![\"cleverhans](\"https://github.com/tensorflow/cleverhans/blob/master/assets/logo.png?raw=true\"){kind=logo}
\n\n[](https://travis-ci.org/tensorflow/cleverhans)\n[](https://cleverhans.readthedocs.io/en/latest/?badge=latest)\n\nThis repository contains the source code for CleverHans, a Python library to\nbenchmark machine learning systems' vulnerability to\n[adversarial examples](http://karpathy.github.io/2015/03/30/breaking-convnets/).\nYou can learn more about such vulnerabilities on the accompanying [blog](http://cleverhans.io).\n\nThe CleverHans library is under continual development, always welcoming\n[contributions](https://github.com/tensorflow/cleverhans#contributing)\nof the latest attacks and defenses.\nIn particular, we always welcome help towards resolving the [issues](https://github.com/tensorflow/cleverhans/issues)\ncurrently open.\n\n## Major updates coming to CleverHans\n\nCleverHans will soon support 3 frameworks: JAX, PyTorch, and TF2. The package\nitself will focus on its initial principle: reference implementation of attacks\nagainst machine learning models to help with benchmarking models against\nadversarial examples. This repository will also contain two folders:\n`tutorials/` for scripts demonstrating the features of CleverHans and\n`defenses/` for scripts that contain authoritative implementations of defenses\nin one of the 3 supported frameworks. The structure of the future repository\nwill look like this:\n\n```\ncleverhans/\n jax/\n attacks/\n ...\n tests/\n ...\n tf2/\n attacks/\n ...\n tests/\n ...\n torch/\n attacks/\n ...\n tests/\n ...\ndefenses/\n jax/\n ...\n tf2/\n ...\n torch/\n ...\ntutorials/\n jax/\n ...\n tf2/\n ...\n torch/\n ...\n```\n\nIn the meanwhile, all of these folders can be found in the correspond `future/`\nsubdirectory (e.g., `cleverhans/future/jax/attacks`, `cleverhans/future/jax/tests` or `defenses/future/jax/`).\n\nA public milestone has been created to track the changes that are to be\nimplemented before the library version is incremented to v4. \n\n## Setting up CleverHans\n\n### Dependencies\n\nThis library uses [TensorFlow](https://www.tensorflow.org/) to accelerate graph\ncomputations performed by many machine learning models.\nTherefore, installing TensorFlow is a pre-requisite.\n\nYou can find instructions\n[here](https://www.tensorflow.org/install/).\nFor better performance, it is also recommended to install TensorFlow\nwith GPU support (detailed instructions on how to do this are available\nin the TensorFlow installation documentation).\n\nInstalling TensorFlow will\ntake care of all other dependencies like `numpy` and `scipy`.\n\n### Installation\n\nOnce dependencies have been taken care of, you can install CleverHans using\n`pip` or by cloning this Github repository.\n\n#### `pip` installation\n\nIf you are installing CleverHans using `pip`, run the following command\nafter installing TensorFlow:\n\n```\npip install cleverhans\n```\n\nThis will install the last version uploaded to\n[Pypi](https://pypi.org/project/cleverhans).\nIf you'd instead like to install the bleeding edge version, use:\n\n```\npip install git+https://github.com/tensorflow/cleverhans.git#egg=cleverhans\n```\n\n#### Installation for development\n\nIf you want to make an editable installation of CleverHans so that you can\ndevelop the library and contribute changes back, first fork the repository\non GitHub and then clone your fork into a directory of your choice:\n\n```\ngit clone https://github.com/tensorflow/cleverhans\n```\n\nYou can then install the local package in \"editable\" mode in order to add it to\nyour `PYTHONPATH`:\n\n```\ncd cleverhans\npip install -e .\n```\n\n### Currently supported setups\n\nAlthough CleverHans is likely to work on many other machine configurations, we\ncurrently [test it](https://travis-ci.org/tensorflow/cleverhans) it with Python\n3.5 and TensorFlow {1.8, 1.12} on Ubuntu 14.04.5 LTS (Trusty Tahr).\nSupport for Python 2.7 is deprecated.\nCleverHans 3.0.1 supports Python 2.7 and the master branch is likely to\ncontinue to work in Python 2.7 for some time, but we no longer run the tests\nin Python 2.7 and we do not plan to fix bugs affecting only Python 2.7 after\n2019-07-04.\nSupport for TensorFlow prior to 1.12 is deprecated.\nBackwards compatibility wrappers for these versions may be removed after 2019-07-07,\nand we will not fix bugs for those versions after that date.\nSupport for TensorFlow 1.7 and earlier is already deprecated: we do not fix\nbugs for those versions and any remaining wrapper code for those versions\nmay be removed without further notice.\n\n## Getting support\n\nIf you have a request for support, please ask a question\non [StackOverflow](https://stackoverflow.com/questions/tagged/cleverhans)\nrather than opening an issue in the GitHub tracker. The GitHub\nissue tracker should *only* be used to report bugs or make feature requests.\n\n## Contributing\n\nContributions are welcomed! To speed the code review process, we ask that:\n* New efforts and features be coordinated\non the mailing list for CleverHans development: [cleverhans-dev@googlegroups.com](https://groups.google.com/forum/#!forum/cleverhans-dev).\n* When making code contributions to CleverHans, you follow the\n`PEP8 with two spaces` coding style (the same as the one used\nby TensorFlow) in your pull requests.\nIn most cases this can be done by running `autopep8 -i --indent-size 2 \n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/abc.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n
\n \n # Generate documentation
\nTo generate the documentation do:\nmake github
\nThe documentation files will be copied to the cleverhans/docs directory.
\n### Preparation
\nPlease do:\npip install sphinx
\nAdd a .nojekyll file in the cleverhans/docs directory. When GitHub sees\na .nojekyll file, it serves the root index.html file. The .nojekyll file\nindicates that we are not using Jekyll as our static site generator in this\nrepository.
\n### Enable GitHub Pages for the GitHub repository
\n- \n
Go to the repository on the GitHub website and make sure you are logged in.
\nAdd a /docs directory to the master branch. Otherwise you do not get the\nmaster branch /docs folder for the Source option in the drop-down list.
\nClick the Settings tab. You first go to the Options section.
\nScroll down to the GitHub Pages section and choose the drop-down list under\nSource. Note: Your choices will differ based on whether you’re in a User repo\nor an Org repository.
\nTo keep source and output HTML separate, choose master branch /docs folder\nfor Source.
\n
### Build Sphinx locally and publish on GitHub Pages
\nWe keep the source docsource and output docs separate, but still are able to\npublish on GitHub Pages and preview builds locally.
\nWe have the following option in the Makefile:
\n\n\nThus, we can run make github from the docsource directory to generate a\nlocal preview and move the docs where GitHub wants to serve them from.
\n### Hacks
\nIf you cannot build the docs for attacks, uncomment\nimport tensorflow_addons as tfa in cleverhans/attacks/spsa.py.
\nOtherwise:
\n`angular2html\nWARNING: autodoc: failed to import module 'attacks' from module 'cleverhans'; the following exception was raised:\ncannot import name 'keras_tensor'\n`
It is convenient to create a virtual environment to install all the specific\nlibraries (e.g. virutalen cleverhans).
