AttackTestTarget( fa.BoundaryAttack( steps=110, init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50), update_stats_every_k=1, )), AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50), None, uses_grad=True), AttackTestTarget(fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, uses_grad=True), AttackTestTarget(fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None), AttackTestTarget(fa.L2AdditiveGaussianNoiseAttack(), 2500.0), AttackTestTarget(fa.L2ClippingAwareAdditiveGaussianNoiseAttack(), 500.0), AttackTestTarget(fa.LinfAdditiveUniformNoiseAttack(), 10.0), AttackTestTarget( fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False), 1000.0), AttackTestTarget( fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack( check_trivial=False), 200.0, ), AttackTestTarget(fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0), AttackTestTarget(fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(), 200.0), AttackTestTarget(fa.L2RepeatedAdditiveUniformNoiseAttack(), 1000.0), AttackTestTarget(fa.L2ClippingAwareRepeatedAdditiveUniformNoiseAttack(), 200.0), AttackTestTarget(fa.LinfRepeatedAdditiveUniformNoiseAttack(), 3.0), ]
(fa.BoundaryAttack(steps=50), None, False, False), ( fa.BoundaryAttack( steps=110, init_attack=fa.LinearSearchBlendedUniformNoiseAttack(steps=50), update_stats_every_k=1, ), None, False, False, ), (fa.SaltAndPepperNoiseAttack(steps=50), None, True, False), (fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, True, False), (fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None, False, False), (fa.L2AdditiveGaussianNoiseAttack(), 2500.0, False, False), (fa.LinfAdditiveUniformNoiseAttack(), 10.0, False, False), ( fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False), 1000.0, False, False, ), (fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0, False, False), (fa.L2RepeatedAdditiveUniformNoiseAttack(), 1000.0, False, False), (fa.LinfRepeatedAdditiveUniformNoiseAttack(), 3.0, False, False), ] @pytest.mark.parametrize("attack_eps_grad_real", attacks, ids=get_attack_id) def test_untargeted_attacks( fmodel_and_data_ext_for_attacks: Tuple[Tuple[fbn.Model, ep.Tensor,
validation_data=ds_test, steps_per_epoch=7500 // batch_size, validation_steps=2500 // batch_size, callbacks=[tensorboard_callback]) for images, labels in ds_train.take(1): # only take first element of dataset images_ex = ep.astensors(images) labels_ex = ep.astensors(labels) fmodel = fb.TensorFlowModel(baseline_model, bounds=(0, 1)) attacks = [ fa.FGSM(), fa.LinfPGD(), fa.LinfBasicIterativeAttack(), fa.LinfAdditiveUniformNoiseAttack(), fa.LinfDeepFoolAttack(), ] attacks_names = [ "FGSM", "LinfPGD", "LinfBasicIterativeAttack", "LinfAdditiveUniformNoiseAttack", "LinfDeepFoolAttack" ] epsilons = [ 0.0, 0.0005, 0.001, 0.0015, 0.002, 0.003, 0.005, 0.01, 0.02, 0.03, 0.1, 0.3, 0.5, 1.0 ] transfer_methods = [ #"Transfer With Last Layer",
AttackTestTarget( fa.SaltAndPepperNoiseAttack(steps=50, channel_axis=1), None, uses_grad=True, stochastic_attack=True, ), AttackTestTarget( fa.LinearSearchBlendedUniformNoiseAttack(steps=50), None, stochastic_attack=True ), AttackTestTarget( fa.L2AdditiveGaussianNoiseAttack(), 3000.0, stochastic_attack=True ), AttackTestTarget( fa.L2ClippingAwareAdditiveGaussianNoiseAttack(), 500.0, stochastic_attack=True ), AttackTestTarget(fa.LinfAdditiveUniformNoiseAttack(), 10.0, stochastic_attack=True), AttackTestTarget( fa.L2RepeatedAdditiveGaussianNoiseAttack(check_trivial=False), 1000.0, stochastic_attack=True, ), AttackTestTarget( fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(check_trivial=False), 200.0, stochastic_attack=True, ), AttackTestTarget( fa.L2RepeatedAdditiveGaussianNoiseAttack(), 1000.0, stochastic_attack=True ), AttackTestTarget( fa.L2ClippingAwareRepeatedAdditiveGaussianNoiseAttack(),