+
+
+
| Dataset | +Precisions | +Unperturbed Accuracy (%) | +Adversarial Accuracy (%) | +||||||
|---|---|---|---|---|---|---|---|---|---|
| Model 1 | +Model 2 | +Model 3 | +CW | +FGSM | +BIM | +PGD | +Average | +||
| MNIST | +abits=4, wbits=2 Download | +abits=4, wbits=2 Download | +Full-precision (32 bits) Download | +98.89 | +86.73 | +67.06 | +18.61 | +17.51 | +47.48 | +
| CIFAR-10 | +abits=2, wbits=4 Download | +abits=2, wbits=2 Download | +Full-precision (32 bits) Download | +72.56 | +48.51 | +20.45 | +24.59 | +13.55 | +26.78 | +
| ImageNet | +abits=2, wbits=2 Download | +abits=4, wbits=4 Download | +Full-precision (32 bits) Download | +55.09 | +29.36 | +21.65 | +20.67 | +11.76 | +20.86 | +
| Dataset | +Models | +Unperturbed Accuracy (%) | +Adversarial Accuracy (%) | +||||
|---|---|---|---|---|---|---|---|
| CW | +FGSM | +BIM | +PGD | +Average | +|||
| MNIST | +MNISTconv Download | +98.87 | +3.69 | +14.32 | +0.9 | +0.77 | +4.92 | +
| CIFAR-10 | +CIFARconv Download | +74.54 | +13.38 | +10.28 | +11.97 | +10.69 | +11.58 | +
| ImageNet | +AlexNet Download | +53.23 | +9.94 | +10.29 | +10.81 | +10.30 | +10.34 | +
+
+This plot shows the MM centers under different number of classes `L`.
+
+## Training codes
+
+### Standard training with the SCE loss
+
+Let `dataset` be `mnist`, `cifar10` or `cifar100`, the command for training models with the SCE loss is
+```shell
+python train.py --batch_size=50 --dataset=[dataset] --optimizer='mom' --lr=0.01 --version=2 --use_MMLDA=False --use_BN=True --use_dense=True --use_leaky=False
+```
+Here the initial learning rate is `0.01`, the optimizer is `mom` and we use the `Resnet-v2` architecture proposed by [He et al. (2016)](https://arxiv.org/abs/1603.05027). The training epoch on MNIST is set as 40, on CIFAR-10 and CIFAR-100 is set as 200.
+
+### Standard training with the MMC loss
+Similarly, let `dataset` be `mnist`, `cifar10` or `cifar100`, the command for training models with the MMC loss is
+```shell
+python train.py --batch_size=50 --mean_var=10 --dataset=[dataset] -optimizer='mom' --lr=0.01 --version=2 --use_MMLDA=True --use_ball=True --use_BN=True --use_random=False --use_dense=True --use_leaky=False
+```
+Here the basic training setting, e.g., learning rate and optimizer are the same as them for the SCE loss. The `meanvar` parameter is the $C_{MM}$ of the MMC loss in the paper. When the bool flag `use_ball` is False, the command run the training with the MMLDA loss.
+
+### Adversarial training with the SCE loss
+For the adversarial training, we apply the most widely studied PGD-based method proposed by [Madry et al. (2017)](https://arxiv.org/abs/1706.06083).
+```shell
+python advtrain.py --batch_size=50 --dataset=[dataset] --optimizer='mom' --lr=0.01 --version=2 --adv_ratio=1.0 --use_MMLDA=False --use_ball=False --use_target=False --attack_method='MadryEtAl' --use_BN=True --use_random=False
+```
+Here the `adv_ratio` is set as 1, which means we only use adversarial examples in the training phase as suggested in previous work. The bool flag `use_target` indicates whether uses targeted attack or untargeted attack when crafting adversarial examples for training.
+
+### Adversarial training with the MMC loss
+The adversarial training command is similar for the MMC loss
+```shell
+python advtrain.py --batch_size=50 --mean_var=10 --dataset=[dataset] --optimizer='mom' --lr=0.01 --version=2 --adv_ratio=1.0 --use_MMLDA=True --use_ball=True --use_target=True --attack_method='MadryEtAl' --use_BN=True --use_random=False
+```
+
+## Evaluation codes
+
+The pretrained models are provided below for Resnet110 (n=18):
+
+[MMC (CIFAR-10)](http://ml.cs.tsinghua.edu.cn/~tianyu/MMC/pretrained_models/MMC_mom_cifar10/model.200.h5)
+
+[MMC (CIFAR-100)](http://ml.cs.tsinghua.edu.cn/~tianyu/MMC/pretrained_models/MMC_mom_cifar100/model.200.h5)
+
+[MMC + adv-training (CIFAR-10)](http://ml.cs.tsinghua.edu.cn/~tianyu/MMC/pretrained_models/MMC_mom_advtrain_cifar10/model.180.h5)
+
+[MMC + adv-training (CIFAR-100)](http://ml.cs.tsinghua.edu.cn/~tianyu/MMC/pretrained_models/MMC_mom_advtrain_cifar100/model.180.h5).
+
+### White-box L-infinity attack (PGD)
+In this setting, the attacking methods are usually iterative-based. For examples, the command of applying targeted PGD-10 to evade the models trained by the MMC loss is
+```shell
+python advtest_iterative.py --batch_size=50 --attack_method='MadryEtAl' --attack_method_for_advtrain=None --dataset=[dataset] --target=True --num_iter=10 --use_ball=True --use_MMLDA=True --use_advtrain=False --epoch=[epoch] --use_BN=True --normalize_output_for_ball=False --use_random=False --use_target=False
+```
+Here `attack_method` could be 'MadryEtAl' (PGD), 'FastGradientMethod' (FGSM), 'MomentumIterativeMethod' (MIM) and 'BasicIterativeMethod' (BIM). The `target` indicates whether use targeted or untargeted attack; `num_iter` is the iteration steps of the performed attacks; `epoch` is the epoch of the checkpoint to load; `normalize_output_for_ball` is a bool flag to decide whether apply a softmax function to return predictions in the inference phase.
+
+**Note that our evaluation is based on cleverhans: 2.1.0. To perform adaptive attack, please manually modify the function** ```model_loss``` **of the file** ```utils_tf.py```**by substituting the softmax cross-entropy loss with other adaptive objectives, e.g.,** ```out=-tf.reduce_sum(logits * y, axis=-1)```.
+
+When attacking the adversarially trained models, we should set the `use_advtrain` as True, and the `attack_method_for_advtrain` to be 'MadryEtAl' since we use the PGD-based adversarial training methods. The `use_target` is set the same as in the training codes. For examples, the command of applying untargeted PGD to evade the models adversarially trained by the MMC loss is
+```shell
+python advtest_iterative.py --mean_var=10 --batch_size=50 --attack_method='MadryEtAl' --attack_method_for_advtrain='MadryEtAl' --dataset=[dataset] --target=False --num_iter=10 --use_ball=True --use_MMLDA=True --use_advtrain=True --epoch=[epoch] --use_BN=True --normalize_output_for_ball=False --use_random=False --adv_ratio=1.0 --use_target=False
+```
+Note that here we set `normalize_output_for_ball` be False to perform an adaptive attacks.
+
+### White-box L-2 attack (C&W)
+In this setting, the attacking methods are usually optimization-based. In the C&W method, there is a binary search mechanism for the constant parameter to find sucessful adversarial examples with minimal distortion. The command below gives an example of applying targeted C&W attack on the models trained by the MMC loss.
+```shell
+python advtest_others.py --mean_var=10 --batch_size=50 --attack_method='CarliniWagnerL2' --attack_method_for_advtrain=None --dataset=[dataset] --target=True --use_ball=True --use_MMLDA=True --use_advtrain=False --adv_ratio=1.0 --use_target=False --epoch=[epoch] --use_BN=True --normalize_output_for_ball=False --use_random=False --use_dense=True --use_leaky=False --CW_confidence=0.
+```
+The specific parameter settings of the C&W attack can be found in the code. The `attack_method` could also be 'ElasticNetMethod' to perform EAD attack.
+
+### Black-box transfer-based attack (MIM & PGD)
+For the black-box transfer-based setting, we apply the MIM and PGD attacks. An example command using the untargeted PGD-10 attack is shown below
+```shell
+python advtest_iterative_blackbox.py --batch_size=50 --optimizer='Adam' --attack_method='MadryEtAl' --dataset=[dataset] --target=False --num_iter=10 --use_random=False --use_dense=True --use_leaky=False --epoch=[epoch] --use_BN=True --model_1='AT-MMC-100' --model_2='SCE'
+```
+Here `model_1` is the substitute model used to craft adversarial examples, `model_2` is the original model used to classify these adversarial examples. These two parameters could be `SCE`, `MMC-10`, `MMC-100`, `AT-SCE`, `AT-MMC-10`, `AT-MMC-100`. The `epoch` here is the training epoch of checkpoint for both the model_1 and model_2.
+
+### Black-box gradient-free attack (SPSA)
+For the black-box gradient-free setting, we apply the SPSA attack. This attacks is based on numerical approximations of the model gradients, and can evade the defenses that based on gradient masking. An example command is given below for untargeted SPSA-10 attack on the models trained by the MMC loss.
+```shell
+python advtest_others.py --mean_var=10 --batch_size=50 --attack_method='SPSA' --attack_method_for_advtrain=None --dataset=[dataset] --target=False --use_ball=True --use_MMLDA=True --use_advtrain=False --adv_ratio=1.0 --use_target=False --epoch=[epoch] --use_BN=True -normalize_output_for_ball=False --use_random=False --use_dense=True --use_leaky=False --SPSA_epsilon=8
+```
+More details of the parameter settings can be found in the code.
+
+### General-purpose attack
+To further test the robustness of our method, we investigate the general-purpose attacks. We add the Gaussian random noise and random rotation transformation on the input images to perform the attacks. An example command is
+```shell
+python advtest_simple_transform.py --mean_var=10 --batch_size=50 --attack_method='Rotation' --attack_method_for_advtrain='MadryEtAl' --dataset=[dataset] --use_ball=True --use_MMLDA=True --use_advtrain=True --epoch=[epoch] --adv_ratio=1.0 --use_target=False --normalize_output_for_ball=False
+```
+The `attack_method` could be 'Rotation' for rotation transformation or 'Gaussian' for Gaussian noise. Detailed parameter settings are provided in the code.
diff --git a/case_studies/mmt/adaptive_attack.py b/case_studies/mmt/adaptive_attack.py
new file mode 100644
index 0000000..9f6ca0c
--- /dev/null
+++ b/case_studies/mmt/adaptive_attack.py
@@ -0,0 +1,378 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from cleverhans.attacks import Attack
+import tensorflow as tf
+import warnings
+import numpy as np
+
+from cleverhans import utils_tf
+from cleverhans.utils_tf import clip_eta
+from cleverhans.attacks import optimize_linear
+from six.moves import xrange
+
+
+def fgm(x,
+ features,
+ logit_means,
+ y=None,
+ eps=0.3,
+ ord=np.inf,
+ clip_min=None,
+ clip_max=None,
+ targeted=False,
+ sanity_checks=True,
+ projection="linf"):
+ asserts = []
+
+ # If a data range was specified, check that the input was in that range
+ if clip_min is not None:
+ asserts.append(utils_tf.assert_greater_equal(
+ x, tf.cast(clip_min, x.dtype)))
+
+ if clip_max is not None:
+ asserts.append(utils_tf.assert_less_equal(x, tf.cast(clip_max, x.dtype)))
+
+ if y is None:
+ raise NotImplementedError("labels must be supplied")
+
+ # Compute loss
+ loss, loss_diff = loss_fn(logit_means=logit_means, labels=y,
+ features=features)
+ if targeted:
+ loss = -loss
+
+ # Define gradient of loss wrt input
+ grad, = tf.gradients(loss, x)
+
+ # optimal_perturbation = optimize_linear(grad, eps, ord)
+
+ if projection == "l2":
+ square = tf.maximum(1e-12,
+ tf.reduce_sum(tf.square(grad),
+ reduction_indices=list(
+ xrange(1, len(grad.get_shape()))),
+ keepdims=True))
+ optimal_perturbation = grad / tf.sqrt(square)
+
+ # Scale perturbation to be the solution for the norm=eps rather than
+ # norm=1 problem
+ scaled_perturbation = utils_tf.mul(eps, optimal_perturbation)
+ else:
+ optimal_perturbation = tf.sign(grad)
+ scaled_perturbation = utils_tf.mul(eps, optimal_perturbation)
+
+ # Add perturbation to original example to obtain adversarial example
+ adv_x = x + scaled_perturbation
+ adv_x = x + utils_tf.clip_eta(adv_x - x, ord, eps)
+
+ # If clipping is needed, reset all values outside of [clip_min, clip_max]
+ if (clip_min is not None) or (clip_max is not None):
+ # We don't currently support one-sided clipping
+ assert clip_min is not None and clip_max is not None
+ adv_x = utils_tf.clip_by_value(adv_x, clip_min, clip_max)
+
+ if sanity_checks:
+ with tf.control_dependencies(asserts):
+ adv_x = tf.identity(adv_x)
+
+ return adv_x, loss_diff
+
+
+def loss_fn(logit_means,
+ sentinel=None,
+ labels=None,
+ features=None,
+ dim=-1, ):
+ """
+ Wrapper around tf.nn.softmax_cross_entropy_with_logits_v2 to handle
+ deprecated warning
+ """
+ # Make sure that all arguments were passed as named arguments.
+ if sentinel is not None:
+ name = "softmax_cross_entropy_with_logits"
+ raise ValueError("Only call `%s` with "
+ "named arguments (labels=..., logits=..., ...)"
+ % name)
+ if labels is None or features is None:
+ raise ValueError("Both labels and features must be provided.")
+
+ labels_oh = tf.stop_gradient(labels)
+ labels = tf.argmax(labels_oh, -1)
+
+ # find target labels
+ # ignore logit means for classes we are not considering (only relevant for
+ # binarization test)
+ logit_means = logit_means[:labels_oh.shape[-1]]
+ distances = tf.reduce_mean((tf.expand_dims(features, 1) - tf.expand_dims(logit_means, 0)) ** 2, -1)
+ distances = distances + 1e9 * labels_oh
+ target_labels = tf.argmin(distances, -1)
+
+
+ # target_labels = (labels + 1) % 2
+
+ target_logit_means = tf.gather(logit_means, target_labels)
+ source_logit_means = tf.gather(logit_means, labels)
+
+ dist = tf.reduce_mean((features - target_logit_means) ** 2, -1)
+ dist_other = tf.reduce_mean((features - source_logit_means) ** 2, -1)
+
+ dist_diff = dist - dist_other
+
+ # invert sign so that we perform gradient ascent instead of descent
+ return -tf.reduce_sum(dist), dist_diff
+
+
+class FeatureSpaceProjectedGradientDescent(Attack):
+ """
+ This class implements either the Basic Iterative Method
+ (Kurakin et al. 2016) when rand_init is set to 0. or the
+ Madry et al. (2017) method when rand_minmax is larger than 0.
+ Paper link (Kurakin et al. 2016): https://arxiv.org/pdf/1607.02533.pdf
+ Paper link (Madry et al. 2017): https://arxiv.org/pdf/1706.06083.pdf
+ :param model: cleverhans.model.Model
+ :param sess: optional tf.Session
+ :param dtypestr: dtype of the data
+ :param default_rand_init: whether to use random initialization by default
+ :param kwargs: passed through to super constructor
+ """
+
+ def __init__(self, model, logit_means, sess=None, dtypestr='float32',
+ default_rand_init=True, max_steps=99999, projection='linf', **kwargs):
+ """
+ Create a ProjectedGradientDescent instance.
+ Note: the model parameter should be an instance of the
+ cleverhans.model.Model abstraction provided by CleverHans.
+ """
+
+ super(FeatureSpaceProjectedGradientDescent, self).__init__(model, sess=sess,
+ dtypestr=dtypestr,
+ **kwargs)
+ self.feedable_kwargs = ('eps', 'eps_iter', 'y', 'y_target', 'clip_min',
+ 'clip_max')
+ self.structural_kwargs = ['ord', 'nb_iter', 'rand_init', 'sanity_checks']
+ self.logit_means = logit_means
+ self.default_rand_init = default_rand_init
+ self.max_steps = max_steps
+ self.projection = projection
+
+ def generate(self, x, **kwargs):
+ """
+ Generate symbolic graph for adversarial examples and return.
+ :param x: The model's symbolic inputs.
+ :param kwargs: See `parse_params`
+ """
+ # Parse and save attack-specific parameters
+ assert self.parse_params(**kwargs)
+
+ asserts = []
+
+ # If a data range was specified, check that the input was in that range
+ if self.clip_min is not None:
+ asserts.append(utils_tf.assert_greater_equal(x,
+ tf.cast(self.clip_min,
+ x.dtype)))
+
+ if self.clip_max is not None:
+ asserts.append(utils_tf.assert_less_equal(x,
+ tf.cast(self.clip_max,
+ x.dtype)))
+
+ # Initialize loop variables
+ if self.rand_init:
+ eta = tf.random_uniform(tf.shape(x),
+ tf.cast(-self.rand_minmax, x.dtype),
+ tf.cast(self.rand_minmax, x.dtype),
+ dtype=x.dtype)
+ else:
+ eta = tf.zeros(tf.shape(x))
+
+ # Clip eta
+ eta = clip_eta(eta, self.ord, self.eps)
+ adv_x = x + eta
+ if self.clip_min is not None or self.clip_max is not None:
+ adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)
+
+ if self.y_target is not None:
+ raise NotImplementedError("Targeted mode not fully implemented yet")
+ elif self.y is not None:
+ y = self.y
+ targeted = False
+ else:
+ raise NotImplementedError("labels must be supplied")
+
+ y_kwarg = 'y_target' if targeted else 'y'
+ fgm_params = {
+ 'eps': self.eps_iter,
+ y_kwarg: y,
+ 'ord': self.ord,
+ 'clip_min': self.clip_min,
+ 'clip_max': self.clip_max,
+ "logit_means": self.logit_means
+ }
+ if self.ord == 1:
+ raise NotImplementedError("It's not clear that FGM is a good inner loop"
+ " step for PGD when ord=1, because ord=1 FGM "
+ " changes only one pixel at a time. We need "
+ " to rigorously test a strong ord=1 PGD "
+ "before enabling this feature.")
+
+ # Use getattr() to avoid errors in eager execution attacks
+
+ def cond(i, _, _2, loss_diff, first_idx_done):
+ return tf.reduce_any(
+ tf.logical_or(
+ tf.less(i, self.nb_iter),
+ tf.logical_and(
+ tf.greater(loss_diff, tf.zeros([])),
+ tf.less(i, self.max_steps)
+ )
+ # tf.logical_or(
+ # tf.less_equal(first_idx_done, tf.zeros([])),
+ # tf.logical_and(
+ # i < 2000,
+ # tf.logical_not(
+ # tf.logical_and(
+ # tf.less(loss_diff, tf.zeros([])),
+ # tf.less(first_idx_done + 10, i)
+ # ))
+ # )
+ # )
+ )
+ )
+
+ def body(i, adv_x, _, _2, first_idx_done):
+ adv_x_before = adv_x
+ adv_x, loss_diff = fgm(adv_x, features=self.model.get_mmd_features(adv_x),
+ **fgm_params, projection=self.projection)
+
+ # adv_x = tf.Print(adv_x, [i, first_idx_done, loss_diff])
+
+ # Clipping perturbation eta to self.ord norm ball
+ eta = adv_x - x
+ eta = clip_eta(eta, self.ord, self.eps)
+ adv_x = x + eta
+
+ # Redo the clipping.
+ # FGM already did it, but subtracting and re-adding eta can add some
+ # small numerical error.
+ if self.clip_min is not None or self.clip_max is not None:
+ adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)
+
+ first_idx_done = tf.where(
+ tf.logical_and(first_idx_done > 0, loss_diff < 0),
+ first_idx_done,
+ i * tf.where(loss_diff < 0, tf.ones(tf.shape(adv_x)[0]), tf.zeros(tf.shape(adv_x)[0]))
+ )
+
+ return i + 1, adv_x, adv_x_before, loss_diff, first_idx_done
+
+ _, _, adv_x, _, _ = tf.while_loop(cond, body,
+ [tf.zeros([]), adv_x, adv_x,
+ tf.ones(tf.shape(adv_x)[0]),
+ -1 * tf.ones(tf.shape(adv_x)[0])],
+ back_prop=True)
+
+ # Asserts run only on CPU.
+ # When multi-GPU eval code tries to force all PGD ops onto GPU, this
+ # can cause an error.
+ common_dtype = tf.float64
+ asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps_iter,
+ dtype=common_dtype),
+ tf.cast(self.eps,
+ dtype=common_dtype)))
+ if self.ord == np.inf and self.clip_min is not None:
+ # The 1e-6 is needed to compensate for numerical error.
+ # Without the 1e-6 this fails when e.g. eps=.2, clip_min=.5,
+ # clip_max=.7
+ asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps, x.dtype),
+ 1e-6 + tf.cast(self.clip_max,
+ x.dtype)
+ - tf.cast(self.clip_min,
+ x.dtype)))
+
+ if self.sanity_checks:
+ with tf.control_dependencies(asserts):
+ adv_x = tf.identity(adv_x)
+
+ return adv_x
+
+ def parse_params(self,
+ eps=0.3,
+ eps_iter=0.05,
+ nb_iter=10,
+ y=None,
+ ord=np.inf,
+ clip_min=None,
+ clip_max=None,
+ y_target=None,
+ rand_init=None,
+ rand_minmax=0.3,
+ sanity_checks=True,
+ **kwargs):
+ """
+ Take in a dictionary of parameters and applies attack-specific checks
+ before saving them as attributes.
+ Attack-specific parameters:
+ :param eps: (optional float) maximum distortion of adversarial example
+ compared to original input
+ :param eps_iter: (optional float) step size for each attack iteration
+ :param nb_iter: (optional int) Number of attack iterations.
+ :param y: (optional) A tensor with the true labels.
+ :param y_target: (optional) A tensor with the labels to target. Leave
+ y_target=None if y is also set. Labels should be
+ one-hot-encoded.
+ :param ord: (optional) Order of the norm (mimics Numpy).
+ Possible values: np.inf, 1 or 2.
+ :param clip_min: (optional float) Minimum input component value
+ :param clip_max: (optional float) Maximum input component value
+ :param sanity_checks: bool Insert tf asserts checking values
+ (Some tests need to run with no sanity checks because the
+ tests intentionally configure the attack strangely)
+ """
+
+ # Save attack-specific parameters
+ self.eps = eps
+ if rand_init is None:
+ rand_init = self.default_rand_init
+ self.rand_init = rand_init
+ if self.rand_init:
+ self.rand_minmax = eps
+ else:
+ self.rand_minmax = 0.
+ self.eps_iter = eps_iter
+ self.nb_iter = nb_iter
+ self.y = y
+ self.y_target = y_target
+ self.ord = ord
+ self.clip_min = clip_min
+ self.clip_max = clip_max
+
+ if isinstance(eps, float) and isinstance(eps_iter, float):
+ # If these are both known at compile time, we can check before anything
+ # is run. If they are tf, we can't check them yet.
+ assert eps_iter <= eps, (eps_iter, eps)
+
+ if self.y is not None and self.y_target is not None:
+ raise ValueError("Must not set both y and y_target")
+ # Check if order of the norm is acceptable given current implementation
+ if self.ord not in [np.inf, 1, 2]:
+ raise ValueError("Norm order must be either np.inf, 1, or 2.")
+ self.sanity_checks = sanity_checks
+
+ if len(kwargs.keys()) > 0:
+ warnings.warn("kwargs is unused and will be removed on or after "
+ "2019-04-26.")
+
+ return True
diff --git a/case_studies/mmt/adversarial_evaluation.sh b/case_studies/mmt/adversarial_evaluation.sh
new file mode 100644
index 0000000..b582819
--- /dev/null
+++ b/case_studies/mmt/adversarial_evaluation.sh
@@ -0,0 +1,21 @@
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$(pwd) venv3.8tf/bin/python case_studies/mmt/advtest_iterative.py --mean_var=10 --batch_size=50 \
+ --attack_method_for_advtrain='MadryEtAl' \
+ --dataset=cifar10 --target=False --use_ball=True \
+ --use_MMLDA=True --use_advtrain=False --epoch=200 \
+ --use_BN=True --normalize_output_for_ball=False --use_random=False \
+ --adv_ratio=1.0 --use_target=False \
+ --checkpoint=checkpoints/mmt_mmc_rn110.h5 \
+ --n_samples=512 \
+ --attack_method='MadryEtAl' \
+ --num_iter=50
+
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$(pwd) venv3.8tf/bin/python case_studies/mmt/advtest_iterative.py --mean_var=10 --batch_size=50 \
+ --attack_method_for_advtrain='MadryEtAl' \
+ --dataset=cifar10 --target=False --use_ball=True \
+ --use_MMLDA=True --use_advtrain=False --epoch=200 \
+ --use_BN=True --normalize_output_for_ball=False --use_random=False \
+ --adv_ratio=1.0 --use_target=False \
+ --checkpoint=checkpoints/mmt_mmc_rn110.h5 \
+ --n_samples=512 \
+ --attack_method='Adaptive' \
+ --num_iter=50
\ No newline at end of file
diff --git a/case_studies/mmt/advtest_iterative.py b/case_studies/mmt/advtest_iterative.py
new file mode 100644
index 0000000..3179558
--- /dev/null
+++ b/case_studies/mmt/advtest_iterative.py
@@ -0,0 +1,402 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+
+import logging
+
+logging.getLogger('tensorflow').setLevel(logging.FATAL)
+import tensorflow as tf
+
+tf.logging.set_verbosity(tf.logging.ERROR)
+
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from mmt_utils.model import resnet_v1, resnet_v2
+import cleverhans.attacks as attacks
+from cleverhans.utils_tf import model_eval
+from mmt_utils.keras_wraper_ensemble import KerasModelWrapper
+from mmt_utils.utils_model_eval import model_eval_targetacc
+from sklearn.metrics import roc_auc_score
+from fgm_patched import fgm_patched
+
+FLAGS = tf.app.flags.FLAGS
+
+tf.app.flags.DEFINE_integer('batch_size', 50, 'batch_size for attack')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_float('mean_var', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('attack_method', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_string('attack_method_for_advtrain', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_integer('version', 2, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_bool('target', True, 'is target attack or not')
+tf.app.flags.DEFINE_bool('use_target', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_integer('num_iter', 10, '')
+tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_advtrain', True, 'whether use advtraining or normal training')
+tf.app.flags.DEFINE_float('adv_ratio', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_integer('epoch', 1, 'the epoch of model to load')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+tf.app.flags.DEFINE_bool('normalize_output_for_ball', True, 'whether apply softmax in the inference phase')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_bool('use_dense', True, 'whether use extra dense layer in the network')
+tf.app.flags.DEFINE_bool('use_leaky', False, 'whether use leaky relu in the network')
+
+tf.app.flags.DEFINE_integer('n_samples', 512, '')
+tf.app.flags.DEFINE_string('checkpoint', None, '')
+# For calculate AUC-scores
+tf.app.flags.DEFINE_bool('is_calculate_auc', False, 'whether to calculate auc scores')
+tf.app.flags.DEFINE_bool('is_auc_metric_softmax_for_MMC', False, 'whether use softmax to calculate auc metrics for MMC')
+
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+ x_place = tf.placeholder(tf.float32, shape=(None, 28, 28, 3))
+
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+else:
+ print('Unknown dataset')
+
+
+# These parameters are usually fixed
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 18 # n=5 for resnet-32 v1, n=18 for Resnet110 (according to README.md)
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+else:
+ name_random = ''
+
+if FLAGS.use_leaky==True:
+ name_leaky = '_withleaky'
+else:
+ name_leaky = ''
+
+if FLAGS.use_dense==True:
+ name_dense = ''
+else:
+ name_dense = '_nodense'
+
+
+#Load means in MMLDA
+kernel_dict = loadmat('case_studies/mmt/kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+name_random+'.mat')
+mean_logits = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits = FLAGS.mean_var * tf.constant(mean_logits,dtype=tf.float32)
+
+
+#MMLDA prediction function
+def MMLDA_layer(x, means=mean_logits, num_class=num_class, use_ball=FLAGS.use_ball):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ if FLAGS.normalize_output_for_ball==False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+# Load the data.
+y_test_target = np.zeros_like(y_test)
+for i in range(y_test.shape[0]):
+ l = np.random.randint(num_class)
+ while l == y_test[i][0]:
+ l = np.random.randint(num_class)
+ y_test_target[i][0] = l
+print('Finish crafting y_test_target!!!!!!!!!!!')
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+clip_min = 0.0
+clip_max = 1.0
+# If subtract pixel mean is enabled
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+ clip_min -= np.max(x_train_mean)
+ clip_max -= np.min(x_train_mean)
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test = keras.utils.to_categorical(y_test, num_class)
+y_test_target = keras.utils.to_categorical(y_test_target, num_class)
+
+
+# Define input TF placeholder
+y_place = tf.placeholder(tf.float32, shape=(None, num_class))
+y_target = tf.placeholder(tf.float32, shape=(None, num_class))
+sess = tf.Session()
+keras.backend.set_session(sess)
+
+
+model_input = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model,_,_,_,final_features = resnet_v2(immediate_input=model_input, input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model,_,_,_,final_features = resnet_v1(immediate_input=model_input, input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+print("depth", depth)
+print("#layers", len(original_model.layers))
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+
+#Whether use target attack for adversarial training
+if FLAGS.use_target==False:
+ is_target = ''
+else:
+ is_target = 'target'
+
+
+if FLAGS.use_advtrain==True:
+ dirr = 'advtrained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = '_'+is_target+FLAGS.attack_method_for_advtrain
+ adv_ratio_name = '_advratio'+str(FLAGS.adv_ratio)
+ mean_var = int(FLAGS.mean_var)
+else:
+ dirr = 'trained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = ''
+ adv_ratio_name = ''
+ mean_var = FLAGS.mean_var
+
+
+if FLAGS.use_MMLDA==True:
+ print('Using MMLDA')
+ new_layer = Lambda(MMLDA_layer)
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ use_ball_=''
+ if FLAGS.use_ball==False:
+ print('Using softmax function')
+ use_ball_='_softmax'
+ filepath_dir = dirr+'resnet32v'+str(version)+'_meanvar'+str(mean_var) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+name_dense+name_random+use_ball_+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+else:
+ print('Using softmax loss')
+ model = original_model
+ filepath_dir = dirr+'resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+
+
+print(filepath_dir)
+model.load_weights(FLAGS.checkpoint)
+
+# TODO: ch_compatibility_mode needs to be set to true since the
+# authors of the model messed logits and predictions up which accidentially
+# worked with ch2.1.0 but not with later version: setting this flag modifies
+# the model so that one can reproduce their results with later ch versions.
+wrap_ensemble = KerasModelWrapper(model, num_class=num_class, binarized_model=False,
+ ch_compatibility_mode=True)
+
+#model.load_weights(filepath_dir)
+
+
+# Initialize the attack method
+if FLAGS.attack_method == 'MadryEtAl':
+ att = attacks.MadryEtAl(wrap_ensemble)
+elif FLAGS.attack_method == 'FastGradientMethod':
+ att = attacks.FastGradientMethod(wrap_ensemble)
+elif FLAGS.attack_method == 'MomentumIterativeMethod':
+ att = attacks.MomentumIterativeMethod(wrap_ensemble)
+elif FLAGS.attack_method == 'BasicIterativeMethod':
+ att = attacks.BasicIterativeMethod(wrap_ensemble)
+elif FLAGS.attack_method == "Adaptive":
+ from adaptive_attack import FeatureSpaceProjectedGradientDescent
+ att = FeatureSpaceProjectedGradientDescent(wrap_ensemble, logit_means=mean_logits,
+ max_steps=600, projection="linf")
+
+
+# Consider the attack to be constant
+eval_par = {'batch_size': FLAGS.batch_size}
+
+if FLAGS.n_samples != -1:
+ print(f"Using {FLAGS.n_samples} random test samples")
+ inds = np.arange(len(x_test))
+ np.random.shuffle(inds)
+ inds = inds[:FLAGS.n_samples]
+ x_test, y_test = x_test[inds], y_test[inds]
+
+
+if FLAGS.is_calculate_auc:
+ # Calculate model preds for clean inputs
+ avg_score_nor = np.array([])
+ nor_indicator = np.ones((1000,), dtype=int)
+ for i in range(10):
+ avg_score_nor_batch = sess.run(tf.reduce_max(model(x_place),axis=-1), feed_dict={x_place:x_test[i*100:(i+1)*100]})
+ avg_score_nor = np.concatenate((avg_score_nor, avg_score_nor_batch), axis=0)
+ print('Calculate score for nor images with batch', i)
+
+ # Calculate model preds for adv inputs
+ eps_ = 8 / 256.0
+ if FLAGS.target==False:
+ y_target = None
+ if FLAGS.attack_method == 'FastGradientMethod':
+ att_params = {'eps': eps_,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'y_target': y_target}
+ else:
+ att_params = {'eps': eps_,
+ #'eps_iter': eps_*1.0/FLAGS.num_iter,
+ #'eps_iter': 3.*eps_/FLAGS.num_iter,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_iter': FLAGS.num_iter,
+ 'y_target': y_target}
+ if FLAGS.attack_method == "Adaptive":
+ att_params["y"] = y_place
+ att_params['eps_iter'] = 1 / 256.
+ print("clip_min", clip_min)
+ print("clip_max", clip_max)
+ adv_x = tf.stop_gradient(att.generate(x_place, **att_params))
+ preds = tf.reduce_max(model(adv_x),axis=-1)
+
+ if FLAGS.is_auc_metric_softmax_for_MMC==True:
+ preds = tf.reduce_max(tf.nn.softmax(model(adv_x)),axis=-1)
+
+ avg_score_adv = np.array([])
+ adv_indicator = np.zeros((1000,), dtype=int)
+ if FLAGS.target==True:
+ for i in range(10):
+ avg_score_adv_batch = sess.run(preds, feed_dict={x_place:x_test[i*100:(i+1)*100], y_target:y_test_target[i*100:(i+1)*100]})
+ avg_score_adv = np.concatenate((avg_score_adv, avg_score_adv_batch), axis=0)
+ print('Calculate score for target attack images with batch', i)
+ else:
+ for i in range(10):
+ avg_score_adv_batch = sess.run(preds, feed_dict={x_place:x_test[i*100:(i+1)*100]})
+ avg_score_adv = np.concatenate((avg_score_adv, avg_score_adv_batch), axis=0)
+ print('Calculate score for untarget attack images with batch', i)
+
+ score_all = np.concatenate((avg_score_nor,avg_score_adv), axis=0)
+ indicator_all = np.concatenate((nor_indicator,adv_indicator), axis=0)
+ print('AUC score is', roc_auc_score(indicator_all, score_all))
+
+else:
+ clip_min = clip_min.item()
+ clip_max = clip_max.item()
+ for eps in range(4):
+ eps_ = (eps+1) * 8
+ print('eps is %d'%eps_)
+ eps_ = eps_ / 256.0
+ if FLAGS.target==False:
+ y_target = None
+ if FLAGS.attack_method == 'FastGradientMethod':
+ att_params = {'eps': eps_,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'y_target': y_target}
+ else:
+ att_params = {'eps': eps_,
+ #'eps_iter': eps_*1.0/FLAGS.num_iter,
+ #'eps_iter': 3.*eps_/FLAGS.num_iter,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_iter': FLAGS.num_iter,
+ 'y_target': y_target,
+ 'y': y_place,
+ }
+ if FLAGS.attack_method == "Adaptive":
+ att_params["y"] = y_place
+ att_params['eps_iter'] = 0.5 / 256.
+
+ # debugging statements
+ print("att_params", att_params)
+ if FLAGS.attack_method != "Adaptive":
+ import cleverhans.attacks
+ cleverhans.attacks.fgm = fgm_patched
+ print("patched fgm function")
+
+ #clean_preds = model(x_place)
+ #ll = sess.run(clean_preds, {x_place: x_test[:16]})
+ #import pdb; pdb.set_trace()
+
+ adv_x = tf.stop_gradient(att.generate(x_place, **att_params))
+ preds = model(adv_x)
+
+ if FLAGS.target==False:
+ acc = model_eval(sess, x_place, y_place, preds, x_test, y_test, args=eval_par)
+ print('adv_acc: %.3f' %acc)
+ else:
+ acc = model_eval_targetacc(sess, x_place, y_place, y_target, preds, x_test, y_test, y_test_target, args=eval_par)
+ print('adv_acc_target: %.3f' %acc)
diff --git a/case_studies/mmt/advtest_iterative_blackbox.py b/case_studies/mmt/advtest_iterative_blackbox.py
new file mode 100644
index 0000000..8d30bfd
--- /dev/null
+++ b/case_studies/mmt/advtest_iterative_blackbox.py
@@ -0,0 +1,404 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from utils.model import resnet_v1, resnet_v2
+import cleverhans.attacks as attacks
+from cleverhans.utils_tf import model_eval
+from utils.keras_wraper_ensemble import KerasModelWrapper
+from utils.utils_model_eval import model_eval_targetacc
+
+FLAGS = tf.app.flags.FLAGS
+
+#Common Flags for two models
+tf.app.flags.DEFINE_integer('batch_size', 50, 'batch_size for attack')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_string('attack_method', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_integer('version', 2, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_bool('target', True, 'is target attack or not')
+tf.app.flags.DEFINE_integer('num_iter', 10, '')
+tf.app.flags.DEFINE_string('dataset', 'cifar10', '')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_bool('use_dense', True, 'whether use extra dense layer in the network')
+tf.app.flags.DEFINE_bool('use_leaky', False, 'whether use leaky relu in the network')
+tf.app.flags.DEFINE_integer('epoch', 180, 'the epoch of model to load')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+
+# SCE, MMC-10, MMC-100, AT-SCE, AT-MMC-10, AT-MMC-100
+tf.app.flags.DEFINE_string('model_1', 'SCE', '')
+tf.app.flags.DEFINE_string('model_2', 'MMC-10', '')
+
+#Specific Flags for model 1
+tf.app.flags.DEFINE_float('mean_var_1', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('attack_method_for_advtrain_1', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_bool('use_target_1', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_bool('use_ball_1', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA_1', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_advtrain_1', True, 'whether use advtraining or normal training')
+tf.app.flags.DEFINE_float('adv_ratio_1', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_bool('normalize_output_for_ball_1', True, 'whether apply softmax in the inference phase')
+
+#Specific Flags for model 2
+tf.app.flags.DEFINE_float('mean_var_2', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('attack_method_for_advtrain_2', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_bool('use_target_2', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_bool('use_ball_2', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA_2', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_advtrain_2', True, 'whether use advtraining or normal training')
+tf.app.flags.DEFINE_float('adv_ratio_2', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_bool('normalize_output_for_ball_2', True, 'whether apply softmax in the inference phase')
+
+##### model 1 is the substitute model used to craft adversarial examples, model 2 is the original model used to classify these adversarial examples.
+
+def return_paras(model_name):
+ if model_name == 'SCE':
+ return 0, None, False, False, False, False, 0.0, True
+ elif model_name == 'MMC-10':
+ return 10.0, None, False, True, True, False, 0.0, False
+ elif model_name == 'MMC-100':
+ return 100.0, None, False, True, True, False, 0.0, False
+ elif model_name == 'AT-SCE':
+ return 0, 'MadryEtAl', True, False, False, True, 1.0, True
+ elif model_name == 'AT-MMC-10':
+ return 10, 'MadryEtAl', True, True, True, True, 1.0, False
+ elif model_name == 'AT-MMC-100':
+ return 100, 'MadryEtAl', True, True, True, True, 1.0, False
+ else:
+ return None
+
+
+FLAGS.mean_var_1, FLAGS.attack_method_for_advtrain_1, FLAGS.use_target_1, FLAGS.use_ball_1, \
+FLAGS.use_MMLDA_1, FLAGS.use_advtrain_1, FLAGS.adv_ratio_1, FLAGS.normalize_output_for_ball_1 = return_paras(FLAGS.model_1)
+
+
+FLAGS.mean_var_2, FLAGS.attack_method_for_advtrain_2, FLAGS.use_target_2, FLAGS.use_ball_2, \
+FLAGS.use_MMLDA_2, FLAGS.use_advtrain_2, FLAGS.adv_ratio_2, FLAGS.normalize_output_for_ball_2 = return_paras(FLAGS.model_2)
+
+
+
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+ x_place = tf.placeholder(tf.float32, shape=(None, 28, 28, 3))
+
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+else:
+ print('Unknown dataset')
+
+
+# These parameters are usually fixed
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 5 # n=5 for resnet-32 v1
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+else:
+ name_random = ''
+
+if FLAGS.use_leaky==True:
+ name_leaky = '_withleaky'
+else:
+ name_leaky = ''
+
+if FLAGS.use_dense==True:
+ name_dense = ''
+else:
+ name_dense = '_nodense'
+
+
+#Load means in MMLDA
+kernel_dict = loadmat('kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+name_random+'.mat')
+mean_logits = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits_1 = FLAGS.mean_var_1 * tf.constant(mean_logits,dtype=tf.float32)
+mean_logits_2 = FLAGS.mean_var_2 * tf.constant(mean_logits,dtype=tf.float32)
+
+
+#MMLDA prediction function
+def MMLDA_layer_1(x, means=mean_logits_1, num_class=num_class, use_ball=FLAGS.use_ball_1):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ if FLAGS.normalize_output_for_ball_1==False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+def MMLDA_layer_2(x, means=mean_logits_2, num_class=num_class, use_ball=FLAGS.use_ball_2):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ if FLAGS.normalize_output_for_ball_2==False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+# Load the data.
+y_test_target = np.zeros_like(y_test)
+for i in range(y_test.shape[0]):
+ l = np.random.randint(num_class)
+ while l == y_test[i][0]:
+ l = np.random.randint(num_class)
+ y_test_target[i][0] = l
+print('Finish crafting y_test_target!!!!!!!!!!!')
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+clip_min = 0.0
+clip_max = 1.0
+# If subtract pixel mean is enabled
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+ clip_min -= x_train_mean
+ clip_max -= x_train_mean
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test = keras.utils.to_categorical(y_test, num_class)
+y_test_target = keras.utils.to_categorical(y_test_target, num_class)
+
+
+# Define input TF placeholder
+y_place = tf.placeholder(tf.float32, shape=(None, num_class))
+y_target = tf.placeholder(tf.float32, shape=(None, num_class))
+sess = tf.Session()
+keras.backend.set_session(sess)
+
+
+model_input_1 = Input(shape=input_shape)
+model_input_2 = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model_1,_,_,_,final_features_1 = resnet_v2(input=model_input_1, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model_1,_,_,_,final_features_1 = resnet_v1(input=model_input_1, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+if version == 2:
+ original_model_2,_,_,_,final_features_2 = resnet_v2(input=model_input_2, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model_2,_,_,_,final_features_2 = resnet_v1(input=model_input_2, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+
+
+
+
+##### Load model 1 #####
+#Whether use target attack for adversarial training
+if FLAGS.use_target_1==False:
+ is_target_1 = ''
+else:
+ is_target_1 = 'target'
+
+if FLAGS.use_advtrain_1==True:
+ dirr_1 = 'advtrained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain_1 = '_'+is_target_1+FLAGS.attack_method_for_advtrain_1
+ adv_ratio_name_1 = '_advratio'+str(FLAGS.adv_ratio_1)
+ mean_var_1 = int(FLAGS.mean_var_1)
+else:
+ dirr_1 = 'trained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain_1 = ''
+ adv_ratio_name_1 = ''
+ mean_var_1 = FLAGS.mean_var_1
+
+if FLAGS.use_MMLDA_1==True:
+ print('Using MMLDA for model 1, the substitute model')
+ new_layer_1 = Lambda(MMLDA_layer_1)
+ predictions_1 = new_layer_1(final_features_1)
+ model_1 = Model(input=model_input_1, output=predictions_1)
+ use_ball_1=''
+ if FLAGS.use_ball_1==False:
+ print('Using softmax function for model 1')
+ use_ball_1='_softmax'
+ filepath_dir_1 = dirr_1+'resnet32v'+str(version)+'_meanvar'+str(mean_var_1) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +attack_method_for_advtrain_1+adv_ratio_name_1+BN_name+name_leaky+name_dense+name_random+use_ball_1+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+else:
+ print('Using softmax loss for model 1')
+ model_1 = original_model_1
+ filepath_dir_1 = dirr_1+'resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+attack_method_for_advtrain_1+adv_ratio_name_1+BN_name+name_leaky+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+wrap_ensemble_1 = KerasModelWrapper(model_1, num_class=num_class)
+model_1.load_weights(filepath_dir_1)
+
+
+
+
+##### Load model 2 #####
+#Whether use target attack for adversarial training
+if FLAGS.use_target_2==False:
+ is_target_2 = ''
+else:
+ is_target_2 = 'target'
+
+if FLAGS.use_advtrain_2==True:
+ dirr_2 = 'advtrained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain_2 = '_'+is_target_2+FLAGS.attack_method_for_advtrain_2
+ adv_ratio_name_2 = '_advratio'+str(FLAGS.adv_ratio_2)
+ mean_var_2 = int(FLAGS.mean_var_2)
+else:
+ dirr_2 = 'trained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain_2 = ''
+ adv_ratio_name_2 = ''
+ mean_var_2 = FLAGS.mean_var_2
+
+if FLAGS.use_MMLDA_2==True:
+ print('Using MMLDA for model 2, the original model')
+ new_layer_2 = Lambda(MMLDA_layer_2)
+ predictions_2 = new_layer_2(final_features_2)
+ model_2 = Model(input=model_input_2, output=predictions_2)
+ use_ball_2=''
+ if FLAGS.use_ball_2==False:
+ print('Using softmax function for model 2')
+ use_ball_2='_softmax'
+ filepath_dir_2 = dirr_2+'resnet32v'+str(version)+'_meanvar'+str(mean_var_2) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +attack_method_for_advtrain_2+adv_ratio_name_2+BN_name+name_leaky+name_dense+name_random+use_ball_2+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+else:
+ print('Using softmax loss for model 2')
+ model_2 = original_model_2
+ filepath_dir_2 = dirr_2+'resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+attack_method_for_advtrain_2+adv_ratio_name_2+BN_name+name_leaky+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+wrap_ensemble_2 = KerasModelWrapper(model_2, num_class=num_class)
+model_2.load_weights(filepath_dir_2)
+
+
+
+
+
+
+# Initialize the attack method
+if FLAGS.attack_method == 'MadryEtAl':
+ att = attacks.MadryEtAl(wrap_ensemble_1)
+elif FLAGS.attack_method == 'FastGradientMethod':
+ att = attacks.FastGradientMethod(wrap_ensemble_1)
+elif FLAGS.attack_method == 'MomentumIterativeMethod':
+ att = attacks.MomentumIterativeMethod(wrap_ensemble_1)
+elif FLAGS.attack_method == 'BasicIterativeMethod':
+ att = attacks.BasicIterativeMethod(wrap_ensemble_1)
+
+
+# Consider the attack to be constant
+eval_par = {'batch_size': FLAGS.batch_size}
+
+for eps in range(2):
+ eps_ = (eps+1) * 8
+ print('eps is %d'%eps_)
+ eps_ = eps_ / 256.0
+ if FLAGS.target==False:
+ y_target = None
+ if FLAGS.attack_method == 'FastGradientMethod':
+ att_params = {'eps': eps_,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'y_target': y_target}
+ else:
+ att_params = {'eps': eps_,
+ #'eps_iter': eps_*1.0/FLAGS.num_iter,
+ #'eps_iter': 3.*eps_/FLAGS.num_iter,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_iter': FLAGS.num_iter,
+ 'y_target': y_target}
+ adv_x = tf.stop_gradient(att.generate(x_place, **att_params))
+ preds = model_2(adv_x)
+ if FLAGS.target==False:
+ acc = model_eval(sess, x_place, y_place, preds, x_test, y_test, args=eval_par)
+ print('adv_acc of model 1 transfer to model 2 is: %.3f' %acc)
+ else:
+ acc = model_eval_targetacc(sess, x_place, y_place, y_target, preds, x_test, y_test, y_test_target, args=eval_par)
+ print('adv_acc_target of model 1 transfer to model 2 is: %.3f' %acc)
diff --git a/case_studies/mmt/advtest_others.py b/case_studies/mmt/advtest_others.py
new file mode 100644
index 0000000..d2cc485
--- /dev/null
+++ b/case_studies/mmt/advtest_others.py
@@ -0,0 +1,422 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from utils.model import resnet_v1, resnet_v2
+import cleverhans.attacks as attacks
+from cleverhans.utils_tf import model_eval
+from utils.keras_wraper_ensemble import KerasModelWrapper
+from utils.utils_model_eval import model_eval_targetacc, model_eval_for_SPSA, model_eval_for_SPSA_targetacc
+
+FLAGS = tf.app.flags.FLAGS
+
+tf.app.flags.DEFINE_integer('batch_size', 50, 'batch_size for attack')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_float('mean_var', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('attack_method', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_string('attack_method_for_advtrain', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_integer('version', 2, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_bool('target', True, 'is target attack or not')
+tf.app.flags.DEFINE_bool('use_target', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_advtrain', True, 'whether use advtraining or normal training')
+tf.app.flags.DEFINE_float('adv_ratio', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_integer('epoch', 1, 'the epoch of model to load')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+tf.app.flags.DEFINE_bool('normalize_output_for_ball', True, 'whether apply softmax in the inference phase')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_bool('use_dense', True, 'whether use extra dense layer in the network')
+tf.app.flags.DEFINE_bool('use_leaky', False, 'whether use leaky relu in the network')
+
+tf.app.flags.DEFINE_float('CW_confidence', 1.0, 'the confidence for CW-L2 attacks')
+tf.app.flags.DEFINE_float('SPSA_epsilon', 8, 'the eps for SPSA attacks in 256 pixel values')
+
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+ x_place = tf.placeholder(tf.float32, shape=(None, 28, 28, 3))
+
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+else:
+ print('Unknown dataset')
+
+
+# These parameters are usually fixed
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 5 # n=5 for resnet-32 v1
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+else:
+ name_random = ''
+
+if FLAGS.use_leaky==True:
+ name_leaky = '_withleaky'
+else:
+ name_leaky = ''
+
+if FLAGS.use_dense==True:
+ name_dense = ''
+else:
+ name_dense = '_nodense'
+
+
+#Load means in MMLDA
+kernel_dict = loadmat('kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+name_random+'.mat')
+mean_logits = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits = FLAGS.mean_var * tf.constant(mean_logits,dtype=tf.float32)
+
+
+#MMLDA prediction function
+def MMLDA_layer(x, means=mean_logits, num_class=num_class, use_ball=FLAGS.use_ball):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ if FLAGS.normalize_output_for_ball==False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+# Load the data.