\n\n\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/attack.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for abc
\n# Copyright 2007 Google, Inc. All Rights Reserved.\n# Licensed to PSF under a Contributor Agreement.\n\n"""Abstract Base Classes (ABCs) according to PEP 3119."""\n\nfrom _weakrefset import WeakSet\n\n\ndef abstractmethod(funcobj):\n """A decorator indicating abstract methods.\n\n Requires that the metaclass is ABCMeta or derived from it. A\n class that has a metaclass derived from ABCMeta cannot be\n instantiated unless all of its abstract methods are overridden.\n The abstract methods can be called using any of the normal\n 'super' call mechanisms.\n\n Usage:\n\n class C(metaclass=ABCMeta):\n @abstractmethod\n def my_abstract_method(self, ...):\n ...\n """\n funcobj.__isabstractmethod__ = True\n return funcobj\n\n\nclass abstractclassmethod(classmethod):\n """\n A decorator indicating abstract classmethods.\n\n Similar to abstractmethod.\n\n Usage:\n\n class C(metaclass=ABCMeta):\n @abstractclassmethod\n def my_abstract_classmethod(cls, ...):\n ...\n\n 'abstractclassmethod' is deprecated. Use 'classmethod' with\n 'abstractmethod' instead.\n """\n\n __isabstractmethod__ = True\n\n def __init__(self, callable):\n callable.__isabstractmethod__ = True\n super().__init__(callable)\n\n\nclass abstractstaticmethod(staticmethod):\n """\n A decorator indicating abstract staticmethods.\n\n Similar to abstractmethod.\n\n Usage:\n\n class C(metaclass=ABCMeta):\n @abstractstaticmethod\n def my_abstract_staticmethod(...):\n ...\n\n 'abstractstaticmethod' is deprecated. Use 'staticmethod' with\n 'abstractmethod' instead.\n """\n\n __isabstractmethod__ = True\n\n def __init__(self, callable):\n callable.__isabstractmethod__ = True\n super().__init__(callable)\n\n\nclass abstractproperty(property):\n """\n A decorator indicating abstract properties.\n\n Requires that the metaclass is ABCMeta or derived from it. A\n class that has a metaclass derived from ABCMeta cannot be\n instantiated unless all of its abstract properties are overridden.\n The abstract properties can be called using any of the normal\n 'super' call mechanisms.\n\n Usage:\n\n class C(metaclass=ABCMeta):\n @abstractproperty\n def my_abstract_property(self):\n ...\n\n This defines a read-only property; you can also define a read-write\n abstract property using the 'long' form of property declaration:\n\n class C(metaclass=ABCMeta):\n def getx(self): ...\n def setx(self, value): ...\n x = abstractproperty(getx, setx)\n\n 'abstractproperty' is deprecated. Use 'property' with 'abstractmethod'\n instead.\n """\n\n __isabstractmethod__ = True\n\n\n[docs]class ABCMeta(type):\n\n """Metaclass for defining Abstract Base Classes (ABCs).\n\n Use this metaclass to create an ABC. An ABC can be subclassed\n directly, and then acts as a mix-in class. You can also register\n unrelated concrete classes (even built-in classes) and unrelated\n ABCs as 'virtual subclasses' -- these and their descendants will\n be considered subclasses of the registering ABC by the built-in\n issubclass() function, but the registering ABC won't show up in\n their MRO (Method Resolution Order) nor will method\n implementations defined by the registering ABC be callable (not\n even via super()).\n\n """\n\n # A global counter that is incremented each time a class is\n # registered as a virtual subclass of anything. It forces the\n # negative cache to be cleared before its next use.\n # Note: this counter is private. Use `abc.get_cache_token()` for\n # external code.\n _abc_invalidation_counter = 0\n\n def __new__(mcls, name, bases, namespace, **kwargs):\n cls = super().__new__(mcls, name, bases, namespace, **kwargs)\n # Compute set of abstract method names\n abstracts = {name\n for name, value in namespace.items()\n if getattr(value, "__isabstractmethod__", False)}\n for base in bases:\n for name in getattr(base, "__abstractmethods__", set()):\n value = getattr(cls, name, None)\n if getattr(value, "__isabstractmethod__", False):\n abstracts.add(name)\n cls.__abstractmethods__ = frozenset(abstracts)\n # Set up inheritance registry\n cls._abc_registry = WeakSet()\n cls._abc_cache = WeakSet()\n cls._abc_negative_cache = WeakSet()\n cls._abc_negative_cache_version = ABCMeta._abc_invalidation_counter\n return cls\n\n[docs] def register(cls, subclass):\n """Register a virtual subclass of an ABC.\n\n Returns the subclass, to allow usage as a class decorator.\n """\n if not isinstance(subclass, type):\n raise TypeError("Can only register classes")\n if issubclass(subclass, cls):\n return subclass # Already a subclass\n # Subtle: test for cycles *after* testing for "already a subclass";\n # this means we allow X.register(X) and interpret it as a no-op.\n if issubclass(cls, subclass):\n # This would create a cycle, which is bad for the algorithm below\n raise RuntimeError("Refusing to create an inheritance cycle")\n cls._abc_registry.add(subclass)\n ABCMeta._abc_invalidation_counter += 1 # Invalidate negative cache\n return subclass\n\n def _dump_registry(cls, file=None):\n """Debug helper to print the ABC registry."""\n print("Class: %s.%s" % (cls.__module__, cls.__qualname__), file=file)\n print("Inv.counter: %s" % ABCMeta._abc_invalidation_counter, file=file)\n for name in sorted(cls.__dict__):\n if name.startswith("_abc_"):\n value = getattr(cls, name)\n if isinstance(value, WeakSet):\n value = set(value)\n print("%s: %r" % (name, value), file=file)\n\n def __instancecheck__(cls, instance):\n """Override for isinstance(instance, cls)."""\n # Inline the cache checking\n subclass = instance.__class__\n if subclass in cls._abc_cache:\n return True\n subtype = type(instance)\n if subtype is subclass:\n if (cls._abc_negative_cache_version ==\n ABCMeta._abc_invalidation_counter and\n subclass in cls._abc_negative_cache):\n return False\n # Fall back to the subclass check.\n return cls.__subclasscheck__(subclass)\n return any(cls.__subclasscheck__(c) for c in {subclass, subtype})\n\n def __subclasscheck__(cls, subclass):\n """Override for issubclass(subclass, cls)."""\n # Check cache\n if subclass in cls._abc_cache:\n return True\n # Check negative cache; may have to invalidate\n if cls._abc_negative_cache_version < ABCMeta._abc_invalidation_counter:\n # Invalidate the negative cache\n cls._abc_negative_cache = WeakSet()\n cls._abc_negative_cache_version = ABCMeta._abc_invalidation_counter\n elif subclass in cls._abc_negative_cache:\n return False\n # Check the subclass hook\n ok = cls.__subclasshook__(subclass)\n if ok is not NotImplemented:\n assert isinstance(ok, bool)\n if ok:\n cls._abc_cache.add(subclass)\n else:\n cls._abc_negative_cache.add(subclass)\n return ok\n # Check if it's a direct subclass\n if cls in getattr(subclass, '__mro__', ()):\n cls._abc_cache.add(subclass)\n return True\n # Check if it's a subclass of a registered class (recursive)\n for rcls in cls._abc_registry:\n if issubclass(subclass, rcls):\n cls._abc_cache.add(subclass)\n return True\n # Check if it's a subclass of a subclass (recursive)\n for scls in cls.__subclasses__():\n if issubclass(subclass, scls):\n cls._abc_cache.add(subclass)\n return True\n # No dice; update negative cache\n cls._abc_negative_cache.add(subclass)\n return False\n\n\nclass ABC(metaclass=ABCMeta):\n """Helper class that provides a standard way to create an ABC using\n inheritance.\n """\n pass\n\n\ndef get_cache_token():\n """Returns the current ABC cache token.\n\n The token is an opaque object (supporting equality testing) identifying the\n current version of the ABC cache for virtual subclasses. The token changes\n with every call to ``register()`` on any ABC.\n """\n return ABCMeta._abc_invalidation_counter\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/basic_iterative_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.attack
\n"""\nThe Attack interface.\n"""\n\nfrom abc import ABCMeta\nimport collections\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.compat import reduce_max\nfrom cleverhans.model import Model\nfrom cleverhans import utils\n\n_logger = utils.create_logger("cleverhans.attacks.attack")\n\n\n[docs]class Attack(object):\n """\n Abstract base class for all attack classes.\n """\n __metaclass__ = ABCMeta\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n :param model: An instance of the cleverhans.model.Model class.\n :param sess: The (possibly optional) tf.Session to run graphs in.\n :param dtypestr: Floating point precision to use (change to float64\n to avoid numerical instabilities).\n :param back: (deprecated and will be removed on or after 2019-03-26).\n The backend to use. Currently 'tf' is the only option.\n """\n if 'back' in kwargs:\n if kwargs['back'] == 'tf':\n warnings.warn("Argument back to attack constructors is not needed"\n " anymore and will be removed on or after 2019-03-26."\n " All attacks are implemented using TensorFlow.")\n else:\n raise ValueError("Backend argument must be 'tf' and is now deprecated"\n "It will be removed on or after 2019-03-26.")\n\n self.tf_dtype = tf.as_dtype(dtypestr)\n self.np_dtype = np.dtype(dtypestr)\n\n if sess is not None and not isinstance(sess, tf.Session):\n raise TypeError("sess is not an instance of tf.Session")\n\n from cleverhans import attacks_tf\n attacks_tf.np_dtype = self.np_dtype\n attacks_tf.tf_dtype = self.tf_dtype\n\n if not isinstance(model, Model):\n raise TypeError("The model argument should be an instance of"\n " the cleverhans.model.Model class.")\n\n # Prepare attributes\n self.model = model\n self.sess = sess\n self.dtypestr = dtypestr\n\n # We are going to keep track of old graphs and cache them.\n self.graphs = {}\n\n # When calling generate_np, arguments in the following set should be\n # fed into the graph, as they are not structural items that require\n # generating a new graph.\n # This dict should map names of arguments to the types they should\n # have.\n # (Usually, the target class will be a feedable keyword argument.)\n self.feedable_kwargs = tuple()\n\n # When calling generate_np, arguments in the following set should NOT\n # be fed into the graph, as they ARE structural items that require\n # generating a new graph.\n # This list should contain the names of the structural arguments.