test_images[:100]).astype(np.float32)) LOGGER.info(TAG, 'KMNC of this test is : %s', model_coverage_test.get_kmnc()) model_fuzz_test = Fuzzer(model, train_images, neuron_num, segmented_num) _, _, _, _, metrics = model_fuzz_test.fuzzing(mutate_config, initial_seeds, eval_metrics='auto') if metrics: for key in metrics: LOGGER.info(TAG, key + ': %s', metrics[key])
def mnist_inversion_attack(net): """ Image inversion attack based on LeNet5 and MNIST dataset. """ # upload trained network ckpt_path = '../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) # get original data and their inferred fearures data_list = "../../common/dataset/MNIST/train" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size) i = 0 batch_num = 1 sample_num = 30 for data in ds.create_tuple_iterator(output_numpy=True): i += 1 images = data[0].astype(np.float32) true_labels = data[1][:sample_num] target_features = net(Tensor(images)).asnumpy()[:sample_num] original_images = images[:sample_num] if i >= batch_num: break # run attacking inversion_attack = ImageInversionAttack(net, input_shape=(1, 32, 32), input_bound=(0, 1), loss_weights=[1, 0.1, 5]) inversion_images = inversion_attack.generate(target_features, iters=100) # get the predict results of inversion images on a new trained model net2 = LeNet5() new_ckpt_path = '../../common/networks/lenet5/new_trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' new_load_dict = load_checkpoint(new_ckpt_path) load_param_into_net(net2, new_load_dict) pred_labels = np.argmax(net2(Tensor(inversion_images).astype( np.float32)).asnumpy(), axis=1) # evaluate the quality of inversion images avg_l2_dis, avg_ssim, avg_confi = inversion_attack.evaluate( original_images, inversion_images, true_labels, net2) LOGGER.info( TAG, 'The average L2 distance between original images and inverted images is: {}' .format(avg_l2_dis)) LOGGER.info( TAG, 'The average ssim value between original images and inverted images is: {}' .format(avg_ssim)) LOGGER.info( TAG, 'The average prediction confidence on true labels of inverted images is: {}' .format(avg_confi)) LOGGER.info(TAG, 'True labels of original images are: %s' % true_labels) LOGGER.info(TAG, 'Predicted labels of inverted images are: %s' % pred_labels) # plot 10 images plot_num = min(sample_num, 10) for n in range(1, plot_num + 1): plt.subplot(2, plot_num, n) if n == 1: plt.title('Original images', fontsize=16, loc='left') plt.gray() plt.imshow(images[n - 1].reshape(32, 32)) plt.subplot(2, plot_num, n + plot_num) if n == 1: plt.title('Inverted images', fontsize=16, loc='left') plt.gray() plt.imshow(inversion_images[n - 1].reshape(32, 32)) plt.show()
'The average prediction confidence on true labels of inverted images is: {}' .format(avg_confi)) LOGGER.info(TAG, 'True labels of original images are: %s' % true_labels) LOGGER.info(TAG, 'Predicted labels of inverted images are: %s' % pred_labels) # plot 10 images plot_num = min(sample_num, 10) for n in range(1, plot_num + 1): plt.subplot(2, plot_num, n) if n == 1: plt.title('Original images', fontsize=16, loc='left') plt.gray() plt.imshow(images[n - 1].reshape(32, 32)) plt.subplot(2, plot_num, n + plot_num) if n == 1: plt.title('Inverted images', fontsize=16, loc='left') plt.gray() plt.imshow(inversion_images[n - 1].reshape(32, 32)) plt.show() if __name__ == '__main__': # device_target can be "CPU", "GPU" or "Ascend" context.set_context(mode=context.GRAPH_MODE, device_target="CPU") # attack based on complete LeNet5 mnist_inversion_attack(LeNet5()) # attack based on part of LeNet5. The network is more shallower and can lead to a better attack result mnist_inversion_attack(LeNet5_part())