+y_test_target = np.zeros_like(y_test)
+for i in range(y_test.shape[0]):
+ l = np.random.randint(num_class)
+ while l == y_test[i][0]:
+ l = np.random.randint(num_class)
+ y_test_target[i][0] = l
+print('Finish crafting y_test_target!!!!!!!!!!!')
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+clip_min = 0.0
+clip_max = 1.0
+# If subtract pixel mean is enabled
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+ clip_min -= x_train_mean
+ clip_max -= x_train_mean
+print (np.min(x_train_mean))
+print (np.max(x_train_mean))
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test_index = np.squeeze(np.copy(y_test).astype('int32'))
+y_test = keras.utils.to_categorical(y_test, num_class)
+y_test_target_index = np.squeeze(np.copy(y_test_target).astype('int32'))
+y_test_target = keras.utils.to_categorical(y_test_target, num_class)
+
+
+# Define input TF placeholder
+y_place = tf.placeholder(tf.float32, shape=(None, num_class))
+y_target = tf.placeholder(tf.float32, shape=(None, num_class))
+sess = tf.Session()
+keras.backend.set_session(sess)
+
+
+model_input = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model,_,_,_,final_features = resnet_v2(input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model,_,_,_,final_features = resnet_v1(input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+
+#Whether use target attack for adversarial training
+if FLAGS.use_target==False:
+ is_target = ''
+else:
+ is_target = 'target'
+
+
+if FLAGS.use_advtrain==True:
+ dirr = 'advtrained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = '_'+is_target+FLAGS.attack_method_for_advtrain
+ adv_ratio_name = '_advratio'+str(FLAGS.adv_ratio)
+ mean_var = int(FLAGS.mean_var)
+else:
+ dirr = 'trained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = ''
+ adv_ratio_name = ''
+ mean_var = FLAGS.mean_var
+
+
+if FLAGS.use_MMLDA==True:
+ print('Using MMLDA')
+ new_layer = Lambda(MMLDA_layer)
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ use_ball_=''
+ if FLAGS.use_ball==False:
+ print('Using softmax function')
+ use_ball_='_softmax'
+ filepath_dir = dirr+'resnet32v'+str(version)+'_meanvar'+str(mean_var) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+name_dense+name_random+use_ball_+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+else:
+ print('Using softmax loss')
+ model = original_model
+ filepath_dir = dirr+'resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+
+
+wrap_ensemble = KerasModelWrapper(model, num_class=num_class)
+
+
+model.load_weights(filepath_dir)
+
+# Initialize the attack method
+if FLAGS.attack_method == 'SaliencyMapMethod':
+ num_samples = 100
+ eval_par = {'batch_size': 1}
+ att = attacks.SaliencyMapMethod(wrap_ensemble, sess=sess)
+ att_params = {
+ 'theta': 1.,
+ 'gamma': 0.1,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ }
+ adv_x = att.generate(x_place, **att_params)
+elif FLAGS.attack_method == 'CarliniWagnerL2': #Update on 2019.3.29
+ num_samples = 500
+ eval_par = {'batch_size': 10}
+ att = attacks.CarliniWagnerL2(wrap_ensemble, sess=sess)
+ if FLAGS.target==False:
+ att_params = {
+ 'batch_size': 10,
+ 'confidence': FLAGS.CW_confidence,
+ 'learning_rate': 5e-3,
+ 'binary_search_steps': 9,
+ 'max_iterations': 1000,
+ 'initial_const': 0.01,
+ 'abort_early': True,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max
+ }
+ else:
+ att_params = {
+ 'batch_size': 10,
+ 'confidence': FLAGS.CW_confidence,
+ 'y_target': y_target,
+ 'learning_rate': 5e-3,
+ 'binary_search_steps': 9,
+ 'max_iterations': 1000,
+ 'initial_const': 0.01,
+ 'abort_early': True,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max
+ }
+ if FLAGS.use_MMLDA == True and FLAGS.use_ball == True:
+ is_MMC = True
+ else:
+ is_MMC = False
+ adv_x = att.generate(x_place, is_MMC=is_MMC, **att_params)
+elif FLAGS.attack_method == 'ElasticNetMethod':
+ num_samples = 1000
+ eval_par = {'batch_size': 100}
+ att = attacks.ElasticNetMethod(wrap_ensemble, sess=sess)
+ att_params = {
+ 'batch_size': 100,
+ 'confidence': 0.1,
+ 'learning_rate': 0.01,
+ 'binary_search_steps': 1,
+ 'max_iterations': 1000,
+ 'initial_const': 1.0,
+ 'beta': 1e-2,
+ 'fista': True,
+ 'decision_rule': 'EN',
+ 'clip_min': clip_min,
+ 'clip_max': clip_max
+ }
+ adv_x = att.generate(x_place, **att_params)
+elif FLAGS.attack_method == 'DeepFool':
+ num_samples = 1000
+ eval_par = {'batch_size': 1}
+ att = attacks.DeepFool(wrap_ensemble, sess=sess)
+ att_params = {
+ 'max_iter': 10,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_candidate': 1
+ }
+ adv_x = att.generate(x_place, **att_params)
+elif FLAGS.attack_method == 'LBFGS':
+ num_samples = 1000
+ eval_par = {'batch_size': 1}
+ att = attacks.LBFGS(wrap_ensemble, sess=sess)
+ clip_min = np.mean(clip_min)
+ clip_max = np.mean(clip_max)
+ att_params = {
+ 'y_target': y_target,
+ 'batch_size': 1,
+ 'binary_search_steps': 1,
+ 'max_iterations': 100,
+ 'initial_const': 1.0,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max
+ }
+ adv_x = att.generate(x_place, **att_params)
+elif FLAGS.attack_method == 'SPSA': #Update on 2019.3.29
+ num_samples = 1000
+ eval_par = {'batch_size': 1}
+ x = tf.placeholder(tf.float32, shape=(1, 32, 32, 3))
+ y_index = tf.placeholder(tf.uint8, shape=())
+ if FLAGS.target:
+ y_target_index = tf.placeholder(tf.uint8, shape=())
+ else:
+ y_target_index = None
+ att = attacks.SPSA(wrap_ensemble, sess=sess)
+ if FLAGS.use_MMLDA == True and FLAGS.use_ball == True:
+ is_MMC = True
+ else:
+ is_MMC = False
+ adv_x = att.generate(x, y_index, y_target=y_target_index, epsilon=FLAGS.SPSA_epsilon / 256., num_steps=10,
+ is_targeted=FLAGS.target, early_stop_loss_threshold=None,
+ learning_rate=0.01, delta=0.01, batch_size=128, spsa_iters=1,
+ is_debug=False, is_MMC=is_MMC)
+
+
+
+preds = wrap_ensemble.get_probs(adv_x)
+if FLAGS.attack_method == 'LBFGS':
+ print(model_eval_targetacc(
+ sess,
+ x_place,
+ y_place,
+ y_target,
+ preds,
+ x_test[:num_samples],
+ y_test[:num_samples],
+ y_test_target[:num_samples],
+ args=eval_par))
+elif FLAGS.attack_method == 'SPSA':
+ if FLAGS.target==False:
+ acc = model_eval_for_SPSA(
+ sess,
+ x,
+ y_place,
+ y_index,
+ preds,
+ x_test[:num_samples],
+ y_test_index[:num_samples],
+ y_test[:num_samples],
+ args=eval_par)
+ print('adv_acc: %.3f' %acc)
+ else:
+ acc = model_eval_for_SPSA_targetacc(
+ sess,
+ x,
+ y_place,
+ y_index,
+ y_target_index,
+ preds,
+ x_test[:num_samples],
+ y_test_index[:num_samples],
+ y_test[:num_samples],
+ y_test_target_index[:num_samples],
+ args=eval_par)
+ print('adv_acc_target: %.3f' %acc)
+elif FLAGS.attack_method == 'CarliniWagnerL2':
+ l2dis_test = np.zeros((num_samples,))
+ reshape_dis = tf.reshape(x_place - adv_x, shape = [-1, 3072])
+ if FLAGS.target==False:
+ for i in range(int(num_samples/10)):
+ l2dis_test[i*10:(i+1)*10]=sess.run(tf.norm(reshape_dis, ord=2, axis=-1), feed_dict={x_place: x_test[i*10:(i+1)*10], \
+ y_place: y_test[i*10:(i+1)*10]})
+ print('Predict batch for test ', i, ', l2dis_mean is ', np.mean(l2dis_test[i*10:(i+1)*10]))
+ print('Total l2dismean is ',np.mean(l2dis_test))
+ acc = model_eval(sess, x_place, y_place, preds, x_test[:num_samples], y_test[:num_samples], args=eval_par)
+ print('adv_acc: %.3f' %acc)
+ else:
+ for i in range(int(num_samples/10)):
+ l2dis_test[i*10:(i+1)*10]=sess.run(tf.norm(reshape_dis, ord=2, axis=-1), feed_dict={x_place: x_test[i*10:(i+1)*10], \
+ y_place: y_test[i*10:(i+1)*10], y_target: y_test_target[i*10:(i+1)*10]})
+ print('Predict batch for test ', i, ', l2dis_mean is ', np.mean(l2dis_test[i*10:(i+1)*10]))
+ print('Total l2dismean is ',np.mean(l2dis_test))
+ acc = model_eval_targetacc(sess, x_place, y_place, y_target, preds, x_test[:num_samples], y_test[:num_samples], y_test_target[:num_samples], args=eval_par)
+ print('adv_acc_target: %.3f' %acc)
+
diff --git a/case_studies/mmt/advtest_simple_transform.py b/case_studies/mmt/advtest_simple_transform.py
new file mode 100644
index 0000000..e843333
--- /dev/null
+++ b/case_studies/mmt/advtest_simple_transform.py
@@ -0,0 +1,280 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from utils.model import resnet_v1, resnet_v2
+import cleverhans.attacks as attacks
+from cleverhans.utils_tf import model_eval
+from utils.keras_wraper_ensemble import KerasModelWrapper
+from utils.utils_model_eval import model_eval_targetacc
+from sklearn.metrics import roc_auc_score
+
+FLAGS = tf.app.flags.FLAGS
+
+tf.app.flags.DEFINE_integer('batch_size', 50, 'batch_size for attack')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_float('mean_var', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('attack_method', 'gaussian', '')
+tf.app.flags.DEFINE_string('attack_method_for_advtrain', 'FastGradientMethod', '')
+tf.app.flags.DEFINE_integer('version', 2, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_bool('target', True, 'is target attack or not')
+tf.app.flags.DEFINE_bool('use_target', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_integer('num_iter', 10, '')
+tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_advtrain', True, 'whether use advtraining or normal training')
+tf.app.flags.DEFINE_float('adv_ratio', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_integer('epoch', 1, 'the epoch of model to load')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+tf.app.flags.DEFINE_bool('normalize_output_for_ball', True, 'whether apply softmax in the inference phase')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_bool('use_dense', True, 'whether use extra dense layer in the network')
+tf.app.flags.DEFINE_bool('use_leaky', False, 'whether use leaky relu in the network')
+
+
+
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+ x_place = tf.placeholder(tf.float32, shape=(None, 28, 28, 3))
+
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+else:
+ print('Unknown dataset')
+
+
+# These parameters are usually fixed
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 5 # n=5 for resnet-32 v1
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+else:
+ name_random = ''
+
+if FLAGS.use_leaky==True:
+ name_leaky = '_withleaky'
+else:
+ name_leaky = ''
+
+if FLAGS.use_dense==True:
+ name_dense = ''
+else:
+ name_dense = '_nodense'
+
+
+#Load means in MMLDA
+kernel_dict = loadmat('kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+name_random+'.mat')
+mean_logits = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits = FLAGS.mean_var * tf.constant(mean_logits,dtype=tf.float32)
+
+
+#MMLDA prediction function
+def MMLDA_layer(x, means=mean_logits, num_class=num_class, use_ball=FLAGS.use_ball):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ if FLAGS.normalize_output_for_ball==False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+# Load the data.
+y_test_target = np.zeros_like(y_test)
+for i in range(y_test.shape[0]):
+ l = np.random.randint(num_class)
+ while l == y_test[i][0]:
+ l = np.random.randint(num_class)
+ y_test_target[i][0] = l
+print('Finish crafting y_test_target!!!!!!!!!!!')
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+clip_min = 0.0
+clip_max = 1.0
+# If subtract pixel mean is enabled
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+ clip_min -= np.max(x_train_mean)
+ clip_max -= np.min(x_train_mean)
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test = keras.utils.to_categorical(y_test, num_class)
+y_test_target = keras.utils.to_categorical(y_test_target, num_class)
+
+
+# Define input TF placeholder
+y_place = tf.placeholder(tf.float32, shape=(None, num_class))
+y_target = tf.placeholder(tf.float32, shape=(None, num_class))
+sess = tf.Session()
+keras.backend.set_session(sess)
+
+
+model_input = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model,_,_,_,final_features = resnet_v2(input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model,_,_,_,final_features = resnet_v1(input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+
+#Whether use target attack for adversarial training
+if FLAGS.use_target==False:
+ is_target = ''
+else:
+ is_target = 'target'
+
+
+if FLAGS.use_advtrain==True:
+ dirr = 'advtrained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = '_'+is_target+FLAGS.attack_method_for_advtrain
+ adv_ratio_name = '_advratio'+str(FLAGS.adv_ratio)
+ mean_var = int(FLAGS.mean_var)
+else:
+ dirr = 'trained_models/'+FLAGS.dataset+'/'
+ attack_method_for_advtrain = ''
+ adv_ratio_name = ''
+ mean_var = FLAGS.mean_var
+
+
+if FLAGS.use_MMLDA==True:
+ print('Using MMT Training Scheme')
+ new_layer = Lambda(MMLDA_layer)
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ use_ball_=''
+ if FLAGS.use_ball==False:
+ print('Using softmax function (MMLDA)')
+ use_ball_='_softmax'
+ filepath_dir = dirr+'resnet32v'+str(version)+'_meanvar'+str(mean_var) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+name_dense+name_random+use_ball_+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+else:
+ print('Using softmax loss')
+ model = original_model
+ filepath_dir = dirr+'resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+attack_method_for_advtrain+adv_ratio_name+BN_name+name_leaky+'/' \
+ +'model.'+str(FLAGS.epoch).zfill(3)+'.h5'
+
+
+wrap_ensemble = KerasModelWrapper(model, num_class=num_class)
+
+
+model.load_weights(filepath_dir)
+
+
+if FLAGS.attack_method == 'Rotation':
+ datagen = ImageDataGenerator(
+ rotation_range=30)
+
+ data_generate=datagen.flow(x_test, y_test, batch_size=100)
+
+ accuracy = 0
+ with sess.as_default():
+ for i in range(10):
+ test_batch = data_generate.next()
+ test_batch_data = test_batch[0]
+ test_batch_label = test_batch[1]
+ correct_preds = tf.equal(tf.argmax(y_place, axis=-1),
+ tf.argmax(model(x_place), axis=-1))
+ cur_corr_preds = correct_preds.eval(feed_dict={x_place: test_batch_data, y_place: test_batch_label})
+ accuracy += cur_corr_preds.sum()
+ print (accuracy)
+ accuracy /= 10.
+ print ('Accuracy is: ', accuracy)
+
+elif FLAGS.attack_method == 'Gaussian':
+ accuracy = 0
+ with sess.as_default():
+ for i in range(10):
+ correct_preds = tf.equal(tf.argmax(y_place, axis=-1),
+ tf.argmax(model(x_place+tf.random_normal([100,32,32,3],mean=0.0,stddev=0.05)), axis=-1))
+ cur_corr_preds = correct_preds.eval(feed_dict={x_place: x_test[i*100:(i+1)*100], y_place: y_test[i*100:(i+1)*100]})
+ accuracy += cur_corr_preds.sum()
+ print (accuracy)
+ accuracy /= 10.
+ print ('Accuracy is: ', accuracy)
diff --git a/case_studies/mmt/advtrain.py b/case_studies/mmt/advtrain.py
new file mode 100644
index 0000000..949132b
--- /dev/null
+++ b/case_studies/mmt/advtrain.py
@@ -0,0 +1,303 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from utils.model import resnet_v1, resnet_v2
+
+from utils.keras_wraper_ensemble import KerasModelWrapper
+import cleverhans.attacks as attacks
+
+FLAGS = tf.app.flags.FLAGS
+
+tf.app.flags.DEFINE_integer('batch_size', 50, '')
+tf.app.flags.DEFINE_integer('mean_var', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_integer('version', 2, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax loss')
+tf.app.flags.DEFINE_float('adv_ratio', 1.0, 'the ratio of adversarial examples in each mini-batch')
+tf.app.flags.DEFINE_string('attack_method', 'MadryEtAl', 'the attack used to craft adversarial examples for adv training')
+tf.app.flags.DEFINE_bool('use_target', False, 'whether use target attack or untarget attack for adversarial training')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+else:
+ print('Unknown dataset')
+
+# These parameters are usually fixed
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 5 # n=5 for resnet-32 v1
+
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+else:
+ name_random = ''
+
+#Load means in MMLDA
+kernel_dict = loadmat('kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+name_random+'.mat')
+mean_logits = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits = FLAGS.mean_var * tf.constant(mean_logits,dtype=tf.float32)
+
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+# If subtract pixel mean is enabled
+clip_min = 0.0
+clip_max = 1.0
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+ clip_min -= x_train_mean
+ clip_max -= x_train_mean
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test = keras.utils.to_categorical(y_test, num_class)
+
+
+def dot_loss(y_true, y_pred):
+ return - tf.reduce_sum(y_pred * y_true, axis=-1) #batch_size X 1
+
+#MMLDA prediction function
+def MMLDA_layer(x, means=mean_logits, num_class=num_class, use_ball=FLAGS.use_ball):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ return logits
+ else:
+ logits = logits - tf.reduce_max(logits, axis=-1, keepdims=True) #Avoid numerical rounding
+ logits = logits - tf.log(tf.reduce_sum(tf.exp(logits), axis=-1, keepdims=True)) #Avoid numerical rounding
+ return logits
+
+
+def lr_schedule(epoch):
+ lr = FLAGS.lr
+ if epoch > epochs_inter[1]:
+ lr *= 1e-2
+ elif epoch > epochs_inter[0]:
+ lr *= 1e-1
+ print('Learning rate: ', lr)
+ return lr
+
+
+model_input = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model,_,_,_,final_features = resnet_v2(input=model_input, depth=depth, num_classes=num_class, use_BN=FLAGS.use_BN)
+else:
+ original_model,_,_,_,final_features = resnet_v1(input=model_input, depth=depth, num_classes=num_class, use_BN=FLAGS.use_BN)
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+#Whether use target attack for adversarial training
+if FLAGS.use_target==False:
+ is_target = ''
+ y_target = None
+else:
+ is_target = 'target'
+ y_target = tf.multinomial(tf.ones((FLAGS.batch_size,num_class)),1) #batch_size x 1
+ y_target = tf.one_hot(tf.reshape(y_target,(FLAGS.batch_size,)),num_class) #batch_size x num_class
+
+
+if FLAGS.use_MMLDA==True:
+ print('Using MMT Training Scheme')
+ new_layer = Lambda(MMLDA_layer)
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ use_ball_=''
+ train_loss = dot_loss
+ if FLAGS.use_ball==False:
+ print('Using softmax function (MMLDA)')
+ use_ball_='_softmax'
+ filepath_dir = 'advtrained_models/'+FLAGS.dataset+'/resnet32v'+str(version)+'_meanvar'+str(FLAGS.mean_var) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +'_'+is_target+FLAGS.attack_method \
+ +'_advratio'+str(FLAGS.adv_ratio)+BN_name+name_random \
+ +use_ball_
+else:
+ print('Using softmax loss')
+ model = original_model
+ train_loss = keras.losses.categorical_crossentropy
+ filepath_dir = 'advtrained_models/'+FLAGS.dataset+'/resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+'_'+is_target+FLAGS.attack_method+'_advratio'+str(FLAGS.adv_ratio)+BN_name
+
+wrap_ensemble = KerasModelWrapper(model, num_class=num_class)
+
+
+eps = 8. / 256.
+if FLAGS.attack_method == 'MadryEtAl':
+ print('apply '+is_target+'PGD'+' for advtrain')
+ att = attacks.MadryEtAl(wrap_ensemble)
+ att_params = {
+ 'eps': eps,
+ #'eps_iter': 3.*eps/10.,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_iter': 10,
+ 'y_target': y_target
+ }
+elif FLAGS.attack_method == 'MomentumIterativeMethod':
+ print('apply '+is_target+'MIM'+' for advtrain')
+ att = attacks.MomentumIterativeMethod(wrap_ensemble)
+ att_params = {
+ 'eps': eps,
+ #'eps_iter': 3.*eps/10.,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'nb_iter': 10,
+ 'y_target': y_target
+ }
+elif FLAGS.attack_method == 'FastGradientMethod':
+ print('apply '+is_target+'FGSM'+' for advtrain')
+ att = attacks.FastGradientMethod(wrap_ensemble)
+ att_params = {'eps': eps,
+ 'clip_min': clip_min,
+ 'clip_max': clip_max,
+ 'y_target': y_target}
+
+adv_x = tf.stop_gradient(att.generate(model_input, **att_params))
+adv_output = model(adv_x)
+normal_output = model(model_input)
+
+
+def adv_train_loss(_y_true, _y_pred):
+ return (1-FLAGS.adv_ratio) * train_loss(_y_true, normal_output) + FLAGS.adv_ratio * train_loss(_y_true, adv_output)
+
+
+if FLAGS.optimizer=='Adam':
+ model.compile(
+ loss=adv_train_loss,
+ optimizer=Adam(lr=lr_schedule(0)),
+ metrics=['accuracy'])
+ print('Using Adam optimizer')
+elif FLAGS.optimizer=='mom':
+ model.compile(
+ loss=adv_train_loss,
+ optimizer=SGD(lr=lr_schedule(0), momentum=0.9),
+ metrics=['accuracy'])
+ print('Using momentum optimizer')
+model.summary()
+
+
+# Prepare model model saving directory.
+save_dir = os.path.join(os.getcwd(), filepath_dir)
+model_name = 'model.{epoch:03d}.h5'
+if not os.path.isdir(save_dir):
+ os.makedirs(save_dir)
+filepath = os.path.join(save_dir, model_name)
+
+# Prepare callbacks for model saving and for learning rate adjustment.
+checkpoint = ModelCheckpoint(
+ filepath=filepath, monitor='val_loss', mode='min', verbose=2, save_best_only=False, save_weights_only=True, period=5)
+
+lr_scheduler = LearningRateScheduler(lr_schedule)
+
+
+callbacks = [checkpoint, lr_scheduler]
+
+
+
+
+# Run training, with data augmentation.
+
+print('Using real-time data augmentation.')
+# This will do preprocessing and realtime data augmentation:
+datagen = ImageDataGenerator(
+ # epsilon for ZCA whitening
+ zca_epsilon=1e-06,
+ # randomly shift images horizontally
+ width_shift_range=0.1,
+ # randomly shift images vertically
+ height_shift_range=0.1,
+ # set mode for filling points outside the input boundaries
+ fill_mode='nearest',
+ # randomly flip images
+ horizontal_flip=True)
+
+# Compute quantities required for featurewise normalization
+datagen.fit(x_train)
+
+# Fit the model on the batches generated by datagen.flow().
+model.fit_generator(
+ datagen.flow(x_train, y_train, batch_size=FLAGS.batch_size),
+ validation_data=(x_test, y_test),
+ epochs=epochs,
+ verbose=2,
+ workers=4,
+ callbacks=callbacks)
diff --git a/case_studies/mmt/binarization_test.sh b/case_studies/mmt/binarization_test.sh
new file mode 100644
index 0000000..1f4195c
--- /dev/null
+++ b/case_studies/mmt/binarization_test.sh
@@ -0,0 +1,43 @@
+nsamples=${1:-512}
+epsilon=${2:-8}
+
+kwargs=""
+kwargs="--sample_from_corners=True"
+
+echo "#samples: $nsamples"
+echo "epsilon: $epsilon"
+echo "kwargs: $kwargs"
+
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "1 boundary point, 999 inner (Original attack)"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$(pwd) venv3.8tf/bin/python case_studies/mmt/binarization_test_iterative.py --mean_var=10 --batch_size=50 \
+ --attack_method_for_advtrain='MadryEtAl' \
+ --dataset=cifar10 --use_ball=True \
+ --use_MMLDA=True --use_advtrain=False --epoch=200 \
+ --use_BN=True --normalize_output_for_ball=False --use_random=False \
+ --adv_ratio=1.0 --use_target=False \
+ --checkpoint=checkpoints/mmt_mmc_rn110.h5 \
+ --n_samples=$nsamples \
+ --attack_method='MadryEtAl' \
+ --num_iter=50 \
+ --epsilon=$epsilon \
+ $kwargs
+
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "1 boundary point, 999 inner (Adaptive attack)"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$(pwd) venv3.8tf/bin/python case_studies/mmt/binarization_test_iterative.py --mean_var=10 --batch_size=50 \
+ --attack_method_for_advtrain='MadryEtAl' \
+ --dataset=cifar10 --use_ball=True \
+ --use_MMLDA=True --use_advtrain=False --epoch=200 \
+ --use_BN=True --normalize_output_for_ball=False --use_random=False \
+ --adv_ratio=1.0 --use_target=False \
+ --checkpoint=checkpoints/mmt_mmc_rn110.h5 \
+ --n_samples=$nsamples \
+ --attack_method='Adaptive' \
+ --num_iter=50 \
+ --epsilon=$epsilon \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/mmt/binarization_test_iterative.py b/case_studies/mmt/binarization_test_iterative.py
new file mode 100644
index 0000000..9a134a3
--- /dev/null
+++ b/case_studies/mmt/binarization_test_iterative.py
@@ -0,0 +1,566 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+
+import logging
+
+logging.getLogger('tensorflow').setLevel(logging.FATAL)
+import tensorflow as tf
+
+tf.logging.set_verbosity(tf.logging.ERROR)
+
+import pdb
+from functools import partial
+
+import keras
+import torch
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, \
+ ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+
+from torch.utils.data import DataLoader
+
+from active_tests.decision_boundary_binarization import LogitRescalingType
+from active_tests.decision_boundary_binarization import \
+ _train_logistic_regression_classifier
+from active_tests.decision_boundary_binarization import format_result
+from active_tests.decision_boundary_binarization import \
+ interior_boundary_discrimination_attack
+from tensorflow_wrapper import TensorFlow1ToPyTorchWrapper
+from utils import build_dataloader_from_arrays
+from mmt_utils.model import resnet_v1, resnet_v2
+import cleverhans.attacks as attacks
+from cleverhans.utils_tf import model_eval
+from mmt_utils.keras_wraper_ensemble import KerasModelWrapper
+from mmt_utils.utils_model_eval import model_eval_targetacc
+from sklearn.metrics import roc_auc_score
+
+FLAGS = tf.app.flags.FLAGS
+
+
+def main():
+ tf.app.flags.DEFINE_integer('epsilon', 8, 'attack radius')
+ tf.app.flags.DEFINE_integer('n_inner_points', 999, '')
+ tf.app.flags.DEFINE_integer('n_boundary_points', 1, '')
+ tf.app.flags.DEFINE_integer('n_samples', 512, '')
+
+ tf.app.flags.DEFINE_integer('batch_size', 512, 'batch_size for attack')
+ tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+ tf.app.flags.DEFINE_float('mean_var', 10, 'parameter in MMLDA')
+ tf.app.flags.DEFINE_string('attack_method', 'FastGradientMethod', '')
+ tf.app.flags.DEFINE_string('attack_method_for_advtrain', 'FastGradientMethod',
+ '')
+ tf.app.flags.DEFINE_integer('version', 2, '')
+ tf.app.flags.DEFINE_bool('use_target', False,
+ 'whether use target attack or untarget attack for adversarial training')
+ tf.app.flags.DEFINE_integer('num_iter', 10, '')
+ tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax')
+ tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+ tf.app.flags.DEFINE_bool('use_advtrain', True,
+ 'whether use advtraining or normal training')
+ tf.app.flags.DEFINE_float('adv_ratio', 1.0,
+ 'the ratio of adversarial examples in each mini-batch')
+ tf.app.flags.DEFINE_integer('epoch', 1, 'the epoch of model to load')
+ tf.app.flags.DEFINE_bool('use_BN', True,
+ 'whether use batch normalization in the network')
+ tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+ tf.app.flags.DEFINE_bool('normalize_output_for_ball', True,
+ 'whether apply softmax in the inference phase')
+ tf.app.flags.DEFINE_bool('use_random', False,
+ 'whether use random center or MMLDA center in the network')
+ tf.app.flags.DEFINE_bool('use_dense', True,
+ 'whether use extra dense layer in the network')
+ tf.app.flags.DEFINE_bool('use_leaky', False,
+ 'whether use leaky relu in the network')
+
+ tf.app.flags.DEFINE_string('checkpoint', None, '')
+
+ # For calculate AUC-scores
+ tf.app.flags.DEFINE_bool('is_calculate_auc', False,
+ 'whether to calculate auc scores')
+ tf.app.flags.DEFINE_bool('is_auc_metric_softmax_for_MMC', False,
+ 'whether use softmax to calculate auc metrics for MMC')
+
+ tf.app.flags.DEFINE_bool('sample_from_corners', False, '')
+
+ run_test()
+
+
+# MMLDA prediction function
+def MMLDA_layer(x, means, num_class, use_ball,
+ normalize_output_for_ball=None):
+ if normalize_output_for_ball is None:
+ normalize_output_for_ball = FLAGS.normalize_output_for_ball
+
+ # x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x, axis=1),
+ [1, num_class, 1]) # batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means, axis=0) # 1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand),
+ axis=-1) # batch_size X num_class
+ if use_ball == True:
+ if normalize_output_for_ball == False:
+ return logits
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+ else:
+ return tf.nn.softmax(logits, axis=-1)
+
+
+def setup_model_and_load_data():
+ # Load the dataset
+ if FLAGS.dataset == 'mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.expand_dims(x_train, axis=3)
+ x_test = np.expand_dims(x_test, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30, 40]
+ x_place = tf.placeholder(tf.float32, shape=(None, 28, 28, 3))
+
+ elif FLAGS.dataset == 'cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100, 150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+ elif FLAGS.dataset == 'cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100, 150]
+ x_place = tf.placeholder(tf.float32, shape=(None, 32, 32, 3))
+
+ else:
+ print('Unknown dataset')
+
+ # These parameters are usually fixed
+ subtract_pixel_mean = True
+ version = FLAGS.version # Model version
+ n = 18 # n=5 for resnet-32 v1, n=18 for Resnet110 (according to README.md)
+
+ # Computed depth from supplied model parameter n
+ if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+ elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = 256
+
+ if FLAGS.use_random == True:
+ name_random = '_random'
+ else:
+ name_random = ''
+
+ if FLAGS.use_leaky == True:
+ name_leaky = '_withleaky'
+ else:
+ name_leaky = ''
+
+ if FLAGS.use_dense == True:
+ name_dense = ''
+ else:
+ name_dense = '_nodense'
+
+ # Load means in MMLDA
+ kernel_dict = loadmat(
+ 'case_studies/mmt/kernel_paras/meanvar1_featuredim' + str(
+ feature_dim) + '_class' + str(
+ num_class) + name_random + '.mat')
+ mean_logits = kernel_dict['mean_logits'] # num_class X num_dense
+ mean_logits = FLAGS.mean_var * tf.constant(mean_logits, dtype=tf.float32)
+
+
+ # Load the data.
+ # Input image dimensions.
+ input_shape = x_train.shape[1:]
+
+ # Normalize data.
+ x_train = x_train.astype('float32') / 255
+ x_test = x_test.astype('float32') / 255
+
+ # clip_min = 0.0
+ # clip_max = 1.0
+ # If subtract pixel mean is enabled
+ if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0, keepdims=True)
+ # x_train -= x_train_mean
+ # x_test -= x_train_mean
+ # clip_min -= np.max(x_train_mean)
+ # clip_max -= np.min(x_train_mean)
+
+ # Convert class vectors to binary class matrices.
+ y_train = keras.utils.to_categorical(y_train, num_class)
+ y_test = keras.utils.to_categorical(y_test, num_class)
+
+ # Define input TF placeholder
+ y_place = tf.placeholder(tf.float32, shape=(None, num_class))
+ sess = tf.Session()
+ keras.backend.set_session(sess)
+
+ model_input = Input(shape=input_shape)
+
+ if subtract_pixel_mean:
+ normalized_model_input = Lambda(lambda x: x - x_train_mean)(model_input)
+ else:
+ normalized_model_input = model_input
+
+ # preprocessed_input =
+
+ # dim of logtis is batchsize x dim_means
+ if version == 2:
+ original_model, _, _, _, final_features = resnet_v2(
+ immediate_input=normalized_model_input, input=model_input, depth=depth,
+ num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense,
+ use_leaky=FLAGS.use_leaky)
+ else:
+ original_model, _, _, _, final_features = resnet_v1(
+ immediate_input=normalized_model_input, input=model_input, depth=depth,
+ num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense,
+ use_leaky=FLAGS.use_leaky)
+
+ if FLAGS.use_BN == True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+ else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+ # Whether use target attack for adversarial training
+ if FLAGS.use_target == False:
+ is_target = ''
+ else:
+ is_target = 'target'
+
+ if FLAGS.use_advtrain == True:
+ dirr = 'advtrained_models/' + FLAGS.dataset + '/'
+ attack_method_for_advtrain = '_' + is_target + FLAGS.attack_method_for_advtrain
+ adv_ratio_name = '_advratio' + str(FLAGS.adv_ratio)
+ mean_var = int(FLAGS.mean_var)
+ else:
+ dirr = 'trained_models/' + FLAGS.dataset + '/'
+ attack_method_for_advtrain = ''
+ adv_ratio_name = ''
+ mean_var = FLAGS.mean_var
+
+ if FLAGS.use_MMLDA == True:
+ print('Using MMLDA')
+ new_layer = Lambda(partial(MMLDA_layer, means=mean_logits,
+ num_class=num_class, use_ball=FLAGS.use_ball))
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ else:
+ print('Using softmax loss')
+ model = original_model
+
+ model.load_weights(FLAGS.checkpoint)
+
+ return (model, model_input, final_features, mean_logits), \
+ x_place, y_place, sess, (x_test, y_test)
+
+
+def run_attack(m, l, kwargs, preds, x_adv, x_ph, y_ph, sess):
+ del kwargs
+ del m
+
+ for x, y in l:
+ x = x.numpy().transpose(0, 2, 3, 1)
+ y = y.numpy()
+
+ y_oh = keras.utils.to_categorical(y, 2)
+
+ x_adv_np, logits = sess.run((x_adv, preds), {x_ph: x, y_ph: y_oh})
+ y_pred = logits.argmax(-1)
+
+ print(logits)
+
+ is_adv = y_pred != y
+
+ x_adv_np = x_adv_np.transpose((0, 3, 1, 2))
+
+ return is_adv, (torch.tensor(x_adv_np, dtype=torch.float32),
+ torch.tensor(logits, dtype=torch.float32)
+ )
+
+
+def train_classifier(
+ n_features: int,
+ train_loader: DataLoader,
+ raw_train_loader: DataLoader,
+ logits: torch.Tensor,
+ device: str,
+ rescale_logits: LogitRescalingType,
+ linear_layer,
+ clean_preds,
+ x_ph,
+ sess,
+ binarized_model_wrapper
+):
+ # del raw_train_loader
+ assert rescale_logits is None
+
+ cls = _train_logistic_regression_classifier(
+ n_features,
+ train_loader,
+ logits if logits is not None else None,
+ "sklearn",
+ 20000,
+ device,
+ n_classes=2,
+ rescale_logits=rescale_logits,
+ solution_goodness="perfect",
+ class_weight={0: 1, 1:5}
+ )
+
+ clw = cls.weight.data.detach().numpy()
+ clb = cls.bias.data.detach().numpy()
+
+ # since the first two MMT weights look roughly like this:
+ # 1: (10, 0, ..., 0)
+ # 2: (-1, 9.9, 0, ..., 0)
+ # we can easily construct a weight matrix that remaps the feature space to
+ # these two vectors
+ nw = np.zeros((256, 256))
+ nb = np.zeros(256)
+ nw[:2] = clw
+ nb[:2] = clb
+ linear_layer.set_weights((nw.T, nb))
+
+ # now test
+ n_correct_inner = 0
+ n_correct_outer = 0
+ n_total_inner = 0
+ n_total_outer = 0
+ for x, y in raw_train_loader:
+ x = x.numpy().transpose((0, 2, 3, 1))
+ y = y.numpy()
+
+ logits = sess.run(clean_preds, {x_ph: x})
+ y_pred = logits.argmax(-1)
+ is_correct = y_pred == y
+
+ n_correct_inner += is_correct[y == 0].sum()
+ n_correct_outer += is_correct[y == 1].sum()
+ n_total_inner += (y == 0).sum()
+ n_total_outer += (y == 1).sum()
+
+ accuracy_inner = n_correct_inner / n_total_inner
+ accuracy_outer = n_correct_outer / n_total_outer
+ if accuracy_outer != 1.0:
+ raise RuntimeError(f"Solver failed to find solution that perfectly detects boundary samples {accuracy_outer}")
+ if accuracy_inner == 0:
+ raise RuntimeError(f"Solver failed to find solution that detects (at least some) inner samples {accuracy_inner}")
+
+ return binarized_model_wrapper
+
+
+def setup_binarized_model(sess, model_input, final_features, mean_logits):
+ assert FLAGS.use_ball
+
+ # means_ph = tf.placeholder(tf.float32, shape=[2, mean_logits.shape[1]])
+ # means = tf.Variable(np.zeros([2, mean_logits.shape[1]], dtype=np.float32),
+ # name="binarized_model_means")
+ # set_means = means.assign(means_ph)
+
+ new_layer = Lambda(partial(MMLDA_layer, means=mean_logits[:2],
+ num_class=2, use_ball=FLAGS.use_ball,
+ normalize_output_for_ball=False))
+ linear_layer = Dense(256)
+ transformed_features = linear_layer(final_features)
+ predictions = new_layer(transformed_features)
+ model = Model(input=model_input, output=predictions)
+
+ # will be used by binarization test to eval the model
+ binarized_model_wrapper = BinarizedModelWrapper(model_input, predictions, sess)
+
+ return model, linear_layer, binarized_model_wrapper
+
+
+class BinarizedModelWrapper:
+ def __init__(self, input, output, sess):
+ self.input = input
+ self.output = output
+ self.sess = sess
+
+ def __call__(self, x):
+ return_torch = False
+ if isinstance(x, torch.Tensor):
+ x = x.cpu().numpy()
+ return_torch = True
+ if isinstance(x, np.ndarray):
+ if x.shape[1] == 3:
+ x = x.transpose(0, 2, 3, 1)
+
+ out = self.sess.run(self.output, {self.input: x})
+ if return_torch:
+ out = torch.tensor(out, dtype=torch.float32)
+ return out
+
+
+def run_test():
+ (model, model_input, final_features, mean_logits), \
+ x_place, y_place, sess, (x_test, y_test) = \
+ setup_model_and_load_data()
+
+ del y_place
+ y_place = tf.placeholder(tf.float32, shape=(None, 2))
+
+ binarized_model, linear_layer, binarized_model_wrapper = \
+ setup_binarized_model(
+ sess,
+ model_input,
+ final_features,
+ mean_logits)
+
+
+ bin_clean_preds = binarized_model(x_place)
+ clean_preds = model(x_place)
+ wrap_ensemble = KerasModelWrapper(binarized_model, num_class=2, binarized_model=True)
+
+ # Initialize the attack method
+ if FLAGS.attack_method == 'MadryEtAl':
+ att = attacks.MadryEtAl(wrap_ensemble)
+ elif FLAGS.attack_method == 'FastGradientMethod':
+ att = attacks.FastGradientMethod(wrap_ensemble)
+ elif FLAGS.attack_method == 'MomentumIterativeMethod':
+ att = attacks.MomentumIterativeMethod(wrap_ensemble)
+ elif FLAGS.attack_method == 'BasicIterativeMethod':
+ att = attacks.BasicIterativeMethod(wrap_ensemble)
+ elif FLAGS.attack_method == "Adaptive":
+ from adaptive_attack import FeatureSpaceProjectedGradientDescent
+ att = FeatureSpaceProjectedGradientDescent(wrap_ensemble, logit_means=mean_logits,
+ projection="l2")
+
+ # Consider the attack to be constant
+ eval_par = {'batch_size': FLAGS.batch_size}
+
+ # TODO: shouldn't this be a 255?
+ eps_ = FLAGS.epsilon / 256.0
+ print("Epsilon:", eps_)
+
+ y_target = None
+ if FLAGS.attack_method == 'FastGradientMethod':
+ att_params = {
+ 'eps': eps_,
+ 'clip_min': 0,
+ 'clip_max': 1,
+ 'y_target': y_target
+ }
+ else:
+ att_params = {
+ 'eps': eps_,
+ # 'eps_iter': eps_*1.0/FLAGS.num_iter,
+ # 'eps_iter': 3.*eps_/FLAGS.num_iter,
+ 'eps_iter': 2. / 256.,
+ 'clip_min': 0,
+ 'clip_max': 1,
+ 'nb_iter': FLAGS.num_iter,
+ 'y_target': y_target
+ }
+ if FLAGS.attack_method == "Adaptive":
+ att_params["y"] = y_place
+ att_params['eps_iter'] = 0.03 / 256.
+
+ print("att_params", att_params)
+ if FLAGS.attack_method != "Adaptive":
+ import cleverhans.attacks
+ from fgm_patched import fgm_patched
+ cleverhans.attacks.fgm = fgm_patched
+ print("patched fgm function")
+
+ adv_x = tf.stop_gradient(att.generate(x_place, **att_params))
+ bin_adv_preds = binarized_model(adv_x)
+
+ def _model_forward_pass(x_np, features_only=False, features_and_logits=False):
+ x_np = np.transpose(x_np, (0, 2, 3, 1))
+
+ if features_only:
+ f = sess.run(final_features, {model_input: x_np})
+
+ return f
+ elif features_and_logits:
+ f, l = sess.run((final_features,
+ clean_preds), {model_input: x_np})
+ f = np.stack(f, 1)
+ return f, l
+ else:
+ l = sess.run(clean_preds, {model_input: x_np})
+ return l
+
+ feature_extractor = TensorFlow1ToPyTorchWrapper(
+ logit_forward_pass=_model_forward_pass,
+ logit_forward_and_backward_pass=None
+ )
+
+ test_loader = build_dataloader_from_arrays(x_test.transpose((0, 3, 1, 2)),
+ y_test,
+ batch_size=FLAGS.batch_size)
+
+ from argparse_utils import DecisionBoundaryBinarizationSettings
+ scores_logit_differences_and_validation_accuracies = \
+ interior_boundary_discrimination_attack(
+ feature_extractor,
+ test_loader,
+ attack_fn=partial(run_attack, preds=bin_adv_preds, sess=sess, x_ph=x_place,
+ y_ph=y_place, x_adv=adv_x),
+ linearization_settings=DecisionBoundaryBinarizationSettings(
+ epsilon=eps_,
+ norm="linf",
+ lr=10000,
+ n_boundary_points=FLAGS.n_boundary_points,
+ n_inner_points=FLAGS.n_inner_points,
+ adversarial_attack_settings=None,
+ optimizer="sklearn"
+ ),
+ n_samples=FLAGS.n_samples,
+ device="cpu",
+ batch_size=FLAGS.batch_size,
+ n_samples_evaluation=200,
+ n_samples_asr_evaluation=200,
+ train_classifier_fn=partial(
+ train_classifier,
+ linear_layer=linear_layer,
+ clean_preds=bin_clean_preds,
+ x_ph=x_place,
+ sess=sess,
+ binarized_model_wrapper=binarized_model_wrapper
+ ),
+ fail_on_exception=False,
+ rescale_logits=None,
+ sample_training_data_from_corners=FLAGS.sample_from_corners,
+ # decision_boundary_closeness=0.9999,
+ )
+ print(format_result(scores_logit_differences_and_validation_accuracies,
+ FLAGS.n_samples))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/case_studies/mmt/fgm_patched.py b/case_studies/mmt/fgm_patched.py
new file mode 100644
index 0000000..0f2c130
--- /dev/null
+++ b/case_studies/mmt/fgm_patched.py
@@ -0,0 +1,102 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from cleverhans.attacks import optimize_linear
+from cleverhans import utils_tf
+import numpy as np
+import tensorflow as tf
+
+
+def fgm_patched(x,
+ logits,
+ y=None,
+ eps=0.3,
+ ord=np.inf,
+ clip_min=None,
+ clip_max=None,
+ targeted=False,
+ sanity_checks=True):
+ """
+ TensorFlow implementation of the Fast Gradient Method.
+ :param x: the input placeholder
+ :param logits: output of model.get_logits
+ :param y: (optional) A placeholder for the true labels. If targeted
+ is true, then provide the target label. Otherwise, only provide
+ this parameter if you'd like to use true labels when crafting
+ adversarial samples. Otherwise, model predictions are used as
+ labels to avoid the "label leaking" effect (explained in this
+ paper: https://arxiv.org/abs/1611.01236). Default is None.
+ Labels should be one-hot-encoded.
+ :param eps: the epsilon (input variation parameter)
+ :param ord: (optional) Order of the norm (mimics NumPy).
+ Possible values: np.inf, 1 or 2.
+ :param clip_min: Minimum float value for adversarial example components
+ :param clip_max: Maximum float value for adversarial example components
+ :param targeted: Is the attack targeted or untargeted? Untargeted, the
+ default, will try to make the label incorrect. Targeted
+ will instead try to move in the direction of being more
+ like y.