\n self.structural_kwargs = []\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate the attack's symbolic graph for adversarial examples. This\n method should be overriden in any child class that implements an\n attack that is expressable symbolically. Otherwise, it will wrap the\n numerical implementation as a symbolic operator.\n\n :param x: The model's symbolic inputs.\n :param **kwargs: optional parameters used by child classes.\n Each child class defines additional parameters as needed.\n Child classes that use the following concepts should use the following\n names:\n clip_min: minimum feature value\n clip_max: maximum feature value\n eps: size of norm constraint on adversarial perturbation\n ord: order of norm constraint\n nb_iter: number of iterations\n eps_iter: size of norm constraint on iteration\n y_target: if specified, the attack is targeted.\n y: Do not specify if y_target is specified.\n If specified, the attack is untargeted, aims to make the output\n class not be y.\n If neither y_target nor y is specified, y is inferred by having\n the model classify the input.\n For other concepts, it's generally a good idea to read other classes\n and check for name consistency.\n :return: A symbolic representation of the adversarial examples.\n """\n\n error = "Sub-classes must implement generate."\n raise NotImplementedError(error)\n # Include an unused return so pylint understands the method signature\n return x\n\n[docs] def construct_graph(self, fixed, feedable, x_val, hash_key):\n """\n Construct the graph required to run the attack through generate_np.\n\n :param fixed: Structural elements that require defining a new graph.\n :param feedable: Arguments that can be fed to the same graph when\n they take different values.\n :param x_val: symbolic adversarial example\n :param hash_key: the key used to store this graph in our cache\n """\n # try our very best to create a TF placeholder for each of the\n # feedable keyword arguments, and check the types are one of\n # the allowed types\n class_name = str(self.__class__).split(".")[-1][:-2]\n _logger.info("Constructing new graph for attack " + class_name)\n\n # remove the None arguments, they are just left blank\n for k in list(feedable.keys()):\n if feedable[k] is None:\n del feedable[k]\n\n # process all of the rest and create placeholders for them\n new_kwargs = dict(x for x in fixed.items())\n for name, value in feedable.items():\n given_type = value.dtype\n if isinstance(value, np.ndarray):\n if value.ndim == 0:\n # This is pretty clearly not a batch of data\n new_kwargs[name] = tf.placeholder(given_type, shape=[], name=name)\n else:\n # Assume that this is a batch of data, make the first axis variable\n # in size\n new_shape = [None] + list(value.shape[1:])\n new_kwargs[name] = tf.placeholder(given_type, new_shape, name=name)\n elif isinstance(value, utils.known_number_types):\n new_kwargs[name] = tf.placeholder(given_type, shape=[], name=name)\n else:\n raise ValueError("Could not identify type of argument " +\n name + ": " + str(value))\n\n # x is a special placeholder we always want to have\n x_shape = [None] + list(x_val.shape)[1:]\n x = tf.placeholder(self.tf_dtype, shape=x_shape)\n\n # now we generate the graph that we want\n x_adv = self.generate(x, **new_kwargs)\n\n self.graphs[hash_key] = (x, new_kwargs, x_adv)\n\n if len(self.graphs) >= 10:\n warnings.warn("Calling generate_np() with multiple different "\n "structural parameters is inefficient and should"\n " be avoided. Calling generate() is preferred.")\n\n[docs] def generate_np(self, x_val, **kwargs):\n """\n Generate adversarial examples and return them as a NumPy array.\n Sub-classes *should not* implement this method unless they must\n perform special handling of arguments.\n\n :param x_val: A NumPy array with the original inputs.\n :param **kwargs: optional parameters used by child classes.\n :return: A NumPy array holding the adversarial examples.\n """\n\n if self.sess is None:\n raise ValueError("Cannot use `generate_np` when no `sess` was"\n " provided")\n\n packed = self.construct_variables(kwargs)\n fixed, feedable, _, hash_key = packed\n\n if hash_key not in self.graphs:\n self.construct_graph(fixed, feedable, x_val, hash_key)\n else:\n # remove the None arguments, they are just left blank\n for k in list(feedable.keys()):\n if feedable[k] is None:\n del feedable[k]\n\n x, new_kwargs, x_adv = self.graphs[hash_key]\n\n feed_dict = {x: x_val}\n\n for name in feedable:\n feed_dict[new_kwargs[name]] = feedable[name]\n\n return self.sess.run(x_adv, feed_dict)\n\n[docs] def construct_variables(self, kwargs):\n """\n Construct the inputs to the attack graph to be used by generate_np.\n\n :param kwargs: Keyword arguments to generate_np.\n :return:\n Structural arguments\n Feedable arguments\n Output of `arg_type` describing feedable arguments\n A unique key\n """\n if isinstance(self.feedable_kwargs, dict):\n warnings.warn("Using a dict for `feedable_kwargs is deprecated."\n "Switch to using a tuple."\n "It is not longer necessary to specify the types "\n "of the arguments---we build a different graph "\n "for each received type."\n "Using a dict may become an error on or after "\n "2019-04-18.")\n feedable_names = tuple(sorted(self.feedable_kwargs.keys()))\n else:\n feedable_names = self.feedable_kwargs\n if not isinstance(feedable_names, tuple):\n raise TypeError("Attack.feedable_kwargs should be a tuple, but "\n "for subclass " + str(type(self)) + " it is "\n + str(self.feedable_kwargs) + " of type "\n + str(type(self.feedable_kwargs)))\n\n # the set of arguments that are structural properties of the attack\n # if these arguments are different, we must construct a new graph\n fixed = dict(\n (k, v) for k, v in kwargs.items() if k in self.structural_kwargs)\n\n # the set of arguments that are passed as placeholders to the graph\n # on each call, and can change without constructing a new graph\n feedable = {k: v for k, v in kwargs.items() if k in feedable_names}\n for k in feedable:\n if isinstance(feedable[k], (float, int)):\n feedable[k] = np.array(feedable[k])\n\n for key in kwargs:\n if key not in fixed and key not in feedable:\n raise ValueError(str(type(self)) + ": Undeclared argument: " + key)\n\n feed_arg_type = arg_type(feedable_names, feedable)\n\n if not all(isinstance(value, collections.Hashable)\n for value in fixed.values()):\n # we have received a fixed value that isn't hashable\n # this means we can't cache this graph for later use,\n # and it will have to be discarded later\n hash_key = None\n else:\n # create a unique key for this set of fixed paramaters\n hash_key = tuple(sorted(fixed.items())) + tuple([feed_arg_type])\n\n return fixed, feedable, feed_arg_type, hash_key\n\n[docs] def get_or_guess_labels(self, x, kwargs):\n """\n Get the label to use in generating an adversarial example for x.\n The kwargs are fed directly from the kwargs of the attack.\n If 'y' is in kwargs, then assume it's an untargeted attack and\n use that as the label.\n If 'y_target' is in kwargs and is not none, then assume it's a\n targeted attack and use that as the label.\n Otherwise, use the model's prediction as the label and perform an\n untargeted attack.\n """\n if 'y' in kwargs and 'y_target' in kwargs:\n raise ValueError("Can not set both 'y' and 'y_target'.")\n elif 'y' in kwargs:\n labels = kwargs['y']\n elif 'y_target' in kwargs and kwargs['y_target'] is not None:\n labels = kwargs['y_target']\n else:\n preds = self.model.get_probs(x)\n preds_max = reduce_max(preds, 1, keepdims=True)\n original_predictions = tf.to_float(tf.equal(preds, preds_max))\n labels = tf.stop_gradient(original_predictions)\n del preds\n if isinstance(labels, np.ndarray):\n nb_classes = labels.shape[1]\n else:\n nb_classes = labels.get_shape().as_list()[1]\n return labels, nb_classes\n\n[docs] def parse_params(self, params=None):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n :param params: a dictionary of attack-specific parameters\n :return: True when parsing was successful\n """\n\n if params is not None:\n warnings.warn("`params` is unused and will be removed "\n " on or after 2019-04-26.")\n return True\n\n\ndef arg_type(arg_names, kwargs):\n """\n Returns a hashable summary of the types of arg_names within kwargs.\n :param arg_names: tuple containing names of relevant arguments\n :param kwargs: dict mapping string argument names to values.\n These must be values for which we can create a tf placeholder.\n Currently supported: numpy darray or something that can ducktype it\n returns:\n API contract is to return a hashable object describing all\n structural consequences of argument values that can otherwise\n be fed into a graph of fixed structure.\n Currently this is implemented as a tuple of tuples that track:\n - whether each argument was passed\n - whether each argument was passed and not None\n - the dtype of each argument\n Callers shouldn't rely on the exact structure of this object,\n just its hashability and one-to-one mapping between graph structures.\n """\n assert isinstance(arg_names, tuple)\n passed = tuple(name in kwargs for name in arg_names)\n passed_and_not_none = []\n for name in arg_names:\n if name in kwargs:\n passed_and_not_none.append(kwargs[name] is not None)\n else:\n passed_and_not_none.append(False)\n passed_and_not_none = tuple(passed_and_not_none)\n dtypes = []\n for name in arg_names:\n if name not in kwargs:\n dtypes.append(None)\n continue\n value = kwargs[name]\n if value is None:\n dtypes.append(None)\n continue\n assert hasattr(value, 'dtype'), type(value)\n dtype = value.dtype\n if not isinstance(dtype, np.dtype):\n dtype = dtype.as_np_dtype\n assert isinstance(dtype, np.dtype)\n dtypes.append(dtype)\n dtypes = tuple(dtypes)\n return (passed, passed_and_not_none, dtypes)\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/carlini_wagner_l2.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.basic_iterative_method
\n"""\nThe BasicIterativeMethod attack.\n"""\n\nfrom cleverhans.attacks.projected_gradient_descent import ProjectedGradientDescent\n\n\n[docs]class BasicIterativeMethod(ProjectedGradientDescent):\n """\n The BasicIterativeMethod attack.\n """\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n super(BasicIterativeMethod, self).__init__(model, sess=sess,\n dtypestr=dtypestr,\n default_rand_init=False,\n **kwargs)\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/deep_fool.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.carlini_wagner_l2
