-
Notifications
You must be signed in to change notification settings - Fork 45
/
Copy pathsvre.py
95 lines (78 loc) · 4.08 KB
/
svre.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
import torch
import torch.nn as nn
import numpy as np
from ..utils import *
from ..attack import Attack
class SVRE(Attack):
"""
SVRE Attack
'Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability (CVPR 2022)'(https://openaccess.thecvf.com/content/CVPR2022/papers/Xiong_Stochastic_Variance_Reduced_Ensemble_Adversarial_Attack_for_Boosting_the_Adversarial_CVPR_2022_paper.pdf)
Arguments:
model (torch.nn.Module): the surrogate model for attack.
epsilon (float): the perturbation budget.
alpha (float): the step size.
epoch (int): the number of iterations.
targeted (bool): targeted/untargeted attack
random_start (bool): whether using random initialization for delta.
norm (str): the norm of perturbation, l2/linfty.
loss (str): the loss function.
device (torch.device): the device for data. If it is None, the device would be same as model
Official arguments:
epsilon=16/255, alpha=epsilon/epoch=1.6/255, epoch=10
Example script:
python main.py --input_dir ./path/to/data --output_dir adv_data/svre/ensemble --attack svre --model='resnet18,resnet101,resnext50_32x4d,densenet121'
python main.py --input_dir ./path/to/data --output_dir adv_data/svre/ensemble --eval
"""
def __init__(self, model_name, epsilon=16/255, alpha=1.6/255, epoch=10, decay=1.0, targeted=False, random_start=True,
norm='linfty', loss='crossentropy', device=None, attack='SVRE', **kwargs):
super().__init__(attack, model_name, epsilon, targeted, random_start, norm, loss, device)
self.alpha = alpha
self.epoch = epoch
self.decay = decay
self.K = len(model_name)
self.M = 4*self.K
self.beta = alpha
def forward(self, data, label, **kwargs):
"""
The general attack procedure
Arguments:
data (N, C, H, W): tensor for input images
labels (N,): tensor for ground-truth labels if untargetd
labels (2,N): tensor for [ground-truth, targeted labels] if targeted
"""
data = data.clone().detach().to(self.device)
label = label.clone().detach().to(self.device)
momentum_G = 0.
delta = self.init_delta(data).to(self.device)
for _ in range(self.epoch):
"""Calculate the gradient of the ensemble model"""
# Obtain the output
logits = self.get_logits(self.transform(data+delta))
# Calculate the loss
loss = self.get_loss(logits, label)
# Calculate the gradients
grad = self.get_grad(loss, delta)
"""Stochastic variance reduction via M updates"""
# Update adversarial perturbation
inner_G = 0.
inner_delta = delta.clone().detach()
inner_delta.requires_grad = True
for _ in range(self.M):
k = np.random.randint(self.K)
inner_k_logits = self.get_logits_by_model_k(self.transform(data+inner_delta), k)
inner_k_grad = self.get_grad(self.get_loss(inner_k_logits, label), inner_delta)
adv_k_logits = self.get_logits_by_model_k(self.transform(data+delta), k)
adv_k_grad = self.get_grad(self.get_loss(adv_k_logits, label), delta)
gm = inner_k_grad - (adv_k_grad - grad)
"""Update the inner gradient by momentum"""
inner_G = self.get_momentum(gm, inner_G)
inner_delta = self.update_delta(inner_delta, data, inner_G, self.beta)
"""Update the outer gradient by momentum"""
momentum_G = self.get_momentum(inner_G, momentum_G)
delta = self.update_delta(delta, data, momentum_G, self.alpha)
return delta.detach()
def get_logits_by_model_k(self, x, k):
"""
The inference stage, which should be overridden when the attack need to change the models (e.g., ensemble-model attack, ghost, etc.) or the input (e.g. DIM, SIM, etc.)
"""
return self.model.models[k](x)