+ :return: a tensor for the adversarial example
+ """
+
+ asserts = []
+
+ # If a data range was specified, check that the input was in that range
+ if clip_min is not None:
+ asserts.append(utils_tf.assert_greater_equal(
+ x, tf.cast(clip_min, x.dtype)))
+
+ if clip_max is not None:
+ asserts.append(utils_tf.assert_less_equal(x, tf.cast(clip_max, x.dtype)))
+
+ # Make sure the caller has not passed probs by accident
+ assert logits.op.type != 'Softmax'
+
+ if y is None:
+ # Using model predictions as ground truth to avoid label leaking
+ preds_max = tf.reduce_max(logits, 1, keepdims=True)
+ y = tf.to_float(tf.equal(logits, preds_max))
+ y = tf.stop_gradient(y)
+ y = y / tf.reduce_sum(y, 1, keepdims=True)
+
+ # Compute loss
+ from cleverhans.compat import softmax_cross_entropy_with_logits
+ #loss = softmax_cross_entropy_with_logits(labels=y, logits=logits)
+
+ loss = -tf.reduce_sum(logits * y, axis=-1)
+ if targeted:
+ loss = -loss
+
+ # Define gradient of loss wrt input
+ grad, = tf.gradients(loss, x)
+
+ optimal_perturbation = optimize_linear(grad, eps, ord)
+
+ # Add perturbation to original example to obtain adversarial example
+ adv_x = x + optimal_perturbation
+
+ # If clipping is needed, reset all values outside of [clip_min, clip_max]
+ if (clip_min is not None) or (clip_max is not None):
+ # We don't currently support one-sided clipping
+ assert clip_min is not None and clip_max is not None
+ adv_x = utils_tf.clip_by_value(adv_x, clip_min, clip_max)
+
+ if sanity_checks:
+ with tf.control_dependencies(asserts):
+ adv_x = tf.identity(adv_x)
+
+ # adv_x = tf.Print(adv_x, [loss, logits, y, grad])
+
+ return adv_x
+
diff --git a/case_studies/mmt/kernel_paras/craft_MMcenters.m b/case_studies/mmt/kernel_paras/craft_MMcenters.m
new file mode 100644
index 0000000..d99e10a
--- /dev/null
+++ b/case_studies/mmt/kernel_paras/craft_MMcenters.m
@@ -0,0 +1,18 @@
+clc
+clear all
+L=10;
+D=256;
+mean_var=1;
+
+mean_logits=zeros(L,D);
+mean_logits(1,1)=1;
+for k=2:L
+ for j =1:k-1
+ mean_logits(k,j)=-(1/(L-1)+dot(mean_logits(k,:),mean_logits(j,:)))/mean_logits(j,j);
+ end
+ mean_logits(k,k)=sqrt(abs(1-norm(mean_logits(k,:))^2));
+end
+mean_logits=mean_logits*mean_var;
+
+
+save(['meanvar1_featuredim',num2str(D),'_class',num2str(L),'.mat'],'mean_logits')
diff --git a/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class10.mat b/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class10.mat
new file mode 100644
index 0000000..92870e6
Binary files /dev/null and b/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class10.mat differ
diff --git a/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class100.mat b/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class100.mat
new file mode 100644
index 0000000..1e9c24c
Binary files /dev/null and b/case_studies/mmt/kernel_paras/meanvar1_featuredim256_class100.mat differ
diff --git a/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class10.mat b/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class10.mat
new file mode 100644
index 0000000..fb34d00
Binary files /dev/null and b/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class10.mat differ
diff --git a/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class100.mat b/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class100.mat
new file mode 100644
index 0000000..5f8b000
Binary files /dev/null and b/case_studies/mmt/kernel_paras/meanvar1_featuredim64_class100.mat differ
diff --git a/case_studies/mmt/mmt_utils/__init__.py b/case_studies/mmt/mmt_utils/__init__.py
new file mode 100644
index 0000000..6cf2daf
--- /dev/null
+++ b/case_studies/mmt/mmt_utils/__init__.py
@@ -0,0 +1,14 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
diff --git a/case_studies/mmt/mmt_utils/craft_MMLDA_means_whenDlessthanL.py b/case_studies/mmt/mmt_utils/craft_MMLDA_means_whenDlessthanL.py
new file mode 100644
index 0000000..14a2f54
--- /dev/null
+++ b/case_studies/mmt/mmt_utils/craft_MMLDA_means_whenDlessthanL.py
@@ -0,0 +1,40 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import tensorflow as tf
+
+L = 10 #Number of classes
+d = 2 #Dimension of features
+lr = 0.0001 #Learning rate
+mean_var = 1
+steps = 10000 #optimization steps
+
+z = tf.get_variable("auxiliary_variable", [d, L]) #dxL
+x = z / tf.norm(z, axis=0, keepdims=True) #dxL, normalized in each column
+XTX = tf.matmul(x, x, transpose_a=True) - 2 * tf.eye(L)#LxL, each element is the dot-product of two means, the diag elements are -1
+cost = tf.reduce_max(XTX) #single element
+opt = tf.train.AdamOptimizer(learning_rate=lr)
+opt_op = opt.minimize(cost)
+with tf.Session() as sess:
+ sess.run(tf.initializers.global_variables())
+ for i in range(steps):
+ _, loss = sess.run([opt_op, cost])
+ min_distance2 = loss
+ print('Step %d, min_distance2: %f'%(i, min_distance2))
+
+ mean_logits = sess.run(x)
+
+mean_logits = mean_var * mean_logits.T
+import scipy.io as sio
+sio.savemat('/MMC/kernel_paras/meanvar1_featuredim'+str(d)+'_class'+str(L)+'.mat', {'mean_logits': mean_logits})
diff --git a/case_studies/mmt/mmt_utils/keras_wraper_ensemble.py b/case_studies/mmt/mmt_utils/keras_wraper_ensemble.py
new file mode 100644
index 0000000..c05f000
--- /dev/null
+++ b/case_studies/mmt/mmt_utils/keras_wraper_ensemble.py
@@ -0,0 +1,181 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Model construction utilities based on keras
+"""
+import warnings
+from distutils.version import LooseVersion
+import keras
+from keras.models import Sequential
+from keras.layers import Dense, Activation, Flatten
+
+from cleverhans.model import Model, NoSuchLayerError
+import tensorflow as tf
+
+
+class KerasModelWrapper(Model):
+ """
+ An implementation of `Model` that wraps a Keras model. It
+ specifically exposes the hidden features of a model by creating new models.
+ The symbolic graph is reused and so there is little overhead. Splitting
+ in-place operations can incur an overhead.
+ """
+
+ # set ch_compatibility_mode=True to use this class with ch3.0.1 (added by AUTHOR)
+ def __init__(self, model, num_class=10, binarized_model=False,
+ ch_compatibility_mode=False):
+ """
+ Create a wrapper for a Keras model
+ :param model: A Keras model
+ """
+ super(KerasModelWrapper, self).__init__()
+
+ if model is None:
+ raise ValueError('model argument must be supplied.')
+
+ self.model = model
+ self.keras_model = None
+ self.num_classes = num_class
+ self.binarized_model=binarized_model
+
+ self.ch_compatibility_mode = ch_compatibility_mode
+
+ def _get_softmax_name(self):
+ """
+ Looks for the name of the softmax layer.
+ :return: Softmax layer name
+ """
+ for layer in self.model.layers:
+ cfg = layer.get_config()
+ if cfg['name'] == 'average_1':
+ return layer.name
+
+ raise Exception("No softmax layers found")
+
+ def _get_logits_name(self):
+ """
+ Looks for the name of the layer producing the logits.
+ :return: name of layer producing the logits
+ """
+ softmax_name = self._get_softmax_name()
+ softmax_layer = self.model.get_layer(softmax_name)
+
+ if not isinstance(softmax_layer, Activation):
+ # In this case, the activation is part of another layer
+ return softmax_name
+
+ if hasattr(softmax_layer, 'inbound_nodes'):
+ warnings.warn(
+ "Please update your version to keras >= 2.1.3; "
+ "support for earlier keras versions will be dropped on "
+ "2018-07-22")
+ node = softmax_layer.inbound_nodes[0]
+ else:
+ node = softmax_layer._inbound_nodes[0]
+
+ logits_name = node.inbound_layers[0].name
+
+ return logits_name
+
+ def get_mmd_features(self, x):
+ outs = self.fprop(x)
+ if self.binarized_model:
+ return outs["dense_3"]
+ else:
+ return outs["dense_1"]
+
+
+ def get_logits(self, x):
+ """
+ :param x: A symbolic representation of the network input.
+ :return: A symbolic representation of the logits
+ """
+ # logits_name = self._get_logits_name()
+ # logits_layer = self.get_layer(x, logits_name)
+
+ # # Need to deal with the case where softmax is part of the
+ # # logits layer
+ # if logits_name == self._get_softmax_name():
+ # softmax_logit_layer = self.get_layer(x, logits_name)
+
+ # # The final op is the softmax. Return its input
+ # logits_layer = softmax_logit_layer._op.inputs[0]
+ prob = self.get_probs(x)
+ if self.ch_compatibility_mode:
+ return prob
+ logits = tf.log(prob)
+ #logits = prob
+ return logits
+
+ def get_probs(self, x):
+ """
+ :param x: A symbolic representation of the network input.
+ :return: A symbolic representation of the probs
+ """
+
+ return self.model(x)
+
+ def get_layer_names(self):
+ """
+ :return: Names of all the layers kept by Keras
+ """
+ layer_names = [x.name for x in self.model.layers]
+ return layer_names
+
+ def fprop(self, x):
+ """
+ Exposes all the layers of the model returned by get_layer_names.
+ :param x: A symbolic representation of the network input
+ :return: A dictionary mapping layer names to the symbolic
+ representation of their output.
+ """
+ from keras.models import Model as KerasModel
+
+ if self.keras_model is None:
+ # Get the input layer
+ new_input = self.model.get_input_at(0)
+
+ # Make a new model that returns each of the layers as output
+ out_layers = [x_layer.output for x_layer in self.model.layers]
+ self.keras_model = KerasModel(new_input, out_layers)
+
+ # and get the outputs for that model on the input x
+ outputs = self.keras_model(x)
+
+ # Keras only returns a list for outputs of length >= 1, if the model
+ # is only one layer, wrap a list
+ if len(self.model.layers) == 1:
+ outputs = [outputs]
+
+ # compute the dict to return
+ fprop_dict = dict(zip(self.get_layer_names(), outputs))
+
+ return fprop_dict
+
+ def get_layer(self, x, layer):
+ """
+ Expose the hidden features of a model given a layer name.
+ :param x: A symbolic representation of the network input
+ :param layer: The name of the hidden layer to return features at.
+ :return: A symbolic representation of the hidden features
+ :raise: NoSuchLayerError if `layer` is not in the model.
+ """
+ # Return the symbolic representation for this layer.
+ output = self.fprop(x)
+ try:
+ requested = output[layer]
+ except KeyError:
+ raise NoSuchLayerError()
+ return requested
\ No newline at end of file
diff --git a/case_studies/mmt/mmt_utils/model.py b/case_studies/mmt/mmt_utils/model.py
new file mode 100644
index 0000000..6868e4f
--- /dev/null
+++ b/case_studies/mmt/mmt_utils/model.py
@@ -0,0 +1,245 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, GlobalAveragePooling2D
+from keras.regularizers import l2
+from keras.models import Model
+
+
+
+
+def resnet_layer(inputs,
+ num_filters=16,
+ kernel_size=3,
+ strides=1,
+ activation='relu',
+ batch_normalization=True,
+ conv_first=True):
+ """2D Convolution-Batch Normalization-Activation stack builder
+ # Arguments
+ inputs (tensor): input tensor from input image or previous layer
+ num_filters (int): Conv2D number of filters
+ kernel_size (int): Conv2D square kernel dimensions
+ strides (int): Conv2D square stride dimensions
+ activation (string): activation name
+ batch_normalization (bool): whether to include batch normalization
+ conv_first (bool): conv-bn-activation (True) or
+ bn-activation-conv (False)
+ # Returns
+ x (tensor): tensor as input to the next layer
+ """
+ conv = Conv2D(
+ num_filters,
+ kernel_size=kernel_size,
+ strides=strides,
+ padding='same',
+ kernel_initializer='he_normal',
+ kernel_regularizer=l2(1e-4))
+
+ x = inputs
+ if conv_first:
+ x = conv(x)
+ if batch_normalization:
+ x = BatchNormalization()(x)
+ if activation is not None:
+ x = Activation(activation)(x)
+ else:
+ if batch_normalization:
+ x = BatchNormalization()(x)
+ if activation is not None:
+ x = Activation(activation)(x)
+ x = conv(x)
+ return x
+
+
+def resnet_v1(immediate_input, input, depth, num_classes=10, num_dims=64, use_BN=True, use_dense=True, use_leaky=False):
+ """ResNet Version 1 Model builder [a]
+ Stacks of 2 x (3 x 3) Conv2D-BN-ReLU
+ Last ReLU is after the shortcut connection.
+ At the beginning of each stage, the feature map size is halved (downsampled)
+ by a convolutional layer with strides=2, while the number of filters is
+ doubled. Within each stage, the layers have the same number filters and the
+ same number of filters.
+ Features maps sizes:
+ stage 0: 32x32, 16
+ stage 1: 16x16, 32
+ stage 2: 8x8, 64
+ The Number of parameters is approx the same as Table 6 of [a]:
+ ResNet20 0.27M
+ ResNet32 0.46M
+ ResNet44 0.66M
+ ResNet56 0.85M
+ ResNet110 1.7M
+ # Arguments
+ input_shape (tensor): shape of input image tensor
+ depth (int): number of core convolutional layers
+ num_classes (int): number of classes (CIFAR10 has 10)
+ # Returns
+ model (Model): Keras model instance
+ """
+ if (depth - 2) % 6 != 0:
+ raise ValueError('depth should be 6n+2 (eg 20, 32, 44 in [a])')
+ # Start model definition.
+ num_filters = 16
+ num_res_blocks = int((depth - 2) / 6)
+
+ inputs = immediate_input
+ x = resnet_layer(inputs=inputs, batch_normalization=use_BN)
+ # Instantiate the stack of residual units
+ for stack in range(3):
+ for res_block in range(num_res_blocks):
+ strides = 1
+ if stack > 0 and res_block == 0: # first layer but not first stack
+ strides = 2 # downsample
+ y = resnet_layer(inputs=x, num_filters=num_filters, strides=strides, batch_normalization=use_BN)
+ y = resnet_layer(inputs=y, num_filters=num_filters, activation=None, batch_normalization=use_BN)
+ if stack > 0 and res_block == 0: # first layer but not first stack
+ # linear projection residual shortcut connection to match
+ # changed dims
+ x = resnet_layer(
+ inputs=x,
+ num_filters=num_filters,
+ kernel_size=1,
+ strides=strides,
+ activation=None,
+ batch_normalization=False)
+ x = keras.layers.add([x, y])
+ if use_leaky==True:
+ x = keras.layers.LeakyReLU(alpha=0.1)(x)
+ else:
+ x = Activation('relu')(x)
+ num_filters *= 2
+
+ # Add classifier on top.
+ # v1 does not use BN after last shortcut connection-ReLU
+ x = GlobalAveragePooling2D()(x)
+ #final_features = Flatten()(x)
+ if use_dense==True:
+ final_features = Dense(
+ num_dims, kernel_initializer='he_normal')(x)
+ else:
+ final_features = x
+ logits = Dense(
+ num_classes, kernel_initializer='he_normal')(final_features)
+ outputs = Activation('softmax')(logits)
+
+ # Instantiate model.
+ model = Model(inputs=inputs, outputs=outputs)
+ return model, inputs, outputs, logits, final_features
+
+
+def resnet_v2(immediate_input, input, depth, num_classes=10, num_dims=256, use_BN=True, use_dense=True, use_leaky=False):
+ """ResNet Version 2 Model builder [b]
+ Stacks of (1 x 1)-(3 x 3)-(1 x 1) BN-ReLU-Conv2D or also known as
+ bottleneck layer
+ First shortcut connection per layer is 1 x 1 Conv2D.
+ Second and onwards shortcut connection is identity.
+ At the beginning of each stage, the feature map size is halved (downsampled)
+ by a convolutional layer with strides=2, while the number of filter maps is
+ doubled. Within each stage, the layers have the same number filters and the
+ same filter map sizes.
+ Features maps sizes:
+ conv1 : 32x32, 16
+ stage 0: 32x32, 64
+ stage 1: 16x16, 128
+ stage 2: 8x8, 256
+ # Arguments
+ input_shape (tensor): shape of input image tensor
+ depth (int): number of core convolutional layers
+ num_classes (int): number of classes (CIFAR10 has 10)
+ # Returns
+ model (Model): Keras model instance
+ """
+ if (depth - 2) % 9 != 0:
+ raise ValueError('depth should be 9n+2 (eg 56 or 110 in [b])')
+ # Start model definition.
+ num_filters_in = 16
+ num_res_blocks = int((depth - 2) / 9)
+
+ inputs = immediate_input
+ # v2 performs Conv2D with BN-ReLU on input before splitting into 2 paths
+ x = resnet_layer(inputs=inputs, num_filters=num_filters_in, conv_first=True, batch_normalization=use_BN)
+
+ # Instantiate the stack of residual units
+ for stage in range(3):
+ for res_block in range(num_res_blocks):
+ activation = 'relu'
+ batch_normalization = use_BN
+ strides = 1
+ if stage == 0:
+ num_filters_out = num_filters_in * 4
+ if res_block == 0: # first layer and first stage
+ activation = None
+ batch_normalization = False
+ else:
+ num_filters_out = num_filters_in * 2
+ if res_block == 0: # first layer but not first stage
+ strides = 2 # downsample
+
+ # bottleneck residual unit
+ y = resnet_layer(
+ inputs=x,
+ num_filters=num_filters_in,
+ kernel_size=1,
+ strides=strides,
+ activation=activation,
+ batch_normalization=batch_normalization,
+ conv_first=False)
+ y = resnet_layer(
+ inputs=y, num_filters=num_filters_in, conv_first=False, batch_normalization=use_BN)
+ y = resnet_layer(
+ inputs=y,
+ num_filters=num_filters_out,
+ kernel_size=1,
+ conv_first=False, batch_normalization=use_BN)
+ if res_block == 0:
+ # linear projection residual shortcut connection to match
+ # changed dims
+ x = resnet_layer(
+ inputs=x,
+ num_filters=num_filters_out,
+ kernel_size=1,
+ strides=strides,
+ activation=None,
+ batch_normalization=False)
+ x = keras.layers.add([x, y])
+
+ num_filters_in = num_filters_out
+
+ # Add classifier on top.
+ # v2 has BN-ReLU before Pooling
+ if use_BN:
+ x = BatchNormalization()(x)
+
+ if use_leaky==True:
+ x = keras.layers.LeakyReLU(alpha=0.1)(x)
+ else:
+ x = Activation('relu')(x)
+
+ x = GlobalAveragePooling2D()(x)
+ #final_features = Flatten()(x)
+ if use_dense==True:
+ final_features = Dense(
+ num_dims, kernel_initializer='he_normal')(x)
+ else:
+ final_features = x
+ logits = Dense(
+ num_classes, kernel_initializer='he_normal')(final_features)
+ outputs = Activation('softmax')(logits)
+ # Instantiate model.
+ model = Model(inputs=input, outputs=outputs)
+ return model, input, outputs, logits, final_features
\ No newline at end of file
diff --git a/case_studies/mmt/mmt_utils/utils_model_eval.py b/case_studies/mmt/mmt_utils/utils_model_eval.py
new file mode 100644
index 0000000..a5488de
--- /dev/null
+++ b/case_studies/mmt/mmt_utils/utils_model_eval.py
@@ -0,0 +1,334 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from distutils.version import LooseVersion
+import logging
+import math
+
+
+import numpy as np
+
+import tensorflow as tf
+from cleverhans.utils import batch_indices, _ArgsWrapper, create_logger
+
+_logger = create_logger("cleverhans.utils.tf")
+_logger.setLevel(logging.INFO)
+
+zero = tf.constant(0, dtype=tf.float32)
+num_classes = 10
+log_offset = 1e-20
+det_offset = 1e-6
+
+def ensemble_diversity(y_true, y_pred, num_model):
+ bool_R_y_true = tf.not_equal(tf.ones_like(y_true) - y_true, zero) # batch_size X (num_class X num_models), 2-D
+ mask_non_y_pred = tf.boolean_mask(y_pred, bool_R_y_true) # batch_size X (num_class-1) X num_models, 1-D
+ mask_non_y_pred = tf.reshape(mask_non_y_pred, [-1, num_model, num_classes-1]) # batch_size X num_model X (num_class-1), 3-D
+ mask_non_y_pred = mask_non_y_pred / tf.norm(mask_non_y_pred, axis=2, keepdims=True) # batch_size X num_model X (num_class-1), 3-D
+ matrix = tf.matmul(mask_non_y_pred, tf.transpose(mask_non_y_pred, perm=[0, 2, 1])) # batch_size X num_model X num_model, 3-D
+ all_log_det = tf.linalg.logdet(matrix+det_offset*tf.expand_dims(tf.eye(num_model),0)) # batch_size X 1, 1-D
+ return all_log_det
+
+def model_eval_targetacc(sess, x, y, y_target, predictions, X_test=None, Y_test=None, Y_test_target=None,
+ feed=None, args=None):
+ """
+ Compute the accuracy of a TF model on some data
+ :param sess: TF session to use
+ :param x: input placeholder
+ :param y: output placeholder (for labels)
+ :param predictions: model output predictions
+ :param X_test: numpy array with training inputs
+ :param Y_test: numpy array with training outputs
+ :param feed: An optional dictionary that is appended to the feeding
+ dictionary before the session runs. Can be used to feed
+ the learning phase of a Keras model for instance.
+ :param args: dict or argparse `Namespace` object.
+ Should contain `batch_size`
+ :return: a float with the accuracy value
+ """
+ args = _ArgsWrapper(args or {})
+
+ assert args.batch_size, "Batch size was not given in args dict"
+ if X_test is None or Y_test_target is None or Y_test is None:
+ raise ValueError("X_test argument and Y_test argument and Y_test_target argument"
+ "must be supplied.")
+
+ # Define accuracy symbolically
+ if LooseVersion(tf.__version__) >= LooseVersion('1.0.0'):
+ correct_preds = tf.equal(tf.argmax(y, axis=-1),
+ tf.argmax(predictions, axis=-1))
+ else:
+ correct_preds = tf.equal(tf.argmax(y, axis=tf.rank(y) - 1),
+ tf.argmax(predictions,
+ axis=tf.rank(predictions) - 1))
+
+ # Init result var
+ accuracy = 0.0
+
+ with sess.as_default():
+ # Compute number of batches
+ nb_batches = int(math.ceil(float(len(X_test)) / args.batch_size))
+ assert nb_batches * args.batch_size >= len(X_test)
+
+ X_cur = np.zeros((args.batch_size,) + X_test.shape[1:],
+ dtype=X_test.dtype)
+ Y_cur = np.zeros((args.batch_size,) + Y_test.shape[1:],
+ dtype=Y_test.dtype)
+ Y_cur_target = np.zeros((args.batch_size,) + Y_test_target.shape[1:],
+ dtype=Y_test_target.dtype)
+ for batch in range(nb_batches):
+ if batch % 100 == 0 and batch > 0:
+ _logger.debug("Batch " + str(batch))
+
+ # Must not use the `batch_indices` function here, because it
+ # repeats some examples.
+ # It's acceptable to repeat during training, but not eval.
+ start = batch * args.batch_size
+ end = min(len(X_test), start + args.batch_size)
+
+ # The last batch may be smaller than all others. This should not
+ # affect the accuarcy disproportionately.
+ cur_batch_size = end - start
+ X_cur[:cur_batch_size] = X_test[start:end]
+ Y_cur[:cur_batch_size] = Y_test[start:end]
+ Y_cur_target[:cur_batch_size] = Y_test_target[start:end]
+ feed_dict = {x: X_cur, y: Y_cur, y_target: Y_cur_target}
+ if feed is not None:
+ feed_dict.update(feed)
+ cur_corr_preds = correct_preds.eval(feed_dict=feed_dict)
+
+ accuracy += cur_corr_preds[:cur_batch_size].sum()
+
+ assert end >= len(X_test)
+
+ # Divide by number of examples to get final value
+ accuracy /= len(X_test)
+
+ return accuracy
+
+
+def model_eval_for_SPSA_targetacc(sess, x, y, y_index, y_target, predictions, X_test=None, Y_test_index=None, Y_test=None, Y_test_target=None,
+ feed=None, args=None):
+ """
+ Compute the accuracy of a TF model on some data
+ :param sess: TF session to use
+ :param x: input placeholder
+ :param y: output placeholder (for labels)
+ :param predictions: model output predictions
+ :param X_test: numpy array with training inputs
+ :param Y_test: numpy array with training outputs
+ :param feed: An optional dictionary that is appended to the feeding
+ dictionary before the session runs. Can be used to feed
+ the learning phase of a Keras model for instance.
+ :param args: dict or argparse `Namespace` object.
+ Should contain `batch_size`
+ :return: a float with the accuracy value
+ """
+ args = _ArgsWrapper(args or {})
+
+ assert args.batch_size, "Batch size was not given in args dict"
+ if X_test is None or Y_test is None or Y_test_index is None:
+ raise ValueError("X_test argument and Y_test and Y_test_index argument "
+ "must be supplied.")
+
+ # Define accuracy symbolically
+ if LooseVersion(tf.__version__) >= LooseVersion('1.0.0'):
+ correct_preds = tf.equal(tf.argmax(y, axis=-1),
+ tf.argmax(predictions, axis=-1))
+ else:
+ correct_preds = tf.equal(tf.argmax(y, axis=tf.rank(y) - 1),
+ tf.argmax(predictions,
+ axis=tf.rank(predictions) - 1))
+
+ # Init result var
+ accuracy = 0.0
+
+ with sess.as_default():
+ # Compute number of batches
+ nb_batches = int(math.ceil(float(len(X_test)) / args.batch_size))
+ assert nb_batches * args.batch_size >= len(X_test)
+
+ X_cur = np.zeros((args.batch_size,) + X_test.shape[1:],
+ dtype=X_test.dtype)
+ Y_cur = np.zeros((args.batch_size,) + Y_test.shape[1:],
+ dtype=Y_test.dtype)
+ Y_cur_target = np.zeros((args.batch_size,) + Y_test_target.shape[1:],
+ dtype=Y_test_target.dtype)
+ for batch in range(nb_batches):
+ print('Sample %d finished'%batch)
+
+ # Must not use the `batch_indices` function here, because it
+ # repeats some examples.
+ # It's acceptable to repeat during training, but not eval.
+ start = batch * args.batch_size
+ end = min(len(X_test), start + args.batch_size)
+
+ # The last batch may be smaller than all others. This should not
+ # affect the accuarcy disproportionately.
+ cur_batch_size = end - start
+ X_cur[:cur_batch_size] = X_test[start:end]
+ Y_cur[:cur_batch_size] = Y_test[start:end]
+ #Y_cur_target[:cur_batch_size] = Y_test_target[start:end]
+ feed_dict = {x: X_cur, y: Y_cur, y_index: Y_test_index[start], y_target: Y_test_target[start]}
+ if feed is not None:
+ feed_dict.update(feed)
+ cur_corr_preds = correct_preds.eval(feed_dict=feed_dict)
+
+ accuracy += cur_corr_preds[:cur_batch_size].sum()
+
+ assert end >= len(X_test)
+
+ # Divide by number of examples to get final value
+ accuracy /= len(X_test)
+
+ return accuracy
+
+def model_eval_for_SPSA(sess, x, y, y_index, predictions, X_test=None, Y_test_index=None, Y_test=None,
+ feed=None, args=None):
+ """
+ Compute the accuracy of a TF model on some data
+ :param sess: TF session to use
+ :param x: input placeholder
+ :param y: output placeholder (for labels)
+ :param predictions: model output predictions
+ :param X_test: numpy array with training inputs
+ :param Y_test: numpy array with training outputs
+ :param feed: An optional dictionary that is appended to the feeding
+ dictionary before the session runs. Can be used to feed
+ the learning phase of a Keras model for instance.
+ :param args: dict or argparse `Namespace` object.
+ Should contain `batch_size`
+ :return: a float with the accuracy value
+ """
+ args = _ArgsWrapper(args or {})
+
+ assert args.batch_size, "Batch size was not given in args dict"
+ if X_test is None or Y_test is None or Y_test_index is None:
+ raise ValueError("X_test argument and Y_test and Y_test_index argument "
+ "must be supplied.")
+
+ # Define accuracy symbolically
+ if LooseVersion(tf.__version__) >= LooseVersion('1.0.0'):
+ correct_preds = tf.equal(tf.argmax(y, axis=-1),
+ tf.argmax(predictions, axis=-1))
+ else:
+ correct_preds = tf.equal(tf.argmax(y, axis=tf.rank(y) - 1),
+ tf.argmax(predictions,
+ axis=tf.rank(predictions) - 1))
+
+ # Init result var
+ accuracy = 0.0
+
+ with sess.as_default():
+ # Compute number of batches
+ nb_batches = int(math.ceil(float(len(X_test)) / args.batch_size))
+ assert nb_batches * args.batch_size >= len(X_test)
+
+ X_cur = np.zeros((args.batch_size,) + X_test.shape[1:],
+ dtype=X_test.dtype)
+ Y_cur = np.zeros((args.batch_size,) + Y_test.shape[1:],
+ dtype=Y_test.dtype)
+ for batch in range(nb_batches):
+ print('Sample %d finished'%batch)
+
+ # Must not use the `batch_indices` function here, because it
+ # repeats some examples.
+ # It's acceptable to repeat during training, but not eval.
+ start = batch * args.batch_size
+ end = min(len(X_test), start + args.batch_size)
+
+ # The last batch may be smaller than all others. This should not
+ # affect the accuarcy disproportionately.
+ cur_batch_size = end - start
+ X_cur[:cur_batch_size] = X_test[start:end]
+ Y_cur[:cur_batch_size] = Y_test[start:end]
+ #Y_cur_target[:cur_batch_size] = Y_test_target[start:end]
+ feed_dict = {x: X_cur, y: Y_cur, y_index: Y_test_index[start]}
+ if feed is not None:
+ feed_dict.update(feed)
+ cur_corr_preds = correct_preds.eval(feed_dict=feed_dict)
+
+ accuracy += cur_corr_preds[:cur_batch_size].sum()
+
+ assert end >= len(X_test)
+
+ # Divide by number of examples to get final value
+ accuracy /= len(X_test)
+
+ return accuracy
+
+def get_ensemble_diversity_values(sess, x, y, predictions, number_model, X_test=None, Y_test=None,
+ feed=None, args=None):
+ """
+ Compute the accuracy of a TF model on some data
+ :param sess: TF session to use
+ :param x: input placeholder
+ :param y: output placeholder (for labels)
+ :param predictions: model output predictions
+ :param X_test: numpy array with training inputs
+ :param Y_test: numpy array with training outputs
+ :param feed: An optional dictionary that is appended to the feeding
+ dictionary before the session runs. Can be used to feed
+ the learning phase of a Keras model for instance.
+ :param args: dict or argparse `Namespace` object.
+ Should contain `batch_size`
+ :return: a float with the accuracy value
+ """
+ args = _ArgsWrapper(args or {})
+
+ assert args.batch_size, "Batch size was not given in args dict"
+ if X_test is None or Y_test is None:
+ raise ValueError("X_test argument and Y_test argument"
+ "must be supplied.")
+
+ ensemble_diversity_records = np.array([])
+ get_batch_ensemble_diversity = ensemble_diversity(y, predictions, number_model)
+ with sess.as_default():
+ # Compute number of batches
+ nb_batches = int(math.ceil(float(len(X_test)) / args.batch_size))
+ assert nb_batches * args.batch_size >= len(X_test)
+
+ X_cur = np.zeros((args.batch_size,) + X_test.shape[1:],
+ dtype=X_test.dtype)
+ Y_cur = np.zeros((args.batch_size,) + Y_test.shape[1:],
+ dtype=Y_test.dtype)
+ for batch in range(nb_batches):
+ if batch % 100 == 0 and batch > 0:
+ _logger.debug("Batch " + str(batch))
+
+ # Must not use the `batch_indices` function here, because it
+ # repeats some examples.
+ # It's acceptable to repeat during training, but not eval.
+ start = batch * args.batch_size
+ end = min(len(X_test), start + args.batch_size)
+
+ # The last batch may be smaller than all others. This should not
+ # affect the accuarcy disproportionately.
+ cur_batch_size = end - start
+ X_cur[:cur_batch_size] = X_test[start:end]
+ Y_cur[:cur_batch_size] = Y_test[start:end]
+ feed_dict = {x: X_cur, y: Y_cur}
+ if feed is not None:
+ feed_dict.update(feed)
+ ensemble_diversity_records_batch = get_batch_ensemble_diversity.eval(feed_dict=feed_dict)
+
+ ensemble_diversity_records = np.concatenate((ensemble_diversity_records, ensemble_diversity_records_batch), axis=0)
+
+ assert end >= len(X_test)
+
+ return ensemble_diversity_records #len(X_test) X 1
\ No newline at end of file
diff --git a/case_studies/mmt/requirements.txt b/case_studies/mmt/requirements.txt
new file mode 100644
index 0000000..fea6967
--- /dev/null
+++ b/case_studies/mmt/requirements.txt
@@ -0,0 +1,153 @@
+absl-py==0.2.0
+ansible==2.0.0.2
+astor==0.6.2
+attrs==15.2.0
+backports-abc==0.5
+backports.functools-lru-cache==1.5
+backports.shutil-get-terminal-size==1.0.0
+backports.weakref==1.0.post1
+bleach==1.5.0
+blessings==1.6.1
+certifi==2018.10.15
+chardet==3.0.4
+cleverhans==2.1.0
+Click==7.0
+cloudpickle==0.6.1
+configobj==5.0.6
+configparser==3.5.0
+cryptography==1.2.3
+cycler==0.10.0
+Cython==0.29.3
+dask==1.1.0
+decorator==4.3.0
+defusedxml==0.5.0
+ecdsa==0.13
+entrypoints==0.3
+enum34==1.1.6
+Flask==1.0.2
+funcsigs==1.0.2
+functools32==3.2.3.post2
+futures==3.2.0
+gast==0.2.0
+gpustat==0.4.1
+grpcio==1.11.0
+gyp==0.1
+h5py==2.8.0
+html5lib==0.9999999
+httplib2==0.9.1
+idna==2.7
+ImageHash==4.0
+imageio==2.4.1
+imgaug==0.2.7
+iotop==0.6
+ipaddress==1.0.16
+ipykernel==4.10.0
+ipython==5.8.0
+ipython-genutils==0.2.0
+ipywidgets==7.4.2
+itsdangerous==1.1.0
+Jinja2==2.10
+jsonschema==2.6.0
+jupyter==1.0.0
+jupyter-client==5.2.4
+jupyter-console==5.2.0
+jupyter-core==4.4.0
+kaggle==1.5.1.1
+Keras==2.2.4
+Keras-Applications==1.0.6
+Keras-Preprocessing==1.0.5
+keras-tqdm==2.0.1
+kiwisolver==1.0.1
+Landscape-Client==16.3+bzr834
+lap==0.4.0
+Mako==1.0.3
+Markdown==2.6.11
+MarkupSafe==1.1.0
+matplotlib==2.2.3
+mistune==0.8.4
+mnist==0.2.2
+mock==2.0.0
+nbconvert==5.4.0
+nbformat==4.4.0
+netaddr==0.7.18
+networkx==2.2
+nose==1.3.7
+notebook==5.7.4
+numexpr==2.6.9
+numpy==1.14.3
+nvidia-ml-py==375.53.1
+ofed-le-utils==1.0.3
+opencv-python==4.0.0.21
+PAM==0.4.2
+pandas==0.23.4
+pandocfilters==1.4.2
+paramiko==1.16.0
+pathlib2==2.3.3
+pbr==4.0.2
+pexpect==4.0.1
+pickleshare==0.7.5
+Pillow==5.4.1
+pkg-resources==0.0.0
+prometheus-client==0.5.0
+prompt-toolkit==1.0.15
+protobuf==3.6.1
+psutil==5.4.3
+ptyprocess==0.5
+PuLP==1.6.8
+pyasn1==0.1.9
+pyasn1-modules==0.0.7
+pycodestyle==2.4.0
+pycrypto==2.6.1
+pycups==1.9.73
+pycurl==7.43.0
+Pygments==2.3.1
+pygobject==3.20.0
+PyMySQL==0.7.2
+PyOpenGL==3.0.2
+pyOpenSSL==0.15.1
+pyparsing==2.3.1
+pyserial==3.0.1
+pysmbc==1.0.15.5
+Pyste==0.9.10
+python-apt==1.1.0b1+ubuntu0.16.4.2
+python-dateutil==2.7.3
+python-slugify==2.0.1
+pytz==2018.7
+PyWavelets==1.0.1
+PyYAML==3.13
+pyzmq==17.1.2
+qtconsole==4.4.3
+requests==2.20.0
+scandir==1.9.0
+scikit-image==0.13.0
+scikit-learn==0.20.2
+scipy==0.17.0
+seaborn==0.9.0
+Send2Trash==1.5.0
+service-identity==16.0.0
+Shapely==1.6.4.post2
+simplegeneric==0.8.1
+singledispatch==3.4.0.3
+six==1.10.0
+sklearn==0.0
+subprocess32==3.5.3
+tables==3.4.4
+tensorboard==1.9.0
+tensorflow-gpu==1.9.0
+tensorflow-hub==0.2.0
+termcolor==1.1.0
+terminado==0.8.1
+testpath==0.4.2
+toolz==0.9.0
+tornado==5.1.1
+tqdm==4.29.1
+traitlets==4.3.2
+trash-cli==0.12.9.14
+Twisted==16.0.0
+Unidecode==1.0.23
+urllib3==1.22
+virtualenv==15.0.1
+wcwidth==0.1.7
+Werkzeug==0.14.1
+widgetsnbextension==3.4.2
+zope.interface==4.1.3
diff --git a/case_studies/mmt/train.py b/case_studies/mmt/train.py
new file mode 100644
index 0000000..f42169f
--- /dev/null
+++ b/case_studies/mmt/train.py
@@ -0,0 +1,255 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import print_function
+import keras
+from keras.layers import Dense, Conv2D, BatchNormalization, Activation
+from keras.layers import AveragePooling2D, Input, Flatten, Lambda
+from keras.optimizers import Adam, SGD
+from keras.callbacks import ModelCheckpoint, LearningRateScheduler, ReduceLROnPlateau
+from keras.callbacks import ReduceLROnPlateau
+from keras.preprocessing.image import ImageDataGenerator
+from keras.regularizers import l2
+from keras import backend as K
+from keras.models import Model
+from keras.datasets import mnist, cifar10, cifar100
+import tensorflow as tf
+import numpy as np
+import os
+from scipy.io import loadmat
+import math
+from utils.model import resnet_v1, resnet_v2
+
+
+FLAGS = tf.app.flags.FLAGS
+
+tf.app.flags.DEFINE_integer('batch_size', 64, '')
+tf.app.flags.DEFINE_float('mean_var', 10, 'parameter in MMLDA')
+tf.app.flags.DEFINE_string('optimizer', 'mom', '')
+tf.app.flags.DEFINE_integer('version', 1, '')
+tf.app.flags.DEFINE_float('lr', 0.01, 'initial lr')
+tf.app.flags.DEFINE_integer('feature_dim', 256, '')
+tf.app.flags.DEFINE_bool('is_2d_demo', False, 'whether is a 2d demo on MNIST')
+tf.app.flags.DEFINE_bool('use_ball', True, 'whether use ball loss or softmax')
+tf.app.flags.DEFINE_bool('use_MMLDA', True, 'whether use MMLDA or softmax')
+tf.app.flags.DEFINE_bool('use_BN', True, 'whether use batch normalization in the network')
+tf.app.flags.DEFINE_bool('use_random', False, 'whether use random center or MMLDA center in the network')
+tf.app.flags.DEFINE_bool('use_dense', True, 'whether use extra dense layer in the network')
+tf.app.flags.DEFINE_bool('use_leaky', False, 'whether use leaky relu in the network')
+tf.app.flags.DEFINE_string('dataset', 'mnist', '')
+
+
+
+random_seed = '' # '' or '2' or '3'
+# Load the dataset
+if FLAGS.dataset=='mnist':
+ (x_train, y_train), (x_test, y_test) = mnist.load_data()
+ x_train = np.repeat(np.expand_dims(x_train, axis=3), 3, axis=3)
+ x_test = np.repeat(np.expand_dims(x_test, axis=3), 3, axis=3)
+ epochs = 50
+ num_class = 10
+ epochs_inter = [30,40]
+elif FLAGS.dataset=='cifar10':
+ (x_train, y_train), (x_test, y_test) = cifar10.load_data()
+ epochs = 200
+ num_class = 10
+ epochs_inter = [100,150]
+elif FLAGS.dataset=='cifar100':
+ (x_train, y_train), (x_test, y_test) = cifar100.load_data()
+ epochs = 200
+ num_class = 100
+ epochs_inter = [100,150]
+else:
+ print('Unknown dataset')
+
+
+# Training parameters
+subtract_pixel_mean = True
+version = FLAGS.version # Model version
+n = 5 # n=5 for resnet-32 v1
+
+# Computed depth from supplied model parameter n
+if version == 1:
+ depth = n * 6 + 2
+ feature_dim = 64
+elif version == 2:
+ depth = n * 9 + 2
+ feature_dim = FLAGS.feature_dim
+
+if FLAGS.use_random==True:
+ name_random = '_random'
+ random_seed = '2'
+else:
+ name_random = ''
+
+if FLAGS.use_leaky==True:
+ name_leaky = '_withleaky'
+else:
+ name_leaky = ''
+
+if FLAGS.use_dense==True:
+ name_dense = ''
+else:
+ name_dense = '_nodense'
+
+if FLAGS.is_2d_demo==True:
+ is_2d_demo = '_demoMNIST'
+else:
+ is_2d_demo = ''
+
+
+#Load centers in MMC
+kernel_dict = loadmat('kernel_paras/meanvar1_featuredim'+str(feature_dim)+'_class'+str(num_class)+'.mat')
+mean_logits_np = kernel_dict['mean_logits'] #num_class X num_dense
+mean_logits = FLAGS.mean_var * tf.constant(mean_logits_np,dtype=tf.float32)
+
+# Input image dimensions.
+input_shape = x_train.shape[1:]
+
+# Normalize data.
+x_train = x_train.astype('float32') / 255
+x_test = x_test.astype('float32') / 255
+
+# If subtract pixel mean is enabled
+if subtract_pixel_mean:
+ x_train_mean = np.mean(x_train, axis=0)
+ x_train -= x_train_mean
+ x_test -= x_train_mean
+
+# Convert class vectors to binary class matrices.
+y_train = keras.utils.to_categorical(y_train, num_class)
+y_test = keras.utils.to_categorical(y_test, num_class)
+
+
+def dot_loss(y_true, y_pred):
+ return - tf.reduce_sum(y_pred * y_true, axis=-1) #batch_size X 1
+
+#MMLDA prediction function
+def MMLDA_layer(x, means=mean_logits, num_class=num_class, use_ball=FLAGS.use_ball):
+ #x_shape = batch_size X num_dense
+ x_expand = tf.tile(tf.expand_dims(x,axis=1),[1,num_class,1]) #batch_size X num_class X num_dense
+ mean_expand = tf.expand_dims(means,axis=0) #1 X num_class X num_dense
+ logits = -tf.reduce_sum(tf.square(x_expand - mean_expand), axis=-1) #batch_size X num_class
+ if use_ball==True:
+ return logits
+ else:
+ logits = logits - tf.reduce_max(logits, axis=-1, keepdims=True) #Avoid numerical rounding
+ logits = logits - tf.log(tf.reduce_sum(tf.exp(logits), axis=-1, keepdims=True)) #Avoid numerical rounding
+ return logits
+
+def lr_schedule(epoch):
+ lr = FLAGS.lr
+ if epoch > epochs_inter[1]:
+ lr *= 1e-2
+ elif epoch > epochs_inter[0]:
+ lr *= 1e-1
+ print('Learning rate: ', lr)
+ return lr
+
+model_input = Input(shape=input_shape)
+
+#dim of logtis is batchsize x dim_means
+if version == 2:
+ original_model,_,_,_,final_features = resnet_v2(input=model_input, depth=depth, num_classes=num_class, num_dims=feature_dim, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+else:
+ original_model,_,_,_,final_features = resnet_v1(input=model_input, depth=depth, num_classes=num_class, \
+ use_BN=FLAGS.use_BN, use_dense=FLAGS.use_dense, use_leaky=FLAGS.use_leaky)
+
+if FLAGS.use_BN==True:
+ BN_name = '_withBN'
+ print('Use BN in the model')
+else:
+ BN_name = '_noBN'
+ print('Do not use BN in the model')
+
+if FLAGS.use_MMLDA==True:
+ print('Using MM Training Scheme')
+ new_layer = Lambda(MMLDA_layer)
+ predictions = new_layer(final_features)
+ model = Model(input=model_input, output=predictions)
+ use_ball_=''
+ train_loss = dot_loss
+ if FLAGS.use_ball==False:
+ print('Using softmax function (MMLDA)')
+ use_ball_='_softmax'
+ filepath_dir = 'trained_models/'+FLAGS.dataset+'/resnet32v'+str(version)+'_meanvar'+str(FLAGS.mean_var) \
+ +'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size) \
+ +BN_name+name_leaky+name_dense+name_random+random_seed+use_ball_+is_2d_demo
+else:
+ print('Using softmax loss')
+ model = original_model
+ train_loss = keras.losses.categorical_crossentropy
+ filepath_dir = 'trained_models/'+FLAGS.dataset+'/resnet32v'+str(version)+'_'+FLAGS.optimizer \
+ +'_lr'+str(FLAGS.lr) \
+ +'_batchsize'+str(FLAGS.batch_size)+BN_name+name_leaky
+
+if FLAGS.optimizer=='Adam':
+ model.compile(
+ loss=train_loss,
+ optimizer=Adam(lr=lr_schedule(0)),
+ metrics=['accuracy'])
+elif FLAGS.optimizer=='mom':
+ model.compile(
+ loss=train_loss,
+ optimizer=SGD(lr=lr_schedule(0), momentum=0.9),
+ metrics=['accuracy'])
+model.summary()
+
+
+# Prepare model model saving directory.
+save_dir = os.path.join(os.getcwd(), filepath_dir)
+model_name = 'model.{epoch:03d}.h5'
+if not os.path.isdir(save_dir):
+ os.makedirs(save_dir)
+filepath = os.path.join(save_dir, model_name)
+
+# Prepare callbacks for model saving and for learning rate adjustment.
+checkpoint = ModelCheckpoint(
+ filepath=filepath, monitor='val_loss', mode='min', verbose=2, save_best_only=False, save_weights_only=True, period=5)
+
+lr_scheduler = LearningRateScheduler(lr_schedule)
+
+
+callbacks = [checkpoint, lr_scheduler]
+
+
+# Run training, with data augmentation.
+print('Using real-time data augmentation.')
+# This will do preprocessing and realtime data augmentation:
+datagen = ImageDataGenerator(
+ # epsilon for ZCA whitening
+ zca_epsilon=1e-06,
+ # randomly shift images horizontally
+ width_shift_range=0.1,
+ # randomly shift images vertically
+ height_shift_range=0.1,
+ # set mode for filling points outside the input boundaries
+ fill_mode='nearest',
+ # randomly flip images
+ horizontal_flip=True)
+
+# Compute quantities required for featurewise normalization
+datagen.fit(x_train)
+
+# Fit the model on the batches generated by datagen.flow().
+model.fit_generator(
+ datagen.flow(x_train, y_train, batch_size=FLAGS.batch_size),
+ validation_data=(x_test, y_test),
+ epochs=epochs,
+ verbose=2,
+ workers=4,
+ callbacks=callbacks)
diff --git a/case_studies/odds/original/README.txt b/case_studies/odds/original/README.txt
new file mode 100644
index 0000000..e603fab
--- /dev/null
+++ b/case_studies/odds/original/README.txt
@@ -0,0 +1,7 @@
+Note: The default parameter settings in this repository, specifically the number of samples and types of noise used to generate statistics, are meant as a quick proof-of-concept to run on minimal hardware. To achieve higher robustness to stronger attacks, it is necessary to increase these parameters.
+
+The code of our method is in tf_robustify. It works with both pytorch and tensorflow.
+Two scripts are provided: tensorflow_example.py and torch_example.py.
+The torch example is the easiest, as it can just be run and will fetch both data as well as model by itself.
+For the tensorflow example, use fetch_Madry_ResNet.py to fetch the models and place them in the appropriate ckpt_dir (parameter of tensorflow_example.py).