\n"""The CarliniWagnerL2 attack\n"""\n# pylint: disable=missing-docstring\nimport logging\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_sum, reduce_max\nfrom cleverhans.model import CallableModelWrapper, Model, wrapper_warning_logits\nfrom cleverhans import utils\n\nnp_dtype = np.dtype('float32')\ntf_dtype = tf.as_dtype('float32')\n\n_logger = utils.create_logger("cleverhans.attacks.carlini_wagner_l2")\n_logger.setLevel(logging.INFO)\n\n\n[docs]class CarliniWagnerL2(Attack):\n """\n This attack was originally proposed by Carlini and Wagner. It is an\n iterative attack that finds adversarial examples on many defenses that\n are robust to other attacks.\n Paper link: https://arxiv.org/abs/1608.04644\n\n At a high level, this attack is an iterative attack using Adam and\n a specially-chosen loss function to find adversarial examples with\n lower distortion than other attacks. This comes at the cost of speed,\n as this attack is often much slower than others.\n\n :param model: cleverhans.model.Model\n :param sess: tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess, dtypestr='float32', **kwargs):\n """\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n if not isinstance(model, Model):\n wrapper_warning_logits()\n model = CallableModelWrapper(model, 'logits')\n\n super(CarliniWagnerL2, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.feedable_kwargs = ('y', 'y_target')\n\n self.structural_kwargs = [\n 'batch_size', 'confidence', 'targeted', 'learning_rate',\n 'binary_search_steps', 'max_iterations', 'abort_early',\n 'initial_const', 'clip_min', 'clip_max'\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n\n :param x: A tensor with the inputs.\n :param kwargs: See `parse_params`\n """\n assert self.sess is not None, \\\n 'Cannot use `generate` when no `sess` was provided'\n self.parse_params(**kwargs)\n\n labels, nb_classes = self.get_or_guess_labels(x, kwargs)\n\n attack = CWL2(self.sess, self.model, self.batch_size, self.confidence,\n 'y_target' in kwargs, self.learning_rate,\n self.binary_search_steps, self.max_iterations,\n self.abort_early, self.initial_const, self.clip_min,\n self.clip_max, nb_classes,\n x.get_shape().as_list()[1:])\n\n def cw_wrap(x_val, y_val):\n return np.array(attack.attack(x_val, y_val), dtype=self.np_dtype)\n\n wrap = tf.py_func(cw_wrap, [x, labels], self.tf_dtype)\n wrap.set_shape(x.get_shape())\n\n return wrap\n\n[docs] def parse_params(self,\n y=None,\n y_target=None,\n batch_size=1,\n confidence=0,\n learning_rate=5e-3,\n binary_search_steps=5,\n max_iterations=1000,\n abort_early=True,\n initial_const=1e-2,\n clip_min=0,\n clip_max=1):\n """\n :param y: (optional) A tensor with the true labels for an untargeted\n attack. If None (and y_target is None) then use the\n original labels the classifier assigns.\n :param y_target: (optional) A tensor with the target labels for a\n targeted attack.\n :param confidence: Confidence of adversarial examples: higher produces\n examples with larger l2 distortion, but more\n strongly classified as adversarial.\n :param batch_size: Number of attacks to run simultaneously.\n :param learning_rate: The learning rate for the attack algorithm.\n Smaller values produce better results but are\n slower to converge.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the purturbation\n and confidence of the classification.\n :param max_iterations: The maximum number of iterations. Setting this\n to a larger value will produce lower distortion\n results. Using only a few iterations requires\n a larger learning rate, and will produce larger\n distortion results.\n :param abort_early: If true, allows early aborts if gradient descent\n is unable to make progress (i.e., gets stuck in\n a local minimum).\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the perturbation\n and confidence of classification.\n If binary_search_steps is large, the initial\n constant is not important. A smaller value of\n this constant gives lower distortion results.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # ignore the y and y_target argument\n self.batch_size = batch_size\n self.confidence = confidence\n self.learning_rate = learning_rate\n self.binary_search_steps = binary_search_steps\n self.max_iterations = max_iterations\n self.abort_early = abort_early\n self.initial_const = initial_const\n self.clip_min = clip_min\n self.clip_max = clip_max\n\n\ndef ZERO():\n return np.asarray(0., dtype=np_dtype)\n\n\nclass CWL2(object):\n def __init__(self, sess, model, batch_size, confidence, targeted,\n learning_rate, binary_search_steps, max_iterations,\n abort_early, initial_const, clip_min, clip_max, num_labels,\n shape):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n\n :param sess: a TF session.\n :param model: a cleverhans.model.Model object.\n :param batch_size: Number of attacks to run simultaneously.\n :param confidence: Confidence of adversarial examples: higher produces\n examples with larger l2 distortion, but more\n strongly classified as adversarial.\n :param targeted: boolean controlling the behavior of the adversarial\n examples produced. If set to False, they will be\n misclassified in any wrong class. If set to True,\n they will be misclassified in a chosen target class.\n :param learning_rate: The learning rate for the attack algorithm.\n Smaller values produce better results but are\n slower to converge.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the purturbation\n and confidence of the classification.\n :param max_iterations: The maximum number of iterations. Setting this\n to a larger value will produce lower distortion\n results. Using only a few iterations requires\n a larger learning rate, and will produce larger\n distortion results.\n :param abort_early: If true, allows early aborts if gradient descent\n is unable to make progress (i.e., gets stuck in\n a local minimum).\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the pururbation\n and confidence of classification.\n If binary_search_steps is large, the initial\n constant is not important. A smaller value of\n this constant gives lower distortion results.\n :param clip_min: (optional float) Minimum input component value.\n :param clip_max: (optional float) Maximum input component value.\n :param num_labels: the number of classes in the model's output.\n :param shape: the shape of the model's input tensor.\n """\n\n self.sess = sess\n self.TARGETED = targeted\n self.LEARNING_RATE = learning_rate\n self.MAX_ITERATIONS = max_iterations\n self.BINARY_SEARCH_STEPS = binary_search_steps\n self.ABORT_EARLY = abort_early\n self.CONFIDENCE = confidence\n self.initial_const = initial_const\n self.batch_size = batch_size\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.model = model\n\n self.repeat = binary_search_steps >= 10\n\n self.shape = shape = tuple([batch_size] + list(shape))\n\n # the variable we're going to optimize over\n modifier = tf.Variable(np.zeros(shape, dtype=np_dtype))\n\n # these are variables to be more efficient in sending data to tf\n self.timg = tf.Variable(np.zeros(shape), dtype=tf_dtype, name='timg')\n self.tlab = tf.Variable(\n np.zeros((batch_size, num_labels)), dtype=tf_dtype, name='tlab')\n self.const = tf.Variable(\n np.zeros(batch_size), dtype=tf_dtype, name='const')\n\n # and here's what we use to assign them\n self.assign_timg = tf.placeholder(tf_dtype, shape, name='assign_timg')\n self.assign_tlab = tf.placeholder(\n tf_dtype, (batch_size, num_labels), name='assign_tlab')\n self.assign_const = tf.placeholder(\n tf_dtype, [batch_size], name='assign_const')\n\n # the resulting instance, tanh'd to keep bounded from clip_min\n # to clip_max\n self.newimg = (tf.tanh(modifier + self.timg) + 1) / 2\n self.newimg = self.newimg * (clip_max - clip_min) + clip_min\n\n # prediction BEFORE-SOFTMAX of the model\n self.output = model.get_logits(self.newimg)\n\n # distance to the input data\n self.other = (tf.tanh(self.timg) + 1) / \\\n 2 * (clip_max - clip_min) + clip_min\n self.l2dist = reduce_sum(\n tf.square(self.newimg - self.other), list(range(1, len(shape))))\n\n # compute the probability of the label class versus the maximum other\n real = reduce_sum((self.tlab) * self.output, 1)\n other = reduce_max((1 - self.tlab) * self.output - self.tlab * 10000,\n 1)\n\n if self.TARGETED:\n # if targeted, optimize for making the other class most likely\n loss1 = tf.maximum(ZERO(), other - real + self.CONFIDENCE)\n else:\n # if untargeted, optimize for making this class least likely.\n loss1 = tf.maximum(ZERO(), real - other + self.CONFIDENCE)\n\n # sum up the losses\n self.loss2 = reduce_sum(self.l2dist)\n self.loss1 = reduce_sum(self.const * loss1)\n self.loss = self.loss1 + self.loss2\n\n # Setup the adam optimizer and keep track of variables we're creating\n start_vars = set(x.name for x in tf.global_variables())\n optimizer = tf.train.AdamOptimizer(self.LEARNING_RATE)\n self.train = optimizer.minimize(self.loss, var_list=[modifier])\n end_vars = tf.global_variables()\n new_vars = [x for x in end_vars if x.name not in start_vars]\n\n # these are the variables to initialize when we run\n self.setup = []\n self.setup.append(self.timg.assign(self.assign_timg))\n self.setup.append(self.tlab.assign(self.assign_tlab))\n self.setup.append(self.const.assign(self.assign_const))\n\n self.init = tf.variables_initializer(var_list=[modifier] + new_vars)\n\n def attack(self, imgs, targets):\n """\n Perform the L_2 attack on the given instance for the given targets.\n\n If self.targeted is true, then the targets represents the target labels\n If self.targeted is false, then targets are the original class labels\n """\n\n r = []\n for i in range(0, len(imgs), self.batch_size):\n _logger.debug(\n ("Running CWL2 attack on instance %s of %s", i, len(imgs)))\n r.extend(\n self.attack_batch(imgs[i:i + self.batch_size],\n targets[i:i + self.batch_size]))\n return np.array(r)\n\n def attack_batch(self, imgs, labs):\n """\n Run the attack on a batch of instance and labels.