def example_lenet_mnist_fuzzing(): """ An example of fuzz testing and then enhance the non-robustness model. """ # upload trained network ckpt_path = '../common/networks/lenet5/trained_ckpt_file/lenet_m1-10_1250.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) model = Model(net) mutate_config = [{'method': 'Blur', 'params': {'auto_param': [True]}}, {'method': 'Contrast', 'params': {'auto_param': [True]}}, {'method': 'Translate', 'params': {'auto_param': [True]}}, {'method': 'Brightness', 'params': {'auto_param': [True]}}, {'method': 'Noise', 'params': {'auto_param': [True]}}, {'method': 'Scale', 'params': {'auto_param': [True]}}, {'method': 'Shear', 'params': {'auto_param': [True]}}, {'method': 'FGSM', 'params': {'eps': [0.3, 0.2, 0.4], 'alpha': [0.1]}} ] # get training data data_list = "../common/dataset/MNIST/train" batch_size = 32 ds = generate_mnist_dataset(data_list, batch_size, sparse=False) train_images = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) train_images.append(images) train_images = np.concatenate(train_images, axis=0) # initialize fuzz test with training dataset model_coverage_test = ModelCoverageMetrics(model, 10, 1000, train_images) # fuzz test with original test data # get test data data_list = "../common/dataset/MNIST/test" batch_size = 32 init_samples = 5000 max_iters = 50000 mutate_num_per_seed = 10 ds = generate_mnist_dataset(data_list, batch_size, num_samples=init_samples, sparse=False) test_images = [] test_labels = [] for data in ds.create_tuple_iterator(output_numpy=True): images = data[0].astype(np.float32) labels = data[1] test_images.append(images) test_labels.append(labels) test_images = np.concatenate(test_images, axis=0) test_labels = np.concatenate(test_labels, axis=0) initial_seeds = [] # make initial seeds for img, label in zip(test_images, test_labels): initial_seeds.append([img, label]) model_coverage_test.calculate_coverage( np.array(test_images[:100]).astype(np.float32)) LOGGER.info(TAG, 'KMNC of test dataset before fuzzing is : %s', model_coverage_test.get_kmnc()) LOGGER.info(TAG, 'NBC of test dataset before fuzzing is : %s', model_coverage_test.get_nbc()) LOGGER.info(TAG, 'SNAC of test dataset before fuzzing is : %s', model_coverage_test.get_snac()) model_fuzz_test = Fuzzer(model, train_images, 10, 1000) gen_samples, gt, _, _, metrics = model_fuzz_test.fuzzing(mutate_config, initial_seeds, eval_metrics='auto', max_iters=max_iters, mutate_num_per_seed=mutate_num_per_seed) if metrics: for key in metrics: LOGGER.info(TAG, key + ': %s', metrics[key]) def split_dataset(image, label, proportion): """ Split the generated fuzz data into train and test set. """ indices = np.arange(len(image)) random.shuffle(indices) train_length = int(len(image) * proportion) train_image = [image[i] for i in indices[:train_length]] train_label = [label[i] for i in indices[:train_length]] test_image = [image[i] for i in indices[:train_length]] test_label = [label[i] for i in indices[:train_length]] return train_image, train_label, test_image, test_label train_image, train_label, test_image, test_label = split_dataset( gen_samples, gt, 0.7) # load model B and test it on the test set ckpt_path = '../common/networks/lenet5/trained_ckpt_file/lenet_m2-10_1250.ckpt' net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(net, load_dict) model_b = Model(net) pred_b = model_b.predict(Tensor(test_image, dtype=mindspore.float32)).asnumpy() acc_b = np.sum(np.argmax(pred_b, axis=1) == np.argmax(test_label, axis=1)) / len(test_label) print('Accuracy of model B on test set is ', acc_b) # enhense model robustness lr = 0.001 momentum = 0.9 loss_fn = SoftmaxCrossEntropyWithLogits(Sparse=True) optimizer = Momentum(net.trainable_params(), lr, momentum) adv_defense = AdversarialDefense(net, loss_fn, optimizer) adv_defense.batch_defense(np.array(train_image).astype(np.float32), np.argmax(train_label, axis=1).astype(np.int32)) preds_en = net(Tensor(test_image, dtype=mindspore.float32)).asnumpy() acc_en = np.sum(np.argmax(preds_en, axis=1) == np.argmax(test_label, axis=1)) / len(test_label) print('Accuracy of enhensed model on test set is ', acc_en)