+
diff --git a/case_studies/odds/original/__init__.py b/case_studies/odds/original/__init__.py
new file mode 100644
index 0000000..6cf2daf
--- /dev/null
+++ b/case_studies/odds/original/__init__.py
@@ -0,0 +1,14 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
diff --git a/case_studies/odds/original/adversarial_evaluation.py b/case_studies/odds/original/adversarial_evaluation.py
new file mode 100644
index 0000000..58689ad
--- /dev/null
+++ b/case_studies/odds/original/adversarial_evaluation.py
@@ -0,0 +1,359 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import functools
+
+import cleverhans.model
+import torch
+from cleverhans import utils_tf
+from cleverhans.attacks import Attack
+import cleverhans.attacks
+from cleverhans.utils_tf import clip_eta
+
+# disable tf logging
+# some of these might have to be commented out to use verbose=True in the
+# adaptive attack
+import warnings
+import logging
+
+logging.getLogger('tensorflow').setLevel(logging.FATAL)
+import tensorflow as tf
+
+tf.logging.set_verbosity(tf.logging.ERROR)
+
+import os
+import math
+import numpy as np
+import tensorflow as tf
+
+from cleverhans.attacks import MadryEtAl
+from cleverhans.dataset import CIFAR10
+from cleverhans.model_zoo.madry_lab_challenges.cifar10_model import \
+ make_wresnet as ResNet
+from cleverhans.utils_tf import initialize_uninitialized_global_variables
+
+import tf_robustify
+from cleverhans.augmentation import random_horizontal_flip, random_shift
+
+from logit_matching_attack import \
+ ProjectedGradientDescentWithDetectorLogitMatching
+
+
+def init_defense(sess, x, preds, batch_size, multi_noise=False):
+ data = CIFAR10()
+
+ if multi_noise:
+ defense_data_path = os.path.join("checkpoints/tf_madry_wrn_vanilla",
+ "defense_alignment_data_multi_noise")
+ else:
+ defense_data_path = os.path.join("checkpoints/tf_madry_wrn_vanilla",
+ "defense_alignment_data")
+
+ if os.path.exists(defense_data_path):
+ print("Trying to load defense statistics")
+ load_alignments_dir = defense_data_path
+ save_alignments_dir = None
+ else:
+ print("Defense statistics not found; generating and saving them now.")
+ load_alignments_dir = None
+ save_alignments_dir = defense_data_path
+
+ dataset_size = data.x_train.shape[0]
+ dataset_train = data.to_tensorflow()[0]
+ dataset_train = dataset_train.map(
+ lambda x, y: (random_shift(random_horizontal_flip(x)), y), 4)
+ dataset_train = dataset_train.batch(batch_size)
+ dataset_train = dataset_train.prefetch(16)
+ x_train, y_train = data.get_set('train')
+ x_train *= 255
+
+ nb_classes = y_train.shape[1]
+
+ n_collect = 10000 # TODO: for debugging set to 100, otherwise to 10000
+ p_ratio_cutoff = .999
+ just_detect = True
+ clip_alignments = True
+ fit_classifier = True
+ noise_eps = 'n30.0'
+ num_noise_samples = 256
+
+ if multi_noise:
+ noises = 'n0.003,s0.003,u0.003,n0.005,s0.005,u0.005,s0.008,n0.008,u0.008'.split(
+ ',')
+ noise_eps_detect = []
+ for n in noises:
+ new_noise = n[0] + str(float(n[1:]) * 255)
+ noise_eps_detect.append(new_noise)
+ else:
+ noise_eps_detect = 'n30.0'
+
+ # these attack parameters are just for initializing the defense
+ eps = 8.0
+ pgd_params = {
+ 'eps': eps,
+ 'eps_iter': (eps / 5),
+ 'nb_iter': 10,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+
+ logits_op = preds.op
+ while logits_op.type != 'MatMul':
+ logits_op = logits_op.inputs[0].op
+ latent_x_tensor, weights = logits_op.inputs
+ logits_tensor = preds
+
+ predictor = tf_robustify.collect_statistics(
+ x_train[:n_collect], y_train[:n_collect], x, sess,
+ logits_tensor=logits_tensor,
+ latent_x_tensor=latent_x_tensor,
+ weights=weights,
+ nb_classes=nb_classes,
+ p_ratio_cutoff=p_ratio_cutoff,
+ noise_eps=noise_eps,
+ noise_eps_detect=noise_eps_detect,
+ pgd_eps=pgd_params['eps'],
+ pgd_lr=pgd_params['eps_iter'] / pgd_params['eps'],
+ pgd_iters=pgd_params['nb_iter'],
+ save_alignments_dir=save_alignments_dir,
+ load_alignments_dir=load_alignments_dir,
+ clip_min=pgd_params['clip_min'],
+ clip_max=pgd_params['clip_max'],
+ batch_size=batch_size,
+ num_noise_samples=num_noise_samples,
+ debug_dict=None,
+ debug=False,
+ targeted=False,
+ pgd_train=None,
+ fit_classifier=fit_classifier,
+ clip_alignments=clip_alignments,
+ just_detect=just_detect,
+ )
+
+ next(predictor)
+ return predictor
+
+
+def do_eval(sess, x, x_adv, logits, preds, x_set,
+ y_set, predictor, batch_size, attack_kwargs={}):
+ n_batches = math.ceil(x_set.shape[0] / batch_size)
+
+ # first generative adversarial examples
+ x_adv_set, logits_set, p_set = [], [], []
+ for b in range(n_batches):
+ values = sess.run((x_adv, logits, preds),
+ {**attack_kwargs,
+ x: x_set[b * batch_size:(b + 1) * batch_size]})
+ x_adv_set.append(values[0])
+ logits_set.append(values[1])
+ p_set.append(values[2])
+ x_adv_set = np.concatenate(x_adv_set)
+ logits_set = np.concatenate(logits_set)
+ p_set = np.concatenate(p_set)
+
+ del x_set
+
+ # now run test
+ p_set, p_det = np.concatenate(
+ [predictor.send(x_adv_set[b * batch_size:(b + 1) * batch_size]) for b in
+ range(n_batches)]).T
+
+ correctly_classified = np.equal(p_set,
+ y_set[:len(p_set)].argmax(-1))
+
+ adversarial_example_detected = np.equal(p_det, True)
+ # model_fooled = np.logical_or(
+ # np.logical_and(~correctly_classified, ~adversarial_example_detected), # fooled classifier & evaded detector
+ # np.logical_and(correctly_classified, adversarial_example_detected) # did not fool classifier but triggered detector (false positive)
+ # )
+ model_fooled = np.logical_and(~correctly_classified,
+ ~adversarial_example_detected) # fooled classifier & evaded detector
+
+ correctly_classified_not_detected = np.logical_and(correctly_classified,
+ ~adversarial_example_detected)
+
+ # print(len(adversarial_example_detected), np.sum(~correctly_classified),
+ # np.sum(adversarial_example_detected))
+
+ # asr = model_fooled.mean()
+ # acc = correctly_classified.mean()
+ # print('Accuracy of base model: %0.4f' % acc)
+ # print('ASR (w/ detection defense): %0.4f' % asr)
+
+ return model_fooled, correctly_classified, adversarial_example_detected
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--debug', action='store_true')
+ parser.add_argument('--multi-noise', action='store_true')
+ parser.add_argument("--n-samples", default=512, type=int)
+ parser.add_argument("--batch-size", default=512, type=int)
+ parser.add_argument("--epsilon", default=8, type=int)
+ parser.add_argument("--attack", choices=("clean", "original", "adaptive",
+ "adaptive-eot"),
+ default="original")
+ args = parser.parse_args()
+
+ # load data
+ data = CIFAR10()
+ x_test, y_test = data.get_set('test')
+
+ sess = tf.Session()
+
+ img_rows, img_cols, nchannels = x_test.shape[1:4]
+ nb_classes = y_test.shape[1]
+
+ # define model & restore weights
+ # Define input TF placeholder
+ x_placeholder = tf.placeholder(
+ tf.float32, shape=(None, img_rows, img_cols, nchannels))
+ # needed for adaptive attack
+ x_reference_placeholder = tf.placeholder(
+ tf.float32, shape=(None, img_rows, img_cols, nchannels))
+ cifar_model = ResNet(scope='ResNet')
+
+ ckpt = tf.train.get_checkpoint_state("checkpoints/tf_madry_wrn_vanilla")
+ saver = tf.train.Saver(var_list=dict(
+ (v.name.split('/', 1)[1].split(':')[0], v) for v in
+ tf.global_variables()))
+ saver.restore(sess, ckpt.model_checkpoint_path)
+ initialize_uninitialized_global_variables(sess)
+
+ logits = cifar_model.get_logits(x_placeholder)
+
+ # setup defense
+ # if multi_noise = True, instantiate the defense with 9 types of noise.
+ # if multi_noise = False, instantiate the defense with a single type of high-magnitude noise.
+ print("multi noise:", args.multi_noise)
+ defense_predictor = init_defense(sess, x_placeholder, logits, args.batch_size,
+ multi_noise=args.multi_noise)
+
+ # prepare dataloader
+ random_indices = list(range(len(x_test)))
+ np.random.shuffle(random_indices)
+ x_batch = []
+ y_batch = []
+ for j in range(args.n_samples):
+ x_, y_ = x_test[random_indices[j]], y_test[random_indices[j]]
+ x_batch.append(x_)
+ y_batch.append(y_)
+ x_batch = np.array(x_batch).transpose((0, 3, 1, 2))
+ y_batch = np.array(y_batch)
+
+ from utils import build_dataloader_from_arrays
+
+ test_loader = build_dataloader_from_arrays(x_batch, y_batch,
+ batch_size=args.batch_size)
+
+ original_pgd_params = {
+ # ord: ,
+ 'eps': args.epsilon,
+ 'eps_iter': (args.epsilon / 5.0),
+ 'nb_iter': 10,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+ adaptive_pgd_params = {
+ # ord: ,
+ 'eps': args.epsilon,
+ 'eps_iter': args.epsilon / 100.0,
+ 'nb_iter': 100,
+ 'clip_min': 0,
+ 'clip_max': 255,
+ 'x_reference': x_reference_placeholder,
+ }
+
+ if args.attack == "clean":
+ adv_x = x_placeholder
+ else:
+ if args.attack == "original":
+ pgd = MadryEtAl(cifar_model, sess=sess)
+ print("Using MadryEtAl attack")
+ elif args.attack == "adaptive":
+ pgd = ProjectedGradientDescentWithDetectorLogitMatching(
+ cifar_model,
+ lambda x: cifar_model.get_logits(x),
+ sess=sess,
+ verbose=False)
+ print("Using logit-matching attack")
+ elif args.attack == "adaptive-eot":
+ pgd = ProjectedGradientDescentWithDetectorLogitMatching(
+ cifar_model,
+ lambda x: cifar_model.get_logits(x),
+ sess=sess,
+ eot_ensemble_size=20,
+ verbose=False)
+ print("Using logit-matching attack w/ EOT")
+ else:
+ raise ValueError("invalid attack")
+
+ pgd_params = original_pgd_params if args.attack == "original" else adaptive_pgd_params
+ adv_x = tf.stop_gradient(pgd.generate(x_placeholder, **pgd_params))
+
+ adv_logits = cifar_model.get_logits(adv_x)
+ adv_predictions = tf.argmax(adv_logits, 1)
+
+ def run_eval(l):
+ # should_be_rejected = ~verify_valid_input_data(kwargs["reference_points_x"])
+ # print("should_be_rejected", should_be_rejected)
+
+ is_advs = []
+ correctly_classifieds = []
+ adv_detecteds = []
+ model_fooleds = []
+ for x, y in l:
+ x = x.numpy().transpose((0, 2, 3, 1)) * 255.0
+ y = y.numpy()
+
+ # pick targets. We'll keep it simple and just target the logits
+ # of the first clean example, except for inputs that have the
+ # same class as that example. For those, we target the logits
+ # of the first clean example w/ different class.
+ y_cls = np.argmax(y, -1)
+ reference_x = x.copy()
+ reference_x[:] = x[0]
+ # get first element that has different class than first sample
+ idx = np.argmax(y_cls != y_cls[0])
+ reference_x[y_cls == y_cls[0]] = x[idx]
+
+ print(x.shape, reference_x.shape)
+
+ model_fooled_np, correctly_classified_np, adv_detected_np = do_eval(
+ sess=sess, x=x_placeholder, x_adv=adv_x,
+ batch_size=args.batch_size,
+ logits=adv_logits,
+ preds=adv_predictions, x_set=x, y_set=y,
+ predictor=defense_predictor,
+ attack_kwargs={x_reference_placeholder: reference_x}
+ )
+
+ # print(is_adv_np, y, logits_np)
+ adv_detecteds.append(adv_detected_np)
+ correctly_classifieds.append(correctly_classified_np)
+ model_fooleds.append(model_fooled_np)
+ adv_detecteds = np.concatenate(adv_detecteds)
+ correctly_classifieds = np.concatenate(correctly_classifieds)
+ model_fooleds = np.concatenate(model_fooleds)
+
+ print("ASR:", np.mean(model_fooleds))
+ print("correctly_classifieds", np.mean(correctly_classifieds),
+ "adversarial detected", np.mean(adv_detecteds))
+
+ run_eval(test_loader)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/case_studies/odds/original/adversarial_evaluation.sh b/case_studies/odds/original/adversarial_evaluation.sh
new file mode 100644
index 0000000..9f66e34
--- /dev/null
+++ b/case_studies/odds/original/adversarial_evaluation.sh
@@ -0,0 +1,19 @@
+nsamples=${1:-512}
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "Original attack"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) venv3.8tf/bin/python case_studies/odds/original/adversarial_evaluation.py \
+ --n-samples=$nsamples --attack=original
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "Adaptive attack"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) venv3.8tf/bin/python case_studies/odds/original/adversarial_evaluation.py \
+ --n-samples=$nsamples --attack=adaptive
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "Adaptive attack w/ EOT attack"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) venv3.8tf/bin/python case_studies/odds/original/adversarial_evaluation.py \
+ --n-samples=$nsamples --attack=adaptive-eot --batch-size=128
\ No newline at end of file
diff --git a/case_studies/odds/original/binarization_test.py b/case_studies/odds/original/binarization_test.py
new file mode 100644
index 0000000..c7cc8cd
--- /dev/null
+++ b/case_studies/odds/original/binarization_test.py
@@ -0,0 +1,550 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import functools
+
+import cleverhans.model
+import torch
+from cleverhans import utils_tf
+from cleverhans.attacks import Attack
+import cleverhans.attacks
+from cleverhans.utils_tf import clip_eta
+
+# disable tf logging
+# some of these might have to be commented out to use verbose=True in the
+# adaptive attack
+import warnings
+import logging
+
+logging.getLogger('tensorflow').setLevel(logging.FATAL)
+import tensorflow as tf
+
+tf.logging.set_verbosity(tf.logging.ERROR)
+
+import os
+import math
+import numpy as np
+import tensorflow as tf
+
+from cleverhans.attacks import MadryEtAl
+from cleverhans.dataset import CIFAR10
+from cleverhans.model_zoo.madry_lab_challenges.cifar10_model import \
+ make_wresnet as ResNet
+from cleverhans.utils_tf import initialize_uninitialized_global_variables
+
+import tf_robustify
+from cleverhans.augmentation import random_horizontal_flip, random_shift
+
+from active_tests.decision_boundary_binarization import \
+ interior_boundary_discrimination_attack, format_result
+from argparse_utils import DecisionBoundaryBinarizationSettings
+from tensorflow_wrapper import TensorFlow1ToPyTorchWrapper
+
+from logit_matching_attack import \
+ ProjectedGradientDescentWithDetectorLogitMatching
+
+
+def init_defense(sess, x, preds, batch_size, multi_noise=False):
+ data = CIFAR10()
+
+ if multi_noise:
+ defense_data_path = os.path.join("checkpoints/tf_madry_wrn_vanilla",
+ "defense_alignment_data_multi_noise")
+ else:
+ defense_data_path = os.path.join("checkpoints/tf_madry_wrn_vanilla",
+ "defense_alignment_data")
+
+ if os.path.exists(defense_data_path):
+ print("Trying to load defense statistics")
+ load_alignments_dir = defense_data_path
+ save_alignments_dir = None
+ else:
+ print("Defense statistics not found; generating and saving them now.")
+ load_alignments_dir = None
+ save_alignments_dir = defense_data_path
+
+ dataset_size = data.x_train.shape[0]
+ dataset_train = data.to_tensorflow()[0]
+ dataset_train = dataset_train.map(
+ lambda x, y: (random_shift(random_horizontal_flip(x)), y), 4)
+ dataset_train = dataset_train.batch(batch_size)
+ dataset_train = dataset_train.prefetch(16)
+ x_train, y_train = data.get_set('train')
+ x_train *= 255
+
+ nb_classes = y_train.shape[1]
+
+ n_collect = 10000 # TODO: for debugging set to 100, otherwise to 10000
+ p_ratio_cutoff = .999
+ just_detect = True
+ clip_alignments = True
+ fit_classifier = True
+ noise_eps = 'n30.0'
+ num_noise_samples = 256
+
+ if multi_noise:
+ noises = 'n0.003,s0.003,u0.003,n0.005,s0.005,u0.005,s0.008,n0.008,u0.008'.split(
+ ',')
+ noise_eps_detect = []
+ for n in noises:
+ new_noise = n[0] + str(float(n[1:]) * 255)
+ noise_eps_detect.append(new_noise)
+ else:
+ noise_eps_detect = 'n30.0'
+
+ # these attack parameters are just for initializing the defense
+ eps = 8.0
+ pgd_params = {
+ 'eps': eps,
+ 'eps_iter': (eps / 5),
+ 'nb_iter': 10,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+
+ logits_op = preds.op
+ while logits_op.type != 'MatMul':
+ logits_op = logits_op.inputs[0].op
+ latent_x_tensor, weights = logits_op.inputs
+ logits_tensor = preds
+
+ predictor = tf_robustify.collect_statistics(
+ x_train[:n_collect], y_train[:n_collect], x, sess,
+ logits_tensor=logits_tensor,
+ latent_x_tensor=latent_x_tensor,
+ weights=weights,
+ nb_classes=nb_classes,
+ p_ratio_cutoff=p_ratio_cutoff,
+ noise_eps=noise_eps,
+ noise_eps_detect=noise_eps_detect,
+ pgd_eps=pgd_params['eps'],
+ pgd_lr=pgd_params['eps_iter'] / pgd_params['eps'],
+ pgd_iters=pgd_params['nb_iter'],
+ save_alignments_dir=save_alignments_dir,
+ load_alignments_dir=load_alignments_dir,
+ clip_min=pgd_params['clip_min'],
+ clip_max=pgd_params['clip_max'],
+ batch_size=batch_size,
+ num_noise_samples=num_noise_samples,
+ debug_dict=None,
+ debug=False,
+ targeted=False,
+ pgd_train=None,
+ fit_classifier=fit_classifier,
+ clip_alignments=clip_alignments,
+ just_detect=just_detect,
+ )
+
+ next(predictor)
+ return predictor
+
+
+def do_binarized_eval(sess, x, y, x_adv, binarized_logits, binarized_preds, x_set,
+ y_set, predictor, batch_size, binarized_sess_kwargs={},
+ inverted_detector_test=False):
+ n_batches = math.ceil(x_set.shape[0] / batch_size)
+
+ # first generative adversarial examples
+ x_adv_set, binarized_logits_set, binarized_p_set = [], [], []
+ for b in range(n_batches):
+ values = sess.run((x_adv, binarized_logits, binarized_preds),
+ {**binarized_sess_kwargs,
+ x: x_set[b * batch_size:(b + 1) * batch_size],
+ y: y_set[b * batch_size:(b + 1) * batch_size]})
+ x_adv_set.append(values[0])
+ binarized_logits_set.append(values[1])
+ binarized_p_set.append(values[2])
+ x_adv_set = np.concatenate(x_adv_set)
+ binarized_logits_set = np.concatenate(binarized_logits_set)
+ binarized_p_set = np.concatenate(binarized_p_set)
+
+ # now run test
+ p_set, p_det = np.concatenate(
+ [predictor.send(x_adv_set[b * batch_size:(b + 1) * batch_size]) for b in
+ range(n_batches)]).T
+
+ correctly_classified = np.equal(binarized_p_set,
+ y_set[:len(p_set)].argmax(-1))
+ if inverted_detector_test:
+ adversarial_example_detected = np.equal(p_det, False)
+ else:
+ adversarial_example_detected = np.equal(p_det, True)
+ # model_fooled = np.logical_or(
+ # np.logical_and(~correctly_classified, ~adversarial_example_detected), # fooled classifier & evaded detector
+ # np.logical_and(correctly_classified, adversarial_example_detected) # did not fool classifier but triggered detector (false positive)
+ # )
+ model_fooled = np.logical_and(~correctly_classified,
+ ~adversarial_example_detected) # fooled classifier & evaded detector
+
+ # print(len(adversarial_example_detected), np.sum(~correctly_classified),
+ # np.sum(adversarial_example_detected))
+
+ # asr = model_fooled.mean()
+ # acc = correctly_classified.mean()
+ # print('Accuracy of base model: %0.4f' % acc)
+ # print('ASR (w/ detection defense): %0.4f' % asr)
+ #print(model_fooled, ~correctly_classified, ~adversarial_example_detected)
+ #print(binarized_logits_set)
+
+ return model_fooled, (x_adv_set, binarized_logits_set)
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--debug', action='store_true')
+ parser.add_argument('--multi-noise', action='store_true')
+ parser.add_argument("--n-samples", default=512, type=int)
+ parser.add_argument("--n-boundary-points", default=49, type=int)
+ parser.add_argument("--n-inner-points", default=10, type=int)
+ parser.add_argument("--batch-size", default=512, type=int)
+ parser.add_argument("--attack", choices=("original", "adaptive",
+ "adaptive-eot"),
+ default="original")
+ parser.add_argument("--dont-verify-training-data", action="store_true")
+ parser.add_argument("--use-boundary-adverarials", action="store_true")
+ parser.add_argument("--inverted-test", action="store_true")
+ args = parser.parse_args()
+
+ if args.inverted_test:
+ print("Running inverted test")
+ else:
+ print("Running normal/non-inverted test")
+
+ # load data
+ data = CIFAR10()
+ x_test, y_test = data.get_set('test')
+
+ sess = tf.Session()
+
+ img_rows, img_cols, nchannels = x_test.shape[1:4]
+ nb_classes = y_test.shape[1]
+
+ # define model & restore weights
+ # Define input TF placeholder
+ x_placeholder = tf.placeholder(
+ tf.float32, shape=(None, img_rows, img_cols, nchannels))
+ y_placeholder = tf.placeholder(tf.int32, shape=(None,))
+ # needed for adaptive attack
+ x_reference_placeholder = tf.placeholder(
+ tf.float32, shape=(None, img_rows, img_cols, nchannels))
+ cifar_model = ResNet(scope='ResNet')
+
+ ckpt = tf.train.get_checkpoint_state("checkpoints/tf_madry_wrn_vanilla")
+ saver = tf.train.Saver(var_list=dict(
+ (v.name.split('/', 1)[1].split(':')[0], v) for v in
+ tf.global_variables()))
+ saver.restore(sess, ckpt.model_checkpoint_path)
+ initialize_uninitialized_global_variables(sess)
+
+ class Model:
+ def __init__(self, model):
+ self.model = model
+
+ def __call__(self, x, features_only=True):
+ assert features_only
+ return self.get_features(x)
+
+ def get_features(self, x):
+ return self.model.fprop(x * 255.0)["Flatten2"]
+
+ def get_features_and_gradients(self, x):
+ features = self.model.fprop(x * 255.0)["Flatten2"]
+ grad = tf.gradients(features, x)[0]
+ return features, grad
+
+ def get_features_logits_and_gradients(self, x):
+ values = self.model.fprop(x * 255.0)
+ features = values["Flatten2"]
+ predictions = values["logits"]
+ grad = tf.gradients(features, x)[0]
+ return features, grad, predictions
+
+ model = Model(cifar_model)
+
+ features, feature_gradients, logits = model.get_features_logits_and_gradients(
+ x_placeholder)
+
+ # setup defense
+ # if multi_noise = True, instantiate the defense with 9 types of noise.
+ # if multi_noise = False, instantiate the defense with a single type of high-magnitude noise.
+ print("multi noise:", args.multi_noise)
+ defense_predictor = init_defense(sess, x_placeholder, logits, args.batch_size,
+ multi_noise=args.multi_noise)
+
+ class ModelWrapper(cleverhans.model.Model):
+ def __init__(self, model, weight_shape, bias_shape):
+ self.weight = tf.placeholder(dtype=tf.float32, shape=weight_shape)
+ self.bias = tf.placeholder(dtype=tf.float32, shape=bias_shape)
+ self.model = model
+ self.first = True
+
+ def fprop(self, x, **kwargs):
+ y = self.model.get_features(x, *kwargs)
+ logits = y @ tf.transpose(self.weight) + tf.reshape(self.bias, (1, -1))
+ return {"logits": logits}
+
+ def logits_and_predictions(self, x=None):
+ if x == None: assert not self.first
+ if self.first:
+ self.logits = self(x)
+ self.predictions = tf.argmax(self.logits, 1)
+ self.first = False
+ return self.logits, self.predictions
+
+ def run_features(x: np.ndarray, features_only=True,
+ features_and_logits=False):
+ if features_only:
+ assert not features_and_logits
+ targets = features
+ elif features_and_logits:
+ targets = (features, logits)
+ else:
+ targets = logits
+ x = x.transpose(0, 2, 3, 1) * 255.0
+ return sess.run(targets,
+ feed_dict={x_placeholder: x})
+
+ def run_features_and_gradients(x: np.ndarray):
+ x = x.transpose(0, 2, 3, 1) * 255.0
+ return sess.run((features, feature_gradients),
+ feed_dict={x_placeholder: x})
+
+ feature_extractor = TensorFlow1ToPyTorchWrapper(
+ logit_forward_pass=lambda x, features_only=False,
+ features_and_logits=False: run_features(x, features_only,
+ features_and_logits),
+ logit_forward_and_backward_pass=lambda x: run_features_and_gradients(x)
+ )
+
+ # prepare dataloader
+ random_indices = list(range(len(x_test)))
+ np.random.shuffle(random_indices)
+ x_batch = []
+ y_batch = []
+ for j in range(args.n_samples):
+ x_, y_ = x_test[random_indices[j]], y_test[random_indices[j]]
+ x_batch.append(x_)
+ y_batch.append(y_)
+ x_batch = np.array(x_batch).transpose((0, 3, 1, 2))
+ y_batch = np.array(y_batch)
+
+ from utils import build_dataloader_from_arrays
+
+ test_loader = build_dataloader_from_arrays(x_batch, y_batch, batch_size=32)
+
+ # TODO: update shapes? apparently not necessary...
+ wrapped_model = ModelWrapper(model, (2, 640), (2,))
+
+ baseline_cifar_pgd = MadryEtAl(cifar_model, sess=sess)
+ original_pgd_params = {
+ # ord: ,
+ 'eps': 8,
+ 'eps_iter': (8 / 5),
+ 'nb_iter': 10,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+ adaptive_pgd_params = {
+ # ord: ,
+ 'eps': 8,
+ 'eps_iter': 8.0 / 300,
+ 'nb_iter': 300,
+ 'clip_min': 0,
+ 'clip_max': 255,
+ 'x_reference': x_reference_placeholder,
+ 'y': y_placeholder
+ }
+
+ if args.attack == "original":
+ pgd = MadryEtAl(wrapped_model, sess=sess)
+ print("Using MadryEtAl attack")
+ elif args.attack == "adaptive":
+ pgd = ProjectedGradientDescentWithDetectorLogitMatching(
+ wrapped_model,
+ lambda x: model.model.get_logits(x),
+ sess=sess,
+ verbose=False)
+ print("Using logit-matching attack")
+ elif args.attack == "adaptive-eot":
+ pgd = ProjectedGradientDescentWithDetectorLogitMatching(
+ wrapped_model,
+ lambda x: model.model.get_logits(x),
+ sess=sess,
+ eot_ensemble_size=20,
+ verbose=False)
+ print("Using logit-matching attack w/ EOT")
+ else:
+ raise ValueError("invalid attack")
+
+ # was 1.75
+ far_off_distance = 1.75 # TODO, was 1.01
+
+ larger_pgd_params = {**original_pgd_params}
+ larger_pgd_params["eps"] *= far_off_distance
+
+ pgd_params = original_pgd_params if args.attack == "original" else adaptive_pgd_params
+
+ adv_x = tf.stop_gradient(pgd.generate(x_placeholder, **pgd_params))
+
+ cifar_adv_x = tf.stop_gradient(
+ baseline_cifar_pgd.generate(x_placeholder, **original_pgd_params))
+ larger_cifar_adv_x = tf.stop_gradient(
+ baseline_cifar_pgd.generate(x_placeholder, **original_pgd_params))
+
+ adv_binarized_logits = wrapped_model.get_logits(adv_x)
+ adv_binarized_predictions = tf.argmax(adv_binarized_logits, 1)
+
+ def run_attack(m, l, kwargs, inverted_detector_test=False):
+ linear_layer = m[-1]
+ del m
+
+ weights_feed_dict = {
+ wrapped_model.weight: linear_layer.weight.data.numpy(),
+ wrapped_model.bias: linear_layer.bias.data.numpy()
+ }
+
+ if "reference_points_x" in kwargs:
+ weights_feed_dict[x_reference_placeholder] = \
+ kwargs["reference_points_x"].numpy().transpose((0, 2, 3, 1)) * 255.0
+
+ # should_be_rejected = ~verify_valid_input_data(kwargs["reference_points_x"])
+ # print("should_be_rejected", should_be_rejected)
+
+ for x, y in l:
+ x = x.numpy().transpose((0, 2, 3, 1)) * 255.0
+ y = y.numpy()
+
+ is_adv_np, (x_adv_np, logits_np) = do_binarized_eval(
+ sess=sess, x=x_placeholder, y=y_placeholder, x_adv=adv_x,
+ batch_size=args.batch_size,
+ binarized_logits=adv_binarized_logits,
+ binarized_preds=adv_binarized_predictions, x_set=x, y_set=y,
+ predictor=defense_predictor, binarized_sess_kwargs=weights_feed_dict,
+ inverted_detector_test=inverted_detector_test
+ )
+
+ # print(is_adv_np, y, logits_np)
+
+ return is_adv_np, (torch.Tensor(x_adv_np), torch.Tensor(logits_np))
+
+ def verify_valid_input_data(x_set):
+ """Returns True if something is not detected as an adversarial example."""
+ x_set = x_set.numpy().transpose((0, 2, 3, 1)) * 255.0
+ n_batches = math.ceil(x_set.shape[0] / args.batch_size)
+ _, p_det = np.concatenate(
+ [defense_predictor.send(
+ x_set[b * args.batch_size:(b + 1) * args.batch_size]
+ ) for b in range(n_batches)]
+ ).T
+ # p_det is True of a possible adversarial example has been detected
+ valid_sample = np.equal(p_det, False)
+
+ return valid_sample
+
+ def get_boundary_adversarials(x, y, n_samples, epsilon):
+ """Generate adversarial examples for the base classifier."""
+ assert len(x.shape) == 3
+ del y
+ device = x.device
+ x = x.unsqueeze(0).numpy()
+ x = x.transpose((0, 2, 3, 1)) * 255.0
+ x = np.repeat(x, n_samples, axis=0)
+
+ # select correct tf placeholder depending on the epsilon ball
+ if epsilon == pgd_params["eps"] / 255.0:
+ x_adv_ph = cifar_adv_x
+ elif epsilon == larger_pgd_params["eps"] / 255.0:
+ x_adv_ph = larger_cifar_adv_x
+ else:
+ raise ValueError("Cannot generate adversarials at eps =", epsilon)
+
+ for _ in range(10):
+ x_advs = []
+ for x_ in np.array_split(x, int(np.ceil(len(x) / args.batch_size))):
+ x_advs.append(sess.run(x_adv_ph, feed_dict={x_placeholder: x_}))
+ x_adv = np.concatenate(x_advs, 0)
+ x_adv = x_adv.transpose((0, 3, 1, 2)) / 255.0
+
+ x_adv = torch.Tensor(x_adv, device=device)
+
+ # make sure adversarial examples are really detected as adversarial examples
+ is_valid = verify_valid_input_data(x_adv)
+ is_invalid = ~is_valid
+ if np.all(is_invalid):
+ # generative until we finally found an adversarial example that gets
+ # detected
+ break
+ else:
+ warnings.warn("Could not generate adversarial example that gets "
+ "detected after 10 trials.")
+
+ return x_adv
+
+ if args.inverted_test:
+ additional_settings = dict(
+ n_boundary_points=args.n_boundary_points,
+ n_boundary_adversarial_points=1,
+ n_far_off_boundary_points=1,
+ n_far_off_adversarial_points=1,
+ )
+ else:
+ additional_settings = dict(
+ n_boundary_points=args.n_boundary_points,
+ n_boundary_adversarial_points=args.n_boundary_points - 1,
+ n_far_off_boundary_points=1,
+ n_far_off_adversarial_points=0,
+ )
+
+ scores_logit_differences_and_validation_accuracies = \
+ interior_boundary_discrimination_attack(
+ feature_extractor,
+ test_loader,
+ attack_fn=functools.partial(
+ run_attack,
+ inverted_detector_test=args.inverted_test
+ ),
+ linearization_settings=DecisionBoundaryBinarizationSettings(
+ epsilon=8 / 255.0,
+ norm="linf",
+ lr=10000,
+ n_inner_points=args.n_inner_points,
+ adversarial_attack_settings=None,
+ optimizer="sklearn",
+ **additional_settings,
+ ),
+ rescale_logits="adaptive",
+ n_samples=args.n_samples,
+ device="cpu",
+ batch_size=args.batch_size,
+ # decision_boundary_closeness=0.999,
+ n_samples_evaluation=200,
+ n_samples_asr_evaluation=200,
+ # verify_valid_boundary_training_data_fn=None if args.dont_verify_training_data else verify_valid_input_data,
+ verify_valid_boundary_training_data_fn=verify_valid_input_data,
+ get_boundary_adversarials_fn=get_boundary_adversarials,
+ verify_valid_inner_training_data_fn=None,
+ verify_valid_input_validation_data_fn=None,
+ # verify_valid_input_data if args.use_boundary_adverarials else None,
+ # get_boundary_adversarials_fn=get_boundary_adversarials if args.use_boundary_adverarials else None,
+ fill_batches_for_verification=False,
+ far_off_distance=far_off_distance
+ )
+
+ print(format_result(scores_logit_differences_and_validation_accuracies,
+ args.n_samples))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/case_studies/odds/original/binarization_test.sh b/case_studies/odds/original/binarization_test.sh
new file mode 100644
index 0000000..fc42e48
--- /dev/null
+++ b/case_studies/odds/original/binarization_test.sh
@@ -0,0 +1,95 @@
+nsamples=${1:-512}
+direction=${2:-normal}
+echo "Evaluating on $nsamples samples"
+echo "Direction: $direction"
+multinoise=${3:-}
+
+
+if [[ "$direction" == "normal" ]]; then
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Original attack"
+ echo "Normal test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=original \
+ $multinoise
+
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Adaptive attack"
+ echo "Normal test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=adaptive \
+ $multinoise
+
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Adaptive attack w/ EOT"
+ echo "Normal test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=adaptive-eot \
+ $multinoise
+else
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Original attack"
+ echo "Inverted test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=original \
+ --inverted-test \
+ $multinoise
+
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Adaptive attack"
+ echo "Inverted test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=adaptive \
+ --inverted-test \
+ $multinoise
+
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 999 inner"
+ echo "Adaptive attack w/ EOT"
+ echo "Inverted test"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+
+ TF_CPP_MIN_LOG_LEVEL=3 PYTHONPATH=$PYTHONPATH:$(pwd) ./venv3.8tf/bin/python case_studies/odds/original/binarization_test.py \
+ --n-samples=$nsamples \
+ --n-boundary=1 \
+ --n-inner=999 \
+ --dont-verify-training-data \
+ --attack=adaptive-eot \
+ --inverted-test \
+ $multinoise
+fi
\ No newline at end of file
diff --git a/case_studies/odds/original/carlini_wagner_attack.py b/case_studies/odds/original/carlini_wagner_attack.py
new file mode 100644
index 0000000..d33f58a
--- /dev/null
+++ b/case_studies/odds/original/carlini_wagner_attack.py
@@ -0,0 +1,250 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# from https://github.com/rwightman/pytorch-nips2017-attack-example
+"""PyTorch Carlini and Wagner L2 attack algorithm.
+
+Based on paper by Carlini & Wagner, https://arxiv.org/abs/1608.04644 and a reference implementation at
+https://github.com/tensorflow/cleverhans/blob/master/cleverhans/attacks_tf.py
+"""
+import os
+import sys
+import torch
+import numpy as np
+from torch import optim
+from torch import autograd
+from carlini_wagner_helpers import *
+
+
+class AttackCarliniWagnerL2:
+
+ def __init__(self, targeted=False, search_steps=5, max_steps=1000, cuda=True, debug=False, num_classes=10, clip_min=-1., clip_max=1., confidence=20, initial_const=.1, learning_rate=1e-4):
+ self.debug = debug
+ self.targeted = targeted
+ self.num_classes = num_classes
+ self.confidence = confidence # FIXME need to find a good value for this, 0 value used in paper not doing much...
+ self.initial_const = initial_const # bumped up from default of .01 in reference code... 10 in mnist tutorial
+ self.binary_search_steps = search_steps
+ # self.repeat = self.binary_search_steps >= 10
+ self.repeat = False
+ self.max_steps = max_steps
+ self.abort_early = True
+ self.clip_min = clip_min
+ self.clip_max = clip_max
+ self.cuda = cuda
+ # self.clamp_fn = 'tanh' # set to something else perform a simple clamp instead of tanh
+ self.clamp_fn = '' # set to something else perform a simple clamp instead of tanh
+ self.init_rand = False # an experiment, does a random starting point help?
+ self.learning_rate = learning_rate
+
+ def _compare(self, output, target):
+ if not isinstance(output, (float, int, np.int64)):
+ output = np.copy(output)
+ if self.targeted:
+ output[target] -= self.confidence
+ else:
+ output[target] += self.confidence
+ output = np.argmax(output)
+ if isinstance(output, np.int64):
+ output = output.item()
+ if self.targeted:
+ return output == target
+ else:
+ return output != target
+
+ def _loss(self, output, target, dist, scale_const):
+ # compute the probability of the label class versus the maximum other
+ real = (target * output).sum(1)
+ other = ((1. - target) * output - target * 10000.).max(1)[0]
+ if self.targeted:
+ # if targeted, optimize for making the other class most likely
+ loss1 = torch.clamp(other - real + self.confidence, min=0.) # equiv to max(..., 0.)
+ else:
+ # if non-targeted, optimize for making this class least likely.
+ loss1 = torch.clamp(real - other + self.confidence, min=0.) # equiv to max(..., 0.)
+ loss1 = torch.sum(scale_const * loss1)
+
+ loss2 = dist.sum()
+
+ loss = loss1 + loss2
+ return loss
+
+ def _optimize(self, optimizer, model, input_var, modifier_var, target_var, scale_const_var, input_orig=None):
+ # apply modifier and clamp resulting image to keep bounded from clip_min to clip_max
+ if self.clamp_fn == 'tanh':
+ input_adv = tanh_rescale(modifier_var + input_var, self.clip_min, self.clip_max)
+ else:
+ input_adv = torch.clamp(modifier_var + input_var, self.clip_min, self.clip_max)
+
+ output = model(input_adv)
+
+ # distance to the original input data
+ if input_orig is None:
+ dist = l2_dist(input_adv, input_var, keepdim=False)
+ else:
+ dist = l2_dist(input_adv, input_orig, keepdim=False)
+
+ loss = self._loss(output, target_var, dist, scale_const_var)
+
+ optimizer.zero_grad()
+ loss.backward()
+ optimizer.step()
+
+ loss_np = loss.data.item()
+ dist_np = dist.data.cpu().numpy()
+ output_np = output.data.cpu().numpy()
+ input_adv_np = input_adv.data.cpu().numpy() # back to BHWC for numpy consumption
+ return loss_np, dist_np, output_np, input_adv_np
+
+ def run(self, model, input, target, batch_idx=0):
+ batch_size = input.size(0)
+
+ # set the lower and upper bounds accordingly
+ lower_bound = np.zeros(batch_size)
+ scale_const = np.ones(batch_size) * self.initial_const
+ upper_bound = np.ones(batch_size) * 1e10
+
+ # python/numpy placeholders for the overall best l2, label score, and adversarial image
+ o_best_l2 = [1e10] * batch_size
+ o_best_score = [-1] * batch_size
+ o_best_attack = input.cpu().numpy()
+
+ # setup input (image) variable, clamp/scale as necessary
+ if self.clamp_fn == 'tanh':
+ # convert to tanh-space, input already int -1 to 1 range, does it make sense to do
+ # this as per the reference implementation or can we skip the arctanh?
+ input_var = autograd.Variable(torch_arctanh(input), requires_grad=False)
+ input_orig = tanh_rescale(input_var, self.clip_min, self.clip_max)
+ else:
+ input_var = autograd.Variable(input, requires_grad=False)
+ input_orig = None
+
+ # setup the target variable, we need it to be in one-hot form for the loss function
+ target_onehot = torch.zeros(target.size() + (self.num_classes,))
+ if self.cuda:
+ target_onehot = target_onehot.cuda()
+ target_onehot.scatter_(1, target.unsqueeze(1), 1.)
+ target_var = autograd.Variable(target_onehot, requires_grad=False)
+
+ # setup the modifier variable, this is the variable we are optimizing over
+ modifier = torch.zeros(input_var.size()).float()
+ if self.init_rand:
+ # Experiment with a non-zero starting point...
+ modifier = torch.normal(means=modifier, std=0.001)
+ if self.cuda:
+ modifier = modifier.cuda()
+ modifier_var = autograd.Variable(modifier, requires_grad=True)
+
+ optimizer = optim.Adam([modifier_var], lr=self.learning_rate)
+
+ for search_step in range(self.binary_search_steps):
+ print('Batch: {0:>3}, search step: {1}'.format(batch_idx, search_step))
+ if self.debug:
+ print('Const:')
+ for i, x in enumerate(scale_const):
+ print(i, x)
+ best_l2 = [1e10] * batch_size
+ best_score = [-1] * batch_size
+
+ # The last iteration (if we run many steps) repeat the search once.
+ if self.repeat and search_step == self.binary_search_steps - 1:
+ scale_const = upper_bound
+
+ scale_const_tensor = torch.from_numpy(scale_const).float()
+ if self.cuda:
+ scale_const_tensor = scale_const_tensor.cuda()
+ scale_const_var = autograd.Variable(scale_const_tensor, requires_grad=False)
+
+ prev_loss = 1e6
+ for step in range(self.max_steps):
+ # perform the attack
+ loss, dist, output, adv_img = self._optimize(
+ optimizer,
+ model,
+ input_var,
+ modifier_var,
+ target_var,
+ scale_const_var,
+ input_orig)
+
+ if step % 100 == 0 or step == self.max_steps - 1:
+ print('Step: {0:>4}, loss: {1:6.4f}, dist: {2:8.5f}, modifier mean: {3:.5e}'.format(
+ step, loss, dist.mean(), modifier_var.data.mean()))
+
+ if self.abort_early and step % (self.max_steps // 10) == 0:
+ if loss > prev_loss * .9999:
+ print('Aborting early...')
+ break
+ prev_loss = loss
+
+ # update best result found
+ for i in range(batch_size):
+ target_label = target[i]
+ output_logits = output[i]
+ output_label = np.argmax(output_logits)
+ di = dist[i]
+ if self.debug:
+ if step % 100 == 0:
+ print('{0:>2} dist: {1:.5f}, output: {2:>3}, {3:5.3}, target {4:>3}'.format(
+ i, di, output_label, output_logits[output_label], target_label))
+ if di < best_l2[i] and self._compare(output_logits, target_label):
+ if self.debug:
+ print('{0:>2} best step, prev dist: {1:.5f}, new dist: {2:.5f}'.format(
+ i, best_l2[i], di))
+ best_l2[i] = di
+ best_score[i] = output_label
+ if di < o_best_l2[i] and self._compare(output_logits, target_label):
+ if self.debug:
+ print('{0:>2} best total, prev dist: {1:.5f}, new dist: {2:.5f}'.format(
+ i, o_best_l2[i], di))
+ o_best_l2[i] = di
+ o_best_score[i] = output_label
+ o_best_attack[i] = adv_img[i]
+
+ sys.stdout.flush()
+ # end inner step loop
+
+ # adjust the constants
+ batch_failure = 0
+ batch_success = 0
+ for i in range(batch_size):
+ if self._compare(best_score[i], target[i]) and best_score[i] != -1:
+ # successful, do binary search and divide const by two
+ upper_bound[i] = min(upper_bound[i], scale_const[i])
+ if upper_bound[i] < 1e9:
+ scale_const[i] = (lower_bound[i] + upper_bound[i]) / 2
+ if self.debug:
+ print('{0:>2} successful attack, lowering const to {1:.3f}'.format(
+ i, scale_const[i]))
+ else:
+ # failure, multiply by 10 if no solution found
+ # or do binary search with the known upper bound
+ lower_bound[i] = max(lower_bound[i], scale_const[i])
+ if upper_bound[i] < 1e9:
+ scale_const[i] = (lower_bound[i] + upper_bound[i]) / 2
+ else:
+ scale_const[i] *= 10
+ if self.debug:
+ print('{0:>2} failed attack, raising const to {1:.3f}'.format(
+ i, scale_const[i]))
+ if self._compare(o_best_score[i], target[i]) and o_best_score[i] != -1:
+ batch_success += 1
+ else:
+ batch_failure += 1
+
+ print('Num failures: {0:2d}, num successes: {1:2d}\n'.format(batch_failure, batch_success))
+ sys.stdout.flush()
+ # end outer search loop
+
+ return o_best_attack
diff --git a/case_studies/odds/original/carlini_wagner_helpers.py b/case_studies/odds/original/carlini_wagner_helpers.py
new file mode 100644
index 0000000..7f4857e
--- /dev/null
+++ b/case_studies/odds/original/carlini_wagner_helpers.py
@@ -0,0 +1,89 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# from https://github.com/rwightman/pytorch-nips2017-attack-example
+import torch
+import operator as op
+import functools as ft
+
+
+'''reduce_* helper functions reduce tensors on all dimensions but the first.
+They are intended to be used on batched tensors where dim 0 is the batch dim.
+'''
+
+
+def reduce_sum(x, keepdim=True):
+ # silly PyTorch, when will you get proper reducing sums/means?