\n """\n\n def compare(x, y):\n if not isinstance(x, (float, int, np.int64)):\n x = np.copy(x)\n if self.TARGETED:\n x[y] -= self.CONFIDENCE\n else:\n x[y] += self.CONFIDENCE\n x = np.argmax(x)\n if self.TARGETED:\n return x == y\n else:\n return x != y\n\n batch_size = self.batch_size\n\n oimgs = np.clip(imgs, self.clip_min, self.clip_max)\n\n # re-scale instances to be within range [0, 1]\n imgs = (imgs - self.clip_min) / (self.clip_max - self.clip_min)\n imgs = np.clip(imgs, 0, 1)\n # now convert to [-1, 1]\n imgs = (imgs * 2) - 1\n # convert to tanh-space\n imgs = np.arctanh(imgs * .999999)\n\n # set the lower and upper bounds accordingly\n lower_bound = np.zeros(batch_size)\n CONST = np.ones(batch_size) * self.initial_const\n upper_bound = np.ones(batch_size) * 1e10\n\n # placeholders for the best l2, score, and instance attack found so far\n o_bestl2 = [1e10] * batch_size\n o_bestscore = [-1] * batch_size\n o_bestattack = np.copy(oimgs)\n\n for outer_step in range(self.BINARY_SEARCH_STEPS):\n # completely reset adam's internal state.\n self.sess.run(self.init)\n batch = imgs[:batch_size]\n batchlab = labs[:batch_size]\n\n bestl2 = [1e10] * batch_size\n bestscore = [-1] * batch_size\n _logger.debug(" Binary search step %s of %s",\n outer_step, self.BINARY_SEARCH_STEPS)\n\n # The last iteration (if we run many steps) repeat the search once.\n if self.repeat and outer_step == self.BINARY_SEARCH_STEPS - 1:\n CONST = upper_bound\n\n # set the variables so that we don't have to send them over again\n self.sess.run(\n self.setup, {\n self.assign_timg: batch,\n self.assign_tlab: batchlab,\n self.assign_const: CONST\n })\n\n prev = 1e6\n for iteration in range(self.MAX_ITERATIONS):\n # perform the attack\n _, l, l2s, scores, nimg = self.sess.run([\n self.train, self.loss, self.l2dist, self.output,\n self.newimg\n ])\n\n if iteration % ((self.MAX_ITERATIONS // 10) or 1) == 0:\n _logger.debug((" Iteration {} of {}: loss={:.3g} " +\n "l2={:.3g} f={:.3g}").format(\n iteration, self.MAX_ITERATIONS, l,\n np.mean(l2s), np.mean(scores)))\n\n # check if we should abort search if we're getting nowhere.\n if self.ABORT_EARLY and \\\n iteration % ((self.MAX_ITERATIONS // 10) or 1) == 0:\n if l > prev * .9999:\n msg = " Failed to make progress; stop early"\n _logger.debug(msg)\n break\n prev = l\n\n # adjust the best result found so far\n for e, (l2, sc, ii) in enumerate(zip(l2s, scores, nimg)):\n lab = np.argmax(batchlab[e])\n if l2 < bestl2[e] and compare(sc, lab):\n bestl2[e] = l2\n bestscore[e] = np.argmax(sc)\n if l2 < o_bestl2[e] and compare(sc, lab):\n o_bestl2[e] = l2\n o_bestscore[e] = np.argmax(sc)\n o_bestattack[e] = ii\n\n # adjust the constant as needed\n for e in range(batch_size):\n if compare(bestscore[e], np.argmax(batchlab[e])) and \\\n bestscore[e] != -1:\n # success, divide const by two\n upper_bound[e] = min(upper_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n # failure, either multiply by 10 if no solution found yet\n # or do binary search with the known upper bound\n lower_bound[e] = max(lower_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n CONST[e] *= 10\n _logger.debug(" Successfully generated adversarial examples " +\n "on {} of {} instances.".format(\n sum(upper_bound < 1e9), batch_size))\n o_bestl2 = np.array(o_bestl2)\n mean = np.mean(np.sqrt(o_bestl2[o_bestl2 < 1e9]))\n _logger.debug(" Mean successful distortion: {:.4g}".format(mean))\n\n # return the best solution found\n o_bestl2 = np.array(o_bestl2)\n return o_bestattack\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/elastic_net_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.deep_fool
\n"""The DeepFool attack\n\n"""\nimport copy\nimport logging\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.model import Model, wrapper_warning_logits, CallableModelWrapper\nfrom cleverhans import utils\nfrom cleverhans import utils_tf\n\nnp_dtype = np.dtype('float32')\n\n_logger = utils.create_logger("cleverhans.attacks.deep_fool")\n_logger.setLevel(logging.INFO)\n\n[docs]class DeepFool(Attack):\n """\n DeepFool is an untargeted & iterative attack which is based on an\n iterative linearization of the classifier. The implementation here\n is w.r.t. the L2 norm.\n Paper link: "https://arxiv.org/pdf/1511.04599.pdf"\n\n :param model: cleverhans.model.Model\n :param sess: tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess, dtypestr='float32', **kwargs):\n """\n Create a DeepFool instance.\n """\n if not isinstance(model, Model):\n wrapper_warning_logits()\n model = CallableModelWrapper(model, 'logits')\n\n super(DeepFool, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.structural_kwargs = [\n 'overshoot', 'max_iter', 'clip_max', 'clip_min', 'nb_candidate'\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n assert self.sess is not None, \\\n 'Cannot use `generate` when no `sess` was provided'\n from cleverhans.utils_tf import jacobian_graph\n\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n # Define graph wrt to this input placeholder\n logits = self.model.get_logits(x)\n self.nb_classes = logits.get_shape().as_list()[-1]\n assert self.nb_candidate <= self.nb_classes, \\\n 'nb_candidate should not be greater than nb_classes'\n preds = tf.reshape(\n tf.nn.top_k(logits, k=self.nb_candidate)[0],\n [-1, self.nb_candidate])\n # grads will be the shape [batch_size, nb_candidate, image_size]\n grads = tf.stack(jacobian_graph(preds, x, self.nb_candidate), axis=1)\n\n # Define graph\n def deepfool_wrap(x_val):\n """deepfool function for py_func"""\n return deepfool_batch(self.sess, x, preds, logits, grads, x_val,\n self.nb_candidate, self.overshoot,\n self.max_iter, self.clip_min, self.clip_max,\n self.nb_classes)\n\n wrap = tf.py_func(deepfool_wrap, [x], self.tf_dtype)\n wrap.set_shape(x.get_shape())\n return wrap\n\n[docs] def parse_params(self,\n nb_candidate=10,\n overshoot=0.02,\n max_iter=50,\n clip_min=0.,\n clip_max=1.,\n **kwargs):\n """\n :param nb_candidate: The number of classes to test against, i.e.,\n deepfool only consider nb_candidate classes when\n attacking(thus accelerate speed). The nb_candidate\n classes are chosen according to the prediction\n confidence during implementation.\n :param overshoot: A termination criterion to prevent vanishing updates\n :param max_iter: Maximum number of iteration for deepfool\n :param clip_min: Minimum component value for clipping\n :param clip_max: Maximum component value for clipping\n """\n self.nb_candidate = nb_candidate\n self.overshoot = overshoot\n self.max_iter = max_iter\n self.clip_min = clip_min\n self.clip_max = clip_max\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n\ndef deepfool_batch(sess,\n x,\n pred,\n logits,\n grads,\n X,\n nb_candidate,\n overshoot,\n max_iter,\n clip_min,\n clip_max,\n nb_classes,\n feed=None):\n """\n Applies DeepFool to a batch of inputs\n :param sess: TF session\n :param x: The input placeholder\n :param pred: The model's sorted symbolic output of logits, only the top\n nb_candidate classes are contained\n :param logits: The model's unnormalized output tensor (the input to\n the softmax layer)\n :param grads: Symbolic gradients of the top nb_candidate classes, procuded\n from gradient_graph\n :param X: Numpy array with sample inputs\n :param nb_candidate: The number of classes to test against, i.e.,\n deepfool only consider nb_candidate classes when\n attacking(thus accelerate speed). The nb_candidate\n classes are chosen according to the prediction\n confidence during implementation.\n :param overshoot: A termination criterion to prevent vanishing updates\n :param max_iter: Maximum number of iteration for DeepFool\n :param clip_min: Minimum value for components of the example returned\n :param clip_max: Maximum value for components of the example returned\n :param nb_classes: Number of model output classes\n :return: Adversarial examples\n """\n X_adv = deepfool_attack(\n sess,\n x,\n pred,\n logits,\n grads,\n X,\n nb_candidate,\n overshoot,\n max_iter,\n clip_min,\n clip_max,\n feed=feed)\n\n return np.asarray(X_adv, dtype=np_dtype)\n\n\ndef deepfool_attack(sess,\n x,\n predictions,\n logits,\n grads,\n sample,\n nb_candidate,\n overshoot,\n max_iter,\n clip_min,\n clip_max,\n feed=None):\n """\n TensorFlow implementation of DeepFool.\n Paper link: see https://arxiv.org/pdf/1511.04599.pdf\n :param sess: TF session\n :param x: The input placeholder\n :param predictions: The model's sorted symbolic output of logits, only the\n top nb_candidate classes are contained\n :param logits: The model's unnormalized output tensor (the input to\n the softmax layer)\n :param grads: Symbolic gradients of the top nb_candidate classes, procuded\n from gradient_graph\n :param sample: Numpy array with sample input\n :param nb_candidate: The number of classes to test against, i.e.,\n deepfool only consider nb_candidate classes when\n attacking(thus accelerate speed). The nb_candidate\n classes are chosen according to the prediction\n confidence during implementation.\n :param overshoot: A termination criterion to prevent vanishing updates\n :param max_iter: Maximum number of iteration for DeepFool\n :param clip_min: Minimum value for components of the example returned\n :param clip_max: Maximum value for components of the example returned\n :return: Adversarial examples\n """\n adv_x = copy.copy(sample)\n # Initialize the loop variables\n iteration = 0\n current = utils_tf.model_argmax(sess, x, logits, adv_x, feed=feed)\n if current.shape == ():\n current = np.array([current])\n w = np.squeeze(np.zeros(sample.shape[1:])) # same shape as original image\n r_tot = np.zeros(sample.shape)\n original = current # use original label as the reference\n\n _logger.debug(\n "Starting DeepFool attack up to %s iterations", max_iter)\n # Repeat this main loop until we have achieved misclassification\n while (np.any(current == original) and iteration < max_iter):\n\n if iteration % 5 == 0 and iteration > 0:\n _logger.info("Attack result at iteration %s is %s", iteration, current)\n gradients = sess.run(grads, feed_dict={x: adv_x})\n predictions_val = sess.run(predictions, feed_dict={x: adv_x})\n for idx in range(sample.shape[0]):\n pert = np.inf\n if current[idx] != original[idx]:\n continue\n for k in range(1, nb_candidate):\n w_k = gradients[idx, k, ...] - gradients[idx, 0, ...]\n f_k = predictions_val[idx, k] - predictions_val[idx, 0]\n # adding value 0.00001 to prevent f_k = 0\n pert_k = (abs(f_k) + 0.00001) / np.linalg.norm(w_k.flatten())\n if pert_k < pert:\n pert = pert_k\n w = w_k\n r_i = pert * w / np.linalg.norm(w)\n r_tot[idx, ...] = r_tot[idx, ...] + r_i\n\n adv_x = np.clip(r_tot + sample, clip_min, clip_max)\n current = utils_tf.model_argmax(sess, x, logits, adv_x, feed=feed)\n if current.shape == ():\n current = np.array([current])\n # Update loop variables\n iteration = iteration + 1\n\n # need more revision, including info like how many succeed\n _logger.info("Attack result at iteration %s is %s", iteration, current)\n _logger.info("%s out of %s become adversarial examples at iteration %s",\n sum(current != original),\n sample.shape[0],\n iteration)\n # need to clip this image into the given range\n adv_x = np.clip((1 + overshoot) * r_tot + sample, clip_min, clip_max)\n return adv_x\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/fast_feature_adversaries.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.elastic_net_method