def test_defense_evaluation(): # load trained network current_dir = os.path.dirname(os.path.abspath(__file__)) ckpt_path = os.path.abspath( os.path.join( current_dir, '../../common/networks/lenet5/trained_ckpt_file/checkpoint_lenet-10_1875.ckpt' )) wb_net = LeNet5() load_dict = load_checkpoint(ckpt_path) load_param_into_net(wb_net, load_dict) # get test data data_list = "../../common/dataset/MNIST/test" batch_size = 32 ds_test = generate_mnist_dataset(data_list, batch_size=batch_size) inputs = [] labels = [] for data in ds_test.create_tuple_iterator(output_numpy=True): inputs.append(data[0].astype(np.float32)) labels.append(data[1]) inputs = np.concatenate(inputs).astype(np.float32) labels = np.concatenate(labels).astype(np.int32) target_label = np.random.randint(0, 10, size=labels.shape[0]) for idx in range(labels.shape[0]): while target_label[idx] == labels[idx]: target_label[idx] = np.random.randint(0, 10) target_label = np.eye(10)[target_label].astype(np.float32) attacked_size = 50 benign_size = 500 attacked_sample = inputs[:attacked_size] attacked_true_label = labels[:attacked_size] benign_sample = inputs[attacked_size:attacked_size + benign_size] wb_model = ModelToBeAttacked(wb_net) # gen white-box adversarial examples of test data loss = SoftmaxCrossEntropyWithLogits(sparse=True) wb_attack = FastGradientSignMethod(wb_net, eps=0.3, loss_fn=loss) wb_adv_sample = wb_attack.generate(attacked_sample, attacked_true_label) wb_raw_preds = softmax(wb_model.predict(wb_adv_sample), axis=1) accuracy_test = np.mean( np.equal(np.argmax(wb_model.predict(attacked_sample), axis=1), attacked_true_label)) LOGGER.info(TAG, "prediction accuracy before white-box attack is : %s", accuracy_test) accuracy_adv = np.mean( np.equal(np.argmax(wb_raw_preds, axis=1), attacked_true_label)) LOGGER.info(TAG, "prediction accuracy after white-box attack is : %s", accuracy_adv) # improve the robustness of model with white-box adversarial examples opt = nn.Momentum(wb_net.trainable_params(), 0.01, 0.09) nad = NaturalAdversarialDefense(wb_net, loss_fn=loss, optimizer=opt, bounds=(0.0, 1.0), eps=0.3) wb_net.set_train(False) nad.batch_defense(inputs[:5000], labels[:5000], batch_size=32, epochs=10) wb_def_preds = wb_net(Tensor(wb_adv_sample)).asnumpy() wb_def_preds = softmax(wb_def_preds, axis=1) accuracy_def = np.mean( np.equal(np.argmax(wb_def_preds, axis=1), attacked_true_label)) LOGGER.info(TAG, "prediction accuracy after defense is : %s", accuracy_def) # calculate defense evaluation metrics for defense against white-box attack wb_def_evaluate = DefenseEvaluate(wb_raw_preds, wb_def_preds, attacked_true_label) LOGGER.info(TAG, 'defense evaluation for white-box adversarial attack') LOGGER.info( TAG, 'classification accuracy variance (CAV) is : {:.2f}'.format( wb_def_evaluate.cav())) LOGGER.info( TAG, 'classification rectify ratio (CRR) is : {:.2f}'.format( wb_def_evaluate.crr())) LOGGER.info( TAG, 'classification sacrifice ratio (CSR) is : {:.2f}'.format( wb_def_evaluate.csr())) LOGGER.info( TAG, 'classification confidence variance (CCV) is : {:.2f}'.format( wb_def_evaluate.ccv())) LOGGER.info( TAG, 'classification output stability is : {:.2f}'.format( wb_def_evaluate.cos())) # calculate defense evaluation metrics for defense against