+ for a in reversed(range(1, x.dim())):
+ x = x.sum(a, keepdim=keepdim)
+ return x
+
+
+def reduce_mean(x, keepdim=True):
+ numel = ft.reduce(op.mul, x.size()[1:])
+ x = reduce_sum(x, keepdim=keepdim)
+ return x / numel
+
+
+def reduce_min(x, keepdim=True):
+ for a in reversed(range(1, x.dim())):
+ x = x.min(a, keepdim=keepdim)[0]
+ return x
+
+
+def reduce_max(x, keepdim=True):
+ for a in reversed(range(1, x.dim())):
+ x = x.max(a, keepdim=keepdim)[0]
+ return x
+
+
+def torch_arctanh(x, eps=1e-6):
+ x *= (1. - eps)
+ return (torch.log((1 + x) / (1 - x))) * 0.5
+
+
+def l2r_dist(x, y, keepdim=True, eps=1e-8):
+ d = (x - y)**2
+ d = reduce_sum(d, keepdim=keepdim)
+ d += eps # to prevent infinite gradient at 0
+ return d.sqrt()
+
+
+def l2_dist(x, y, keepdim=True):
+ d = (x - y)**2
+ return reduce_sum(d, keepdim=keepdim)
+ # d = torch.abs(x - y)
+ # return reduce_max(d, keepdim=keepdim)
+
+
+def l1_dist(x, y, keepdim=True):
+ d = torch.abs(x - y)
+ return reduce_sum(d, keepdim=keepdim)
+
+
+def l2_norm(x, keepdim=True):
+ norm = reduce_sum(x*x, keepdim=keepdim)
+ return norm.sqrt()
+
+
+def l1_norm(x, keepdim=True):
+ return reduce_sum(x.abs(), keepdim=keepdim)
+
+
+def rescale(x, x_min=-1., x_max=1.):
+ return x * (x_max - x_min) + x_min
+
+
+def tanh_rescale(x, x_min=-1., x_max=1.):
+ return (torch.tanh(x) + 1) * 0.5 * (x_max - x_min) + x_min
diff --git a/case_studies/odds/original/cifar_model.py b/case_studies/odds/original/cifar_model.py
new file mode 100644
index 0000000..101f2ad
--- /dev/null
+++ b/case_studies/odds/original/cifar_model.py
@@ -0,0 +1,140 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import torch as th
+import torch.nn as nn
+import torch.utils.model_zoo as model_zoo
+from collections import OrderedDict
+
+model_urls = {
+ 'cifar10': 'http://ml.cs.tsinghua.edu.cn/~chenxi/pytorch-models/cifar10-d875770b.pth',
+ 'cifar10_tiny': os.path.expanduser('~/models/advhyp/cifar10_tiny/cifar10_tiny-38058c52.pth'),
+ 'cifar10_tinyb': os.path.expanduser('~/models/advhyp/cifar10_tinyb/cifar10_tinyb-7ab86c47.pth'),
+ 'carlini': os.path.expanduser('~/models/advhyp/carlini/carlini-caa52d4e.pth'),
+ 'cifar10_tinyb_adv': os.path.expanduser('~/models/advhyp/cifar10_tinyb_adv/cifar10_tinyb_adv-ac4936dc.pth'),
+ 'cifar100': 'http://ml.cs.tsinghua.edu.cn/~chenxi/pytorch-models/cifar100-3a55a987.pth',
+}
+
+class CIFAR(nn.Module):
+ def __init__(self, features, n_channel, num_classes):
+ super(CIFAR, self).__init__()
+ assert isinstance(features, nn.Sequential), type(features)
+ self.features = features
+ self.classifier = nn.Sequential(
+ nn.Linear(n_channel, num_classes)
+ )
+
+ def forward(self, x):
+ x = self.features(x)
+ x = x.view(x.size(0), -1)
+ x = self.classifier(x)
+ return x
+
+
+class Carlini(nn.Module):
+ def __init__(self, features, n_channel):
+ super(Carlini, self).__init__()
+ assert isinstance(features, nn.Sequential), type(features)
+ self.features = features
+ self.classifier = nn.Sequential(
+ nn.Linear(n_channel, 256),
+ nn.ReLU(),
+ nn.Dropout(),
+ nn.Linear(256, 256),
+ nn.ReLU(),
+ nn.Linear(256, 10)
+ )
+
+ def forward(self, x):
+ x = self.features(x)
+ x = x.view(x.size(0), -1)
+ x = self.classifier(x)
+ return x
+
+
+def make_layers(cfg, batch_norm=False):
+ layers = []
+ in_channels = 3
+ for i, v in enumerate(cfg):
+ if v == 'M':
+ layers += [nn.MaxPool2d(kernel_size=2, stride=2)]
+ else:
+ padding = v[1] if isinstance(v, tuple) else 1
+ out_channels = v[0] if isinstance(v, tuple) else v
+ conv2d = nn.Conv2d(in_channels, out_channels, kernel_size=3, padding=padding)
+ if batch_norm:
+ layers += [conv2d, nn.BatchNorm2d(out_channels, affine=False), nn.ReLU()]
+ else:
+ layers += [conv2d, nn.ReLU()]
+ in_channels = out_channels
+ return nn.Sequential(*layers)
+
+def cifar10_tiny(n_channel, pretrained=False, map_location=None, padding=1, trained_adv=False):
+ if padding == 1:
+ cfg = [(n_channel, padding), 'M', (n_channel, padding), 'M', (2*n_channel, padding), 'M', (2*n_channel, 0), 'M']
+ elif padding == 0:
+ cfg = [(n_channel, padding), (n_channel, padding), 'M', (2*n_channel, padding), 'M', (2*n_channel, 0), 'M']
+ layers = make_layers(cfg, batch_norm=False)
+ model = CIFAR(layers, n_channel=2*n_channel if padding == 1 else 4*2*n_channel, num_classes=10)
+ if pretrained or trained_adv:
+ if padding == 1:
+ state_dict = th.load(model_urls['cifar10_tiny'], map_location=map_location)
+ elif padding == 0:
+ if trained_adv and pretrained:
+ state_dict = th.load(model_urls['cifar10_tinyb_adv'], map_location=map_location)
+ else:
+ state_dict = th.load(model_urls['cifar10_tinyb'], map_location=map_location)
+ assert isinstance(state_dict, (dict, OrderedDict)), type(state_dict)
+ model.load_state_dict(state_dict)
+ return model
+
+def cifar10(n_channel, pretrained=False, map_location=None, trained_adv=False):
+ cfg = [n_channel, n_channel, 'M', 2*n_channel, 2*n_channel, 'M', 4*n_channel, 4*n_channel, 'M', (8*n_channel, 0), 'M']
+ layers = make_layers(cfg, batch_norm=True)
+ model = CIFAR(layers, n_channel=8*n_channel, num_classes=10)
+ if pretrained or trained_adv:
+ if trained_adv and pretrained:
+ m = th.load(model_urls['cifar10_adv'], map_location=map_location)
+ else:
+ m = model_zoo.load_url(model_urls['cifar10'], map_location=map_location)
+ state_dict = m.state_dict() if isinstance(m, nn.Module) else m
+ assert isinstance(state_dict, (dict, OrderedDict)), type(state_dict)
+ model.load_state_dict(state_dict)
+ return model
+
+def carlini(pretrained=False, map_location=None, trained_adv=False):
+ cfg = [(64, 0), (64, 0), 'M', (128, 0), (128, 0), 'M']
+ layers = make_layers(cfg, batch_norm=False)
+ model = Carlini(layers, n_channel=128*5*5)
+ if pretrained or trained_adv:
+ if trained_adv and pretrained:
+ state_dict= th.load(model_urls['carlini_adv'], map_location=map_location)
+ else:
+ state_dict = th.load(model_urls['carlini'], map_location=map_location)
+ assert isinstance(state_dict, (dict, OrderedDict)), type(state_dict)
+ model.load_state_dict(state_dict)
+ return model
+
+def cifar100(n_channel, pretrained=None):
+ cfg = [n_channel, n_channel, 'M', 2*n_channel, 2*n_channel, 'M', 4*n_channel, 4*n_channel, 'M', (8*n_channel, 0), 'M']
+ layers = make_layers(cfg, batch_norm=True)
+ model = CIFAR(layers, n_channel=8*n_channel, num_classes=100)
+ if pretrained is not None:
+ m = model_zoo.load_url(model_urls['cifar100'])
+ state_dict = m.state_dict() if isinstance(m, nn.Module) else m
+ assert isinstance(state_dict, (dict, OrderedDict)), type(state_dict)
+ model.load_state_dict(state_dict)
+ return model
+
diff --git a/case_studies/odds/original/fetch_Madry_ResNet.py b/case_studies/odds/original/fetch_Madry_ResNet.py
new file mode 100644
index 0000000..496c3f5
--- /dev/null
+++ b/case_studies/odds/original/fetch_Madry_ResNet.py
@@ -0,0 +1,60 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Downloads a model, computes its SHA256 hash and unzips it
+ at the proper location."""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import sys
+import zipfile
+import hashlib
+
+if len(sys.argv) == 1 or sys.argv[1] not in ['natural',
+ 'adv_trained',
+ 'secret']:
+ print('Usage: python fetch_Madry_ResNet.py [natural, adv_trained]')
+ sys.exit(1)
+
+if sys.argv[1] == 'natural':
+ url = 'https://www.dropbox.com/s/cgzd5odqoojvxzk/natural.zip?dl=1'
+elif sys.argv[1] == 'adv_trained':
+ url = 'https://www.dropbox.com/s/g4b6ntrp8zrudbz/adv_trained.zip?dl=1'
+else: # fetch secret model
+ url = 'https://www.dropbox.com/s/ywc0hg8lr5ba8zd/secret.zip?dl=1'
+
+fname = url.split('/')[-1].split('?')[0] # get the name of the file
+
+# model download
+print('Downloading models')
+if sys.version_info >= (3,):
+ import urllib.request
+ urllib.request.urlretrieve(url, fname)
+else:
+ import urllib
+ urllib.urlretrieve(url, fname)
+
+# computing model hash
+sha256 = hashlib.sha256()
+with open(fname, 'rb') as f:
+ data = f.read()
+ sha256.update(data)
+print('SHA256 hash: {}'.format(sha256.hexdigest()))
+
+# extracting model
+print('Extracting model')
+with zipfile.ZipFile(fname, 'r') as model_zip:
+ model_zip.extractall()
+ print('Extracted model in {}'.format(model_zip.namelist()[0]))
diff --git a/case_studies/odds/original/logit_matching_attack.py b/case_studies/odds/original/logit_matching_attack.py
new file mode 100644
index 0000000..4b9bc16
--- /dev/null
+++ b/case_studies/odds/original/logit_matching_attack.py
@@ -0,0 +1,325 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import functools
+
+import cleverhans.model
+import torch
+from cleverhans import utils_tf
+from cleverhans.attacks import Attack
+import cleverhans.attacks
+from cleverhans.utils_tf import clip_eta
+
+import os
+import math
+import numpy as np
+import tensorflow as tf
+
+
+class ProjectedGradientDescentWithDetectorLogitMatching(Attack):
+ def __init__(self, model, get_features_for_detector,
+ sess=None, dtypestr='float32',
+ default_rand_init=True, verbose=False, eot_ensemble_size=None,
+ eot_multinoise=False, **kwargs):
+ """
+ Create a ProjectedGradientDescent instance.
+ Note: the model parameter should be an instance of the
+ cleverhans.model.Model abstraction provided by CleverHans.
+ """
+
+ super(ProjectedGradientDescentWithDetectorLogitMatching, self).__init__(model, sess=sess,
+ dtypestr=dtypestr, **kwargs)
+ self.feedable_kwargs = ('eps', 'eps_iter', 'clip_min',
+ 'clip_max', 'loss_lambda')
+ self.structural_kwargs = ['ord', 'nb_iter', 'rand_init', 'sanity_checks']
+ self.default_rand_init = default_rand_init
+ self.get_features_for_detector = get_features_for_detector
+ self.verbose = verbose
+
+ self.eot_ensemble_size = eot_ensemble_size
+ assert eot_ensemble_size is None or eot_ensemble_size > 0
+ self.eot_multinoise = eot_multinoise
+
+ def generate(self, x, x_reference, **kwargs):
+ """
+ Generate symbolic graph for adversarial examples and return.
+ :param x: The model's symbolic inputs.
+ :param kwargs: See `parse_params`
+ """
+ # Parse and save attack-specific parameters
+ assert self.parse_params(**kwargs)
+
+ asserts = []
+
+ # If a data range was specified, check that the input was in that range
+ if self.clip_min is not None:
+ asserts.append(utils_tf.assert_greater_equal(x,
+ tf.cast(self.clip_min,
+ x.dtype)))
+
+ if self.clip_max is not None:
+ asserts.append(utils_tf.assert_less_equal(x,
+ tf.cast(self.clip_max,
+ x.dtype)))
+
+ # Initialize loop variables
+ if self.rand_init:
+ eta = tf.random_uniform(tf.shape(x),
+ tf.cast(-self.rand_minmax, x.dtype),
+ tf.cast(self.rand_minmax, x.dtype),
+ dtype=x.dtype)
+ else:
+ eta = tf.zeros(tf.shape(x))
+
+ # Clip eta
+ eta = clip_eta(eta, self.ord, self.eps)
+ adv_x = x + eta
+ if self.clip_min is not None or self.clip_max is not None:
+ adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)
+
+ fgm_params = {
+ 'eps': self.eps_iter,
+ 'ord': self.ord,
+ 'clip_min': self.clip_min,
+ 'clip_max': self.clip_max,
+ "eot_ensemble_size": self.eot_ensemble_size,
+ "eot_multinoise": self.eot_multinoise,
+ }
+ if self.ord == 1:
+ raise NotImplementedError("It's not clear that FGM is a good inner loop"
+ " step for PGD when ord=1, because ord=1 FGM "
+ " changes only one pixel at a time. We need "
+ " to rigorously test a strong ord=1 PGD "
+ "before enabling this feature.")
+
+ def cond(i, _):
+ return tf.less(i, self.nb_iter)
+
+ def body(i, adv_x):
+ adv_x = self.fgm_generate(x_adv=adv_x,
+ x_reference=x_reference,
+ **fgm_params, step=i)
+
+ # Clipping perturbation eta to self.ord norm ball
+ eta = adv_x - x
+ eta = clip_eta(eta, self.ord, self.eps)
+ adv_x = x + eta
+
+ # Redo the clipping.
+ # FGM already did it, but subtracting and re-adding eta can add some
+ # small numerical error.
+ if self.clip_min is not None or self.clip_max is not None:
+ adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)
+
+ return i + 1, adv_x
+
+ _, adv_x = tf.while_loop(cond, body, [tf.zeros([]), adv_x], back_prop=True)
+
+
+ # Asserts run only on CPU.
+ # When multi-GPU eval code tries to force all PGD ops onto GPU, this
+ # can cause an error.
+ #asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps_iter,
+ # dtype=self.eps.dtype),
+ # self.eps))
+ if self.ord == np.inf and self.clip_min is not None:
+ # The 1e-6 is needed to compensate for numerical error.
+ # Without the 1e-6 this fails when e.g. eps=.2, clip_min=.5,
+ # clip_max=.7
+ asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps, x.dtype),
+ 1e-6 + tf.cast(self.clip_max,
+ x.dtype)
+ - tf.cast(self.clip_min,
+ x.dtype)))
+
+ if self.sanity_checks:
+ with tf.control_dependencies(asserts):
+ adv_x = tf.identity(adv_x)
+
+ return adv_x
+
+ def fgm_generate(self,
+ x_adv,
+ x_reference,
+ step,
+ eps=0.3,
+ ord=np.inf,
+ clip_min=None,
+ clip_max=None,
+ targeted=False,
+ sanity_checks=True,
+ eot_ensemble_size=None,
+ eot_multinoise=False):
+ asserts = []
+
+ # If a data range was specified, check that the input was in that range
+ if clip_min is not None:
+ asserts.append(utils_tf.assert_greater_equal(
+ x_adv, tf.cast(clip_min, x_adv.dtype)))
+
+ if clip_max is not None:
+ asserts.append(utils_tf.assert_less_equal(x_adv, tf.cast(clip_max, x_adv.dtype)))
+
+ if targeted:
+ raise ValueError("targeted mode not supported")
+
+ # while this check looks good in theory in pratice it doesnt make sense
+ # since the softmax op might not add an additional AddV2 operation at the end
+ # Make sure the caller has not passed probs by accident
+ #assert logits.op.type != 'Softmax'
+ #assert target_logits.op.type != 'Softmax'
+
+ target_detector_features = tf.stop_gradient(
+ self.get_features_for_detector(x_reference))
+ labels = tf.one_hot(self.y, 2)
+ if eot_ensemble_size is None:
+ # no EOT
+ detector_features = self.get_features_for_detector(x_adv)
+ classifier_logits = self.model.get_logits(x_adv)
+ real = tf.reduce_sum(labels * classifier_logits, -1)
+ other = tf.reduce_max((1-labels) * classifier_logits - (labels*10000), -1)
+ classifier_loss = -tf.clip_by_value(real - other, -1e-2, 1e9)
+ detector_features_matching_loss = -tf.reduce_mean(
+ tf.reduce_sum((detector_features - target_detector_features)**2,-1),
+ 0)
+ loss = self.loss_lambda * classifier_loss + (1.0 - self.loss_lambda) * detector_features_matching_loss
+
+ # Define gradient of loss wrt input
+ grad, = tf.gradients(loss, x_adv)
+ grad = tf.stop_gradient(grad)
+ else:
+ grads = []
+ for i in range(eot_ensemble_size):
+ if i == 0:
+ # dont add noise to first forward pass
+ x_adv_noisy = x_adv
+ else:
+ if eot_multinoise:
+ if i % 2 == 0:
+ noise = tf.random.normal(tf.shape(x_adv), 0.0, 1.0)
+ elif i % 2 == 1:
+ noise = tf.random.uniform(tf.shape(x_adv), -1.0, 1.0)
+ else:
+ # defined in https://github.com/wielandbrendel/adaptive_attacks_paper/blob/master/02_odds/Attack.ipynb
+ # but doesnt make sense to me since this never gets called
+ noise = tf.sign(tf.random.uniform(tf.shape(x_adv), -1.0, 1.0))
+ noise *= 0.01 * 255.0
+ else:
+ noise = tf.random.normal(tf.shape(x_adv), 0.0, 1.0)
+ noise *= 2.0
+ x_adv_noisy = tf.clip_by_value(x_adv + noise, 0, 255.0)
+ detector_features = self.get_features_for_detector(x_adv_noisy)
+ classifier_logits = self.model.get_logits(x_adv_noisy)
+ real = tf.reduce_sum(labels * classifier_logits, -1)
+ other = tf.reduce_max((1-labels) * classifier_logits - (labels*10000), -1)
+ classifier_loss = -tf.clip_by_value(real - other, -1e-2, 1e9)
+ detector_features_matching_loss = -tf.reduce_mean(
+ tf.reduce_sum((detector_features - target_detector_features)**2,-1),
+ 0)
+ loss = self.loss_lambda * classifier_loss + (1.0 - self.loss_lambda) * detector_features_matching_loss
+
+ # Define gradient of loss wrt input
+ grad, = tf.gradients(loss, x_adv_noisy)
+ grad = tf.stop_gradient(grad)
+ grads.append(grad)
+ grad = tf.reduce_mean(grads, axis=0)
+
+ optimal_perturbation = cleverhans.attacks.optimize_linear(grad, eps, ord)
+
+ # Add perturbation to original example to obtain adversarial example
+ adv_x = x_adv + optimal_perturbation
+
+ # If clipping is needed, reset all values outside of [clip_min, clip_max]
+ if (clip_min is not None) or (clip_max is not None):
+ # We don't currently support one-sided clipping
+ assert clip_min is not None and clip_max is not None
+ adv_x = utils_tf.clip_by_value(adv_x, clip_min, clip_max)
+
+ if sanity_checks:
+ with tf.control_dependencies(asserts):
+ adv_x = tf.identity(adv_x)
+
+ if self.verbose:
+ adv_x = tf.Print(adv_x, [step, loss, classifier_loss, detector_features_matching_loss])
+
+ return adv_x
+
+ def parse_params(self,
+ eps=0.3,
+ eps_iter=0.05,
+ nb_iter=10,
+ y=None,
+ ord=np.inf,
+ clip_min=None,
+ clip_max=None,
+ y_target=None,
+ rand_init=None,
+ rand_minmax=0.3,
+ sanity_checks=True,
+ loss_lambda=0.5,
+ **kwargs):
+ """
+ Take in a dictionary of parameters and applies attack-specific checks
+ before saving them as attributes.
+ Attack-specific parameters:
+ :param eps: (optional float) maximum distortion of adversarial example
+ compared to original input
+ :param eps_iter: (optional float) step size for each attack iteration
+ :param nb_iter: (optional int) Number of attack iterations.
+ :param y: (optional) A tensor with the true labels.
+ :param y_target: (optional) A tensor with the labels to target. Leave
+ y_target=None if y is also set. Labels should be
+ one-hot-encoded.
+ :param ord: (optional) Order of the norm (mimics Numpy).
+ Possible values: np.inf, 1 or 2.
+ :param clip_min: (optional float) Minimum input component value
+ :param clip_max: (optional float) Maximum input component value
+ :param sanity_checks: bool Insert tf asserts checking values
+ (Some tests need to run with no sanity checks because the
+ tests intentionally configure the attack strangely)
+ """
+
+ # Save attack-specific parameters
+ self.eps = eps
+ if rand_init is None:
+ rand_init = self.default_rand_init
+ self.rand_init = rand_init
+ if self.rand_init:
+ self.rand_minmax = eps
+ else:
+ self.rand_minmax = 0.
+ self.eps_iter = eps_iter
+ self.nb_iter = nb_iter
+ self.y = y
+ self.y_target = y_target
+ self.ord = ord
+ self.clip_min = clip_min
+ self.clip_max = clip_max
+
+ self.loss_lambda = loss_lambda
+
+ if isinstance(eps, float) and isinstance(eps_iter, float):
+ # If these are both known at compile time, we can check before anything
+ # is run. If they are tf, we can't check them yet.
+ assert eps_iter <= eps, (eps_iter, eps)
+
+ if self.y is not None and self.y_target is not None:
+ raise ValueError("Must not set both y and y_target")
+ # Check if order of the norm is acceptable given current implementation
+ if self.ord not in [np.inf, 1, 2]:
+ raise ValueError("Norm order must be either np.inf, 1, or 2.")
+ self.sanity_checks = sanity_checks
+
+ return True
diff --git a/case_studies/odds/original/tensorflow_example.py b/case_studies/odds/original/tensorflow_example.py
new file mode 100644
index 0000000..fd7a829
--- /dev/null
+++ b/case_studies/odds/original/tensorflow_example.py
@@ -0,0 +1,499 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+based on cleverhans' cifar10_tutorial_tf except that it uses Madry's wide-ResNet
+"""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+import logging
+import numpy as np
+import tensorflow as tf
+from tensorflow.python.platform import flags
+import time
+
+from cleverhans.attacks import MadryEtAl, CarliniWagnerL2
+from cleverhans.augmentation import random_horizontal_flip, random_shift
+from cleverhans.dataset import CIFAR10
+from cleverhans.loss import CrossEntropy
+from cleverhans.model_zoo.all_convolutional import ModelAllConvolutional
+from cleverhans.model_zoo.madry_lab_challenges.cifar10_model import make_wresnet as ResNet
+from cleverhans.utils_tf import initialize_uninitialized_global_variables
+from cleverhans.train import train
+from cleverhans.utils import AccuracyReport, set_log_level
+from cleverhans.utils_tf import tf_model_load, model_eval
+
+from cleverhans.evaluation import batch_eval
+import math
+import tqdm
+import os
+import tf_robustify
+from tensorboardX import SummaryWriter
+import pickle
+
+FLAGS = flags.FLAGS
+
+NB_EPOCHS = 6
+BATCH_SIZE = 128
+LEARNING_RATE = 0.001
+CLEAN_TRAIN = True
+BACKPROP_THROUGH_ATTACK = False
+NB_FILTERS = 64
+
+ARCHITECTURE = 'ResNet'
+LOAD_MODEL = True
+
+os.makedirs('logs', exist_ok=True)
+swriter = SummaryWriter('logs')
+
+def cifar10_tutorial(
+ train_start=0,
+ train_end=60000,
+ test_start=0,
+ test_end=10000,
+ nb_epochs=NB_EPOCHS,
+ batch_size=BATCH_SIZE,
+ architecture=ARCHITECTURE,
+ load_model=LOAD_MODEL,
+ ckpt_dir='None',
+ learning_rate=LEARNING_RATE,
+ clean_train=CLEAN_TRAIN,
+ backprop_through_attack=BACKPROP_THROUGH_ATTACK,
+ nb_filters=NB_FILTERS,
+ num_threads=None,
+ label_smoothing=0.):
+ """
+ CIFAR10 cleverhans tutorial
+ :param train_start: index of first training set example
+ :param train_end: index of last training set example
+ :param test_start: index of first test set example
+ :param test_end: index of last test set example
+ :param nb_epochs: number of epochs to train model
+ :param batch_size: size of training batches
+ :param learning_rate: learning rate for training
+ :param clean_train: perform normal training on clean examples only
+ before performing adversarial training.
+ :param backprop_through_attack: If True, backprop through adversarial
+ example construction process during
+ adversarial training.
+ :param label_smoothing: float, amount of label smoothing for cross entropy
+ :return: an AccuracyReport object
+ """
+
+ # Object used to keep track of (and return) key accuracies
+ report = AccuracyReport()
+
+ # Set TF random seed to improve reproducibility
+ tf.set_random_seed(int(time.time() * 1000) % 2**31)
+ np.random.seed(int(time.time() * 1001) % 2**31)
+
+ # Set logging level to see debug information
+ set_log_level(logging.DEBUG)
+
+ # Create TF session
+ if num_threads:
+ config_args = dict(intra_op_parallelism_threads=1)
+ else:
+ config_args = {}
+ sess = tf.Session(config=tf.ConfigProto(**config_args))
+
+ # Get CIFAR10 data
+ data = CIFAR10(train_start=train_start, train_end=train_end,
+ test_start=test_start, test_end=test_end)
+ dataset_size = data.x_train.shape[0]
+ dataset_train = data.to_tensorflow()[0]
+ dataset_train = dataset_train.map(
+ lambda x, y: (random_shift(random_horizontal_flip(x)), y), 4)
+ dataset_train = dataset_train.batch(batch_size)
+ dataset_train = dataset_train.prefetch(16)
+ x_train, y_train = data.get_set('train')
+
+ pgd_train = None
+ if FLAGS.load_pgd_train_samples:
+ pgd_path = os.path.expanduser('~/data/advhyp/{}/samples'.format(FLAGS.load_pgd_train_samples))
+ x_train = np.load(os.path.join(pgd_path, 'train_clean.npy'))
+ y_train = np.load(os.path.join(pgd_path, 'train_y.npy'))
+ pgd_train = np.load(os.path.join(pgd_path, 'train_pgd.npy'))
+ if x_train.shape[1] == 3:
+ x_train = x_train.transpose((0, 2, 3, 1))
+ pgd_train = pgd_train.transpose((0, 2, 3, 1))
+ if len(y_train.shape) == 1:
+ y_tmp = np.zeros((len(y_train), np.max(y_train)+1), y_train.dtype)
+ y_tmp[np.arange(len(y_tmp)), y_train] = 1.
+ y_train = y_tmp
+
+ x_test, y_test = data.get_set('test')
+ pgd_test = None
+ if FLAGS.load_pgd_test_samples:
+ pgd_path = os.path.expanduser('~/data/advhyp/{}/samples'.format(FLAGS.load_pgd_test_samples))
+ x_test = np.load(os.path.join(pgd_path, 'test_clean.npy'))
+ y_test = np.load(os.path.join(pgd_path, 'test_y.npy'))
+ pgd_test = np.load(os.path.join(pgd_path, 'test_pgd.npy'))
+ if x_test.shape[1] == 3:
+ x_test = x_test.transpose((0, 2, 3, 1))
+ pgd_test = pgd_test.transpose((0, 2, 3, 1))
+ if len(y_test.shape) == 1:
+ y_tmp = np.zeros((len(y_test), np.max(y_test)+1), y_test.dtype)
+ y_tmp[np.arange(len(y_tmp)), y_test] = 1.
+ y_test = y_tmp
+
+ train_idcs = np.arange(len(x_train))
+ np.random.shuffle(train_idcs)
+ x_train, y_train = x_train[train_idcs], y_train[train_idcs]
+ if pgd_train is not None:
+ pgd_train = pgd_train[train_idcs]
+ test_idcs = np.arange(len(x_test))[:FLAGS.test_size]
+ np.random.shuffle(test_idcs)
+ x_test, y_test = x_test[test_idcs], y_test[test_idcs]
+ if pgd_test is not None:
+ pgd_test = pgd_test[test_idcs]
+
+ # Use Image Parameters
+ img_rows, img_cols, nchannels = x_test.shape[1:4]
+ nb_classes = y_test.shape[1]
+
+ # Define input TF placeholder
+ x = tf.placeholder(tf.float32, shape=(None, img_rows, img_cols,
+ nchannels))
+ y = tf.placeholder(tf.float32, shape=(None, nb_classes))
+
+ # Train an MNIST model
+ train_params = {
+ 'nb_epochs': nb_epochs,
+ 'batch_size': batch_size,
+ 'learning_rate': learning_rate
+ }
+ eval_params = {'batch_size': batch_size}
+ pgd_params = {
+ # ord: ,
+ 'eps': FLAGS.eps,
+ 'eps_iter': (FLAGS.eps / 5),
+ 'nb_iter': 10,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+ cw_params = {
+ 'binary_search_steps': FLAGS.cw_search_steps,
+ 'max_iterations': FLAGS.cw_steps, #1000
+ 'abort_early': True,
+ 'learning_rate': FLAGS.cw_lr,
+ 'batch_size': batch_size,
+ 'confidence': 0,
+ 'initial_const': FLAGS.cw_c,
+ 'clip_min': 0,
+ 'clip_max': 255
+ }
+
+ # Madry dosen't divide by 255
+ x_train *= 255
+ x_test *= 255
+ if pgd_train is not None:
+ pgd_train *= 255
+ if pgd_test is not None:
+ pgd_test *= 255
+
+ print('x_train amin={} amax={}'.format(np.amin(x_train), np.amax(x_train)))
+ print('x_test amin={} amax={}'.format(np.amin(x_test), np.amax(x_test)))
+
+ print('clip_min : {}, clip_max : {} >> CHECK WITH WHICH VALUES THE CLASSIFIER WAS PRETRAINED !!! <<'
+ .format(pgd_params['clip_min'], pgd_params['clip_max']))
+
+ rng = np.random.RandomState() # [2017, 8, 30]
+ debug_dict = dict() if FLAGS.save_debug_dict else None
+
+ def do_eval(preds, x_set, y_set, report_key, is_adv=None, predictor=None, x_adv=None):
+ if predictor is None:
+ acc = model_eval(sess, x, y, preds, x_set, y_set, args=eval_params)
+ else:
+ do_eval(preds, x_set, y_set, report_key, is_adv=is_adv)
+ if x_adv is not None:
+ x_set_adv, = batch_eval(sess, [x], [x_adv], [x_set], batch_size=batch_size)
+ assert x_set.shape == x_set_adv.shape
+ x_set = x_set_adv
+ n_batches = math.ceil(x_set.shape[0] / batch_size)
+ p_set, p_det = np.concatenate([predictor.send(x_set[b*batch_size:(b+1)*batch_size]) for b in tqdm.trange(n_batches)]).T
+ acc = np.equal(p_set, y_set[:len(p_set)].argmax(-1)).mean()
+ # if is_adv:
+ # import IPython ; IPython.embed() ; exit(1)
+ if FLAGS.save_debug_dict:
+ debug_dict['x_set'] = x_set
+ debug_dict['y_set'] = y_set
+ ddfn = 'logs/debug_dict_{}.pkl'.format('adv' if is_adv else 'clean')
+ if not os.path.exists(ddfn):
+ with open(ddfn, 'wb') as f:
+ pickle.dump(debug_dict, f)
+ debug_dict.clear()
+ if is_adv is None:
+ report_text = None
+ elif is_adv:
+ report_text = 'adversarial'
+ else:
+ report_text = 'legitimate'
+ if report_text:
+ print('Test accuracy on %s examples %s: %0.4f' % (report_text, 'with correction' if predictor is not None else 'without correction', acc))
+ if is_adv is not None:
+ label = 'test_acc_{}_{}'.format(report_text, 'corrected' if predictor else 'uncorrected')
+ swriter.add_scalar(label, acc)
+ if predictor is not None:
+ detect = np.equal(p_det, is_adv).mean()
+ label = 'test_det_{}_{}'.format(report_text, 'corrected' if predictor else 'uncorrected')
+ print(label, detect)
+ swriter.add_scalar(label, detect)
+ label = 'test_dac_{}_{}'.format(report_text, 'corrected' if predictor else 'uncorrected')
+ swriter.add_scalar(label, np.equal(p_set, y_set[:len(p_set)].argmax(-1))[np.equal(p_det, is_adv)].mean())
+
+ return acc
+
+ if clean_train:
+ if architecture == 'ConvNet':
+ model = ModelAllConvolutional('model1', nb_classes, nb_filters,
+ input_shape=[32, 32, 3])
+ elif architecture == 'ResNet':
+ model = ResNet(scope='ResNet')
+ else:
+ raise Exception('Specify valid classifier architecture!')
+
+ preds = model.get_logits(x)
+ loss = CrossEntropy(model, smoothing=label_smoothing)
+
+ if load_model:
+ model_name = 'naturally_trained'
+ if FLAGS.load_adv_trained:
+ model_name = 'adv_trained'
+ if ckpt_dir is not 'None':
+ ckpt = tf.train.get_checkpoint_state(os.path.join(
+ os.path.expanduser(ckpt_dir), model_name))
+ else:
+ ckpt = tf.train.get_checkpoint_state(
+ './models/' + model_name)
+ ckpt_path = False if ckpt is None else ckpt.model_checkpoint_path
+
+ saver = tf.train.Saver(var_list=dict((v.name.split('/', 1)[1].split(':')[0], v) for v in tf.global_variables()))
+ saver.restore(sess, ckpt_path)
+ print('\nMODEL SUCCESSFULLY LOADED from : {}'.format(ckpt_path))
+
+ initialize_uninitialized_global_variables(sess)
+
+ else:
+ def evaluate():
+ do_eval(preds, x_test, y_test, 'clean_train_clean_eval', False)
+
+ train(sess, loss, None, None,
+ dataset_train=dataset_train, dataset_size=dataset_size,
+ evaluate=evaluate, args=train_params, rng=rng,
+ var_list=model.get_params())
+
+ logits_op = preds.op
+ while logits_op.type != 'MatMul':
+ logits_op = logits_op.inputs[0].op
+ latent_x_tensor, weights = logits_op.inputs
+ logits_tensor = preds
+
+ nb_classes = weights.shape[-1].value
+
+ if not FLAGS.save_pgd_samples:
+ noise_eps = FLAGS.noise_eps.split(',')
+ if FLAGS.noise_eps_detect is None:
+ FLAGS.noise_eps_detect = FLAGS.noise_eps
+ noise_eps_detect = FLAGS.noise_eps_detect.split(',')
+ if pgd_train is not None:
+ pgd_train = pgd_train[:FLAGS.n_collect]
+ if not FLAGS.passthrough:
+ predictor = tf_robustify.collect_statistics(x_train[:FLAGS.n_collect], y_train[:FLAGS.n_collect], x, sess, logits_tensor=logits_tensor, latent_x_tensor=latent_x_tensor, weights=weights, nb_classes=nb_classes, p_ratio_cutoff=FLAGS.p_ratio_cutoff, noise_eps=noise_eps, noise_eps_detect=noise_eps_detect, pgd_eps=pgd_params['eps'], pgd_lr=pgd_params['eps_iter'] / pgd_params['eps'], pgd_iters=pgd_params['nb_iter'], save_alignments_dir='logs/stats' if FLAGS.save_alignments else None, load_alignments_dir=os.path.expanduser('~/data/advhyp/madry/stats') if FLAGS.load_alignments else None, clip_min=pgd_params['clip_min'], clip_max=pgd_params['clip_max'], batch_size=batch_size, num_noise_samples=FLAGS.num_noise_samples, debug_dict=debug_dict, debug=FLAGS.debug, targeted=False, pgd_train=pgd_train, fit_classifier=FLAGS.fit_classifier, clip_alignments=FLAGS.clip_alignments, just_detect=FLAGS.just_detect)
+ else:
+ def _predictor():
+ _x = yield
+ while(_x is not None):
+ _y = sess.run(preds, {x: _x}).argmax(-1)
+ _x = yield np.stack((_y, np.zeros_like(_y)), -1)
+ predictor = _predictor()
+ next(predictor)
+ if FLAGS.save_alignments:
+ exit(0)
+
+ # Evaluate the accuracy of the model on clean examples
+ acc_clean = do_eval(preds, x_test, y_test, 'clean_train_clean_eval', False, predictor=predictor)
+
+ # Initialize the PGD attack object and graph
+ if FLAGS.attack == 'pgd':
+ pgd = MadryEtAl(model, sess=sess)
+ adv_x = pgd.generate(x, **pgd_params)
+ elif FLAGS.attack == 'cw':
+ cw = CarliniWagnerL2(model, sess=sess)
+ adv_x = cw.generate(x, **cw_params)
+ elif FLAGS.attack == 'mean':
+ pgd = MadryEtAl(model, sess=sess)
+ mean_eps = FLAGS.mean_eps * FLAGS.eps
+ def _attack_mean(x):
+ x_many = tf.tile(x[None], (FLAGS.mean_samples, 1, 1, 1))
+ x_noisy = x_many + tf.random_uniform(x_many.shape, -mean_eps, mean_eps)
+ x_noisy = tf.clip_by_value(x_noisy, 0, 255)
+ x_pgd = pgd.generate(x_noisy, **pgd_params)
+ x_clip = tf.minimum(x_pgd, x_many + FLAGS.eps)
+ x_clip = tf.maximum(x_clip, x_many - FLAGS.eps)
+ x_clip = tf.clip_by_value(x_clip, 0, 255)
+ return x_clip
+ adv_x = tf.map_fn(_attack_mean, x)
+ adv_x = tf.reduce_mean(adv_x, 1)
+
+
+ preds_adv = model.get_logits(adv_x)
+
+ if FLAGS.save_pgd_samples:
+ for ds, y, name in ((x_train, y_train, 'train'), (x_test, y_test, 'test')):
+ train_batches = math.ceil(len(ds) / FLAGS.batch_size)
+ train_pgd = np.concatenate([sess.run(adv_x, {x: ds[b*FLAGS.batch_size:(b+1)*FLAGS.batch_size]}) for b in tqdm.trange(train_batches)])
+ np.save('logs/{}_clean.npy'.format(name), ds / 255.)
+ np.save('logs/{}_y.npy'.format(name), y)
+ train_pgd /= 255.
+ np.save('logs/{}_pgd.npy'.format(name), train_pgd)
+ exit(0)
+
+ # Evaluate the accuracy of the model on adversarial examples
+ if not FLAGS.load_pgd_test_samples:
+ acc_pgd = do_eval(preds_adv, x_test, y_test, 'clean_train_adv_eval', True, predictor=predictor, x_adv=adv_x)
+ else:
+ acc_pgd = do_eval(preds, pgd_test, y_test, 'clean_train_adv_eval', True, predictor=predictor)
+ swriter.add_scalar('test_acc_mean', (acc_clean + acc_pgd) / 2., 0)
+
+ print('Repeating the process, using adversarial training')
+
+ exit(0)
+ # Create a new model and train it to be robust to MadryEtAl
+ if architecture == 'ConvNet':
+ model2 = ModelAllConvolutional('model2', nb_classes, nb_filters,
+ input_shape=[32, 32, 3])
+ elif architecture == 'ResNet':
+ model = ResNet()
+ else:
+ raise Exception('Specify valid classifier architecture!')
+
+ pgd2 = MadryEtAl(model2, sess=sess)
+
+ def attack(x):
+ return pgd2.generate(x, **pgd_params)
+
+ loss2 = CrossEntropy(model2, smoothing=label_smoothing, attack=attack)
+ preds2 = model2.get_logits(x)
+ adv_x2 = attack(x)
+
+ if not backprop_through_attack:
+ # For some attacks, enabling this flag increases the cost of
+ # training, but gives the defender the ability to anticipate how
+ # the atacker will change their strategy in response to updates to
+ # the defender's parameters.
+ adv_x2 = tf.stop_gradient(adv_x2)
+ preds2_adv = model2.get_logits(adv_x2)
+
+ if load_model:
+ if ckpt_dir is not 'None':
+ ckpt = tf.train.get_checkpoint_state(os.path.join(
+ os.path.expanduser(ckpt_dir), 'adv_trained'))
+ else:
+ ckpt = tf.train.get_checkpoint_state('./models/adv_trained')
+ ckpt_path = False if ckpt is None else ckpt.model_checkpoint_path
+
+ assert ckpt_path and tf_model_load(
+ sess, file_path=ckpt_path), '\nMODEL LOADING FAILED'
+ print('\nMODEL SUCCESSFULLY LOADED from : {}'.format(ckpt_path))
+
+ initialize_uninitialized_global_variables(sess)
+
+ else:
+
+ def evaluate2():
+ # Accuracy of adversarially trained model on legitimate test inputs
+ do_eval(preds2, x_test, y_test, 'adv_train_clean_eval', False)
+ # Accuracy of the adversarially trained model on adversarial
+ # examples
+ do_eval(preds2_adv, x_test, y_test, 'adv_train_adv_eval', True)
+
+ # Perform and evaluate adversarial training
+ train(sess, loss2, None, None,
+ dataset_train=dataset_train, dataset_size=dataset_size,
+ evaluate=evaluate2, args=train_params, rng=rng,
+ var_list=model2.get_params())
+
+ # Evaluate model
+ do_eval(preds2, x_test, y_test, 'adv_train_clean_eval', False)
+ do_eval(preds2_adv, x_test, y_test, 'adv_train_adv_eval', True)
+
+ return report
+
+
+def main(argv=None):
+ from cleverhans_tutorials import check_installation
+ check_installation(__file__)
+
+ cifar10_tutorial(nb_epochs=FLAGS.nb_epochs, batch_size=FLAGS.batch_size,
+ learning_rate=FLAGS.learning_rate,
+ clean_train=FLAGS.clean_train,
+ architecture=FLAGS.architecture,
+ load_model=FLAGS.load_model,
+ ckpt_dir=FLAGS.ckpt_dir,
+ backprop_through_attack=FLAGS.backprop_through_attack,
+ nb_filters=FLAGS.nb_filters,
+ test_end=FLAGS.test_size)
+
+
+if __name__ == '__main__':
+ flags.DEFINE_integer('nb_filters', NB_FILTERS,
+ 'Model size multiplier')
+ flags.DEFINE_integer('nb_epochs', NB_EPOCHS,
+ 'Number of epochs to train model')
+ flags.DEFINE_integer('batch_size', BATCH_SIZE,
+ 'Size of training batches')
+ flags.DEFINE_float('learning_rate', LEARNING_RATE,
+ 'Learning rate for training')
+ flags.DEFINE_string('architecture', ARCHITECTURE,
+ 'Architecture [ResNet, ConvNet]')
+ flags.DEFINE_bool('load_model', LOAD_MODEL, 'Load Pretrained Model')
+ flags.DEFINE_string('ckpt_dir', '~/models/advhyp/madry/models',
+ 'ckpt_dir [path_to_checkpoint_dir]')
+ flags.DEFINE_bool('clean_train', CLEAN_TRAIN, 'Train on clean examples')
+ flags.DEFINE_bool('backprop_through_attack', BACKPROP_THROUGH_ATTACK,
+ ('If True, backprop through adversarial example '
+ 'construction process during adversarial training'))
+ flags.DEFINE_integer('n_collect', 10000, '')
+ flags.DEFINE_float('p_ratio_cutoff', .999, '')
+ flags.DEFINE_float('eps', 8., '')
+ flags.DEFINE_string('noise_eps', 'n18.0,n24.0,n30.0', '')
+ flags.DEFINE_string('noise_eps_detect', 'n30.0', '')
+ flags.DEFINE_bool('debug', False, 'for debugging')
+ flags.DEFINE_integer('test_size', 10000, '')
+ flags.DEFINE_bool('save_alignments', False, '')
+ flags.DEFINE_bool('load_alignments', False, '')
+ flags.DEFINE_integer('num_noise_samples', 256, '')
+ flags.DEFINE_integer('rep', 0, '')
+ flags.DEFINE_bool('save_debug_dict', False, '')
+ flags.DEFINE_bool('save_pgd_samples', False, '')
+ flags.DEFINE_string('load_pgd_train_samples', None, '')
+ flags.DEFINE_string('load_pgd_test_samples', None, '')
+ flags.DEFINE_bool('fit_classifier', True, '')
+ flags.DEFINE_bool('clip_alignments', True, '')
+ flags.DEFINE_string('attack', 'pgd', '')
+ flags.DEFINE_bool('passthrough', False, '')
+ flags.DEFINE_integer('cw_steps', 300, '')
+ flags.DEFINE_integer('cw_search_steps', 20, '')
+ flags.DEFINE_float('cw_lr', 1e-1, '')
+ flags.DEFINE_float('cw_c', 1e-4, '')
+ flags.DEFINE_bool('just_detect', False, '')
+ flags.DEFINE_integer('mean_samples', 16, '')
+ flags.DEFINE_float('mean_eps', .1, '')
+ flags.DEFINE_bool('load_adv_trained', False, '')
+
+ tf.app.run()
diff --git a/case_studies/odds/original/tf_robustify/__init__.py b/case_studies/odds/original/tf_robustify/__init__.py
new file mode 100644
index 0000000..6e7faf8
--- /dev/null
+++ b/case_studies/odds/original/tf_robustify/__init__.py
@@ -0,0 +1,522 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#!/usr/bin/env python3
+
+import os
+import numpy as np
+import tqdm
+import math
+import scipy.stats
+from absl import logging
+from collections import OrderedDict
+from sklearn.linear_model import LogisticRegression
+import itertools as itt
+from types import SimpleNamespace
+
+
+logging.set_verbosity(logging.INFO)
+
+
+def collect_statistics(x_train, y_train, x_ph=None, sess=None,
+ latent_and_logits_fn_th=None, latent_x_tensor=None, logits_tensor=None,
+ nb_classes=None, weights=None, cuda=True, targeted=False, noise_eps=8e-3,
+ noise_eps_detect=None, num_noise_samples=256, batch_size=256,
+ pgd_eps=8/255, pgd_lr=1/4, pgd_iters=10, clip_min=-1., clip_max=1.,
+ p_ratio_cutoff=20., save_alignments_dir=None, load_alignments_dir=None,
+ debug_dict=None, debug=False, clip_alignments=True, pgd_train=None,
+ fit_classifier=False, just_detect=False):
+ assert len(x_train) == len(y_train)
+ if pgd_train is not None:
+ assert len(pgd_train) == len(x_train)
+
+ if x_ph is not None:
+ import tensorflow as tf
+ backend = 'tf'
+ assert sess is not None
+ assert latent_and_logits_fn_th is None
+ assert latent_x_tensor is not None
+ assert logits_tensor is not None
+ assert nb_classes is not None
+ assert weights is not None
+ else:
+ import torch as th
+ backend = 'th'
+ assert x_ph is None
+ assert sess is None
+ assert latent_and_logits_fn_th is not None
+ assert latent_x_tensor is None
+ assert logits_tensor is None
+ assert nb_classes is not None
+ assert weights is not None
+ cuda = th.cuda.is_available() and cuda
+
+ def latent_fn_th(x):
+ return to_np(latent_and_logits_fn_th(to_th(x))[0])
+
+ def logits_fn_th(x):
+ return latent_and_logits_fn_th(x)[1]
+
+ def to_th(x, dtype=np.float32):
+ x = th.from_numpy(x.astype(dtype))
+ if cuda:
+ x = x.cuda()
+ return x
+
+ def to_np(x):
+ return x.detach().cpu().numpy()
+
+ if debug:
+ logging.set_verbosity(logging.DEBUG)
+
+ try:
+ len(noise_eps)
+ if isinstance(noise_eps, str):
+ raise TypeError()
+ except TypeError:
+ noise_eps = [noise_eps]
+
+ if noise_eps_detect is None:
+ noise_eps_detect = noise_eps
+
+ try:
+ len(noise_eps_detect)
+ if isinstance(noise_eps_detect, str):
+ raise TypeError()
+ except TypeError:
+ noise_eps_detect = [noise_eps_detect]
+
+ noise_eps_all = set(noise_eps + noise_eps_detect)
+
+ pgd_lr = pgd_eps * pgd_lr
+ n_batches = math.ceil(x_train.shape[0] / batch_size)
+
+ if len(y_train.shape) == 2:
+ y_train = y_train.argmax(-1)
+
+ if backend == 'tf':
+ y_ph = tf.placeholder(tf.int64, [None])
+ loss_tensor = tf.reduce_sum(tf.nn.sparse_softmax_cross_entropy_with_logits(logits=logits_tensor, labels=y_ph))
+ pgd_gradients = tf.gradients(loss_tensor, x_ph)[0]
+ preds_tensor = tf.arg_max(logits_tensor, -1)
+ else:
+ loss_fn = th.nn.CrossEntropyLoss(reduce='sum')
+ if cuda:
+ loss_fn = loss_fn.cuda()
+
+ def get_noise_samples(x, num_samples, noise_eps, clip=False):
+ if isinstance(noise_eps, float):
+ kind = 'u'
+ eps = noise_eps
+ else:
+ kind, eps = noise_eps[:1], float(noise_eps[1:])
+
+ if isinstance(x, np.ndarray):
+ if kind == 'u':
+ noise = np.random.uniform(-1., 1., size=(num_samples,) + x.shape[1:])
+ elif kind == 'n':
+ noise = np.random.normal(0., 1., size=(num_samples,) + x.shape[1:])
+ elif kind == 's':
+ noise = np.random.uniform(-1., 1., size=(num_samples,) + x.shape[1:])
+ noise = np.sign(noise)
+ x_noisy = x + noise * eps
+ if clip:
+ x_noisy = x_noisy.clip(clip_min, clip_max)
+ elif backend == 'tf':
+ shape = (num_samples,) + tuple(s.value for s in x.shape[1:])
+ if kind == 'u':
+ noise = tf.random_uniform(shape=shape, minval=-1., maxval=1.)