\n"""The ElasticNetMethod attack.\n"""\n# pylint: disable=missing-docstring\nimport logging\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_sum, reduce_max\nfrom cleverhans.model import Model, CallableModelWrapper, wrapper_warning_logits\nfrom cleverhans import utils\n\nnp_dtype = np.dtype('float32')\ntf_dtype = tf.as_dtype('float32')\n\n_logger = utils.create_logger("cleverhans.attacks.elastic_net_method")\n_logger.setLevel(logging.INFO)\n\n\ndef ZERO():\n return np.asarray(0., dtype=np_dtype)\n\n\n[docs]class ElasticNetMethod(Attack):\n """\n This attack features L1-oriented adversarial examples and includes\n the C&W L2 attack as a special case (when beta is set to 0).\n Adversarial examples attain similar performance to those\n generated by the C&W L2 attack in the white-box case,\n and more importantly, have improved transferability properties\n and complement adversarial training.\n Paper link: https://arxiv.org/abs/1709.04114\n\n :param model: cleverhans.model.Model\n :param sess: tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess, dtypestr='float32', **kwargs):\n """\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n if not isinstance(model, Model):\n wrapper_warning_logits()\n model = CallableModelWrapper(model, 'logits')\n\n super(ElasticNetMethod, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.feedable_kwargs = ('y', 'y_target')\n\n self.structural_kwargs = [\n 'beta', 'decision_rule', 'batch_size', 'confidence',\n 'targeted', 'learning_rate', 'binary_search_steps',\n 'max_iterations', 'abort_early', 'initial_const', 'clip_min',\n 'clip_max'\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n\n :param x: (required) A tensor with the inputs.\n :param kwargs: See `parse_params`\n """\n assert self.sess is not None, \\\n 'Cannot use `generate` when no `sess` was provided'\n self.parse_params(**kwargs)\n\n labels, nb_classes = self.get_or_guess_labels(x, kwargs)\n\n attack = EAD(self.sess, self.model, self.beta,\n self.decision_rule, self.batch_size, self.confidence,\n 'y_target' in kwargs, self.learning_rate,\n self.binary_search_steps, self.max_iterations,\n self.abort_early, self.initial_const, self.clip_min,\n self.clip_max, nb_classes,\n x.get_shape().as_list()[1:])\n\n def ead_wrap(x_val, y_val):\n return np.array(attack.attack(x_val, y_val), dtype=self.np_dtype)\n\n wrap = tf.py_func(ead_wrap, [x, labels], self.tf_dtype)\n wrap.set_shape(x.get_shape())\n\n return wrap\n\n[docs] def parse_params(self,\n y=None,\n y_target=None,\n beta=1e-2,\n decision_rule='EN',\n batch_size=1,\n confidence=0,\n learning_rate=1e-2,\n binary_search_steps=9,\n max_iterations=1000,\n abort_early=False,\n initial_const=1e-3,\n clip_min=0,\n clip_max=1):\n """\n :param y: (optional) A tensor with the true labels for an untargeted\n attack. If None (and y_target is None) then use the\n original labels the classifier assigns.\n :param y_target: (optional) A tensor with the target labels for a\n targeted attack.\n :param beta: Trades off L2 distortion with L1 distortion: higher\n produces examples with lower L1 distortion, at the\n cost of higher L2 (and typically Linf) distortion\n :param decision_rule: EN or L1. Select final adversarial example from\n all successful examples based on the least\n elastic-net or L1 distortion criterion.\n :param confidence: Confidence of adversarial examples: higher produces\n examples with larger l2 distortion, but more\n strongly classified as adversarial.\n :param batch_size: Number of attacks to run simultaneously.\n :param learning_rate: The learning rate for the attack algorithm.\n Smaller values produce better results but are\n slower to converge.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the perturbation\n and confidence of the classification. Set\n 'initial_const' to a large value and fix\n this param to 1 for speed.\n :param max_iterations: The maximum number of iterations. Setting this\n to a larger value will produce lower distortion\n results. Using only a few iterations requires\n a larger learning rate, and will produce larger\n distortion results.\n :param abort_early: If true, allows early abort when the total\n loss starts to increase (greatly speeds up attack,\n but hurts performance, particularly on ImageNet)\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the perturbation\n and confidence of classification.\n If binary_search_steps is large, the initial\n constant is not important. A smaller value of\n this constant gives lower distortion results.\n For computational efficiency, fix\n binary_search_steps to 1 and set this param\n to a large value.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # ignore the y and y_target argument\n self.beta = beta\n self.decision_rule = decision_rule\n self.batch_size = batch_size\n self.confidence = confidence\n self.learning_rate = learning_rate\n self.binary_search_steps = binary_search_steps\n self.max_iterations = max_iterations\n self.abort_early = abort_early\n self.initial_const = initial_const\n self.clip_min = clip_min\n self.clip_max = clip_max\n\n\nclass EAD(object):\n def __init__(self, sess, model, beta, decision_rule, batch_size,\n confidence, targeted, learning_rate, binary_search_steps,\n max_iterations, abort_early, initial_const, clip_min,\n clip_max, num_labels, shape):\n """\n EAD Attack\n\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n\n :param sess: a TF session.\n :param model: a cleverhans.model.Model object.\n :param beta: Trades off L2 distortion with L1 distortion: higher\n produces examples with lower L1 distortion, at the\n cost of higher L2 (and typically Linf) distortion\n :param decision_rule: EN or L1. Select final adversarial example from\n all successful examples based on the least\n elastic-net or L1 distortion criterion.\n :param batch_size: Number of attacks to run simultaneously.\n :param confidence: Confidence of adversarial examples: higher produces\n examples with larger l2 distortion, but more\n strongly classified as adversarial.\n :param targeted: boolean controlling the behavior of the adversarial\n examples produced. If set to False, they will be\n misclassified in any wrong class. If set to True,\n they will be misclassified in a chosen target class.\n :param learning_rate: The learning rate for the attack algorithm.\n Smaller values produce better results but are\n slower to converge.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the perturbation\n and confidence of the classification. Set\n 'initial_const' to a large value and fix\n this param to 1 for speed.\n :param max_iterations: The maximum number of iterations. Setting this\n to a larger value will produce lower distortion\n results. Using only a few iterations requires\n a larger learning rate, and will produce larger\n distortion results.\n :param abort_early: If true, allows early abort when the total\n loss starts to increase (greatly speeds up attack,\n but hurts performance, particularly on ImageNet)\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the perturbation\n and confidence of classification.\n If binary_search_steps is large, the initial\n constant is not important. A smaller value of\n this constant gives lower distortion results.\n For computational efficiency, fix\n binary_search_steps to 1 and set this param\n to a large value.\n :param clip_min: (optional float) Minimum input component value.\n :param clip_max: (optional float) Maximum input component value.\n :param num_labels: the number of classes in the model's output.\n :param shape: the shape of the model's input tensor.\n """\n\n self.sess = sess\n self.TARGETED = targeted\n self.LEARNING_RATE = learning_rate\n self.MAX_ITERATIONS = max_iterations\n self.BINARY_SEARCH_STEPS = binary_search_steps\n self.ABORT_EARLY = abort_early\n self.CONFIDENCE = confidence\n self.initial_const = initial_const\n self.batch_size = batch_size\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.model = model\n self.decision_rule = decision_rule\n\n self.beta = beta\n self.beta_t = tf.cast(self.beta, tf_dtype)\n\n self.repeat = binary_search_steps >= 10\n\n self.shape = shape = tuple([batch_size] + list(shape))\n\n # these are variables to be more efficient in sending data to tf\n self.timg = tf.Variable(np.zeros(shape), dtype=tf_dtype, name='timg')\n self.newimg = tf.Variable(\n np.zeros(shape), dtype=tf_dtype, name='newimg')\n self.slack = tf.Variable(\n np.zeros(shape), dtype=tf_dtype, name='slack')\n self.tlab = tf.Variable(\n np.zeros((batch_size, num_labels)), dtype=tf_dtype, name='tlab')\n self.const = tf.Variable(\n np.zeros(batch_size), dtype=tf_dtype, name='const')\n\n # and here's what we use to assign them\n self.assign_timg = tf.placeholder(tf_dtype, shape, name='assign_timg')\n self.assign_newimg = tf.placeholder(\n tf_dtype, shape, name='assign_newimg')\n self.assign_slack = tf.placeholder(\n tf_dtype, shape, name='assign_slack')\n self.assign_tlab = tf.placeholder(\n tf_dtype, (batch_size, num_labels), name='assign_tlab')\n self.assign_const = tf.placeholder(\n tf_dtype, [batch_size], name='assign_const')\n\n self.global_step = tf.Variable(0, trainable=False)\n self.global_step_t = tf.cast(self.global_step, tf_dtype)\n\n # Fast Iterative Shrinkage Thresholding\n self.zt = tf.divide(self.global_step_t,\n self.global_step_t + tf.cast(3, tf_dtype))\n cond1 = tf.cast(tf.greater(tf.subtract(self.slack, self.timg),\n self.beta_t), tf_dtype)\n cond2 = tf.cast(tf.less_equal(tf.abs(tf.subtract(self.slack,\n self.timg)),\n self.beta_t), tf_dtype)\n cond3 = tf.cast(tf.less(tf.subtract(self.slack, self.timg),\n tf.negative(self.beta_t)), tf_dtype)\n\n upper = tf.minimum(tf.subtract(self.slack, self.beta_t),\n tf.cast(self.clip_max, tf_dtype))\n lower = tf.maximum(tf.add(self.slack, self.beta_t),\n tf.cast(self.clip_min, tf_dtype))\n\n self.assign_newimg = tf.multiply(cond1, upper)\n self.assign_newimg += tf.multiply(cond2, self.timg)\n self.assign_newimg += tf.multiply(cond3, lower)\n\n self.assign_slack = self.assign_newimg\n self.assign_slack += tf.multiply(self.zt,\n self.assign_newimg - self.newimg)\n\n # --------------------------------\n self.setter = tf.assign(self.newimg, self.assign_newimg)\n self.setter_y = tf.assign(self.slack, self.assign_slack)\n\n # prediction BEFORE-SOFTMAX of the model\n self.output = model.get_logits(self.newimg)\n self.output_y = model.get_logits(self.slack)\n\n # distance to the input data\n self.l2dist = reduce_sum(tf.square(self.newimg-self.timg),\n list(range(1, len(shape))))\n self.l2dist_y = reduce_sum(tf.square(self.slack-self.timg),\n list(range(1, len(shape))))\n self.l1dist = reduce_sum(tf.abs(self.newimg-self.timg),\n list(range(1, len(shape))))\n self.l1dist_y = reduce_sum(tf.abs(self.slack-self.timg),\n list(range(1, len(shape))))\n self.elasticdist = self.l2dist + tf.multiply(self.l1dist,\n self.beta_t)\n self.elasticdist_y = self.l2dist_y + tf.multiply(self.l1dist_y,\n self.beta_t)\n if self.decision_rule == 'EN':\n self.crit = self.elasticdist\n self.crit_p = 'Elastic'\n else:\n self.crit = self.l1dist\n self.crit_p = 'L1'\n\n # compute the probability of the label class versus the maximum other\n real = reduce_sum((self.tlab) * self.output, 1)\n real_y = reduce_sum((self.tlab) * self.output_y, 1)\n other = reduce_max((1 - self.tlab) * self.output -\n (self.tlab * 10000), 1)\n other_y = reduce_max((1 - self.tlab) * self.output_y -\n (self.tlab * 10000), 1)\n\n if self.TARGETED:\n # if targeted, optimize for making the other class most likely\n loss1 = tf.maximum(ZERO(), other - real + self.CONFIDENCE)\n loss1_y = tf.maximum(ZERO(), other_y - real_y + self.CONFIDENCE)\n else:\n # if untargeted, optimize for making this class least likely.\n loss1 = tf.maximum(ZERO(), real - other + self.CONFIDENCE)\n loss1_y = tf.maximum(ZERO(), real_y - other_y + self.CONFIDENCE)\n\n # sum up the losses\n self.loss21 = reduce_sum(self.l1dist)\n self.loss21_y = reduce_sum(self.l1dist_y)\n self.loss2 = reduce_sum(self.l2dist)\n self.loss2_y = reduce_sum(self.l2dist_y)\n self.loss1 = reduce_sum(self.const * loss1)\n self.loss1_y = reduce_sum(self.const * loss1_y)\n self.loss_opt = self.loss1_y + self.loss2_y\n self.loss = self.loss1+self.loss2+tf.multiply(self.beta_t, self.loss21)\n\n self.learning_rate = tf.train.polynomial_decay(\n self.LEARNING_RATE,\n self.global_step,\n self.MAX_ITERATIONS,\n 0,\n power=0.5)\n\n # Setup the optimizer and keep track of variables we're creating\n start_vars = set(x.name for x in tf.global_variables())\n optimizer = tf.train.GradientDescentOptimizer(self.learning_rate)\n self.train = optimizer.minimize(self.loss_opt,\n var_list=[self.slack],\n global_step=self.global_step)\n end_vars = tf.global_variables()\n new_vars = [x for x in end_vars if x.name not in start_vars]\n\n # these are the variables to initialize when we run\n self.setup = []\n self.setup.append(self.timg.assign(self.assign_timg))\n self.setup.append(self.tlab.assign(self.assign_tlab))\n self.setup.append(self.const.assign(self.assign_const))\n\n var_list = [self.global_step]+[self.slack]+[self.newimg]+new_vars\n self.init = tf.variables_initializer(var_list=var_list)\n\n def attack(self, imgs, targets):\n """\n Perform the EAD attack on the given instance for the given targets.\n\n If self.targeted is true, then the targets represents the target labels\n If self.targeted is false, then targets are the original class labels\n """\n\n batch_size = self.batch_size\n r = []\n for i in range(0, len(imgs) // batch_size):\n _logger.debug(\n ("Running EAD attack on instance %s of %s",\n i * batch_size, len(imgs)))\n r.extend(\n self.attack_batch(\n imgs[i * batch_size:(i + 1) * batch_size],\n targets[i * batch_size:(i + 1) * batch_size]))\n if len(imgs) % batch_size != 0:\n last_elements = len(imgs) - (len(imgs) % batch_size)\n _logger.debug(\n ("Running EAD attack on instance %s of %s",\n last_elements, len(imgs)))\n temp_imgs = np.zeros((batch_size, ) + imgs.shape[2:])\n temp_targets = np.zeros((batch_size, ) + targets.shape[2:])\n temp_imgs[:(len(imgs) % batch_size)] = imgs[last_elements:]\n temp_targets[:(len(imgs) % batch_size)] = targets[last_elements:]\n temp_data = self.attack_batch(temp_imgs, temp_targets)\n r.extend(temp_data[:(len(imgs) % batch_size)],\n targets[last_elements:])\n return np.array(r)\n\n def attack_batch(self, imgs, labs):\n """\n Run the attack on a batch of instance and labels.\n """\n\n def compare(x, y):\n if not isinstance(x, (float, int, np.int64)):\n x = np.copy(x)\n if self.TARGETED:\n x[y] -= self.CONFIDENCE\n else:\n x[y] += self.CONFIDENCE\n x = np.argmax(x)\n if self.TARGETED:\n return x == y\n else:\n return x != y\n\n batch_size = self.batch_size\n\n imgs = np.clip(imgs, self.clip_min, self.clip_max)\n\n # set the lower and upper bounds accordingly\n lower_bound = np.zeros(batch_size)\n CONST = np.ones(batch_size) * self.initial_const\n upper_bound = np.ones(batch_size) * 1e10\n\n # placeholders for the best en, score, and instance attack found so far\n o_bestdst = [1e10] * batch_size\n o_bestscore = [-1] * batch_size\n o_bestattack = np.copy(imgs)\n\n for outer_step in range(self.BINARY_SEARCH_STEPS):\n # completely reset the optimizer's internal state.\n self.sess.run(self.init)\n batch = imgs[:batch_size]\n batchlab = labs[:batch_size]\n\n bestdst = [1e10] * batch_size\n bestscore = [-1] * batch_size\n _logger.debug(" Binary search step %s of %s",\n outer_step, self.BINARY_SEARCH_STEPS)\n\n # The last iteration (if we run many steps) repeat the search once.\n if self.repeat and outer_step == self.BINARY_SEARCH_STEPS - 1:\n CONST = upper_bound\n\n # set the variables so that we don't have to send them over again\n self.sess.run(\n self.setup, {\n self.assign_timg: batch,\n self.assign_tlab: batchlab,\n self.assign_const: CONST\n })\n self.sess.run(self.setter, {self.assign_newimg: batch})\n self.sess.run(self.setter_y, {self.assign_slack: batch})\n prev = 1e6\n for iteration in range(self.MAX_ITERATIONS):\n # perform the attack\n self.sess.run([self.train])\n self.sess.run([self.setter, self.setter_y])\n l, l2s, l1s, crit, scores, nimg = self.sess.run([self.loss,\n self.l2dist,\n self.l1dist,\n self.crit,\n self.output,\n self.newimg])\n if iteration % ((self.MAX_ITERATIONS // 10) or 1) == 0:\n _logger.debug((" Iteration {} of {}: loss={:.3g} " +\n "l2={:.3g} l1={:.3g} f={:.3g}").format(\n iteration, self.MAX_ITERATIONS, l,\n np.mean(l2s), np.mean(l1s),\n np.mean(scores)))\n\n # check if we should abort search if we're getting nowhere.\n if self.ABORT_EARLY and \\\n iteration % ((self.MAX_ITERATIONS // 10) or 1) == 0:\n if l > prev * .9999:\n msg = " Failed to make progress; stop early"\n _logger.debug(msg)\n break\n prev = l\n\n # adjust the best result found so far\n for e, (dst, sc, ii) in enumerate(zip(crit, scores, nimg)):\n lab = np.argmax(batchlab[e])\n if dst < bestdst[e] and compare(sc, lab):\n bestdst[e] = dst\n bestscore[e] = np.argmax(sc)\n if dst < o_bestdst[e] and compare(sc, lab):\n o_bestdst[e] = dst\n o_bestscore[e] = np.argmax(sc)\n o_bestattack[e] = ii\n\n # adjust the constant as needed\n for e in range(batch_size):\n if compare(bestscore[e], np.argmax(batchlab[e])) and \\\n bestscore[e] != -1:\n # success, divide const by two\n upper_bound[e] = min(upper_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n # failure, either multiply by 10 if no solution found yet\n # or do binary search with the known upper bound\n lower_bound[e] = max(lower_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n CONST[e] *= 10\n _logger.debug(" Successfully generated adversarial examples " +\n "on {} of {} instances.".format(\n sum(upper_bound < 1e9), batch_size))\n o_bestdst = np.array(o_bestdst)\n mean = np.mean(np.sqrt(o_bestdst[o_bestdst < 1e9]))\n _logger.debug(self.crit_p +\n " Mean successful distortion: {:.4g}".format(mean))\n\n # return the best solution found\n o_bestdst = np.array(o_bestdst)\n return o_bestattack\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/fast_gradient_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.fast_feature_adversaries
\n"""\nThe FastFeatureAdversaries attack\n"""\n# pylint: disable=missing-docstring\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_sum\nfrom cleverhans.model import Model\nfrom cleverhans.utils_tf import clip_eta\n\n\n[docs]class FastFeatureAdversaries(Attack):\n """\n This is a fast implementation of "Feature Adversaries", an attack\n against a target internal representation of a model.\n "Feature adversaries" were originally introduced in (Sabour et al. 2016),\n where the optimization was done using LBFGS.\n Paper link: https://arxiv.org/abs/1511.05122\n\n This implementation is similar to "Basic Iterative Method"\n (Kurakin et al. 2016) but applied to the internal representations.\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a FastFeatureAdversaries instance.\n """\n super(FastFeatureAdversaries, self).__init__(model, sess, dtypestr,\n **kwargs)\n self.feedable_kwargs = ('eps', 'eps_iter', 'clip_min', 'clip_max')\n self.structural_kwargs = ['ord', 'nb_iter', 'layer']\n\n assert isinstance(self.model, Model)\n\n[docs] def parse_params(self,\n layer=None,\n eps=0.3,\n eps_iter=0.05,\n nb_iter=10,\n ord=np.inf,\n clip_min=None,\n clip_max=None,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param layer: (required str) name of the layer to target.\n :param eps: (optional float) maximum distortion of adversarial example\n compared to original input\n :param eps_iter: (optional float) step size for each attack iteration\n :param nb_iter: (optional int) Number of attack iterations.\n :param ord: (optional) Order of the norm (mimics Numpy).\n Possible values: np.inf, 1 or 2.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # Save attack-specific parameters\n self.layer = layer\n self.eps = eps\n self.eps_iter = eps_iter\n self.nb_iter = nb_iter\n self.ord = ord\n self.clip_min = clip_min\n self.clip_max = clip_max\n\n # Check if order of the norm is acceptable given current implementation\n if self.ord not in [np.inf, 1, 2]:\n raise ValueError("Norm order must be either np.inf, 1, or 2.")\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n[docs] def attack_single_step(self, x, eta, g_feat):\n """\n TensorFlow implementation of the Fast Feature Gradient. This is a\n single step attack similar to Fast Gradient Method that attacks an\n internal representation.