black-box attack LOGGER.info(TAG, 'defense evaluation for black-box adversarial attack') bb_raw_preds = [] bb_def_preds = [] raw_query_counts = [] raw_query_time = [] def_query_counts = [] def_query_time = [] def_detection_counts = [] # gen black-box adversarial examples of test data bb_net = LeNet5() load_param_into_net(bb_net, load_dict) bb_model = ModelToBeAttacked(bb_net, defense=False) attack_rm = GeneticAttack(model=bb_model, pop_size=6, mutation_rate=0.05, per_bounds=0.5, step_size=0.25, temp=0.1, sparse=False) attack_target_label = target_label[:attacked_size] true_label = labels[:attacked_size + benign_size] # evaluate robustness of original model # gen black-box adversarial examples of test data for idx in range(attacked_size): raw_st = time.time() _, raw_a, raw_qc = attack_rm.generate( np.expand_dims(attacked_sample[idx], axis=0), np.expand_dims(attack_target_label[idx], axis=0)) raw_t = time.time() - raw_st bb_raw_preds.extend(softmax(bb_model.predict(raw_a), axis=1)) raw_query_counts.extend(raw_qc) raw_query_time.append(raw_t) for idx in range(benign_size): raw_st = time.time() bb_raw_pred = softmax(bb_model.predict( np.expand_dims(benign_sample[idx], axis=0)), axis=1) raw_t = time.time() - raw_st bb_raw_preds.extend(bb_raw_pred) raw_query_counts.extend([0]) raw_query_time.append(raw_t) accuracy_test = np.mean( np.equal(np.argmax(bb_raw_preds[0:len(attack_target_label)], axis=1), np.argmax(attack_target_label, axis=1))) LOGGER.info(TAG, "attack success before adv defense is : %s", accuracy_test) # improve the robustness of model with similarity-based detector bb_def_model = ModelToBeAttacked(bb_net, defense=True, train_images=inputs[0:6000]) # attack defensed model attack_dm = GeneticAttack(model=bb_def_model, pop_size=6, mutation_rate=0.05, per_bounds=0.5, step_size=0.25, temp=0.1, sparse=False) for idx in range(attacked_size): def_st = time.time() _, def_a, def_qc = attack_dm.generate( np.expand_dims(attacked_sample[idx], axis=0), np.expand_dims(attack_target_label[idx], axis=0)) def_t = time.time() - def_st det_res = bb_def_model.get_detected_result() def_detection_counts.append(np.sum(det_res[-def_qc[0]:])) bb_def_preds.extend(softmax(bb_def_model.predict(def_a), axis=1)) def_query_counts.extend(def_qc) def_query_time.append(def_t) for idx in range(benign_size): def_st = time.time() bb_def_pred = softmax(bb_def_model.predict( np.expand_dims(benign_sample[idx], axis=0)), axis=1) def_t = time.time() - def_st det_res = bb_def_model.get_detected_result() def_detection_counts.append(np.sum(det_res[-1])) bb_def_preds.extend(bb_def_pred) def_query_counts.extend([0]) def_query_time.append(def_t) accuracy_adv = np.mean( np.equal(np.argmax(bb_def_preds[0:len(attack_target_label)], axis=1), np.argmax(attack_target_label, axis=1))) LOGGER.info(TAG, "attack success rate after adv defense is : %s", accuracy_adv) bb_raw_preds = np.array(bb_raw_preds).astype(np.float32) bb_def_preds = np.array(bb_def_preds).astype(np.float32) # check evaluate data max_queries = 6000 def_evaluate = BlackDefenseEvaluate(bb_raw_preds, bb_def_preds, np.array(raw_query_counts), np.array(def_query_counts), np.array(raw_query_time), np.array(def_query_time), np.array(def_detection_counts), true_label, max_queries) LOGGER.info( TAG, 'query count variance of adversaries is : {:.2f}'.format( def_evaluate.qcv())) LOGGER.info( TAG, 'attack success rate variance of adversaries ' 'is : {:.2f}'.format(def_evaluate.asv())) LOGGER.info( TAG, 'false positive rate (FPR) of the query-based detector ' 'is : {:.2f}'.format(def_evaluate.fpr())) LOGGER.info( TAG, 'the benign query response time variance (QRV) ' 'is : {:.2f}'.format(def_evaluate.qrv()))