+ elif kind == 'n':
+ noise = tf.random_normal(shape=shape, mean=0., stddev=1.)
+ elif kind == 's':
+ noise = tf.random_uniform(shape=shape, minval=-1., maxval=1.)
+ noise = tf.sign(noise)
+ x_noisy = x + noise * eps
+ if clip:
+ x_noisy = tf.clip_by_value(x_noisy, clip_min, clip_max)
+ elif backend == 'th':
+ if kind == 'u':
+ noise = x.new_zeros((num_samples,) + x.shape[1:]).uniform_(-1., 1.)
+ elif kind == 'n':
+ noise = x.new_zeros((num_samples,) + x.shape[1:]).normal_(0., 1.)
+ elif kind == 's':
+ noise = x.new_zeros((num_samples,) + x.shape[1:]).uniform_(-1., 1.)
+ noise.sign_()
+ x_noisy = x + noise * eps
+ if clip:
+ x_noisy.clamp_(clip_min, clip_max)
+ return x_noisy
+
+ def attack_pgd(x, x_pred, targeted=False):
+ x_pgd = get_noise_samples(x, x.shape[0], pgd_eps, clip=True)
+
+ for _ in range(pgd_iters):
+ if backend == 'tf':
+ x_grads = sess.run(pgd_gradients, {x_ph: x_pgd, y_ph: x_pred})
+ else:
+ x_th = to_th(x_pgd).requires_grad_(True)
+ x_grads = to_np(th.autograd.grad(loss_fn(logits_fn_th(x_th), to_th(x_pred, np.long)), [x_th])[0])
+
+ x_pgd += pgd_lr * np.sign(x_grads) * (-2. * (targeted - 1/2))
+ x_pgd = x_pgd.clip(x - pgd_eps, x + pgd_eps)
+ x_pgd = x_pgd.clip(clip_min, clip_max)
+ if debug:
+ break
+ return x_pgd
+
+ def get_latent_and_pred(x):
+ if backend == 'tf':
+ return sess.run([latent_x_tensor, preds_tensor], {x_ph: x})
+ else:
+ l, p = map(to_np, latent_and_logits_fn_th(to_th(x)))
+ return l, p.argmax(-1)
+
+ x_preds_clean = []
+ x_train_pgd = []
+ x_preds_pgd = []
+ latent_clean = []
+ latent_pgd = []
+
+ if not load_alignments_dir:
+ for b in tqdm.trange(n_batches, desc='creating adversarial samples'):
+ x_batch = x_train[b*batch_size:(b+1)*batch_size]
+ lc, pc = get_latent_and_pred(x_batch)
+ x_preds_clean.append(pc)
+ latent_clean.append(lc)
+
+ if not just_detect:
+ if pgd_train is not None:
+ x_pgd = pgd_train[b*batch_size:(b+1)*batch_size]
+ else:
+ if targeted:
+ x_pgd = np.stack([attack_pgd(x_batch, np.ones_like(pc) * i, targeted=True) for i in range(nb_classes)], 1)
+ else:
+ x_pgd = attack_pgd(x_batch, pc, targeted=False)
+ x_train_pgd.append(x_pgd)
+
+ if targeted:
+ pps, lps = [], []
+ for i in range(x_pgd.shape[1]):
+ lp, pp = get_latent_and_pred(x_pgd[:, i])
+ pps.append(pp)
+ lps.append(lp)
+ x_preds_pgd.append(np.stack(pps, 1))
+ latent_pgd.append(np.stack(lps, 1))
+ else:
+ lp, pp = get_latent_and_pred(x_pgd)
+ x_preds_pgd.append(pp)
+ latent_pgd.append(lp)
+
+ x_preds_clean, latent_clean = map(np.concatenate, (x_preds_clean, latent_clean))
+ if not just_detect:
+ x_train_pgd, x_preds_pgd, latent_pgd = map(np.concatenate, (x_train_pgd, x_preds_pgd, latent_pgd))
+
+ valid_idcs = []
+ if not just_detect:
+ for i, (pc, pp, y) in enumerate(zip(x_preds_clean, x_preds_pgd, y_train)):
+ if y == pc and pc != pp:
+ # if y == pc:
+ valid_idcs.append(i)
+ else:
+ valid_idcs = list(range(len(x_preds_clean)))
+
+ logging.info('valid idcs ratio: {}'.format(len(valid_idcs) / len(y_train)))
+ if targeted:
+ for i, xpp in enumerate(x_preds_pgd.T):
+ logging.info('pgd success class {}: {}'.format(i, (xpp == i).mean()))
+
+ x_train, y_train, x_preds_clean, latent_clean = (a[valid_idcs] for a in (x_train, y_train, x_preds_clean, latent_clean))
+ if not just_detect:
+ x_train_pgd, x_preds_pgd, latent_pgd = (a[valid_idcs] for a in (x_train_pgd, x_preds_pgd, latent_pgd))
+
+ if backend == 'tf':
+ weights = tf.transpose(weights, (1, 0))
+ weights_np = sess.run(weights)
+ else:
+ weights_np = weights.cpu().numpy()
+ big_memory = weights.shape[0] > 20
+ logging.info('BIG MEMORY: {}'.format(big_memory))
+ if not big_memory:
+ wdiffs = weights[None, :, :] - weights[:, None, :]
+ wdiffs_np = weights_np[None, :, :] - weights_np[:, None, :]
+
+ if backend == 'tf':
+ # lat_ph = tf.placeholder(tf.float32, [weights.shape[-1]])
+ # pred_ph = tf.placeholder(tf.int64)
+ # if big_memory:
+ # wdiffs_relevant = weights[pred_ph, None] - weights
+ # else:
+ # wdiffs_relevant = wdiffs[:, pred_ph]
+ # lat_diff_tensor = lat_ph[None] - latent_x_tensor
+ # alignments_tensor = tf.matmul(lat_diff_tensor, wdiffs_relevant, transpose_b=True)
+
+ # def _compute_neps_alignments(x, lat, pred, idx_wo_pc, neps):
+ # x_noisy = get_noise_samples(x[None], num_noise_samples, noise_eps=neps, clip=clip_alignments)
+ # return sess.run(alignments_tensor, {x_ph: x_noisy, lat_ph: lat, pred_ph: pred})[:, idx_wo_pc]
+ lat_ph = tf.placeholder(tf.float32, [weights.shape[-1]])
+ wdiffs_relevant_ph = tf.placeholder(tf.float32, [weights.shape[-1], nb_classes])
+ lat_diff_tensor = lat_ph[None] - latent_x_tensor
+ alignments_tensor = tf.matmul(lat_diff_tensor, wdiffs_relevant_ph)
+
+ def _compute_neps_alignments(x, lat, pred, idx_wo_pc, neps):
+ if big_memory:
+ wdiffs_relevant = weights_np[pred, None] - weights_np
+ else:
+ wdiffs_relevant = wdiffs_np[:, pred]
+ x_noisy = get_noise_samples(x[None], num_noise_samples, noise_eps=neps, clip=clip_alignments)
+ # return sess.run(alignments_tensor, {x_ph: x_noisy, lat_ph: lat, wdiffs_relevant_ph:wdiffs_relevant.T})[:, idx_wo_pc]
+ lat_x = sess.run(latent_x_tensor, {x_ph: x_noisy})
+ lat_diffs = lat[None] - lat_x
+ return np.matmul(lat_diffs, wdiffs_relevant.T)[:, idx_wo_pc]
+
+ else:
+
+ def _compute_neps_alignments(x, lat, pred, idx_wo_pc, neps):
+ x, lat = map(to_th, (x, lat))
+ if big_memory:
+ wdiffs_relevant = weights[pred, None] - weights
+ else:
+ wdiffs_relevant = wdiffs[:, pred]
+ x_noisy = get_noise_samples(x[None], num_noise_samples, noise_eps=neps, clip=clip_alignments)
+ lat_noisy, _ = latent_and_logits_fn_th(x_noisy)
+ lat_diffs = lat[None] - lat_noisy
+ return to_np(th.matmul(lat_diffs, wdiffs_relevant.transpose(1, 0)))[:, idx_wo_pc]
+
+ if debug_dict is not None:
+ debug_dict['weights'] = weights_np
+ debug_dict['wdiffs'] = wdiffs_np
+
+ def _compute_alignments(x, lat, pred, source=None, noise_eps=noise_eps_all):
+ if source is None:
+ idx_wo_pc = [i for i in range(nb_classes) if i != pred]
+ assert len(idx_wo_pc) == nb_classes - 1
+ else:
+ idx_wo_pc = source
+
+ alignments = OrderedDict()
+ for neps in noise_eps:
+ alignments[neps] = _compute_neps_alignments(x, lat, pred, idx_wo_pc, neps)
+ # if debug_dict is not None:
+ # debug_dict.setdefault('lat', []).append(lat)
+ # debug_dict.setdefault('lat_noisy', []).append(lat_noisy)
+ # debug_dict['weights'] = weights
+ # debug_dict['wdiffs'] = wdiffs
+ return alignments, idx_wo_pc
+
+ def _collect_wdiff_stats(x_set, latent_set, x_preds_set, clean, save_alignments_dir=None, load_alignments_dir=None):
+ if clean:
+ wdiff_stats = {(tc, tc, e): [] for tc in range(nb_classes) for e in noise_eps_all}
+ name = 'clean'
+ else:
+ wdiff_stats = {(sc, tc, e): [] for sc in range(nb_classes) for tc in range(nb_classes) for e in noise_eps_all if sc != tc}
+ name = 'adv'
+
+ def _compute_stats_from_values(v, raw=False):
+ if not v.shape:
+ return None
+ v = v.mean(1)
+ if debug:
+ v = np.concatenate([v, v*.5, v*1.5])
+ if clean or not fit_classifier:
+ if v.shape[0] < 3:
+ return None
+ return v.mean(0), v.std(0)
+ else:
+ return v
+
+ for neps in noise_eps_all:
+ neps_keys = {k for k in wdiff_stats.keys() if k[-1] == neps}
+ loading = load_alignments_dir
+ if loading:
+ for k in neps_keys:
+ fn = 'alignments_{}_{}.npy'.format(name, str(k))
+ load_fn = os.path.join(load_alignments_dir, fn)
+ if not os.path.exists(load_fn):
+ loading = False
+ break
+ v = np.load(load_fn)
+ wdiff_stats[k] = _compute_stats_from_values(v)
+ logging.info('loading alignments from {} for {}'.format(load_alignments_dir, neps))
+ if not loading:
+ for x, lc, pc, pcc in tqdm.tqdm(zip(x_set, latent_set, x_preds_set, x_preds_clean), total=len(x_set), desc='collecting stats for {}'.format(neps)):
+ if len(lc.shape) == 2:
+ alignments = []
+ for i, (xi, lci, pci) in enumerate(zip(x, lc, pc)):
+ if i == pcc:
+ continue
+ alignments_i, _ = _compute_alignments(xi, lci, i, source=pcc, noise_eps=[neps])
+ for e, a in alignments_i.items():
+ wdiff_stats[(pcc, i, e)].append(a)
+ else:
+ alignments, idx_wo_pc = _compute_alignments(x, lc, pc, noise_eps=[neps])
+ for e, a in alignments.items():
+ wdiff_stats[(pcc, pc, e)].append(a)
+
+ saving = save_alignments_dir and not loading
+ if saving:
+ logging.info('saving alignments to {} for {}'.format(save_alignments_dir, neps))
+ if debug:
+ some_v = None
+ for k in neps_keys:
+ some_v = some_v or wdiff_stats[k]
+ for k in neps_keys:
+ wdiff_stats[k] = wdiff_stats[k] or some_v
+
+ for k in neps_keys:
+ wdsk = wdiff_stats[k]
+ if len(wdsk):
+ wdiff_stats[k] = np.stack(wdsk)
+ else:
+ wdiff_stats[k] = np.array(None)
+ if saving:
+ fn = 'alignments_{}_{}.npy'.format(name, str(k))
+ save_fn = os.path.join(save_alignments_dir, fn)
+ os.makedirs(os.path.dirname(save_fn), exist_ok=True)
+ wds = wdiff_stats[k]
+ np.save(save_fn, wds)
+ wdiff_stats[k] = _compute_stats_from_values(wdiff_stats[k])
+ return wdiff_stats
+
+ save_alignments_dir_clean = os.path.join(save_alignments_dir, 'clean') if save_alignments_dir else None
+ save_alignments_dir_pgd = os.path.join(save_alignments_dir, 'pgd') if save_alignments_dir else None
+ load_alignments_dir_clean = os.path.join(load_alignments_dir, 'clean') if load_alignments_dir else None
+ load_alignments_dir_pgd = os.path.join(load_alignments_dir, 'pgd') if load_alignments_dir else None
+ if load_alignments_dir:
+ load_alignments_dir_clean, load_alignments_dir_pgd = map(lambda s: '{}_{}'.format(s, 'clip' if clip_alignments else 'noclip'), (load_alignments_dir_clean, load_alignments_dir_pgd))
+ if save_alignments_dir:
+ save_alignments_dir_clean, save_alignments_dir_pgd = map(lambda s: '{}_{}'.format(s, 'clip' if clip_alignments else 'noclip'), (save_alignments_dir_clean, save_alignments_dir_pgd))
+ wdiff_stats_clean = _collect_wdiff_stats(x_train, latent_clean, x_preds_clean, clean=True, save_alignments_dir=save_alignments_dir_clean, load_alignments_dir=load_alignments_dir_clean)
+ if not just_detect:
+ wdiff_stats_pgd = _collect_wdiff_stats(x_train_pgd, latent_pgd, x_preds_pgd, clean=False, save_alignments_dir=save_alignments_dir_pgd, load_alignments_dir=load_alignments_dir_pgd)
+
+ if debug_dict is not None and False:
+ esizes = OrderedDict((k, []) for k in noise_eps_all)
+ for k, (mc, sc) in wdiff_stats_clean.items():
+ mp, sp = wdiff_stats_pgd[k]
+ esizes[k[-1]].append(np.abs(mp - mc) / ((sp + sc) / 2.))
+ debug_dict['effect_sizes'] = OrderedDict((k, np.array(v)) for k, v in esizes.items())
+
+ wdiff_stats_clean_detect = [np.stack([wdiff_stats_clean[(p, p, eps)] for eps in noise_eps_detect]) for p in range(nb_classes)]
+ wdiff_stats_clean_detect = [s.transpose((1, 0, 2)) if len(s.shape) == 3 else None for s in wdiff_stats_clean_detect]
+ wdiff_stats_pgd_classify = []
+ if not just_detect:
+ for tc in range(nb_classes):
+ tc_stats = []
+ for sc in range(nb_classes):
+ if sc == tc:
+ continue
+ sc_stats = [wdiff_stats_pgd[(sc, tc, eps)] for eps in noise_eps]
+ if sc_stats[0] is None:
+ tc_stats.append(None)
+ else:
+ tc_stats.append(np.stack(sc_stats, 1))
+ wdiff_stats_pgd_classify.append(tc_stats)
+
+ if fit_classifier:
+ logging.info('fitting classifier')
+ for tc in tqdm.trange(nb_classes):
+ tc_X = []
+ tc_Y = []
+ idx_wo_tc = [sc for sc in range(nb_classes) if sc != tc]
+ for i, sc in enumerate(idx_wo_tc):
+ sc_data = wdiff_stats_pgd_classify[tc][i]
+ if sc_data is not None:
+ sc_data = sc_data.reshape(sc_data.shape[0], -1)
+ for d in sc_data:
+ tc_X.append(d.ravel())
+ tc_Y.append(sc)
+ Y_unq = np.unique(tc_Y)
+ if len(Y_unq) == 0:
+ lr = SimpleNamespace(predict=lambda x: np.array(tc))
+ elif len(Y_unq) == 1:
+ lr = SimpleNamespace(predict=lambda x: np.array(tc_Y[0]))
+ else:
+ tc_X = np.stack(tc_X)
+ tc_Y = np.array(tc_Y)
+ lr = LogisticRegression(solver='lbfgs', multi_class='multinomial', max_iter=1000)
+ lr.fit(tc_X, tc_Y)
+ wdiff_stats_pgd_classify[tc] = lr
+
+ batch = yield
+
+ while batch is not None:
+ batch_latent, batch_pred = get_latent_and_pred(batch)
+ if debug_dict is not None:
+ debug_dict.setdefault('batch_pred', []).append(batch_pred)
+ corrected_pred = []
+ detection = []
+ for b, lb, pb in zip(batch, batch_latent, batch_pred):
+ b_align, idx_wo_pb = _compute_alignments(b, lb, pb)
+ b_align_det = np.stack([b_align[eps] for eps in noise_eps_detect])
+ b_align = np.stack([b_align[eps] for eps in noise_eps])
+
+ wdsc_det_pb = wdiff_stats_clean_detect[pb]
+ if wdsc_det_pb is None:
+ z_hit = False
+ else:
+ wdm_det, wds_det = wdsc_det_pb
+ z_clean = (b_align_det - wdm_det[:, None]) / wds_det[:, None]
+ z_clean_mean = z_clean.mean(1)
+ z_cutoff = scipy.stats.norm.ppf(p_ratio_cutoff)
+ z_hit = z_clean_mean.mean(0).max(-1) > z_cutoff
+
+ if not just_detect:
+ if fit_classifier:
+ lr = wdiff_stats_pgd_classify[pb]
+ b_align = b_align.mean(1).reshape((1, -1))
+ lr_pred = lr.predict(b_align)
+ else:
+ wdp = wdiff_stats_pgd_classify[pb]
+ if wdp is None:
+ z_pgd_mode = None
+ else:
+ wdp_not_none_idcs = [i for i, w in enumerate(wdp) if w is not None]
+ if len(wdp_not_none_idcs) == 0:
+ z_pgd_mode = None
+ else:
+ wdp = np.stack([wdp[i] for i in wdp_not_none_idcs], 2)
+ idx_wo_pb_wdp = [idx_wo_pb[i] for i in wdp_not_none_idcs]
+ ssidx = np.arange(wdp.shape[-2])
+ wdp = wdp[:, :, ssidx, ssidx]
+ wdmp, wdsp = wdp
+ b_align = b_align[:, :, wdp_not_none_idcs]
+ z_pgd = (b_align - wdmp[:, None]) / wdsp[:, None]
+ z_pgd_mean = z_pgd.mean(1)
+ z_pgd_mode = scipy.stats.mode(z_pgd_mean.argmax(-1)).mode[0]
+ if z_hit:
+ if not just_detect:
+ if fit_classifier:
+ print(lr_pred)
+ pb = lr_pred.item()
+ else:
+ if z_pgd_mode is not None:
+ pb = idx_wo_pb_wdp[z_pgd_mode]
+ detection.append(True)
+ else:
+ detection.append(False)
+ if debug_dict is not None:
+ debug_dict.setdefault('b_align', []).append(b_align)
+ # debug_dict.setdefault('stats', []).append((wdm_det, wds_det, wdmp, wdsp))
+ # debug_dict.setdefault('p_ratio', []).append(p_ratio)
+ # debug_dict.setdefault('p_clean', []).append(p_clean)
+ # debug_dict.setdefault('p_pgd', []).append(p_pgd)
+ debug_dict.setdefault('z_clean', []).append(z_clean)
+ # debug_dict.setdefault('z_conf', []).append(z_conf)
+ # debug_dict.setdefault('z_pgdm', []).append(z_pgdm)
+ # debug_dict.setdefault('z_pgd', []).append(z_pgd)
+ corrected_pred.append(pb)
+ if debug_dict is not None:
+ debug_dict.setdefault('detection', []).append(detection)
+ debug_dict.setdefault('corrected_pred', []).append(corrected_pred)
+ batch = yield np.stack((corrected_pred, detection), -1)
diff --git a/case_studies/odds/original/torch_example.py b/case_studies/odds/original/torch_example.py
new file mode 100644
index 0000000..8b96322
--- /dev/null
+++ b/case_studies/odds/original/torch_example.py
@@ -0,0 +1,789 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#!/usr/bin/env python3
+
+import matplotlib
+matplotlib.use('Agg')
+
+import io
+from PIL import Image
+from matplotlib import pyplot as plt
+import os
+import sys
+import torch as th
+import torchvision as tv
+import torch.nn.functional as F
+from torch.autograd import Variable
+import math
+import tqdm
+from filelock import FileLock
+import threading
+import time
+import signal
+import numpy as np
+import itertools as itt
+import scipy.linalg
+import scipy.stats
+from scipy.spatial.distance import pdist, squareform
+import cifar_model
+from sklearn.decomposition import PCA
+from sklearn.metrics import confusion_matrix
+import tf_robustify
+import vgg
+import carlini_wagner_attack
+
+
+os.system("taskset -p 0xffffffff %d" % os.getpid())
+
+import sh
+sh.rm('-rf', 'logs')
+
+import logging
+logging.basicConfig(level=logging.INFO, stream=sys.stdout)
+
+from tensorboardX.writer import SummaryWriter
+swriter = SummaryWriter('logs')
+add_scalar_old = swriter.add_scalar
+
+def add_scalar_and_log(key, value, global_step=0):
+ logging.info('{}:{}: {}'.format(global_step, key, value))
+ add_scalar_old(key, value, global_step)
+
+swriter.add_scalar = add_scalar_and_log
+
+def str2bool(x):
+ return x.lower() == 'true'
+
+def new_inception_conv2d_forward(self, x):
+ x = self.conv(x)
+ x = self.bn(x)
+ return F.relu(x, inplace=False)
+
+tv.models.inception.BasicConv2d.forward = new_inception_conv2d_forward
+
+
+import argparse
+parser = argparse.ArgumentParser()
+parser.add_argument('--ds', default='cifar10')
+parser.add_argument('--model', default='cifar10')
+parser.add_argument('--batch_size', default=32, type=int)
+parser.add_argument('--eval_bs', default=256, type=int)
+parser.add_argument('--eval_batches', default=None, type=int)
+parser.add_argument('--epochs', default=50, type=int)
+parser.add_argument('--num_evals', default=20, type=int)
+parser.add_argument('--train_log_after', default=0, type=int)
+parser.add_argument('--stop_after', default=-1, type=int)
+parser.add_argument('--cuda', default=True, type=str2bool)
+parser.add_argument('--optim', default='sgd', type=str)
+parser.add_argument('--lr', default=1e-4, type=float)
+parser.add_argument('--attack_lr', default=.25, type=float)
+parser.add_argument('--eps', default=8/255, type=float)
+parser.add_argument('--eps_rand', default=None, type=float)
+parser.add_argument('--eps_eval', default=None, type=float)
+parser.add_argument('--rep', default=0, type=int)
+parser.add_argument('--img_size', default=32, type=int)
+parser.add_argument('--iters', default=10, type=int)
+parser.add_argument('--noise_eps', default='n0.01,s0.01,u0.01,n0.02,s0.02,u0.02,s0.03,n0.03,u0.03', type=str)
+parser.add_argument('--noise_eps_detect', default='n0.003,s0.003,u0.003,n0.005,s0.005,u0.005,s0.008,n0.008,u0.008', type=str)
+parser.add_argument('--clip_alignments', default=True, type=str2bool)
+parser.add_argument('--pgd_strength', default=1., type=float)
+
+parser.add_argument('--debug', default=False, type=str2bool)
+parser.add_argument('--mode', default='eval', type=str)
+parser.add_argument('--constrained', default=True, type=str2bool)
+parser.add_argument('--clamp_attack', default=False, type=str2bool)
+parser.add_argument('--clamp_uniform', default=False, type=str2bool)
+parser.add_argument('--train_adv', default=False, type=str2bool)
+parser.add_argument('--wdiff_samples', default=256, type=int)
+parser.add_argument('--maxp_cutoff', default=.999, type=float)
+parser.add_argument('--collect_targeted', default=False, type=str2bool)
+parser.add_argument('--n_collect', default=10000, type=int)
+parser.add_argument('--save_alignments', default=False, type=str2bool)
+parser.add_argument('--load_alignments', default=False, type=str2bool)
+parser.add_argument('--save_pgd_samples', default=False, type=str2bool)
+parser.add_argument('--load_pgd_train_samples', default=None, type=str)
+parser.add_argument('--load_pgd_test_samples', default=None, type=str)
+parser.add_argument('--fit_classifier', default=True, type=str2bool)
+parser.add_argument('--just_detect', default=False, type=str2bool)
+parser.add_argument('--attack', default='pgd', type=str)
+parser.add_argument('--cw_confidence', default=0, type=float)
+parser.add_argument('--cw_c', default=1e-4, type=float)
+parser.add_argument('--cw_lr', default=1e-4, type=float)
+parser.add_argument('--cw_steps', default=300, type=int)
+parser.add_argument('--cw_search_steps', default=10, type=int)
+parser.add_argument('--mean_samples', default=16, type=int)
+parser.add_argument('--mean_eps', default=.1, type=float)
+
+args = parser.parse_args()
+
+args.cuda = args.cuda and th.cuda.is_available()
+
+args.eps_rand = args.eps_rand or args.eps
+
+args.eps_eval = args.eps_eval or args.eps
+
+args.mean_eps = args.mean_eps * args.eps_eval
+
+
+def check_pid():
+ while os.getppid() != 1:
+ time.sleep(.1)
+ os.kill(os.getpid(), signal.SIGKILL)
+
+
+def init_worker(worker_id):
+ thread = threading.Thread(target=check_pid)
+ thread.daemon = True
+ thread.start()
+
+
+def gini_coef(a):
+ a = th.sort(a, dim=-1)[0]
+ n = a.shape[1]
+ index = th.arange(1, n+1)[None, :].float()
+ return (th.sum((2 * index - n - 1) * a, -1) / (n * th.sum(a, -1)))
+
+
+def main():
+ nrms = dict(imagenet=([0.485, 0.456, 0.406], [0.229, 0.224, 0.225]), imagenet64=([0.485, 0.456, 0.406], [0.229, 0.224, 0.225]), cifar10=([.5, .5, .5], [.5, .5, .5]))[args.ds]
+ if args.ds == 'cifar10' and args.model.startswith('vgg'):
+ nrms = [0.485, 0.456, 0.406], [0.229, 0.224, 0.225]
+
+ if args.ds == 'imagenet':
+ if args.model.startswith('inception'):
+ transforms = [
+ tv.transforms.Resize((299, 299)),
+ ]
+ else:
+ transforms = [
+ tv.transforms.Resize((256, 256)),
+ tv.transforms.CenterCrop(224)
+ ]
+ else:
+ transforms = [tv.transforms.Resize((args.img_size, args.img_size))]
+ transforms = tv.transforms.Compose(
+ transforms + [
+ tv.transforms.ToTensor(),
+ ])
+ clip_min = 0.
+ clip_max = 1.
+ nrms_mean, nrms_std = [th.FloatTensor(n)[None, :, None, None] for n in nrms]
+ if args.cuda:
+ nrms_mean, nrms_std = map(th.Tensor.cuda, (nrms_mean, nrms_std))
+
+ if args.ds == 'cifar10':
+ data_dir = os.path.expanduser('~/data/cifar10')
+ os.makedirs(data_dir, exist_ok=True)
+ with FileLock(os.path.join(data_dir, 'lock')):
+ train_ds = tv.datasets.CIFAR10(data_dir, train=True, transform=transforms, download=True)
+ test_ds = tv.datasets.CIFAR10(data_dir, train=False, transform=transforms, download=True)
+ elif args.ds == 'imagenet':
+ train_folder = os.path.expanduser('~/../stuff/imagenet/train')
+ test_folder = os.path.expanduser('~/../stuff/imagenet/val')
+
+ with FileLock(os.path.join(os.path.dirname(train_folder), 'lock')):
+ train_ds = tv.datasets.ImageFolder(train_folder, transform=transforms)
+ test_ds = tv.datasets.ImageFolder(test_folder, transform=transforms)
+
+ if args.load_pgd_test_samples:
+ pgd_path = os.path.expanduser('~/data/advhyp/{}/samples'.format(args.load_pgd_test_samples))
+ x_test = np.load(os.path.join(pgd_path, 'test_clean.npy'))
+ y_test = np.load(os.path.join(pgd_path, 'test_y.npy'))
+ pgd_test = np.load(os.path.join(pgd_path, 'test_pgd.npy'))
+ if x_test.shape[-1] == 3:
+ x_test = x_test.transpose((0, 3, 1, 2))
+ pgd_test = pgd_test.transpose((0, 3, 1, 2))
+ if len(y_test.shape) == 2:
+ y_test = y_test.argmax(-1)
+ test_ds = th.utils.data.TensorDataset(*map(th.from_numpy, (x_test, y_test, pgd_test)))
+
+ train_loader = th.utils.data.DataLoader(train_ds, batch_size=args.batch_size, shuffle=True, num_workers=4, drop_last=True, pin_memory=True, worker_init_fn=init_worker)
+ test_loader = th.utils.data.DataLoader(test_ds, batch_size=args.eval_bs, shuffle=True, num_workers=1, drop_last=False, pin_memory=True, worker_init_fn=init_worker)
+
+ if args.ds == 'imagenet64' or args.ds == 'imagenet':
+ with FileLock(os.path.join(os.path.dirname(train_folder), 'lock')):
+ if args.model in tv.models.__dict__:
+ if args.model.startswith('inception'):
+ net = tv.models.__dict__[args.model](pretrained=True, transform_input=False)
+ else:
+ net = tv.models.__dict__[args.model](pretrained=True)
+ else:
+ raise ValueError('Unknown model: {}'.format(args.model))
+ elif args.ds == 'cifar10':
+ if args.model == 'tiny':
+ net = cifar_model.cifar10_tiny(32, pretrained=args.mode == 'eval' , map_location=None if args.cuda else 'cpu')
+ elif args.model == 'tinyb':
+ net = cifar_model.cifar10_tiny(32, pretrained=args.mode == 'eval' , map_location=None if args.cuda else 'cpu', padding=0, trained_adv=args.train_adv)
+ elif args.model.startswith('vgg'):
+ net = vgg.__dict__[args.model]()
+ cp_path = os.path.expanduser('~/models/advhyp/vgg/{}/checkpoint.tar'.format(args.model))
+ checkpoint = th.load(cp_path, map_location='cpu')
+ state_dict = {k.replace('module.', ''): v for k, v in checkpoint['state_dict'].items()}
+ net.load_state_dict(state_dict)
+ elif args.model == 'carlini':
+ net = cifar_model.carlini(pretrained=args.mode == 'eval' , map_location=None if args.cuda else 'cpu', trained_adv=args.train_adv)
+ else:
+ net = cifar_model.cifar10(128, pretrained=args.mode == 'eval' , map_location=None if args.cuda else 'cpu', trained_adv=args.train_adv)
+ print(net)
+
+ def get_layers():
+ return itt.chain(net.features.children(), net.classifier.children())
+
+ def get_layer_names():
+ return [l.__class__.__name__ for l in get_layers()]
+
+ if args.cuda:
+ net.cuda()
+
+ def net_forward(x, layer_by_layer=False, from_layer=0):
+ x = x - nrms_mean # cannot be inplace
+ x.div_(nrms_std)
+ if not layer_by_layer:
+ return net(x)
+ cldr = list(net.children())
+ if args.model.startswith('resnet'):
+ x = net.conv1(x)
+ x = net.bn1(x)
+ x = net.relu(x)
+ x = net.maxpool(x)
+
+ x = net.layer1(x)
+ x = net.layer2(x)
+ x = net.layer3(x)
+ x = net.layer4(x)
+
+ outputs = [net.avgpool(x)]
+ flat_features = outputs[-1].view(x.size(0), -1)
+ outputs.append(net.fc(flat_features))
+ elif args.model.startswith('inception'):
+ # 299 x 299 x 3
+ x = net.Conv2d_1a_3x3(x)
+ # 149 x 149 x 32
+ x = net.Conv2d_2a_3x3(x)
+ # 147 x 147 x 32
+ x = net.Conv2d_2b_3x3(x)
+ # 147 x 147 x 64
+ x = F.max_pool2d(x, kernel_size=3, stride=2)
+ # 73 x 73 x 64
+ x = net.Conv2d_3b_1x1(x)
+ # 73 x 73 x 80
+ x = net.Conv2d_4a_3x3(x)
+ # 71 x 71 x 192
+ x = F.max_pool2d(x, kernel_size=3, stride=2)
+ # 35 x 35 x 192
+ x = net.Mixed_5b(x)
+ # 35 x 35 x 256
+ x = net.Mixed_5c(x)
+ # 35 x 35 x 288
+ x = net.Mixed_5d(x)
+ # 35 x 35 x 288
+ x = net.Mixed_6a(x)
+ # 17 x 17 x 768
+ x = net.Mixed_6b(x)
+ # 17 x 17 x 768
+ x = net.Mixed_6c(x)
+ # 17 x 17 x 768
+ x = net.Mixed_6d(x)
+ # 17 x 17 x 768
+ x = net.Mixed_6e(x)
+ # 17 x 17 x 768
+ x = net.Mixed_7a(x)
+ # 8 x 8 x 1280
+ x = net.Mixed_7b(x)
+ # 8 x 8 x 2048
+ x = net.Mixed_7c(x)
+ # 8 x 8 x 2048
+ x = F.avg_pool2d(x, kernel_size=8)
+ # 1 x 1 x 2048
+ outputs = [F.dropout(x, training=net.training)]
+ # 1 x 1 x 2048
+ flat_features = outputs[-1].view(x.size(0), -1)
+ # 2048
+ outputs.append(net.fc(flat_features))
+ # 1000 (num_classes)
+ else:
+ outputs = [net.features(x)]
+ for cidx, c in enumerate(net.classifier.children()):
+ flat_features = outputs[-1].view(x.size(0), -1)
+ outputs.append(c(flat_features))
+ return outputs
+
+ loss_fn = th.nn.CrossEntropyLoss(reduce=False)
+ loss_fn_adv = th.nn.CrossEntropyLoss(reduce=False)
+ if args.cuda:
+ loss_fn.cuda()
+ loss_fn_adv.cuda()
+
+ def get_outputs(x, y, from_layer=0):
+ outputs = net_forward(x, layer_by_layer=True, from_layer=from_layer)
+ logits = outputs[-1]
+ loss = loss_fn(logits, y)
+ _, preds = th.max(logits, 1)
+ return outputs, loss, preds
+
+ def get_loss_and_preds(x, y):
+ logits = net_forward(x, layer_by_layer=False)
+ loss = loss_fn(logits, y)
+ _, preds = th.max(logits, 1)
+ return loss, preds
+
+ def clip(x, cmin, cmax):
+ return th.min(th.max(x, cmin), cmax)
+
+ def project(x, x_orig, eps):
+ dx = x - x_orig
+ dx = dx.flatten(1)
+ dx /= th.norm(dx, p=2, dim=1, keepdim=True) + 1e-9
+ dx *= eps
+ return x_orig + dx.view(x.shape)
+
+
+ if args.attack == 'cw':
+ cw_attack = carlini_wagner_attack.AttackCarliniWagnerL2(cuda=args.cuda, clip_min=clip_min, clip_max=clip_max, confidence=args.cw_confidence, initial_const=args.cw_c / (255**2.), max_steps=args.cw_steps, search_steps=args.cw_search_steps, learning_rate=args.cw_lr)
+ def attack_cw(x, y):
+ x_adv = cw_attack.run(net_forward, x, y)
+ x_adv = th.from_numpy(x_adv)
+ if args.cuda:
+ x_adv = x_adv.cuda()
+ return x_adv
+
+ def attack_mean(x, y, eps=args.eps):
+ x_advs = attack_pgd(x, y, eps)
+ for _ in tqdm.trange(args.mean_samples, desc='mean attack samples'):
+ x_noisy = x + th.empty_like(x).uniform_(-args.mean_eps, args.mean_eps)
+ x_advs += attack_pgd(x_noisy, y, eps)
+ x_advs = x_advs / (args.mean_samples + 1)
+ x_advs.clamp_(clip_min, clip_max)
+ x_advs = clip(x_advs, x-eps, x+eps)
+ return x_advs
+
+ def attack_anti(x, y, eps=args.eps):
+ pass
+
+ def attack_pgd(x, y, eps=args.eps, l2=False):
+ if l2:
+ eps = np.sqrt(np.prod(x.shape[1:])) * eps
+ x_orig = x
+ x = th.empty_like(x).copy_(x)
+ x.requires_grad_(True)
+ x.data.add_(th.empty_like(x).uniform_(-eps, eps))
+ x.data.clamp_(clip_min, clip_max)
+ for i in range(args.iters):
+ if x.grad is not None:
+ x.grad.zero_()
+
+ logits = net_forward(x)
+ loss = th.sum(loss_fn_adv(logits, y))
+ loss.backward()
+ if args.constrained:
+ if l2:
+ gx = x.grad.flatten(1)
+ gx /= th.norm(gx, p=2, dim=-1, keepdim=True) + 1e-9
+ gx = gx.view(x.shape)
+ x.data.add_(args.attack_lr * eps * gx)
+ x.data = project(x.data, x_orig, eps)
+ else:
+ x.data.add_(args.attack_lr * eps * th.sign(x.grad))
+ x.data = clip(x.data, x_orig-eps, x_orig+eps)
+ x.data.clamp_(clip_min, clip_max)
+ else:
+ x.data += args.attack_lr * eps * x.grad
+ if args.debug:
+ break
+
+ if args.pgd_strength < 1.:
+ mask = (x.data.new_zeros(len(x)).uniform_() <= args.pgd_strength).float()
+ for _ in x.shape[1:]:
+ mask = mask[:, None]
+ x.data = x.data * mask + x_orig.data * (1. - mask)
+
+ x = x.detach()
+ inf_norm = (x - x_orig).abs().max().cpu().numpy().item()
+ if args.clamp_attack:
+ with th.no_grad():
+ diff = th.sign(x - x_orig) * inf_norm
+ x = x_orig + diff
+ x = clip(x, clip_min, clip_max)
+ # if args.constrained:
+ # assert inf_norm < eps * (1.001), 'inf norm {} > {}'.format(inf_norm, eps)
+ return x
+
+ eval_after = math.floor(args.epochs * len(train_ds) / args.batch_size / args.num_evals)
+
+ global_step = 0
+
+ def run_train():
+ nonlocal global_step # noqa: E999
+ if args.model == 'carlini':
+ optim = th.optim.SGD(net.parameters(), lr=args.lr, momentum=0.9, nesterov=True)
+ elif args.model == 'cifar10':
+ optim = th.optim.Adam(net.parameters(), lr=args.lr)
+ else:
+ optim = th.optim.RMSprop(net.parameters(), lr=args.lr)
+
+ logging.info('train')
+ for epoch in tqdm.trange(args.epochs):
+ for batch in tqdm.tqdm(train_loader):
+ x, y = batch
+ if args.cuda:
+ x, y = x.cuda(), y.cuda()
+
+ if global_step % eval_after == 0:
+ run_eval_basic(True)
+
+ if args.train_adv:
+ x_adv = attack_pgd(x, y)
+ x = th.cat((x, x_adv))
+ y = th.cat((y, y))
+
+ net.zero_grad()
+ loss, _ = get_loss_and_preds(x, y)
+ loss = loss.mean()
+
+ net.zero_grad()
+ loss.backward()
+ optim.step()
+ if args.model == 'carlini' and not args.train_adv:
+ for pg in optim.param_groups:
+ pg['lr'] = args.lr * ((1. - 1e-6)**global_step)
+
+ global_step += 1
+
+ if args.model == 'cifar10' and not args.train_adv:
+ if epoch == 80 or epoch == 120:
+ for pg in optim.param_groups:
+ pg['lr'] *= .1
+
+ with open('logs/model.ckpt', 'wb') as f:
+ th.save(net.state_dict(), f)
+
+ def run_eval_basic(with_attack=True):
+ logging.info('eval')
+ eval_loss_clean = []
+ eval_acc_clean = []
+ eval_loss_rand = []
+ eval_acc_rand = []
+ eval_loss_pgd = []
+ eval_acc_pgd = []
+ eval_loss_pand = []
+ eval_acc_pand = []
+ all_outputs = []
+ diffs_rand, diffs_pgd, diffs_pand = [], [], []
+ eval_preds_clean, eval_preds_rand, eval_preds_pgd, eval_preds_pand = [], [], [], []
+ norms_clean, norms_pgd, norms_rand, norms_pand = [], [], [], []
+ norms_dpgd, norms_drand, norms_dpand = [], [], []
+ eval_important_valid = []
+ eval_loss_incr = []
+ eval_conf_pgd = []
+ wdiff_corrs = []
+ udiff_corrs = []
+ grad_corrs = []
+ minps_clean = []
+ minps_pgd = []
+ acc_clean_after_corr = []
+ acc_pgd_after_corr = []
+ eval_det_clean = []
+ eval_det_pgd = []
+
+ net.train(False)
+ for eval_batch in tqdm.tqdm(itt.islice(test_loader, args.eval_batches)):
+ x, y = eval_batch
+ if args.cuda:
+ x, y = x.cuda(), y.cuda()
+
+ loss_clean, preds_clean = get_loss_and_preds(x, y)
+
+ eval_loss_clean.append((loss_clean.data).cpu().numpy())
+ eval_acc_clean.append((th.eq(preds_clean, y).float()).cpu().numpy())
+ eval_preds_clean.extend(preds_clean)
+
+ if with_attack:
+ if args.clamp_uniform:
+ x_rand = x + th.sign(th.empty_like(x).uniform_(-args.eps_rand, args.eps_rand)) * args.eps_rand
+ else:
+ x_rand = x + th.empty_like(x).uniform_(-args.eps_rand, args.eps_rand)
+ loss_rand, preds_rand = get_loss_and_preds(x_rand, y)
+
+ eval_loss_rand.append((loss_rand.data).cpu().numpy())
+ eval_acc_rand.append((th.eq(preds_rand, y).float()).cpu().numpy())
+ eval_preds_rand.extend(preds_rand)
+
+ if not args.load_pgd_test_samples:
+ x_pgd = attack_pgd(x, preds_clean, eps=args.eps_eval)
+ loss_pgd, preds_pgd = get_loss_and_preds(x_pgd, y)
+
+ eval_loss_pgd.append((loss_pgd.data).cpu().numpy())
+ eval_acc_pgd.append((th.eq(preds_pgd, y).float()).cpu().numpy())
+ eval_preds_pgd.extend(preds_pgd)
+
+ loss_incr = loss_pgd - loss_clean
+ eval_loss_incr.append(loss_incr.detach().cpu())
+
+ x_pand = x_pgd + th.empty_like(x_pgd).uniform_(-args.eps_rand, args.eps_rand)
+ loss_pand, preds_pand = get_loss_and_preds(x_pand, y)
+
+ eval_loss_pand.append((loss_pand.data).cpu().numpy())
+ eval_acc_pand.append((th.eq(preds_pand, y).float()).cpu().numpy())
+ eval_preds_pand.extend(preds_pand)
+
+
+ if args.debug:
+ break
+
+ swriter.add_scalar('eval_loss_clean', np.concatenate(eval_loss_clean).mean(), global_step)
+ swriter.add_scalar('eval_acc_clean', np.concatenate(eval_acc_clean).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_rand', np.concatenate(eval_loss_rand).mean(), global_step)
+ swriter.add_scalar('eval_acc_rand', np.concatenate(eval_acc_rand).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_pgd', np.concatenate(eval_loss_pgd).mean(), global_step)
+ swriter.add_scalar('eval_acc_pgd', np.concatenate(eval_acc_pgd).mean(), global_step)
+ swriter.add_scalar('eval_loss_incr', th.cat(eval_loss_incr).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_pand', np.concatenate(eval_loss_pand).mean(), global_step)
+ swriter.add_scalar('eval_acc_pand', np.concatenate(eval_acc_pand).mean(), global_step)
+ net.train(False)
+
+
+ def run_eval(with_attack=True):
+ logging.info('eval')
+ net.train(False)
+ eval_loss_clean = []
+ eval_acc_clean = []
+ eval_loss_rand = []
+ eval_acc_rand = []
+ eval_loss_pgd = []
+ eval_acc_pgd = []
+ eval_loss_pand = []
+ eval_acc_pand = []
+ all_outputs = []
+ diffs_rand, diffs_pgd, diffs_pand = [], [], []
+ eval_preds_clean, eval_preds_rand, eval_preds_pgd, eval_preds_pand = [], [], [], []
+ norms_clean, norms_pgd, norms_rand, norms_pand = [], [], [], []
+ norms_dpgd, norms_drand, norms_dpand = [], [], []
+ eval_important_valid = []
+ eval_loss_incr = []
+ eval_conf_pgd = []
+ wdiff_corrs = []
+ udiff_corrs = []
+ grad_corrs = []
+ minps_clean = []
+ minps_pgd = []
+ acc_clean_after_corr = []
+ acc_pgd_after_corr = []
+ eval_det_clean = []
+ eval_det_pgd = []
+ eval_x_pgd_l0 = []
+ eval_x_pgd_l2 = []
+
+ all_eval_important_pixels = []
+ all_eval_important_single_pixels = []
+ all_eval_losses_per_pixel = []
+
+ if args.save_pgd_samples:
+ for loader, name in ((train_loader, 'train'), (test_loader, 'test')):
+ train_x = []
+ train_y = []
+ train_pgd = []
+ for eval_batch in tqdm.tqdm(loader):
+ x, y = eval_batch
+ if args.cuda:
+ x, y = x.cuda(), y.cuda()
+ _, p = get_loss_and_preds(x, y)
+ train_pgd.append(attack_pgd(x, p, eps=args.eps_eval).cpu().numpy())
+ train_x.append(x.cpu().numpy())
+ train_y.append(y.cpu().numpy())
+ train_pgd = np.concatenate(train_pgd)
+ train_x = np.concatenate(train_x)
+ train_y = np.concatenate(train_y)
+ np.save('logs/{}_pgd.npy'.format(name), train_pgd)
+ np.save('logs/{}_clean.npy'.format(name), train_x)
+ np.save('logs/{}_y.npy'.format(name), train_y)
+ exit(0)
+
+ X, Y = [], []
+ with th.no_grad():
+ for eval_batch in tqdm.tqdm(train_loader):
+ x, y = eval_batch
+ X.append(x.cpu().numpy()), Y.append(y.cpu().numpy())
+ if args.n_collect > 0 and sum(len(x) for x in X) > args.n_collect:
+ if args.ds.startswith('imagenet'):
+ break
+ y_nc, y_cts = np.unique(Y, return_counts=True)
+ if y_nc.size == 1000:
+ if np.all(y_cts >= 5):
+ break
+ else:
+ break
+ logging.debug('need more samples, have {} classes with min size {}...'.format(y_nc.size, np.min(y_cts)))
+ if args.debug:
+ break
+ X, Y = map(np.concatenate, (X, Y))
+
+ pgd_train = None
+ if args.load_pgd_train_samples:
+ pgd_path = os.path.expanduser('~/data/advhyp/{}/samples'.format(args.load_pgd_train_samples))
+ X = np.load(os.path.join(pgd_path, 'train_clean.npy'))
+ Y = np.load(os.path.join(pgd_path, 'train_y.npy'))
+ pgd_train = np.load(os.path.join(pgd_path, 'train_pgd.npy'))
+ if X.shape[-1] == 3:
+ X = X.transpose((0, 3, 1, 2))
+ pgd_train = pgd_train.transpose((0, 3, 1, 2))
+ if len(Y.shape) == 2:
+ Y = Y.argmax(-1)
+
+ if args.model.startswith('resnet') or args.model.startswith('inception'):
+ w_cls = net.fc.weight
+ else:
+ w_cls = list(net.classifier.children())[-1].weight
+ nb_classes = w_cls.shape[0]
+
+ if args.n_collect > 0 and args.load_pgd_train_samples:
+ all_idcs = np.arange(len(X))
+ while True:
+ np.random.shuffle(all_idcs)
+ idcs = all_idcs[:args.n_collect]
+ Y_partial = Y[idcs]
+ y_nc = np.unique(Y_partial).size
+ if y_nc == nb_classes:
+ break
+ logging.debug('only have {} classes, reshuffling...'.format(y_nc))
+ X, Y = X[idcs], Y[idcs]
+ if pgd_train is not None:
+ pgd_train = pgd_train[idcs]
+
+ def latent_and_logits_fn(x):
+ lat, log = net_forward(x, True)[-2:]
+ lat = lat.reshape(lat.shape[0], -1)
+ return lat, log
+
+ noise_eps_detect = args.noise_eps_detect
+ if noise_eps_detect is None:
+ noise_eps_detect = args.noise_eps
+
+ predictor = tf_robustify.collect_statistics(X, Y, latent_and_logits_fn_th=latent_and_logits_fn, nb_classes=nb_classes, weights=w_cls, cuda=args.cuda, debug=args.debug, targeted=args.collect_targeted, noise_eps=args.noise_eps.split(','), noise_eps_detect=noise_eps_detect.split(','), num_noise_samples=args.wdiff_samples, batch_size=args.eval_bs, pgd_eps=args.eps, pgd_lr=args.attack_lr, pgd_iters=args.iters, clip_min=clip_min, clip_max=clip_max, p_ratio_cutoff=args.maxp_cutoff, save_alignments_dir='logs/stats' if args.save_alignments else None, load_alignments_dir=os.path.expanduser('~/data/advhyp/{}/stats'.format(args.model)) if args.load_alignments else None, clip_alignments=args.clip_alignments, pgd_train=pgd_train, fit_classifier=args.fit_classifier, just_detect=args.just_detect)
+ next(predictor)
+ if args.save_alignments:
+ exit(0)
+
+ for eval_batch in tqdm.tqdm(itt.islice(test_loader, args.eval_batches)):
+ if args.load_pgd_test_samples:
+ x, y, x_pgd = eval_batch
+ else:
+ x, y = eval_batch
+ if args.cuda:
+ x, y = x.cuda(), y.cuda()
+ if args.load_pgd_test_samples:
+ x_pgd = x_pgd.cuda()
+
+ loss_clean, preds_clean = get_loss_and_preds(x, y)
+
+ eval_loss_clean.append((loss_clean.data).cpu().numpy())
+ eval_acc_clean.append((th.eq(preds_clean, y).float()).cpu().numpy())
+ eval_preds_clean.extend(preds_clean)
+
+ if with_attack:
+ if args.clamp_uniform:
+ x_rand = x + th.sign(th.empty_like(x).uniform_(-args.eps_rand, args.eps_rand)) * args.eps_rand
+ else:
+ x_rand = x + th.empty_like(x).uniform_(-args.eps_rand, args.eps_rand)
+ loss_rand, preds_rand = get_loss_and_preds(x_rand, y)
+
+ eval_loss_rand.append((loss_rand.data).cpu().numpy())
+ eval_acc_rand.append((th.eq(preds_rand, y).float()).cpu().numpy())
+ eval_preds_rand.extend(preds_rand)
+
+ if args.attack == 'pgd':
+ if not args.load_pgd_test_samples:
+ x_pgd = attack_pgd(x, preds_clean, eps=args.eps_eval)
+ elif args.attack == 'pgdl2':
+ x_pgd = attack_pgd(x, preds_clean, eps=args.eps_eval, l2=True)
+ elif args.attack == 'cw':
+ x_pgd = attack_cw(x, preds_clean)
+
+ elif args.attack == 'mean':
+ x_pgd = attack_mean(x, preds_clean, eps=args.eps_eval)
+ eval_x_pgd_l0.append(th.max(th.abs((x - x_pgd).view(x.size(0), -1)), -1)[0].detach().cpu().numpy())
+ eval_x_pgd_l2.append(th.norm((x - x_pgd).view(x.size(0), -1), p=2, dim=-1).detach().cpu().numpy())
+
+ loss_pgd, preds_pgd = get_loss_and_preds(x_pgd, y)
+
+ eval_loss_pgd.append((loss_pgd.data).cpu().numpy())
+ eval_acc_pgd.append((th.eq(preds_pgd, y).float()).cpu().numpy())
+ conf_pgd = confusion_matrix(preds_clean.cpu(), preds_pgd.cpu(), np.arange(nb_classes))
+ conf_pgd -= np.diag(np.diag(conf_pgd))
+ eval_conf_pgd.append(conf_pgd)
+ eval_preds_pgd.extend(preds_pgd)
+
+ loss_incr = loss_pgd - loss_clean
+ eval_loss_incr.append(loss_incr.detach().cpu())
+
+ x_pand = x_pgd + th.empty_like(x_pgd).uniform_(-args.eps_rand, args.eps_rand)
+ loss_pand, preds_pand = get_loss_and_preds(x_pand, y)
+
+ eval_loss_pand.append((loss_pand.data).cpu().numpy())
+ eval_acc_pand.append((th.eq(preds_pand, y).float()).cpu().numpy())
+ eval_preds_pand.extend(preds_pand)
+
+ preds_clean_after_corr, det_clean = predictor.send(x.cpu().numpy()).T
+ preds_pgd_after_corr, det_pgd = predictor.send(x_pgd.cpu().numpy()).T
+
+ acc_clean_after_corr.append(preds_clean_after_corr == y.cpu().numpy())
+ acc_pgd_after_corr.append(preds_pgd_after_corr == y.cpu().numpy())
+
+ eval_det_clean.append(det_clean)
+ eval_det_pgd.append(det_pgd)
+
+ if args.debug:
+ break
+
+ swriter.add_scalar('eval_loss_clean', np.concatenate(eval_loss_clean).mean(), global_step)
+ swriter.add_scalar('eval_acc_clean', np.concatenate(eval_acc_clean).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_rand', np.concatenate(eval_loss_rand).mean(), global_step)
+ swriter.add_scalar('eval_acc_rand', np.concatenate(eval_acc_rand).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_pgd', np.concatenate(eval_loss_pgd).mean(), global_step)
+ swriter.add_scalar('eval_acc_pgd', np.concatenate(eval_acc_pgd).mean(), global_step)
+ swriter.add_scalar('eval_loss_incr', th.cat(eval_loss_incr).mean(), global_step)
+
+ swriter.add_scalar('eval_loss_pand', np.concatenate(eval_loss_pand).mean(), global_step)
+ swriter.add_scalar('eval_acc_pand', np.concatenate(eval_acc_pand).mean(), global_step)
+
+ swriter.add_histogram('class_dist_clean', th.stack(eval_preds_clean), global_step)
+ swriter.add_histogram('class_dist_rand', th.stack(eval_preds_rand), global_step)
+ swriter.add_histogram('class_dist_pgd', th.stack(eval_preds_pgd), global_step)
+ swriter.add_histogram('class_dist_pand', th.stack(eval_preds_pand), global_step)
+
+ swriter.add_scalar('acc_clean_after_corr', np.concatenate(acc_clean_after_corr).mean(), global_step)
+ swriter.add_scalar('acc_pgd_after_corr', np.concatenate(acc_pgd_after_corr).mean(), global_step)
+ swriter.add_scalar('det_clean', np.concatenate(eval_det_clean).mean(), global_step)
+ swriter.add_scalar('det_pgd', np.concatenate(eval_det_pgd).mean(), global_step)
+
+ swriter.add_scalar('x_pgd_l0', np.concatenate(eval_x_pgd_l0).mean(), global_step)
+ swriter.add_scalar('x_pgd_l2', np.concatenate(eval_x_pgd_l2).mean(), global_step)
+
+ net.train(True)
+
+ if args.mode == 'eval':
+ for p in net.parameters():
+ p.requires_grad_(False)
+ run_eval()
+ elif args.mode == 'train':
+ run_train()
+
+
+if __name__ == '__main__':
+ main()
diff --git a/case_studies/odds/original/vgg.py b/case_studies/odds/original/vgg.py
new file mode 100644
index 0000000..aef147e
--- /dev/null
+++ b/case_studies/odds/original/vgg.py
@@ -0,0 +1,177 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+'''
+Modified from https://github.com/pytorch/vision.git
+'''
+import math
+
+import torch.nn as nn
+import torch.nn.init as init
+
+__all__ = [
+ 'VGG', 'vgg11', 'vgg11_bn', 'vgg13', 'vgg13_bn', 'vgg16', 'vgg16_bn',
+ 'vgg19_bn', 'vgg19', 'vgg11_nd', 'vgg11_nd_s', 'vgg13_nd', 'vgg13_nd_s', 'vgg16_nd', 'vgg16_nd_s', 'vgg19_nd', 'vgg19_nd_s',
+ 'vgg11_nd_ss', 'vgg13_nd_ss', 'vgg16_nd_ss', 'vgg19_nd_ss',
+]
+
+
+class VGG(nn.Module):
+ '''
+ VGG model
+ '''
+ def __init__(self, features, dropout=True, small=False, supersmall=False):
+ super(VGG, self).__init__()
+ self.features = features
+ cls_layers = []
+ if dropout or supersmall:
+ cls_layers.append(nn.Dropout())
+ if not (small or supersmall):
+ cls_layers.append(nn.Linear(512, 512))
+ cls_layers.append(nn.ReLU())
+ if dropout:
+ cls_layers.append(nn.Dropout())
+ if not supersmall:
+ cls_layers.append(nn.Linear(512, 512))
+ cls_layers.append(nn.ReLU())
+ cls_layers.append(nn.Linear(512, 10))
+
+ self.classifier = nn.Sequential(*cls_layers)
+ # Initialize weights
+ for m in self.modules():
+ if isinstance(m, nn.Conv2d):
+ n = m.kernel_size[0] * m.kernel_size[1] * m.out_channels
+ m.weight.data.normal_(0, math.sqrt(2. / n))
+ m.bias.data.zero_()
+
+
+ def forward(self, x):
+ x = self.features(x)
+ x = x.view(x.size(0), -1)
+ x = self.classifier(x)
+ return x
+
+
+def make_layers(cfg, batch_norm=False):
+ layers = []
+ in_channels = 3
+ for v in cfg:
+ if v == 'M':
+ layers += [nn.MaxPool2d(kernel_size=2, stride=2)]
+ else:
+ conv2d = nn.Conv2d(in_channels, v, kernel_size=3, padding=1)
+ if batch_norm:
+ layers += [conv2d, nn.BatchNorm2d(v), nn.ReLU(inplace=False)]
+ else:
+ layers += [conv2d, nn.ReLU(inplace=False)]
+ in_channels = v
+ return nn.Sequential(*layers)
+
+
+cfg = {
+ 'A': [64, 'M', 128, 'M', 256, 256, 'M', 512, 512, 'M', 512, 512, 'M'],
+ 'B': [64, 64, 'M', 128, 128, 'M', 256, 256, 'M', 512, 512, 'M', 512, 512, 'M'],
+ 'D': [64, 64, 'M', 128, 128, 'M', 256, 256, 256, 'M', 512, 512, 512, 'M', 512, 512, 512, 'M'],
+ 'E': [64, 64, 'M', 128, 128, 'M', 256, 256, 256, 256, 'M', 512, 512, 512, 512, 'M',
+ 512, 512, 512, 512, 'M'],
+}
+
+
+def vgg11():
+ """VGG 11-layer model (configuration "A")"""
+ return VGG(make_layers(cfg['A']))
+
+def vgg11_nd():
+ """VGG 11-layer model (configuration "A")"""
+ return VGG(make_layers(cfg['A']), dropout=False)
+
+def vgg11_nd_s():
+ """VGG 11-layer model (configuration "A")"""
+ return VGG(make_layers(cfg['A']), dropout=False, small=True)
+
+def vgg11_nd_ss():
+ """VGG 11-layer model (configuration "A")"""
+ return VGG(make_layers(cfg['A']), dropout=False, small=True, supersmall=True)
+
+
+def vgg11_bn():
+ """VGG 11-layer model (configuration "A") with batch normalization"""
+ return VGG(make_layers(cfg['A'], batch_norm=True))
+
+
+def vgg13():
+ """VGG 13-layer model (configuration "B")"""
+ return VGG(make_layers(cfg['B']))
+
+def vgg13_nd():
+ """VGG 13-layer model (configuration "B")"""
+ return VGG(make_layers(cfg['B']), dropout=False)
+
+def vgg13_nd_s():
+ """VGG 13-layer model (configuration "B")"""
+ return VGG(make_layers(cfg['B']), dropout=False, small=True)
+
+def vgg13_nd_ss():
+ """VGG 13-layer model (configuration "B")"""
+ return VGG(make_layers(cfg['B']), dropout=False, small=True, supersmall=True)
+
+
+def vgg13_bn():
+ """VGG 13-layer model (configuration "B") with batch normalization"""
+ return VGG(make_layers(cfg['B'], batch_norm=True))
+
+
+def vgg16():
+ """VGG 16-layer model (configuration "D")"""
+ return VGG(make_layers(cfg['D']))
+
+def vgg16_nd():
+ """VGG 16-layer model (configuration "D")"""
+ return VGG(make_layers(cfg['D']), dropout=False)
+
+def vgg16_nd_s():
+ """VGG 16-layer model (configuration "D")"""
+ return VGG(make_layers(cfg['D']), dropout=False, small=True)
+
+def vgg16_nd_ss():
+ """VGG 16-layer model (configuration "D")"""
+ return VGG(make_layers(cfg['D']), dropout=False, small=True, supersmall=True)
+
+
+def vgg16_bn():
+ """VGG 16-layer model (configuration "D") with batch normalization"""
+ return VGG(make_layers(cfg['D'], batch_norm=True))
+
+
+def vgg19():
+ """VGG 19-layer model (configuration "E")"""
+ return VGG(make_layers(cfg['E']))
+
+def vgg19_nd():
+ """VGG 19-layer model (configuration "E")"""
+ return VGG(make_layers(cfg['E']), dropout=False)
+
+def vgg19_nd_s():
+ """VGG 19-layer model (configuration "E")"""
+ return VGG(make_layers(cfg['E']), dropout=False, small=True)
+
+def vgg19_nd_ss():
+ """VGG 19-layer model (configuration "E")"""
+ return VGG(make_layers(cfg['E']), dropout=False, small=True, supersmall=True)
+
+
+
+def vgg19_bn():
+ """VGG 19-layer model (configuration 'E') with batch normalization"""
+ return VGG(make_layers(cfg['E'], batch_norm=True))
diff --git a/case_studies/odds/setup_venv.sh b/case_studies/odds/setup_venv.sh
new file mode 100644
index 0000000..987999f
--- /dev/null
+++ b/case_studies/odds/setup_venv.sh
@@ -0,0 +1,11 @@
+set -e
+apt-get update
+apt install python3.8-venv
+python -m venv /projects/active-adversarial-tests/venv3.8tf --system-site-packages
+source /projects/active-adversarial-tests/venv3.8tf/bin/activate
+pip install robustml
+pip install cleverhans==3.0.1 # updating causes package inconsistencies
+pip install keras==2.2.4 # updating causes package inconsistencies
+pip install line_profiler
+/projects/active-adversarial-tests/install_requirements.sh
+
diff --git a/case_studies/pcl_defense/README.md b/case_studies/pcl_defense/README.md
new file mode 100644
index 0000000..9fe851c
--- /dev/null
+++ b/case_studies/pcl_defense/README.md
@@ -0,0 +1,68 @@
+
+# Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks (ICCV'19)
+
+
+
+This repository is an PyTorch implementation of the ICCV'19 paper [Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks](https://arxiv.org/abs/1904.00887).
+
+To counter adversarial attacks, we propose Prototype Conformity Loss to class-wise disentangle intermediate features of a deep network. From the figure, it can be observed that the main reason for the existence of such adversarial samples is the close proximity of learnt features in the latent feature space.
+
+We provide scripts for reproducing the results from our paper.
+
+
+## Clone the repository
+Clone this repository into any place you want.
+```bash
+git clone https://github.com/aamir-mustafa/pcl-adversarial-defense
+cd pcl-adversarial-defense
+```
+## Softmax (Cross-Entropy) Training
+To expedite the process of forming clusters for our proposed loss, we initially train the model using cross-entropy loss.
+
+``softmax_training.py`` -- ( For initial softmax training).
+
+* The trained checkpoints will be saved in ``Models_Softmax`` folder.
+
+
+## Prototype Conformity Loss
+The deep features for the prototype conformity loss are extracted from different intermediate layers using auxiliary branches, which map the features to a lower dimensional output as shown in the following figure.
+
+
+
+
+
+``pcl_training.py`` -- ( Joint supervision with cross-entropy and our loss).
+
+* The trained checkpoints will be saved in ``Models_PCL`` folder.
+
+## Adversarial Training
+``pcl_training_adversarial_fgsm.py`` -- ( Adversarial Training using FGSM Attack).
+
+``pcl_training_adversarial_pgd.py`` -- ( Adversarial Training using PGD Attack).
+
+
+
+## Testing Model's Robustness against White-Box Attacks
+
+``robustness.py`` -- (Evaluate trained model's robustness against various types of attacks).
+
+## Comparison of Softmax Trained Model and Our Model
+Retained classification accuracy of the model's under various types of adversarial attacks:
+
+| Training Scheme | No Attack | FGSM | BIM | MIM | PGD |
+| :------- | :---------- | :----- |:------ |:------ |:------ |
+| Softmax | 92.15 | 21.48 | 0.01 | 0.02 | 0.00 |
+| Ours | 89.55 | 55.76 | 39.75 | 36.44 | 31.10 |
+
+
+## Citation
+```
+@InProceedings{Mustafa_2019_ICCV,
+author = {Mustafa, Aamir and Khan, Salman and Hayat, Munawar and Goecke, Roland and Shen, Jianbing and Shao, Ling},
+title = {Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks},
+booktitle = {The IEEE International Conference on Computer Vision (ICCV)},
+month = {October},
+year = {2019}
+}
+```
+
diff --git a/case_studies/pcl_defense/binarization_test.sh b/case_studies/pcl_defense/binarization_test.sh
new file mode 100644
index 0000000..2fa03fe
--- /dev/null
+++ b/case_studies/pcl_defense/binarization_test.sh
@@ -0,0 +1,20 @@
+nsamples=${1:-512}
+attack=${2:-pgd}
+epsilon=${3:-8}
+
+# kwargs=""
+kwargs="--sample-from-corners"
+
+echo "Attack: $attack"
+echo "Epsilon: $epsilon"
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+ --binarization-test \
+ --epsilon=$epsilon \
+ --n-boundary-points=1 \
+ --n-inner-points=999 \
+ --attack=$attack \
+ --num-samples-test=$nsamples \
+ $kwargs
diff --git a/case_studies/pcl_defense/binarization_test_increased_hardness.sh b/case_studies/pcl_defense/binarization_test_increased_hardness.sh
new file mode 100644
index 0000000..fa4fa3a
--- /dev/null
+++ b/case_studies/pcl_defense/binarization_test_increased_hardness.sh
@@ -0,0 +1,42 @@
+attack=${1:-pgd}
+nsamples=${2:-2048}
+mode=$3
+epsilon=${4:-8}
+
+if [ -z ${mode+x} ]; then
+ echo "No hardness mode specified. Choose from: ninner, gap"
+ exit -1
+fi
+
+echo "Attack: $attack, #Samples: $nsamples, epsilon: $epsilon"
+echo ""
+
+if [[ "$mode" == "ninner" ]]; then
+ for ninner in 49 99 199 299 399 499 599 699 799 899 999 1999; do
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, $ninner inner"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+ --binarization-test \
+ --epsilon=$epsilon \
+ --attack=$attack \
+ --num-samples-test=$nsamples \
+ --n-boundary-points=1 \
+ --n-inner-points=999
+ done
+elif [[ "$mode" == "gap" ]]; then
+ for closeness in 0.9999 0.999 0.95 0.90 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1; do
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "1 boundary point, 1999 inner, closeness of $closeness"
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+ --binarization-test \
+ --epsilon=$epsilon \
+ --attack=$attack \
+ --num-samples-test=$nsamples \
+ --n-boundary-points=1 \
+ --n-inner-points=1999 \
+ --decision-boundary-closeness=$closeness
+ # -n-inner-points was 999 before 25.02.2022
+ done
+fi
\ No newline at end of file
diff --git a/case_studies/pcl_defense/contrastive_proximity.py b/case_studies/pcl_defense/contrastive_proximity.py
new file mode 100644
index 0000000..a46f5ab
--- /dev/null
+++ b/case_studies/pcl_defense/contrastive_proximity.py
@@ -0,0 +1,60 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import torch
+import torch.nn as nn
+
+class Con_Proximity(nn.Module):
+
+ def __init__(self, num_classes=100, feat_dim=1024, use_gpu=True):
+ super(Con_Proximity, self).__init__()
+ self.num_classes = num_classes
+ self.feat_dim = feat_dim
+ self.use_gpu = use_gpu
+
+ if self.use_gpu:
+ self.centers = nn.Parameter(torch.randn(self.num_classes, self.feat_dim).cuda())#100 x feats- for 100 centers
+ else:
+ self.centers = nn.Parameter(torch.randn(self.num_classes, self.feat_dim))
+
+ def forward(self, x, labels):
+
+ batch_size = x.size(0)
+ distmat = torch.pow(x, 2).sum(dim=1, keepdim=True).expand(batch_size, self.num_classes) + \
+ torch.pow(self.centers, 2).sum(dim=1, keepdim=True).expand(self.num_classes, batch_size).t()
+ distmat.addmm_(1, -2, x, self.centers.t())
+
+ classes = torch.arange(self.num_classes).long()
+ if self.use_gpu: classes = classes.cuda()
+ labels = labels.unsqueeze(1).expand(batch_size, self.num_classes)
+ mask = labels.eq(classes.expand(batch_size, self.num_classes))
+
+ dist = []
+ for i in range(batch_size):
+
+ k= mask[i].clone().to(dtype=torch.int8)
+
+ k= -1* k +1
+
+ kk= k.clone().to(dtype=torch.uint8)
+
+ value = distmat[i][kk]
+
+ value = value.clamp(min=1e-12, max=1e+12) # for numerical stability
+
+ dist.append(value)
+ dist = torch.cat(dist)
+ loss = dist.mean()
+
+ return loss
diff --git a/case_studies/pcl_defense/eval.sh b/case_studies/pcl_defense/eval.sh
new file mode 100644
index 0000000..b16ad9f
--- /dev/null
+++ b/case_studies/pcl_defense/eval.sh
@@ -0,0 +1,25 @@
+
+echo "Baseline:"
+#python3 case_studies/pcl_defense/robustness.py --baseline
+#python3 case_studies/pcl_defense/robustness.py --baseline --binarization-test --epsilon=4
+
+echo "Model w/ their defense"
+#python3 case_studies/pcl_defense/robustness.py
+#python3 case_studies/pcl_defense/robustness.py --binarization-test --epsilon=8 --n-boundary-points=1 --n-inner-points=999
+#python3 case_studies/pcl_defense/robustness.py --binarization-test --epsilon=6
+#python3 case_studies/pcl_defense/robustness.py --binarization-test --epsilon=4
+
+
+PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+ --binarization-test --epsilon=8 --n-boundary-points=1 \
+ --n-inner-points=999
+PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+ --binarization-test --epsilon=8 --n-boundary-points=1 --n-inner-points=999 \
+ --attack=autopgd
+
+#PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+# --binarization-test --epsilon=8 --n-boundary-points=1 \
+# --n-inner-points=999 --use-autopgd-boundary-adversarials
+#PYTHONPATH=$(pwd) python3 case_studies/pcl_defense/robustness.py \
+# --binarization-test --epsilon=8 --n-boundary-points=1 --n-inner-points=999 \
+# --use-autopgd-boundary-adversarials --attack=autopgd
\ No newline at end of file
diff --git a/case_studies/pcl_defense/pcl_training.py b/case_studies/pcl_defense/pcl_training.py
new file mode 100644
index 0000000..c068a93
--- /dev/null
+++ b/case_studies/pcl_defense/pcl_training.py
@@ -0,0 +1,297 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+"""
+Created on Wed Jan 23 10:15:27 2019
+
+@author: aamir-mustafa
+Implementation Part 2 of Paper:
+ "Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks"
+
+Here it is not necessary to save the best performing model (in terms of accuracy). The model with high robustness
+against adversarial attacks is chosen.
+
+"""
+
+#Essential Imports
+import os
+import sys
+import argparse
+import datetime
+import time
+import os.path as osp
+import numpy as np
+import torch
+import torch.nn as nn
+import torch.backends.cudnn as cudnn
+import torchvision
+import torchvision.transforms as transforms
+from pcl_utils import AverageMeter, Logger
+from proximity import Proximity
+from contrastive_proximity import Con_Proximity
+from resnet_model import * # Imports the ResNet Model
+
+
+parser = argparse.ArgumentParser("Prototype Conformity Loss Implementation")
+parser.add_argument('-j', '--workers', default=4, type=int,
+ help="number of data loading workers (default: 4)")
+parser.add_argument('--train-batch', default=128, type=int, metavar='N',
+ help='train batchsize')
+parser.add_argument('--test-batch', default=100, type=int, metavar='N',
+ help='test batchsize')
+parser.add_argument('--schedule', type=int, nargs='+', default=[142, 230, 360],
+ help='Decrease learning rate at these epochs.')
+parser.add_argument('--lr_model', type=float, default=0.01, help="learning rate for CE Loss")
+parser.add_argument('--lr_prox', type=float, default=0.5, help="learning rate for Proximity Loss") # as per paper
+parser.add_argument('--weight-prox', type=float, default=1, help="weight for Proximity Loss") # as per paper
+parser.add_argument('--lr_conprox', type=float, default=0.0001, help="learning rate for Con-Proximity Loss") # as per paper
+parser.add_argument('--weight-conprox', type=float, default=0.0001, help="weight for Con-Proximity Loss") # as per paper
+parser.add_argument('--max-epoch', type=int, default=400)
+parser.add_argument('--gamma', type=float, default=0.1, help="learning rate decay")
+parser.add_argument('--eval-freq', type=int, default=10)
+parser.add_argument('--print-freq', type=int, default=50)
+parser.add_argument('--gpu', type=str, default='0')
+parser.add_argument('--seed', type=int, default=1)
+parser.add_argument('--use-cpu', action='store_true')
+parser.add_argument('--save-dir', type=str, default='log')
+
+args = parser.parse_args()
+state = {k: v for k, v in args._get_kwargs()}
+
+
+def main():
+ torch.manual_seed(args.seed)
+ os.environ['CUDA_VISIBLE_DEVICES'] = args.gpu
+ use_gpu = torch.cuda.is_available()
+ if args.use_cpu: use_gpu = False
+
+ sys.stdout = Logger(osp.join(args.save_dir, 'log_' + 'CIFAR-10_PC_Loss' + '.txt'))
+
+ if use_gpu:
+ print("Currently using GPU: {}".format(args.gpu))
+ cudnn.benchmark = True
+ torch.cuda.manual_seed_all(args.seed)
+ else:
+ print("Currently using CPU")
+
+ # Data Load
+ num_classes=10
+ print('==> Preparing dataset')
+ transform_train = transforms.Compose([
+ transforms.RandomCrop(32, padding=4),
+ transforms.RandomHorizontalFlip(),
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ transform_test = transforms.Compose([
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ trainset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=True,
+ download=True, transform=transform_train)
+ trainloader = torch.utils.data.DataLoader(trainset, batch_size=args.train_batch, pin_memory=True,
+ shuffle=True, num_workers=args.workers)
+
+ testset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=False,
+ download=True, transform=transform_test)
+ testloader = torch.utils.data.DataLoader(testset, batch_size=args.test_batch, pin_memory=True,
+ shuffle=False, num_workers=args.workers)
+
+# Loading the Model
+ model = resnet(num_classes=num_classes,depth=110)
+
+ if True:
+ model = nn.DataParallel(model).cuda()
+
+ criterion_xent = nn.CrossEntropyLoss()
+ criterion_prox_1024 = Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_prox_256 = Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ criterion_conprox_1024 = Con_Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_conprox_256 = Con_Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ optimizer_model = torch.optim.SGD(model.parameters(), lr=args.lr_model, weight_decay=1e-04, momentum=0.9)
+
+ optimizer_prox_1024 = torch.optim.SGD(criterion_prox_1024.parameters(), lr=args.lr_prox)
+ optimizer_prox_256 = torch.optim.SGD(criterion_prox_256.parameters(), lr=args.lr_prox)
+
+ optimizer_conprox_1024 = torch.optim.SGD(criterion_conprox_1024.parameters(), lr=args.lr_conprox)
+ optimizer_conprox_256 = torch.optim.SGD(criterion_conprox_256.parameters(), lr=args.lr_conprox)
+
+
+ filename= 'Models_Softmax/CIFAR10_Softmax.pth.tar'
+ checkpoint = torch.load(filename)
+
+ model.load_state_dict(checkpoint['state_dict'])
+ optimizer_model.load_state_dict= checkpoint['optimizer_model']
+
+ start_time = time.time()
+
+ for epoch in range(args.max_epoch):
+
+ adjust_learning_rate(optimizer_model, epoch)
+ adjust_learning_rate_prox(optimizer_prox_1024, epoch)
+ adjust_learning_rate_prox(optimizer_prox_256, epoch)
+
+ adjust_learning_rate_conprox(optimizer_conprox_1024, epoch)
+ adjust_learning_rate_conprox(optimizer_conprox_256, epoch)
+
+ print("==> Epoch {}/{}".format(epoch+1, args.max_epoch))
+ train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch)
+
+ if args.eval_freq > 0 and (epoch+1) % args.eval_freq == 0 or (epoch+1) == args.max_epoch:
+ print("==> Test") #Tests after every 10 epochs
+ acc, err = test(model, testloader, use_gpu, num_classes, epoch)
+ print("Accuracy (%): {}\t Error rate (%): {}".format(acc, err))
+
+ state_ = {'epoch': epoch + 1, 'state_dict': model.state_dict(),
+ 'optimizer_model': optimizer_model.state_dict(), 'optimizer_prox_1024': optimizer_prox_1024.state_dict(),
+ 'optimizer_prox_256': optimizer_prox_256.state_dict(), 'optimizer_conprox_1024': optimizer_conprox_1024.state_dict(),
+ 'optimizer_conprox_256': optimizer_conprox_256.state_dict(),}
+
+ torch.save(state_, 'Models_PCL/CIFAR10_PCL.pth.tar')
+
+ elapsed = round(time.time() - start_time)
+ elapsed = str(datetime.timedelta(seconds=elapsed))
+ print("Finished. Total elapsed time (h:m:s): {}".format(elapsed))
+
+def train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch):
+
+ model.train()
+ xent_losses = AverageMeter() #Computes and stores the average and current value
+ prox_losses_1024 = AverageMeter()
+ prox_losses_256= AverageMeter()
+
+ conprox_losses_1024 = AverageMeter()
+ conprox_losses_256= AverageMeter()
+ losses = AverageMeter()
+
+ #Batchwise training
+ for batch_idx, (data, labels) in enumerate(trainloader):
+ if use_gpu:
+ data, labels = data.cuda(), labels.cuda()
+ feats128, feats256, feats1024, outputs = model(data)
+ loss_xent = criterion_xent(outputs, labels)
+
+ loss_prox_1024 = criterion_prox_1024(feats1024, labels)
+ loss_prox_256= criterion_prox_256(feats256, labels)
+
+ loss_conprox_1024 = criterion_conprox_1024(feats1024, labels)
+ loss_conprox_256= criterion_conprox_256(feats256, labels)
+
+ loss_prox_1024 *= args.weight_prox
+ loss_prox_256 *= args.weight_prox
+
+ loss_conprox_1024 *= args.weight_conprox
+ loss_conprox_256 *= args.weight_conprox
+
+ loss = loss_xent + loss_prox_1024 + loss_prox_256 - loss_conprox_1024 - loss_conprox_256 # total loss
+ optimizer_model.zero_grad()
+
+ optimizer_prox_1024.zero_grad()
+ optimizer_prox_256.zero_grad()
+
+ optimizer_conprox_1024.zero_grad()
+ optimizer_conprox_256.zero_grad()
+
+ loss.backward()
+ optimizer_model.step()
+
+ for param in criterion_prox_1024.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_1024.step()
+
+ for param in criterion_prox_256.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_256.step()
+
+
+ for param in criterion_conprox_1024.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_1024.step()
+
+ for param in criterion_conprox_256.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_256.step()
+
+ losses.update(loss.item(), labels.size(0))
+ xent_losses.update(loss_xent.item(), labels.size(0))
+ prox_losses_1024.update(loss_prox_1024.item(), labels.size(0))
+ prox_losses_256.update(loss_prox_256.item(), labels.size(0))
+
+ conprox_losses_1024.update(loss_conprox_1024.item(), labels.size(0))
+ conprox_losses_256.update(loss_conprox_256.item(), labels.size(0))
+
+ if (batch_idx+1) % args.print_freq == 0:
+ print("Batch {}/{}\t Loss {:.6f} ({:.6f}) XentLoss {:.6f} ({:.6f}) ProxLoss_1024 {:.6f} ({:.6f}) ProxLoss_256 {:.6f} ({:.6f}) \n ConProxLoss_1024 {:.6f} ({:.6f}) ConProxLoss_256 {:.6f} ({:.6f}) " \
+ .format(batch_idx+1, len(trainloader), losses.val, losses.avg, xent_losses.val, xent_losses.avg,
+ prox_losses_1024.val, prox_losses_1024.avg, prox_losses_256.val, prox_losses_256.avg ,
+ conprox_losses_1024.val, conprox_losses_1024.avg, conprox_losses_256.val,
+ conprox_losses_256.avg ))
+
+
+def test(model, testloader, use_gpu, num_classes, epoch):
+ model.eval()
+ correct, total = 0, 0
+
+ with torch.no_grad():
+ for data, labels in testloader:
+ if True:
+ data, labels = data.cuda(), labels.cuda()
+ feats128, feats256, feats1024, outputs = model(data)
+ predictions = outputs.data.max(1)[1]
+ total += labels.size(0)
+ correct += (predictions == labels.data).sum()
+
+
+ acc = correct * 100. / total
+ err = 100. - acc
+ return acc, err
+
+def adjust_learning_rate(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_model'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_model'] = state['lr_model']
+
+def adjust_learning_rate_prox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_prox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_prox'] = state['lr_prox']
+
+def adjust_learning_rate_conprox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_conprox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_conprox'] = state['lr_conprox']
+if __name__ == '__main__':
+ main()
+
+
+
+
+
diff --git a/case_studies/pcl_defense/pcl_training_adversarial_fgsm.py b/case_studies/pcl_defense/pcl_training_adversarial_fgsm.py
new file mode 100644
index 0000000..50026b8
--- /dev/null
+++ b/case_studies/pcl_defense/pcl_training_adversarial_fgsm.py
@@ -0,0 +1,335 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+"""
+Created on Wed Jan 23 10:15:27 2019
+
+@author: aamir-mustafa
+Implementation Part 2 of Paper:
+ "Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks"
+
+Here it is not necessary to save the best performing model (in terms of accuracy). The model with high robustness
+against adversarial attacks is chosen.
+This coe implements Adversarial Training using FGSM Attack.
+"""
+
+#Essential Imports
+import os
+import sys
+import argparse
+import datetime
+import time
+import os.path as osp
+import numpy as np
+import torch
+import torch.nn as nn
+import torch.backends.cudnn as cudnn
+import torchvision
+import torchvision.transforms as transforms
+from pcl_utils import AverageMeter, Logger
+from proximity import Proximity
+from contrastive_proximity import Con_Proximity
+from resnet_model import * # Imports the ResNet Model
+
+
+parser = argparse.ArgumentParser("Prototype Conformity Loss Implementation")
+parser.add_argument('-j', '--workers', default=4, type=int,
+ help="number of data loading workers (default: 4)")
+parser.add_argument('--train-batch', default=64, type=int, metavar='N',
+ help='train batchsize')
+parser.add_argument('--test-batch', default=100, type=int, metavar='N',
+ help='test batchsize')
+parser.add_argument('--schedule', type=int, nargs='+', default=[142, 230, 360],
+ help='Decrease learning rate at these epochs.')
+parser.add_argument('--lr_model', type=float, default=0.01, help="learning rate for model")
+parser.add_argument('--lr_prox', type=float, default=0.5, help="learning rate for Proximity Loss") # as per paper
+parser.add_argument('--weight-prox', type=float, default=1, help="weight for Proximity Loss") # as per paper
+parser.add_argument('--lr_conprox', type=float, default=0.00001, help="learning rate for Con-Proximity Loss") # as per paper
+parser.add_argument('--weight-conprox', type=float, default=0.00001, help="weight for Con-Proximity Loss") # as per paper
+parser.add_argument('--max-epoch', type=int, default=500)
+parser.add_argument('--gamma', type=float, default=0.1, help="learning rate decay")
+parser.add_argument('--eval-freq', type=int, default=10)
+parser.add_argument('--print-freq', type=int, default=50)
+parser.add_argument('--gpu', type=str, default='0')
+parser.add_argument('--seed', type=int, default=1)
+parser.add_argument('--use-cpu', action='store_true')
+parser.add_argument('--save-dir', type=str, default='log')
+
+args = parser.parse_args()
+state = {k: v for k, v in args._get_kwargs()}
+
+mean = [0.4914, 0.4822, 0.4465]
+std = [0.2023, 0.1994, 0.2010]
+def normalize(t):
+ t[:, 0, :, :] = (t[:, 0, :, :] - mean[0])/std[0]
+ t[:, 1, :, :] = (t[:, 1, :, :] - mean[1])/std[1]
+ t[:, 2, :, :] = (t[:, 2, :, :] - mean[2])/std[2]
+
+ return t
+
+def un_normalize(t):
+ t[:, 0, :, :] = (t[:, 0, :, :] * std[0]) + mean[0]
+ t[:, 1, :, :] = (t[:, 1, :, :] * std[1]) + mean[1]
+ t[:, 2, :, :] = (t[:, 2, :, :] * std[2]) + mean[2]
+
+ return t
+
+def FGSM(model, criterion, img, label, eps):
+ adv = img.clone()
+ adv.requires_grad = True
+ _,_,_, out= model(adv)
+ loss = criterion(out, label)
+ loss.backward()
+ adv.data = un_normalize(adv.data) + eps * adv.grad.sign()
+ adv.data.clamp_(0.0, 1.0)
+ adv.grad.data.zero_()
+ return adv.detach()
+
+def main():
+ torch.manual_seed(args.seed)
+ os.environ['CUDA_VISIBLE_DEVICES'] = args.gpu
+ use_gpu = torch.cuda.is_available()
+ if args.use_cpu: use_gpu = False
+
+ sys.stdout = Logger(osp.join(args.save_dir, 'log_' + 'CIFAR-10_PC_Loss_FGSM_AdvTrain' + '.txt'))
+
+ if use_gpu:
+ print("Currently using GPU: {}".format(args.gpu))
+ cudnn.benchmark = True
+ torch.cuda.manual_seed_all(args.seed)
+ else:
+ print("Currently using CPU")
+
+ # Data Load
+ num_classes=10
+ print('==> Preparing dataset')
+ transform_train = transforms.Compose([
+ transforms.RandomCrop(32, padding=4),
+ transforms.RandomHorizontalFlip(),
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ transform_test = transforms.Compose([
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ trainset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=True,
+ download=True, transform=transform_train)
+ trainloader = torch.utils.data.DataLoader(trainset, batch_size=args.train_batch, pin_memory=True,
+ shuffle=True, num_workers=args.workers)
+
+ testset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=False,
+ download=True, transform=transform_test)
+ testloader = torch.utils.data.DataLoader(testset, batch_size=args.test_batch, pin_memory=True,
+ shuffle=False, num_workers=args.workers)
+
+# Loading the Model
+ model = resnet(num_classes=num_classes,depth=110)
+
+ if True:
+ model = nn.DataParallel(model).cuda()
+
+ criterion_xent = nn.CrossEntropyLoss()
+ criterion_prox_1024 = Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_prox_256 = Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ criterion_conprox_1024 = Con_Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_conprox_256 = Con_Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ optimizer_model = torch.optim.SGD(model.parameters(), lr=args.lr_model, weight_decay=1e-04, momentum=0.9)
+
+ optimizer_prox_1024 = torch.optim.SGD(criterion_prox_1024.parameters(), lr=args.lr_prox)
+ optimizer_prox_256 = torch.optim.SGD(criterion_prox_256.parameters(), lr=args.lr_prox)
+
+ optimizer_conprox_1024 = torch.optim.SGD(criterion_conprox_1024.parameters(), lr=args.lr_conprox)
+ optimizer_conprox_256 = torch.optim.SGD(criterion_conprox_256.parameters(), lr=args.lr_conprox)
+
+
+ filename= 'Models_Softmax/CIFAR10_Softmax.pth.tar'
+ checkpoint = torch.load(filename)
+
+ model.load_state_dict(checkpoint['state_dict'])
+ optimizer_model.load_state_dict= checkpoint['optimizer_model']
+
+ start_time = time.time()
+
+ for epoch in range(args.max_epoch):
+
+ adjust_learning_rate(optimizer_model, epoch)
+ adjust_learning_rate_prox(optimizer_prox_1024, epoch)
+ adjust_learning_rate_prox(optimizer_prox_256, epoch)
+
+ adjust_learning_rate_conprox(optimizer_conprox_1024, epoch)
+ adjust_learning_rate_conprox(optimizer_conprox_256, epoch)
+
+ print("==> Epoch {}/{}".format(epoch+1, args.max_epoch))
+ train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch)
+
+ if args.eval_freq > 0 and (epoch+1) % args.eval_freq == 0 or (epoch+1) == args.max_epoch:
+ print("==> Test") #Tests after every 10 epochs
+ acc, err = test(model, testloader, use_gpu, num_classes, epoch)
+ print("Accuracy (%): {}\t Error rate (%): {}".format(acc, err))
+
+ state_ = {'epoch': epoch + 1, 'state_dict': model.state_dict(),
+ 'optimizer_model': optimizer_model.state_dict(), 'optimizer_prox_1024': optimizer_prox_1024.state_dict(),
+ 'optimizer_prox_256': optimizer_prox_256.state_dict(), 'optimizer_conprox_1024': optimizer_conprox_1024.state_dict(),
+ 'optimizer_conprox_256': optimizer_conprox_256.state_dict(),}
+
+ torch.save(state_, 'Models_PCL_AdvTrain_FGSM/CIFAR10_PCL_AdvTrain_FGSM.pth.tar')
+
+ elapsed = round(time.time() - start_time)
+ elapsed = str(datetime.timedelta(seconds=elapsed))
+ print("Finished. Total elapsed time (h:m:s): {}".format(elapsed))
+
+def train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch):
+
+# model.train()
+ xent_losses = AverageMeter() #Computes and stores the average and current value
+ prox_losses_1024 = AverageMeter()
+ prox_losses_256= AverageMeter()
+
+ conprox_losses_1024 = AverageMeter()
+ conprox_losses_256= AverageMeter()
+ losses = AverageMeter()
+
+ #Batchwise training
+ for batch_idx, (data, labels) in enumerate(trainloader):
+ if use_gpu:
+ data, labels = data.cuda(), labels.cuda()
+ model.eval()
+ eps= np.random.uniform(0.02,0.05)
+ adv = FGSM(model, criterion_xent, data, labels, eps=eps) # Generates Batch-wise Adv Images
+ adv.requires_grad= False
+
+ adv= normalize(adv)
+ adv= adv.cuda()
+ true_labels_adv= labels
+ data= torch.cat((data, adv),0)
+ labels= torch.cat((labels, true_labels_adv))
+ model.train()
+
+ feats128, feats256, feats1024, outputs = model(data)
+ loss_xent = criterion_xent(outputs, labels)
+
+ loss_prox_1024 = criterion_prox_1024(feats1024, labels)
+ loss_prox_256= criterion_prox_256(feats256, labels)
+
+ loss_conprox_1024 = criterion_conprox_1024(feats1024, labels)
+ loss_conprox_256= criterion_conprox_256(feats256, labels)
+
+ loss_prox_1024 *= args.weight_prox
+ loss_prox_256 *= args.weight_prox
+
+ loss_conprox_1024 *= args.weight_conprox
+ loss_conprox_256 *= args.weight_conprox
+
+ loss = loss_xent + loss_prox_1024 + loss_prox_256 - loss_conprox_1024 - loss_conprox_256 # total loss
+ optimizer_model.zero_grad()
+
+ optimizer_prox_1024.zero_grad()
+ optimizer_prox_256.zero_grad()
+
+ optimizer_conprox_1024.zero_grad()
+ optimizer_conprox_256.zero_grad()
+
+ loss.backward()
+ optimizer_model.step()
+
+ for param in criterion_prox_1024.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_1024.step()
+
+ for param in criterion_prox_256.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_256.step()
+
+
+ for param in criterion_conprox_1024.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_1024.step()
+
+ for param in criterion_conprox_256.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_256.step()
+
+ losses.update(loss.item(), labels.size(0))
+ xent_losses.update(loss_xent.item(), labels.size(0))
+ prox_losses_1024.update(loss_prox_1024.item(), labels.size(0))
+ prox_losses_256.update(loss_prox_256.item(), labels.size(0))
+
+ conprox_losses_1024.update(loss_conprox_1024.item(), labels.size(0))
+ conprox_losses_256.update(loss_conprox_256.item(), labels.size(0))
+
+ if (batch_idx+1) % args.print_freq == 0:
+ print("Batch {}/{}\t Loss {:.6f} ({:.6f}) XentLoss {:.6f} ({:.6f}) ProxLoss_1024 {:.6f} ({:.6f}) ProxLoss_256 {:.6f} ({:.6f}) \n ConProxLoss_1024 {:.6f} ({:.6f}) ConProxLoss_256 {:.6f} ({:.6f}) " \
+ .format(batch_idx+1, len(trainloader), losses.val, losses.avg, xent_losses.val, xent_losses.avg,
+ prox_losses_1024.val, prox_losses_1024.avg, prox_losses_256.val, prox_losses_256.avg ,
+ conprox_losses_1024.val, conprox_losses_1024.avg, conprox_losses_256.val,
+ conprox_losses_256.avg ))
+
+
+def test(model, testloader, use_gpu, num_classes, epoch):
+ model.eval()
+ correct, total = 0, 0
+
+ with torch.no_grad():
+ for data, labels in testloader:
+ if True:
+ data, labels = data.cuda(), labels.cuda()
+ feats128, feats256, feats1024, outputs = model(data)
+ predictions = outputs.data.max(1)[1]
+ total += labels.size(0)
+ correct += (predictions == labels.data).sum()
+
+
+ acc = correct * 100. / total
+ err = 100. - acc
+ return acc, err
+
+def adjust_learning_rate(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_model'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_model'] = state['lr_model']
+
+def adjust_learning_rate_prox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_prox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_prox'] = state['lr_prox']
+
+def adjust_learning_rate_conprox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_conprox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_conprox'] = state['lr_conprox']
+if __name__ == '__main__':
+ main()
+
+
+
+
+
diff --git a/case_studies/pcl_defense/pcl_training_adversarial_pgd.py b/case_studies/pcl_defense/pcl_training_adversarial_pgd.py
new file mode 100644
index 0000000..c14f468
--- /dev/null
+++ b/case_studies/pcl_defense/pcl_training_adversarial_pgd.py
@@ -0,0 +1,367 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+"""
+Created on Wed Jan 23 10:15:27 2019
+
+@author: aamir-mustafa
+Implementation Part 2 of Paper:
+ "Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks"
+
+Here it is not necessary to save the best performing model (in terms of accuracy). The model with high robustness
+against adversarial attacks is chosen.
+This coe implements Adversarial Training using PGD Attack.
+"""
+
+#Essential Imports
+import os
+import sys
+import argparse
+import datetime
+import time
+import os.path as osp
+import numpy as np
+import torch
+import torch.nn as nn
+import torch.backends.cudnn as cudnn
+import torchvision
+import torchvision.transforms as transforms
+from pcl_utils import AverageMeter, Logger
+from proximity import Proximity
+from contrastive_proximity import Con_Proximity
+from resnet_model import * # Imports the ResNet Model
+
+
+parser = argparse.ArgumentParser("Prototype Conformity Loss Implementation")
+parser.add_argument('-j', '--workers', default=4, type=int,
+ help="number of data loading workers (default: 4)")
+parser.add_argument('--train-batch', default=64, type=int, metavar='N',
+ help='train batchsize')
+parser.add_argument('--test-batch', default=100, type=int, metavar='N',
+ help='test batchsize')
+parser.add_argument('--schedule', type=int, nargs='+', default=[142, 230, 360],
+ help='Decrease learning rate at these epochs.')
+parser.add_argument('--lr_model', type=float, default=0.01, help="learning rate for model")
+parser.add_argument('--lr_prox', type=float, default=0.5, help="learning rate for Proximity Loss") # as per paper
+parser.add_argument('--weight-prox', type=float, default=1, help="weight for Proximity Loss") # as per paper
+parser.add_argument('--lr_conprox', type=float, default=0.00001, help="learning rate for Con-Proximity Loss") # as per paper
+parser.add_argument('--weight-conprox', type=float, default=0.00001, help="weight for Con-Proximity Loss") # as per paper
+parser.add_argument('--max-epoch', type=int, default=500)
+parser.add_argument('--gamma', type=float, default=0.1, help="learning rate decay")
+parser.add_argument('--eval-freq', type=int, default=10)
+parser.add_argument('--print-freq', type=int, default=50)
+parser.add_argument('--gpu', type=str, default='0')
+parser.add_argument('--seed', type=int, default=1)
+parser.add_argument('--use-cpu', action='store_true')
+parser.add_argument('--save-dir', type=str, default='log')
+
+args = parser.parse_args()
+state = {k: v for k, v in args._get_kwargs()}
+
+mean = [0.4914, 0.4822, 0.4465]
+std = [0.2023, 0.1994, 0.2010]
+def normalize(t):
+ t[:, 0, :, :] = (t[:, 0, :, :] - mean[0])/std[0]
+ t[:, 1, :, :] = (t[:, 1, :, :] - mean[1])/std[1]
+ t[:, 2, :, :] = (t[:, 2, :, :] - mean[2])/std[2]
+
+ return t
+
+def un_normalize(t):
+ t[:, 0, :, :] = (t[:, 0, :, :] * std[0]) + mean[0]
+ t[:, 1, :, :] = (t[:, 1, :, :] * std[1]) + mean[1]
+ t[:, 2, :, :] = (t[:, 2, :, :] * std[2]) + mean[2]
+
+ return t
+
+def attack(model, criterion, img, label, eps, attack_type, iters):
+ adv = img.detach()
+ adv.requires_grad = True
+
+ if attack_type == 'fgsm':
+ iterations = 1
+ else:
+ iterations = iters
+
+ if attack_type == 'pgd':
+ step = 2 / 255
+ else:
+ step = eps / iterations
+
+ noise = 0
+
+ for j in range(iterations):
+ _,_,_,out_adv = model(adv.clone())
+ loss = criterion(out_adv, label)
+ loss.backward()
+
+ if attack_type == 'mim':
+ adv_mean= torch.mean(torch.abs(adv.grad), dim=1, keepdim=True)
+ adv_mean= torch.mean(torch.abs(adv_mean), dim=2, keepdim=True)
+ adv_mean= torch.mean(torch.abs(adv_mean), dim=3, keepdim=True)
+ adv.grad = adv.grad / adv_mean
+ noise = noise + adv.grad
+ else:
+ noise = adv.grad
+
+ # Optimization step
+ adv.data = un_normalize(adv.data) + step * noise.sign()
+# adv.data = adv.data + step * adv.grad.sign()
+
+ if attack_type == 'pgd':
+ adv.data = torch.where(adv.data > img.data + eps, img.data + eps, adv.data)
+ adv.data = torch.where(adv.data < img.data - eps, img.data - eps, adv.data)
+ adv.data.clamp_(0.0, 1.0)
+
+ adv.grad.data.zero_()
+
+ return adv.detach()
+
+def main():
+ torch.manual_seed(args.seed)
+ os.environ['CUDA_VISIBLE_DEVICES'] = args.gpu
+ use_gpu = torch.cuda.is_available()
+ if args.use_cpu: use_gpu = False
+
+ sys.stdout = Logger(osp.join(args.save_dir, 'log_' + 'CIFAR-10_PC_Loss_PGD_AdvTrain' + '.txt'))
+
+ if use_gpu:
+ print("Currently using GPU: {}".format(args.gpu))
+ cudnn.benchmark = True
+ torch.cuda.manual_seed_all(args.seed)
+ else:
+ print("Currently using CPU")
+
+ # Data Load
+ num_classes=10
+ print('==> Preparing dataset')
+ transform_train = transforms.Compose([
+ transforms.RandomCrop(32, padding=4),
+ transforms.RandomHorizontalFlip(),
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ transform_test = transforms.Compose([
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ trainset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=True,
+ download=True, transform=transform_train)
+ trainloader = torch.utils.data.DataLoader(trainset, batch_size=args.train_batch, pin_memory=True,
+ shuffle=True, num_workers=args.workers)
+
+ testset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=False,
+ download=True, transform=transform_test)
+ testloader = torch.utils.data.DataLoader(testset, batch_size=args.test_batch, pin_memory=True,
+ shuffle=False, num_workers=args.workers)
+
+# Loading the Model
+ model = resnet(num_classes=num_classes,depth=110)
+
+ if True:
+ model = nn.DataParallel(model).cuda()
+
+ criterion_xent = nn.CrossEntropyLoss()
+ criterion_prox_1024 = Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_prox_256 = Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ criterion_conprox_1024 = Con_Proximity(num_classes=num_classes, feat_dim=1024, use_gpu=use_gpu)
+ criterion_conprox_256 = Con_Proximity(num_classes=num_classes, feat_dim=256, use_gpu=use_gpu)
+
+ optimizer_model = torch.optim.SGD(model.parameters(), lr=args.lr_model, weight_decay=1e-04, momentum=0.9)
+
+ optimizer_prox_1024 = torch.optim.SGD(criterion_prox_1024.parameters(), lr=args.lr_prox)
+ optimizer_prox_256 = torch.optim.SGD(criterion_prox_256.parameters(), lr=args.lr_prox)
+
+ optimizer_conprox_1024 = torch.optim.SGD(criterion_conprox_1024.parameters(), lr=args.lr_conprox)
+ optimizer_conprox_256 = torch.optim.SGD(criterion_conprox_256.parameters(), lr=args.lr_conprox)
+
+
+ filename= 'Models_Softmax/CIFAR10_Softmax.pth.tar'
+ checkpoint = torch.load(filename)
+
+ model.load_state_dict(checkpoint['state_dict'])
+ optimizer_model.load_state_dict= checkpoint['optimizer_model']
+
+ start_time = time.time()
+
+ for epoch in range(args.max_epoch):
+
+ adjust_learning_rate(optimizer_model, epoch)
+ adjust_learning_rate_prox(optimizer_prox_1024, epoch)
+ adjust_learning_rate_prox(optimizer_prox_256, epoch)
+
+ adjust_learning_rate_conprox(optimizer_conprox_1024, epoch)
+ adjust_learning_rate_conprox(optimizer_conprox_256, epoch)
+
+ print("==> Epoch {}/{}".format(epoch+1, args.max_epoch))
+ train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch)
+
+ if args.eval_freq > 0 and (epoch+1) % args.eval_freq == 0 or (epoch+1) == args.max_epoch:
+ print("==> Test") #Tests after every 10 epochs
+ acc, err = test(model, testloader, use_gpu, num_classes, epoch)
+ print("Accuracy (%): {}\t Error rate (%): {}".format(acc, err))
+
+ state_ = {'epoch': epoch + 1, 'state_dict': model.state_dict(),
+ 'optimizer_model': optimizer_model.state_dict(), 'optimizer_prox_1024': optimizer_prox_1024.state_dict(),
+ 'optimizer_prox_256': optimizer_prox_256.state_dict(), 'optimizer_conprox_1024': optimizer_conprox_1024.state_dict(),
+ 'optimizer_conprox_256': optimizer_conprox_256.state_dict(),}
+
+ torch.save(state_, 'Models_PCL_AdvTrain_PGD/CIFAR10_PCL_AdvTrain_PGD.pth.tar')
+
+ elapsed = round(time.time() - start_time)
+ elapsed = str(datetime.timedelta(seconds=elapsed))
+ print("Finished. Total elapsed time (h:m:s): {}".format(elapsed))
+
+def train(model, criterion_xent, criterion_prox_1024, criterion_prox_256,
+ criterion_conprox_1024, criterion_conprox_256,
+ optimizer_model, optimizer_prox_1024, optimizer_prox_256,
+ optimizer_conprox_1024, optimizer_conprox_256,
+ trainloader, use_gpu, num_classes, epoch):
+
+# model.train()
+ xent_losses = AverageMeter() #Computes and stores the average and current value
+ prox_losses_1024 = AverageMeter()
+ prox_losses_256= AverageMeter()
+
+ conprox_losses_1024 = AverageMeter()
+ conprox_losses_256= AverageMeter()
+ losses = AverageMeter()
+
+ #Batchwise training
+ for batch_idx, (data, labels) in enumerate(trainloader):
+ if use_gpu:
+ data, labels = data.cuda(), labels.cuda()
+ model.eval()
+ eps= np.random.uniform(0.02,0.05)
+ adv = attack(model, criterion_xent, data, labels, eps=eps, attack_type='pgd', iters= 10) # Generates Batch-wise Adv Images
+ adv.requires_grad= False
+
+ adv= normalize(adv)
+ adv= adv.cuda()
+ true_labels_adv= labels
+ data= torch.cat((data, adv),0)
+ labels= torch.cat((labels, true_labels_adv))
+ model.train()
+
+ feats128, feats256, feats1024, outputs = model(data)
+ loss_xent = criterion_xent(outputs, labels)
+
+ loss_prox_1024 = criterion_prox_1024(feats1024, labels)
+ loss_prox_256= criterion_prox_256(feats256, labels)
+
+ loss_conprox_1024 = criterion_conprox_1024(feats1024, labels)
+ loss_conprox_256= criterion_conprox_256(feats256, labels)
+
+ loss_prox_1024 *= args.weight_prox
+ loss_prox_256 *= args.weight_prox
+
+ loss_conprox_1024 *= args.weight_conprox
+ loss_conprox_256 *= args.weight_conprox
+
+ loss = loss_xent + loss_prox_1024 + loss_prox_256 - loss_conprox_1024 - loss_conprox_256 # total loss
+ optimizer_model.zero_grad()
+
+ optimizer_prox_1024.zero_grad()
+ optimizer_prox_256.zero_grad()
+
+ optimizer_conprox_1024.zero_grad()
+ optimizer_conprox_256.zero_grad()
+
+ loss.backward()
+ optimizer_model.step()
+
+ for param in criterion_prox_1024.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_1024.step()
+
+ for param in criterion_prox_256.parameters():
+ param.grad.data *= (1. / args.weight_prox)
+ optimizer_prox_256.step()
+
+
+ for param in criterion_conprox_1024.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_1024.step()
+
+ for param in criterion_conprox_256.parameters():
+ param.grad.data *= (1. / args.weight_conprox)
+ optimizer_conprox_256.step()
+
+ losses.update(loss.item(), labels.size(0))
+ xent_losses.update(loss_xent.item(), labels.size(0))
+ prox_losses_1024.update(loss_prox_1024.item(), labels.size(0))
+ prox_losses_256.update(loss_prox_256.item(), labels.size(0))
+
+ conprox_losses_1024.update(loss_conprox_1024.item(), labels.size(0))
+ conprox_losses_256.update(loss_conprox_256.item(), labels.size(0))
+
+ if (batch_idx+1) % args.print_freq == 0:
+ print("Batch {}/{}\t Loss {:.6f} ({:.6f}) XentLoss {:.6f} ({:.6f}) ProxLoss_1024 {:.6f} ({:.6f}) ProxLoss_256 {:.6f} ({:.6f}) \n ConProxLoss_1024 {:.6f} ({:.6f}) ConProxLoss_256 {:.6f} ({:.6f}) " \
+ .format(batch_idx+1, len(trainloader), losses.val, losses.avg, xent_losses.val, xent_losses.avg,
+ prox_losses_1024.val, prox_losses_1024.avg, prox_losses_256.val, prox_losses_256.avg ,
+ conprox_losses_1024.val, conprox_losses_1024.avg, conprox_losses_256.val,
+ conprox_losses_256.avg ))
+
+
+def test(model, testloader, use_gpu, num_classes, epoch):
+ model.eval()
+ correct, total = 0, 0
+
+ with torch.no_grad():
+ for data, labels in testloader:
+ if True:
+ data, labels = data.cuda(), labels.cuda()
+ feats128, feats256, feats1024, outputs = model(data)
+ predictions = outputs.data.max(1)[1]
+ total += labels.size(0)
+ correct += (predictions == labels.data).sum()
+
+
+ acc = correct * 100. / total
+ err = 100. - acc
+ return acc, err
+
+def adjust_learning_rate(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_model'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_model'] = state['lr_model']
+
+def adjust_learning_rate_prox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_prox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_prox'] = state['lr_prox']
+
+def adjust_learning_rate_conprox(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr_conprox'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr_conprox'] = state['lr_conprox']
+if __name__ == '__main__':
+ main()
+
+
+
+
+
diff --git a/case_studies/pcl_defense/pcl_utils.py b/case_studies/pcl_defense/pcl_utils.py
new file mode 100644
index 0000000..a46c62d
--- /dev/null
+++ b/case_studies/pcl_defense/pcl_utils.py
@@ -0,0 +1,93 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+import errno
+import shutil
+import os.path as osp
+
+import torch
+
+def mkdir_if_missing(directory):
+ if not osp.exists(directory):
+ try:
+ os.makedirs(directory)
+ except OSError as e:
+ if e.errno != errno.EEXIST:
+ raise
+
+class AverageMeter(object):
+ """Computes and stores the average and current value.
+
+ Code imported from https://github.com/pytorch/examples/blob/master/imagenet/main.py#L247-L262
+ """
+ def __init__(self):
+ self.reset()
+
+ def reset(self):
+ self.val = 0
+ self.avg = 0
+ self.sum = 0
+ self.count = 0
+
+ def update(self, val, n=1):
+ self.val = val
+ self.sum += val * n
+ self.count += n
+ self.avg = self.sum / self.count
+
+def save_checkpoint(state, is_best, fpath='checkpoint.pth.tar'):
+ mkdir_if_missing(osp.dirname(fpath))
+ torch.save(state, fpath)
+ if is_best:
+ shutil.copy(fpath, osp.join(osp.dirname(fpath), 'best_model.pth.tar'))
+
+class Logger(object):
+ """
+ Write console output to external text file.
+
+ Code imported from https://github.com/Cysu/open-reid/blob/master/reid/utils/logging.py.
+ """
+ def __init__(self, fpath=None):
+ self.console = sys.stdout
+ self.file = None
+ if fpath is not None:
+ mkdir_if_missing(os.path.dirname(fpath))
+ self.file = open(fpath, 'w')
+
+ def __del__(self):
+ self.close()
+
+ def __enter__(self):
+ pass
+
+ def __exit__(self, *args):
+ self.close()
+
+ def write(self, msg):
+ self.console.write(msg)
+ if self.file is not None:
+ self.file.write(msg)
+
+ def flush(self):
+ self.console.flush()
+ if self.file is not None:
+ self.file.flush()
+ os.fsync(self.file.fileno())
+
+ def close(self):
+ self.console.close()
+ if self.file is not None:
+ self.file.close()
\ No newline at end of file
diff --git a/case_studies/pcl_defense/proximity.py b/case_studies/pcl_defense/proximity.py
new file mode 100644
index 0000000..d051bdc
--- /dev/null
+++ b/case_studies/pcl_defense/proximity.py
@@ -0,0 +1,51 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import torch
+import torch.nn as nn
+
+class Proximity(nn.Module):
+
+ def __init__(self, num_classes=100, feat_dim=1024, use_gpu=True):
+ super(Proximity, self).__init__()
+ self.num_classes = num_classes
+ self.feat_dim = feat_dim
+ self.use_gpu = use_gpu
+
+ if self.use_gpu:
+ self.centers = nn.Parameter(torch.randn(self.num_classes, self.feat_dim).cuda())
+ else:
+ self.centers = nn.Parameter(torch.randn(self.num_classes, self.feat_dim))
+
+ def forward(self, x, labels):
+
+ batch_size = x.size(0)
+ distmat = torch.pow(x, 2).sum(dim=1, keepdim=True).expand(batch_size, self.num_classes) + \
+ torch.pow(self.centers, 2).sum(dim=1, keepdim=True).expand(self.num_classes, batch_size).t()
+ distmat.addmm_(1, -2, x, self.centers.t())
+
+ classes = torch.arange(self.num_classes).long()
+ if self.use_gpu: classes = classes.cuda()
+ labels = labels.unsqueeze(1).expand(batch_size, self.num_classes)
+ mask = labels.eq(classes.expand(batch_size, self.num_classes))
+
+ dist = []
+ for i in range(batch_size):
+ value = distmat[i][mask[i]]
+ value = value.clamp(min=1e-12, max=1e+12)
+ dist.append(value)
+ dist = torch.cat(dist)
+ loss = dist.mean()
+
+ return loss
diff --git a/case_studies/pcl_defense/resnet_model.py b/case_studies/pcl_defense/resnet_model.py
new file mode 100644
index 0000000..34e0d99
--- /dev/null
+++ b/case_studies/pcl_defense/resnet_model.py
@@ -0,0 +1,181 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Created on Tue Apr 2 14:21:30 2019
+
+@author: aamir-mustafa
+"""
+
+import torch.nn as nn
+import math
+
+def conv3x3(in_planes, out_planes, stride=1):
+ "3x3 convolution with padding"
+ return nn.Conv2d(in_planes, out_planes, kernel_size=3, stride=stride,
+ padding=1, bias=False)
+
+
+class BasicBlock(nn.Module):
+ expansion = 1
+
+ def __init__(self, inplanes, planes, stride=1, downsample=None):
+ super(BasicBlock, self).__init__()
+ self.conv1 = conv3x3(inplanes, planes, stride)
+ self.bn1 = nn.BatchNorm2d(planes)
+ self.relu = nn.ReLU(inplace=True)
+ self.conv2 = conv3x3(planes, planes)
+ self.bn2 = nn.BatchNorm2d(planes)
+ self.downsample = downsample
+ self.stride = stride
+
+ def forward(self, x):
+ residual = x
+
+ out = self.conv1(x)
+ out = self.bn1(out)
+ out = self.relu(out)
+ out = self.conv2(out)
+ out = self.bn2(out)
+
+ if self.downsample is not None:
+ residual = self.downsample(x)
+
+ out += residual
+ out = self.relu(out)
+
+ return out
+
+
+class Bottleneck(nn.Module):
+ expansion = 4
+
+ def __init__(self, inplanes, planes, stride=1, downsample=None):
+ super(Bottleneck, self).__init__()
+ self.conv1 = nn.Conv2d(inplanes, planes, kernel_size=1, bias=False)
+ self.bn1 = nn.BatchNorm2d(planes)
+ self.conv2 = nn.Conv2d(planes, planes, kernel_size=3, stride=stride,
+ padding=1, bias=False)
+ self.bn2 = nn.BatchNorm2d(planes)
+ self.conv3 = nn.Conv2d(planes, planes * 4, kernel_size=1, bias=False)
+ self.bn3 = nn.BatchNorm2d(planes * 4)
+ self.relu = nn.ReLU(inplace=True)
+ self.downsample = downsample
+ self.stride = stride
+
+ def forward(self, x): # (conv-bn-relu) x 3 times
+ residual = x
+
+ out = self.conv1(x)
+ out = self.bn1(out)
+ out = self.relu(out)
+ out = self.conv2(out)
+ out = self.bn2(out)
+ out = self.relu(out)
+ out = self.conv3(out)
+ out = self.bn3(out)
+
+ if self.downsample is not None:
+ residual = self.downsample(x)
+
+ out += residual # in our case is none
+ out = self.relu(out)
+
+ return out
+
+
+class ResNet(nn.Module):
+
+ def __init__(self, depth, num_classes=10):
+ super(ResNet, self).__init__()
+ # Model type specifies number of layers for CIFAR-10 model
+ assert (depth - 2) % 6 == 0, 'depth should be 6n+2'
+ n = (depth - 2) // 6
+
+ block = Bottleneck if depth >=44 else BasicBlock
+
+ self.inplanes = 16
+ self.conv1 = nn.Conv2d(3, 16, kernel_size=3, padding=1,
+ bias=False)
+ self.bn1 = nn.BatchNorm2d(16)
+ self.relu = nn.ReLU(inplace=True)
+ self.layer1 = self._make_layer(block, 16, n)
+
+ self.layer2 = self._make_layer(block, 32, n, stride=2)
+ self.layer3 = self._make_layer(block, 64, n, stride=2)
+ self.avgpool = nn.AvgPool2d(8)
+
+ self.maxpool2= nn.MaxPool2d(16)
+ self.fc = nn.Linear(64 * block.expansion, 1024)
+ self.fcf = nn.Linear(1024,num_classes)
+
+ for m in self.modules():
+ if isinstance(m, nn.Conv2d):
+ n = m.kernel_size[0] * m.kernel_size[1] * m.out_channels
+ m.weight.data.normal_(0, math.sqrt(2. / n))
+ elif isinstance(m, nn.BatchNorm2d):
+ m.weight.data.fill_(1)
+ m.bias.data.zero_()
+
+ def _make_layer(self, block, planes, blocks, stride=1):
+ downsample = None
+ if stride != 1 or self.inplanes != planes * block.expansion:
+ downsample = nn.Sequential(
+ nn.Conv2d(self.inplanes, planes * block.expansion,
+ kernel_size=1, stride=stride, bias=False),
+ nn.BatchNorm2d(planes * block.expansion),
+ )
+
+ layers = []
+ layers.append(block(self.inplanes, planes, stride, downsample))
+ self.inplanes = planes * block.expansion
+ for i in range(1, blocks):
+ layers.append(block(self.inplanes, planes))
+
+ return nn.Sequential(*layers)
+
+ def forward(self, x, features_only=False, features_and_logits=False):
+ x = self.conv1(x)
+
+
+ x = self.bn1(x)
+ x = self.relu(x)
+
+ x = self.layer1(x)
+ x = self.layer2(x)
+
+ m = self.maxpool2(x)
+ m = m.view(m.size(0), -1) # 128 dimensional
+
+ x = self.layer3(x)
+
+
+ x = self.avgpool(x)
+ z = x.view(x.size(0), -1) # 256 dimensional
+ x = self.fc(z) # 1024 dimensional
+ y = self.fcf(x) # num_classes dimensional
+
+ if features_only:
+ return z
+ elif features_and_logits:
+ return z, y
+ else:
+ return m, z, x, y
+
+
+def resnet(**kwargs):
+ """
+ Constructs a ResNet model.
+ """
+ return ResNet(**kwargs)
\ No newline at end of file
diff --git a/case_studies/pcl_defense/robustness.py b/case_studies/pcl_defense/robustness.py
new file mode 100644
index 0000000..ce49d85
--- /dev/null
+++ b/case_studies/pcl_defense/robustness.py
@@ -0,0 +1,321 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Created on Sun Mar 24 17:51:08 2019
+
+@author: aamir-mustafa
+"""
+import inspect
+import os
+import sys
+import warnings
+
+import numpy as np
+import torch
+import torchvision
+import torchvision.transforms as transforms
+
+import utils
+from resnet_model import * # Imports the ResNet Model
+
+"""
+Adversarial Attack Options: fgsm, bim, mim, pgd
+"""
+
+warnings.simplefilter('once', RuntimeWarning)
+
+currentdir = os.path.dirname(
+ os.path.abspath(inspect.getfile(inspect.currentframe())))
+grandarentdir = os.path.dirname(os.path.dirname(currentdir))
+sys.path.insert(0, grandarentdir)
+
+import active_tests.decision_boundary_binarization
+
+from attacks.autopgd import auto_pgd
+from attacks.fab import fab
+from functools import partial
+import argparse
+import utils
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--attack", choices=("autopgd", "autopgd2", "fab", "fgsm", "bim", "mim", "pgd"), default="pgd")
+parser.add_argument("--baseline", action="store_true")
+parser.add_argument("--binarization-test", action="store_true")
+parser.add_argument("--num-samples-test", type=int, default=512)
+parser.add_argument('--n-inner-points',
+ default=49,
+ type=int)
+
+parser.add_argument('--n-boundary-points',
+ default=10,
+ type=int)
+parser.add_argument("--epsilon", type=int, default=8)
+parser.add_argument("--use-autopgd-boundary-adversarials", action="store_true")
+parser.add_argument("--use-autoattack", action="store_true")
+parser.add_argument("--sample-from-corners", action="store_true")
+parser.add_argument("--decision-boundary-closeness", type=float, default=0.999)
+args = parser.parse_args()
+
+num_classes = 10
+
+model = resnet(num_classes=num_classes, depth=110)
+device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
+
+model = nn.DataParallel(model).to(device)
+
+# Loading Trained Model
+
+if args.baseline:
+ filename = 'checkpoints/pcl_defense_rn110_softmax_baseline.pth.tar'
+else:
+ filename = 'checkpoints/pcl_defense_rn110.pth.tar'
+print(f"Loading checkpoint from: {filename}")
+
+checkpoint = torch.load(filename)
+model.load_state_dict(checkpoint['state_dict'])
+model.eval()
+
+
+# Loading Test Data (Un-normalized)
+transform_test = transforms.Compose([transforms.ToTensor(), ])
+
+unfiltered_testset = torchvision.datasets.CIFAR10(root='./data/', train=False,
+ download=True, transform=transform_test)
+unfiltered_test_loader = torch.utils.data.DataLoader(unfiltered_testset, batch_size=256,
+ pin_memory=True,
+ shuffle=False)
+
+# create test subset where model has perfect accuracy
+xs, ys = [], []
+n_checked = 0
+for x, y in unfiltered_test_loader:
+ x, y = x, y
+ with torch.no_grad():
+ y_pred = model(x.to(device))[3].argmax(-1).to("cpu")
+ x = x[y_pred == y]
+ y = y[y_pred == y]
+ xs.append(x)
+ ys.append(y)
+ n_checked += len(x)
+
+ if n_checked >= args.num_samples_test:
+ break
+
+xs = torch.cat(xs, 0)
+ys = torch.cat(ys, 0)
+filtered_testset = torch.utils.data.TensorDataset(xs, ys)
+test_loader = torch.utils.data.DataLoader(filtered_testset, batch_size=256,
+ pin_memory=True,
+ shuffle=False)
+
+# Mean and Standard Deviation of the Dataset
+mean = torch.tensor([0.4914, 0.4822, 0.4465]).view((1, 3, 1, 1)).to(device)
+std = torch.tensor( [0.2023, 0.1994, 0.2010]).view((1, 3, 1, 1)).to(device)
+
+
+def normalize(t):
+ return (t - mean)/std
+ #t[:, 0, :, :] = (t[:, 0, :, :] - mean[0]) / std[0]
+ #t[:, 1, :, :] = (t[:, 1, :, :] - mean[1]) / std[1]
+ #t[:, 2, :, :] = (t[:, 2, :, :] - mean[2]) / std[2]
+
+ #return t
+
+
+def un_normalize(t):
+ return (t*std) + mean
+ #t[:, 0, :, :] = (t[:, 0, :, :] * std[0]) + mean[0]
+ #t[:, 1, :, :] = (t[:, 1, :, :] * std[1]) + mean[1]
+ #t[:, 2, :, :] = (t[:, 2, :, :] * std[2]) + mean[2]
+
+ #return t
+
+
+class ZeroOneStandardizedNetwork(nn.Module):
+ def __init__(self, model):
+ super().__init__()
+ self.model = model
+
+ def forward(self, x, **kwargs):
+ return self.model(normalize(x), **kwargs)
+
+
+model = ZeroOneStandardizedNetwork(model)
+
+
+# Attacking Images batch-wise
+def attack(model, criterion, img, label, eps, attack_type, iters):
+ adv = img.detach()
+ adv.requires_grad = True
+
+ if attack_type == 'fgsm':
+ iterations = 1
+ else:
+ iterations = iters
+
+ if attack_type == 'pgd':
+ step = 2 / 255
+ else:
+ step = eps / iterations
+
+ noise = 0
+
+ for j in range(iterations):
+ output = model(adv.clone())
+ if isinstance(output, tuple):
+ _, _, _, out_adv = output
+ else:
+ out_adv = output
+ loss = criterion(out_adv, label)
+ loss.backward()
+
+ if attack_type == 'mim':
+ adv_mean = torch.mean(torch.abs(adv.grad), dim=1, keepdim=True)
+ adv_mean = torch.mean(torch.abs(adv_mean), dim=2, keepdim=True)
+ adv_mean = torch.mean(torch.abs(adv_mean), dim=3, keepdim=True)
+ adv.grad = adv.grad / adv_mean
+ noise = noise + adv.grad
+ else:
+ noise = adv.grad
+
+ # Optimization step
+ adv.data = adv.data + step * noise.sign()
+ # adv.data = adv.data + step * adv.grad.sign()
+
+ if attack_type == 'pgd':
+ adv.data = torch.where(adv.data > img.data + eps, img.data + eps,
+ adv.data)
+ adv.data = torch.where(adv.data < img.data - eps, img.data - eps,
+ adv.data)
+ adv.data.clamp_(0.0, 1.0)
+
+ adv.grad.data.zero_()
+
+ return adv.detach()
+
+def get_boundary_adversarials(x, y, n_samples, epsilon, model):
+ """Generate adversarial examples for the base classifier using AutoAttack."""
+ x_advs = []
+ for _ in range(n_samples):
+ x_adv = auto_pgd(model, x, y, 100, epsilon, "linf", n_classes=10,
+ n_restarts=5)[0]
+ x_advs.append(x_adv)
+
+ x_advs = torch.cat(x_advs, 0)
+
+ # replace examples for which no adversarials could be found with rnd. noise
+ is_identical = torch.max(torch.abs(x_advs.flatten(1) - x.flatten(1))) < 1e-6
+ random_noise = 2 * torch.rand_like(x) - 1.0
+ x_advs[is_identical] = random_noise[is_identical]
+
+ x_advs = utils.clipping_aware_rescaling(x, x_advs - x, epsilon, "linf")
+
+ return x_advs
+
+def binarization_test(feature_extractor, attack_type, epsilon):
+ def run_attack(model, loader):
+ adv_acc = 0
+ n_total_samples = 0
+ x_adv = []
+ logits_adv = []
+ for i, (img, label) in enumerate(loader):
+ img, label = img.to(device), label.to(device)
+ if attack_type == "autopgd":
+ adv = auto_pgd(model, img, label, 200, epsilon, "linf",
+ n_restarts=5, n_classes=2)[0]
+ elif attack_type == "autopgd2":
+ adv = auto_pgd(model, img, label, 400, epsilon, "linf",
+ n_restarts=10, n_classes=2)[0]
+ elif attack_type == "fab":
+ adv = fab(model, img, label, 200, epsilon, "linf",
+ n_restarts=5, n_classes=2)[0]
+ else:
+ adv = attack(model, criterion, img, label, eps=epsilon, attack_type=attack_type,
+ iters=10)
+ with torch.no_grad():
+ outputs = model(adv.clone().detach())
+ adv_acc += torch.sum(
+ outputs.argmax(dim=-1) == label).item()
+ n_total_samples += len(img)
+
+ x_adv.append(adv.detach().cpu())
+ logits_adv.append(outputs.detach().cpu())
+
+ x_adv = torch.cat(x_adv, 0)
+ logits_adv = torch.cat(logits_adv, 0)
+
+ asr = 1.0 - adv_acc / n_total_samples
+
+ return asr, (x_adv, logits_adv)
+
+ from argparse_utils import DecisionBoundaryBinarizationSettings
+ scores_logit_differences_and_validation_accuracies = active_tests.decision_boundary_binarization.interior_boundary_discrimination_attack(
+ feature_extractor,
+ test_loader,
+ attack_fn=lambda m, l, kwargs: run_attack(m, l, **kwargs),
+ linearization_settings=DecisionBoundaryBinarizationSettings(
+ epsilon=epsilon,
+ norm="linf",
+ lr=10000,
+ n_boundary_points=args.n_boundary_points,
+ n_inner_points=args.n_inner_points,
+ adversarial_attack_settings=None,
+ optimizer="sklearn",
+ n_boundary_adversarial_points=1 if args.use_autopgd_boundary_adversarials else 0
+ ),
+ n_samples=args.num_samples_test,
+ device=device,
+ n_samples_evaluation=200,
+ n_samples_asr_evaluation=200,
+ #args.num_samples_test * 10
+ decision_boundary_closeness=args.decision_boundary_closeness,
+ # TODO: activate this again
+ rescale_logits="adaptive",
+ get_boundary_adversarials_fn=partial(get_boundary_adversarials, model=lambda x: model(x)[3]) \
+ if args.use_autopgd_boundary_adversarials else None,
+ sample_training_data_from_corners=args.sample_from_corners
+ )
+
+ print(active_tests.decision_boundary_binarization.format_result(
+ scores_logit_differences_and_validation_accuracies,
+ args.num_samples_test
+ ))
+
+def adversarial_test():
+ adv_acc = 0
+ clean_acc = 0
+ for i, (img, label) in enumerate(test_loader):
+ img, label = img.to(device), label.to(device)
+
+ clean_acc += torch.sum(
+ model(img.clone().detach())[3].argmax(dim=-1) == label).item()
+ adv = attack(model, criterion, img, label, eps=eps, attack_type=attack_type,
+ iters=10)
+ adv_acc += torch.sum(
+ model(adv.clone().detach())[3].argmax(dim=-1) == label).item()
+ # print('Batch: {0}'.format(i))
+ print('Clean accuracy:{0:.3%}\t Adversarial ({2}) accuracy:{1:.3%}'.format(
+ clean_acc / len(testset), adv_acc / len(testset), attack_type))
+
+# Loss Criteria
+criterion = nn.CrossEntropyLoss()
+eps = args.epsilon / 255 # Epsilon for Adversarial Attack
+print("eps:", eps)
+
+for attack_type in (args.attack,): # ("fgsm", "bim", "mim", "pgd"):
+ if args.binarization_test:
+ binarization_test(model, attack_type, eps)
+ else:
+ adversarial_test()
diff --git a/case_studies/pcl_defense/softmax_training.py b/case_studies/pcl_defense/softmax_training.py
new file mode 100644
index 0000000..8bc8ff7
--- /dev/null
+++ b/case_studies/pcl_defense/softmax_training.py
@@ -0,0 +1,217 @@
+# Copyright 2022 The Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Created on Wed Jan 23 10:15:27 2019
+
+@author: aamir-mustafa
+This is Part 1 file for replicating the results for Paper:
+ "Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks"
+Here a ResNet model is trained with Softmax Loss for 164 epochs.
+"""
+
+# Essential Imports
+import os
+import sys
+import argparse
+import datetime
+import time
+import os.path as osp
+import numpy as np
+import torch
+import torch.nn as nn
+import torch.backends.cudnn as cudnn
+import torchvision
+import torchvision.transforms as transforms
+from pcl_utils import AverageMeter, Logger
+from resnet_model import * # Imports the ResNet Model
+
+parser = argparse.ArgumentParser("Softmax Training for CIFAR-10 Dataset")
+parser.add_argument('-j', '--workers', default=4, type=int,
+ help="number of data loading workers (default: 4)")
+parser.add_argument('--train-batch', default=128, type=int, metavar='N',
+ help='train batchsize')
+parser.add_argument('--test-batch', default=100, type=int, metavar='N',
+ help='test batchsize')
+parser.add_argument('--lr', type=float, default=0.1, help="learning rate for model")
+parser.add_argument('--schedule', type=int, nargs='+', default=[81, 122, 140],
+ help='Decrease learning rate at these epochs.')
+parser.add_argument('--gamma', type=float, default=0.1, help='LR is multiplied by gamma on schedule.')
+parser.add_argument('--momentum', default=0.9, type=float, metavar='M',
+ help='momentum')
+parser.add_argument('--weight-decay', '--wd', default=1e-4, type=float,
+ metavar='W', help='weight decay (default: 1e-4)')
+parser.add_argument('--max-epoch', type=int, default=164)
+parser.add_argument('--eval-freq', type=int, default=10)
+parser.add_argument('--print-freq', type=int, default=50)
+parser.add_argument('--gpu', type=str, default='0') #gpu to be used
+parser.add_argument('--seed', type=int, default=1)
+parser.add_argument('--use-cpu', action='store_true')
+parser.add_argument('--save-dir', type=str, default='log')
+
+args = parser.parse_args()
+state = {k: v for k, v in args._get_kwargs()}
+
+#%%
+
+def main():
+ torch.manual_seed(args.seed)
+ os.environ['CUDA_VISIBLE_DEVICES'] = args.gpu
+ use_gpu = torch.cuda.is_available()
+ if args.use_cpu: use_gpu = False
+
+ sys.stdout = Logger(osp.join(args.save_dir, 'log_' + 'CIFAR-10_OnlySoftmax' + '.txt'))
+
+ if use_gpu:
+ print("Currently using GPU: {}".format(args.gpu))
+ cudnn.benchmark = True
+ torch.cuda.manual_seed_all(args.seed)
+ else:
+ print("Currently using CPU")
+
+# Data Loading
+ num_classes=10
+ print('==> Preparing dataset ')
+ transform_train = transforms.Compose([
+ transforms.RandomCrop(32, padding=4),
+ transforms.RandomHorizontalFlip(),
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+ transform_test = transforms.Compose([
+ transforms.ToTensor(),
+ transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010)),])
+
+
+ trainset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=True,
+ download=True, transform=transform_train)
+ trainloader = torch.utils.data.DataLoader(trainset, batch_size=args.train_batch, pin_memory=True,
+ shuffle=True, num_workers=args.workers)
+
+ testset = torchvision.datasets.CIFAR10(root='./data/cifar10', train=False,
+ download=True, transform=transform_test)
+ testloader = torch.utils.data.DataLoader(testset, batch_size=args.test_batch, pin_memory=True,
+ shuffle=False, num_workers=args.workers)
+
+# Loading the Model
+
+ model = resnet(num_classes=num_classes,depth=110)
+
+ if use_gpu:
+ model = nn.DataParallel(model).cuda()
+
+ criterion = nn.CrossEntropyLoss()
+ optimizer = torch.optim.SGD(model.parameters(), lr=args.lr, momentum=args.momentum,
+ weight_decay=args.weight_decay)
+
+ start_time = time.time()
+
+ for epoch in range(args.max_epoch):
+ adjust_learning_rate(optimizer, epoch)
+
+ print("==> Epoch {}/{}".format(epoch+1, args.max_epoch))
+ print('LR: %f' % (state['lr']))
+
+ train(trainloader, model, criterion, optimizer, epoch, use_gpu, num_classes)
+
+ if args.eval_freq > 0 and (epoch+1) % args.eval_freq == 0 or (epoch+1) == args.max_epoch:
+ print("==> Test") #Tests after every 10 epochs
+ acc, err = test(model, testloader, use_gpu, num_classes, epoch)
+ print("Accuracy (%): {}\t Error rate (%): {}".format(acc, err))
+
+ checkpoint = {'epoch': epoch + 1, 'state_dict': model.state_dict(),
+ 'optimizer_model': optimizer.state_dict(), }
+ torch.save(checkpoint, 'Models_Softmax/CIFAR10_Softmax.pth.tar')
+
+ elapsed = round(time.time() - start_time)
+ elapsed = str(datetime.timedelta(seconds=elapsed))
+ print("Finished. Total elapsed time (h:m:s): {}".format(elapsed))
+
+
+def train(trainloader, model, criterion, optimizer, epoch, use_gpu, num_classes):
+
+ model.train()
+ losses = AverageMeter()
+
+#Batch-wise Training
+ for batch_idx, (data, labels) in enumerate(trainloader):
+ if use_gpu:
+ data, labels = data.cuda(), labels.cuda()
+ feats_128, feats_256, feats_1024, outputs = model(data)
+ loss_xent = criterion(outputs, labels) # cross-entropy loss calculation
+
+ optimizer.zero_grad()
+ loss_xent.backward()
+ optimizer.step()
+
+ losses.update(loss_xent.item(), labels.size(0)) # AverageMeter() has this param
+
+ if (batch_idx+1) % args.print_freq == 0:
+ print("Batch {}/{}\t Loss {:.6f} ({:.6f}) " \
+ .format(batch_idx+1, len(trainloader), losses.val, losses.avg))
+
+def test(model, testloader, use_gpu, num_classes, epoch):
+ model.eval()
+ correct, total = 0, 0
+
+ with torch.no_grad():
+ for data, labels in testloader:
+ if use_gpu:
+ data, labels = data.cuda(), labels.cuda()
+ feats_128, feats_256, feats_1024, outputs = model(data)
+ predictions = outputs.data.max(1)[1]
+ total += labels.size(0)
+ correct += (predictions == labels.data).sum()
+
+ acc = correct * 100. / total
+ err = 100. - acc
+ return acc, err
+
+def adjust_learning_rate(optimizer, epoch):
+ global state
+ if epoch in args.schedule:
+ state['lr'] *= args.gamma
+ for param_group in optimizer.param_groups:
+ param_group['lr'] = state['lr']
+
+if __name__ == '__main__':
+ main()
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/case_studies/robust_models/gowal_adversarial_evaluation.sh b/case_studies/robust_models/gowal_adversarial_evaluation.sh
new file mode 100644
index 0000000..c06e649
--- /dev/null
+++ b/case_studies/robust_models/gowal_adversarial_evaluation.sh
@@ -0,0 +1,65 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/robust_models/gowal_binarization_test.sh b/case_studies/robust_models/gowal_binarization_test.sh
new file mode 100644
index 0000000..39793f1
--- /dev/null
+++ b/case_studies/robust_models/gowal_binarization_test.sh
@@ -0,0 +1,61 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/gowal_wrn28_10_linf_with_extra.pt \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/robust_models/rade_badversarial_evaluation.sh b/case_studies/robust_models/rade_badversarial_evaluation.sh
new file mode 100644
index 0000000..4439f81
--- /dev/null
+++ b/case_studies/robust_models/rade_badversarial_evaluation.sh
@@ -0,0 +1,65 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/robust_models/rade_binarization_test.sh b/case_studies/robust_models/rade_binarization_test.sh
new file mode 100644
index 0000000..1bf1c04
--- /dev/null
+++ b/case_studies/robust_models/rade_binarization_test.sh
@@ -0,0 +1,61 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=512 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.preactresnet_18 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rade_helper_rn18_linf.pt \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/robust_models/rebuffi_adversarial_evaluation.sh b/case_studies/robust_models/rebuffi_adversarial_evaluation.sh
new file mode 100644
index 0000000..29f4252
--- /dev/null
+++ b/case_studies/robust_models/rebuffi_adversarial_evaluation.sh
@@ -0,0 +1,66 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
+
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ --adversarial-attack="$advattack" \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/robust_models/rebuffi_binarization_test.sh b/case_studies/robust_models/rebuffi_binarization_test.sh
new file mode 100644
index 0000000..fd81b88
--- /dev/null
+++ b/case_studies/robust_models/rebuffi_binarization_test.sh
@@ -0,0 +1,62 @@
+nsamples=${1:-512}
+ninner=9999
+nboundary=1
+
+#kwargs=""
+kwargs="--dbl-sample-from-corners"
+
+echo "#samples: $nsamples"
+echo "kwargs: $kwargs"
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points PGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=pgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ $kwargs
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points APGD+"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=autopgd+"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ $kwargs
+
+
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+echo "eps=8/255, $nboundary boundary, $ninner inner points FAB"
+printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+advattack="norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200 attack=fab"
+PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py \
+ --n-samples=$nsamples \
+ --batch-size=128 \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=$ninner n_boundary_points=$nboundary optimizer=sklearn adversarial_attack_settings=\"$advattack\"" \
+ --classifier=dm_networks.wideresnet_28_10 \
+ --no-logit-diff-loss \
+ --input=checkpoints/rebuffi_wrn28_10_linf.pt \
+ $kwargs
\ No newline at end of file
diff --git a/case_studies/thermometer/eval.sh b/case_studies/thermometer/eval.sh
new file mode 100644
index 0000000..975a24e
--- /dev/null
+++ b/case_studies/thermometer/eval.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+
+checkpoint="$1"
+
+basecommand='
+--n-samples=2048
+--batch-size=512
+'
+basecommand="${basecommand} --input=${checkpoint}"
+
+if [ -z ${2+x} ]; then echo "Using default device"; else basecommand="$basecommand --device=$2"; fi
+epsilon=${3:-8}
+attack=${4:-pgd}
+echo "Attack: $attack"
+
+if [[ "$attack" == "thermometer-lspgd" ]]; then
+ nsteps=100
+ stepsize=0.01
+else
+ nsteps=10 # 200
+ stepsize=0.005 # 0.0011372549
+fi
+#--classifier="networks.differentiable_16_thermometer_encoding_cifar_resnet18" \
+if [[ "$epsilon" == "8" ]]; then
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "[Linf, 8/255] Thermometer encoding (${checkpoint}) evaluation"
+ PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py $basecommand \
+ --classifier="networks.differentiable_16_thermometer_encoding_cifar_wideresnet344" \
+ --decision-boundary-binarization="norm=linf epsilon=0.031372549 n_inner_points=49 n_boundary_points=1 \
+ optimizer=sklearn adversarial_attack_settings=\"norm=linf epsilon=0.031372549 step_size=$stepsize n_steps=$nsteps attack=$attack\"" \
+ --no-logit-diff-loss \
+ --adversarial-attack="norm=linf epsilon=0.031372549 step_size=$stepsize n_steps=$nsteps attack=$attack"
+ #--logit-matching="n_steps=2000 step_size=0.0011372549" \
+ # --model-destruction="adversarial_attack_settings=\"norm=linf epsilon=0.031372549 step_size=0.0011372549 n_steps=200\" n_probes=10 stddev=1.0" \
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+elif [[ "$epsilon" == "6" ]]; then
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "[Linf, 6/255] Thermometer encoding (${checkpoint}) evaluation"
+ PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py $basecommand \
+ --classifier="networks.differentiable_16_thermometer_encoding_cifar_resnet18" \
+ --decision-boundary-binarization="norm=linf epsilon=0.02352941176 n_inner_points=49 n_boundary_points=1 \
+ optimizer=sklearn adversarial_attack_settings=\"norm=linf epsilon=0.02352941176 step_size=$stepsize n_steps=$nsteps attack=$attack\"" \
+ --no-logit-diff-loss \
+ --adversarial-attack="norm=linf epsilon=0.02352941176 step_size=$stepsize n_steps=$nsteps attack=$attack"
+ #--logit-matching="n_steps=2000 step_size=0.0011372549" \
+ # --model-destruction="adversarial_attack_settings=\"norm=linf epsilon=0.02352941176 step_size=0.0011372549 n_steps=200\" n_probes=10 stddev=1.0" \
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+elif [[ "$epsilon" == "4" ]]; then
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+ echo "[Linf, 4/255] Thermometer encoding (${checkpoint}) evaluation"
+ PYTHONPATH=$PYTHONPATH:$(pwd) python case_studies/evaluate_classifier.py $basecommand \
+ --classifier="networks.differentiable_16_thermometer_encoding_cifar_resnet18" \
+ --decision-boundary-binarization="norm=linf epsilon=0.0156862745 n_inner_points=49 n_boundary_points=1 \
+ optimizer=sklearn adversarial_attack_settings=\"norm=linf epsilon=0.0156862745 step_size=$stepsize n_steps=$nsteps attack=$attack\"" \
+ --no-logit-diff-loss \
+ --adversarial-attack="norm=linf epsilon=0.0156862745 step_size=$stepsize n_steps=$nsteps attack=$attack"
+ #--logit-matching="n_steps=2000 step_size=0.0011372549" \
+ # --model-destruction="adversarial_attack_settings=\"norm=linf epsilon=0.0156862745 step_size=0.0011372549 n_steps=200\" n_probes=10 stddev=1.0" \
+ printf '%*s\n' "${COLUMNS:-$(tput cols)}" '' | tr ' ' -
+else
+ echo "Unknown epsilon value: $epsilon"
+fi
+
diff --git a/case_studies/thermometer/original/README.md b/case_studies/thermometer/original/README.md
new file mode 100644
index 0000000..81a3094
--- /dev/null
+++ b/case_studies/thermometer/original/README.md
@@ -0,0 +1,25 @@
+# Thermometer Encoding: One Hot Way To Resist Adversarial Examples
+
+Paper: [Buckman et al. 2018](https://openreview.net/forum?id=S18Su--CW)
+
+## Setup
+
+Run `./setup.sh` to fetch models.
+
+The included model is the thermometer-encoded model trained with adversarial
+training, which has 30% accuracy under the specified linf perturbation bound of
+0.031 (while the model trained without adversarial training has 0% accuracy).
+
+## Breaks
+
+* Thermometer Encoding: BPDA
+
+## [robustml] evaluation
+
+Run with:
+
+```bash
+python robustml_attack.py --cifar-path