\n\n :param x: the input placeholder\n :param eta: A tensor the same shape as x that holds the perturbation.\n :param g_feat: model's internal tensor for guide\n :return: a tensor for the adversarial example\n """\n\n adv_x = x + eta\n a_feat = self.model.fprop(adv_x)[self.layer]\n\n # feat.shape = (batch, c) or (batch, w, h, c)\n axis = list(range(1, len(a_feat.shape)))\n\n # Compute loss\n # This is a targeted attack, hence the negative sign\n loss = -reduce_sum(tf.square(a_feat - g_feat), axis)\n\n # Define gradient of loss wrt input\n grad, = tf.gradients(loss, adv_x)\n\n # Multiply by constant epsilon\n scaled_signed_grad = self.eps_iter * tf.sign(grad)\n\n # Add perturbation to original example to obtain adversarial example\n adv_x = adv_x + scaled_signed_grad\n\n # If clipping is needed,\n # reset all values outside of [clip_min, clip_max]\n if (self.clip_min is not None) and (self.clip_max is not None):\n adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n adv_x = tf.stop_gradient(adv_x)\n\n eta = adv_x - x\n eta = clip_eta(eta, self.ord, self.eps)\n\n return eta\n\n[docs] def generate(self, x, g, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param g: The target value of the symbolic representation\n :param kwargs: See `parse_params`\n """\n\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n g_feat = self.model.fprop(g)[self.layer]\n\n # Initialize loop variables\n eta = tf.random_uniform(\n tf.shape(x), -self.eps, self.eps, dtype=self.tf_dtype)\n eta = clip_eta(eta, self.ord, self.eps)\n\n def cond(i, _):\n return tf.less(i, self.nb_iter)\n\n def body(i, e):\n new_eta = self.attack_single_step(x, e, g_feat)\n return i + 1, new_eta\n\n _, eta = tf.while_loop(cond, body, (tf.zeros([]), eta), back_prop=True,\n maximum_iterations=self.nb_iter)\n\n # Define adversarial example (and clip if necessary)\n adv_x = x + eta\n if self.clip_min is not None and self.clip_max is not None:\n adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n return adv_x\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/hop_skip_jump_attack.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.fast_gradient_method
\n"""\nThe FastGradientMethod attack.\n"""\n\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_max, reduce_sum, softmax_cross_entropy_with_logits\nfrom cleverhans import utils_tf\n\n\n[docs]class FastGradientMethod(Attack):\n """\n This attack was originally implemented by Goodfellow et al. (2014) with the\n infinity norm (and is known as the "Fast Gradient Sign Method"). This\n implementation extends the attack to other norms, and is therefore called\n the Fast Gradient Method.\n Paper link: https://arxiv.org/abs/1412.6572\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a FastGradientMethod instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n\n super(FastGradientMethod, self).__init__(model, sess, dtypestr, **kwargs)\n self.feedable_kwargs = ('eps', 'y', 'y_target', 'clip_min', 'clip_max')\n self.structural_kwargs = ['ord', 'sanity_checks', 'clip_grad', 'loss_fn']\n\n[docs] def generate(self, x, **kwargs):\n """\n Returns the graph for Fast Gradient Method adversarial examples.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n labels, _nb_classes = self.get_or_guess_labels(x, kwargs)\n\n return fgm(\n x,\n self.model.get_logits(x),\n y=labels,\n eps=self.eps,\n ord=self.ord,\n loss_fn=self.loss_fn,\n clip_min=self.clip_min,\n clip_max=self.clip_max,\n clip_grad=self.clip_grad,\n targeted=(self.y_target is not None),\n sanity_checks=self.sanity_checks)\n\n[docs] def parse_params(self,\n eps=0.3,\n ord=np.inf,\n loss_fn=softmax_cross_entropy_with_logits,\n y=None,\n y_target=None,\n clip_min=None,\n clip_max=None,\n clip_grad=False,\n sanity_checks=True,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float) attack step size (input variation)\n :param ord: (optional) Order of the norm (mimics NumPy).\n Possible values: np.inf, 1 or 2.\n :param loss_fn: Loss function that takes (labels, logits) as arguments and returns loss\n :param y: (optional) A tensor with the true labels. Only provide\n this parameter if you'd like to use true labels when crafting\n adversarial samples. Otherwise, model predictions are used as\n labels to avoid the "label leaking" effect (explained in this\n paper: https://arxiv.org/abs/1611.01236). Default is None.\n Labels should be one-hot-encoded.\n :param y_target: (optional) A tensor with the labels to target. Leave\n y_target=None if y is also set. Labels should be\n one-hot-encoded.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n :param clip_grad: (optional bool) Ignore gradient components\n at positions where the input is already at the boundary\n of the domain, and the update step will get clipped out.\n :param sanity_checks: bool, if True, include asserts\n (Turn them off to use less runtime / memory or for unit tests that\n intentionally pass strange input)\n """\n # Save attack-specific parameters\n\n self.eps = eps\n self.ord = ord\n self.loss_fn = loss_fn\n self.y = y\n self.y_target = y_target\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.clip_grad = clip_grad\n self.sanity_checks = sanity_checks\n\n if self.y is not None and self.y_target is not None:\n raise ValueError("Must not set both y and y_target")\n # Check if order of the norm is acceptable given current implementation\n if self.ord not in [np.inf, int(1), int(2)]:\n raise ValueError("Norm order must be either np.inf, 1, or 2.")\n\n if self.clip_grad and (self.clip_min is None or self.clip_max is None):\n raise ValueError("Must set clip_min and clip_max if clip_grad is set")\n\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n\n[docs]def fgm(x,\n logits,\n y=None,\n eps=0.3,\n ord=np.inf,\n loss_fn=softmax_cross_entropy_with_logits,\n clip_min=None,\n clip_max=None,\n clip_grad=False,\n targeted=False,\n sanity_checks=True):\n """\n TensorFlow implementation of the Fast Gradient Method.\n :param x: the input placeholder\n :param logits: output of model.get_logits\n :param y: (optional) A placeholder for the true labels. If targeted\n is true, then provide the target label. Otherwise, only provide\n this parameter if you'd like to use true labels when crafting\n adversarial samples. Otherwise, model predictions are used as\n labels to avoid the "label leaking" effect (explained in this\n paper: https://arxiv.org/abs/1611.01236). Default is None.\n Labels should be one-hot-encoded.\n :param eps: the epsilon (input variation parameter)\n :param ord: (optional) Order of the norm (mimics NumPy).\n Possible values: np.inf, 1 or 2.\n :param loss_fn: Loss function that takes (labels, logits) as arguments and returns loss\n :param clip_min: Minimum float value for adversarial example components\n :param clip_max: Maximum float value for adversarial example components\n :param clip_grad: (optional bool) Ignore gradient components\n at positions where the input is already at the boundary\n of the domain, and the update step will get clipped out.\n :param targeted: Is the attack targeted or untargeted? Untargeted, the\n default, will try to make the label incorrect. Targeted\n will instead try to move in the direction of being more\n like y.\n :return: a tensor for the adversarial example\n """\n\n asserts = []\n\n # If a data range was specified, check that the input was in that range\n if clip_min is not None:\n asserts.append(utils_tf.assert_greater_equal(\n x, tf.cast(clip_min, x.dtype)))\n\n if clip_max is not None:\n asserts.append(utils_tf.assert_less_equal(x, tf.cast(clip_max, x.dtype)))\n\n # Make sure the caller has not passed probs by accident\n assert logits.op.type != 'Softmax'\n\n if y is None:\n # Using model predictions as ground truth to avoid label leaking\n preds_max = reduce_max(logits, 1, keepdims=True)\n y = tf.to_float(tf.equal(logits, preds_max))\n y = tf.stop_gradient(y)\n y = y / reduce_sum(y, 1, keepdims=True)\n\n # Compute loss\n loss = loss_fn(labels=y, logits=logits)\n if targeted:\n loss = -loss\n\n # Define gradient of loss wrt input\n grad, = tf.gradients(loss, x)\n\n if clip_grad:\n grad = utils_tf.zero_out_clipped_grads(grad, x, clip_min, clip_max)\n\n optimal_perturbation = optimize_linear(grad, eps, ord)\n\n # Add perturbation to original example to obtain adversarial example\n adv_x = x + optimal_perturbation\n\n # If clipping is needed, reset all values outside of [clip_min, clip_max]\n if (clip_min is not None) or (clip_max is not None):\n # We don't currently support one-sided clipping\n assert clip_min is not None and clip_max is not None\n adv_x = utils_tf.clip_by_value(adv_x, clip_min, clip_max)\n\n if sanity_checks:\n with tf.control_dependencies(asserts):\n adv_x = tf.identity(adv_x)\n\n return adv_x\n\n\n[docs]def optimize_linear(grad, eps, ord=np.inf):\n """\n Solves for the optimal input to a linear function under a norm constraint.\n\n Optimal_perturbation = argmax_{eta, ||eta||_{ord} < eps} dot(eta, grad)\n\n :param grad: tf tensor containing a batch of gradients\n :param eps: float scalar specifying size of constraint region\n :param ord: int specifying order of norm\n :returns:\n tf tensor containing optimal perturbation\n """\n\n # In Python 2, the `list` call in the following line is redundant / harmless.\n # In Python 3, the `list` call is needed to convert the iterator returned by `range` into a list.\n red_ind = list(range(1, len(grad.get_shape())))\n avoid_zero_div = 1e-12\n if ord == np.inf:\n # Take sign of gradient\n optimal_perturbation = tf.sign(grad)\n # The following line should not change the numerical results.\n # It applies only because `optimal_perturbation` is the output of\n # a `sign` op, which has zero derivative anyway.\n # It should not be applied for the other norms, where the\n # perturbation has a non-zero derivative.\n optimal_perturbation = tf.stop_gradient(optimal_perturbation)\n elif ord == 1:\n abs_grad = tf.abs(grad)\n sign = tf.sign(grad)\n max_abs_grad = tf.reduce_max(abs_grad, red_ind, keepdims=True)\n tied_for_max = tf.to_float(tf.equal(abs_grad, max_abs_grad))\n num_ties = tf.reduce_sum(tied_for_max, red_ind, keepdims=True)\n optimal_perturbation = sign * tied_for_max / num_ties\n elif ord == 2:\n square = tf.maximum(avoid_zero_div,\n reduce_sum(tf.square(grad),\n reduction_indices=red_ind,\n keepdims=True))\n optimal_perturbation = grad / tf.sqrt(square)\n else:\n raise NotImplementedError("Only L-inf, L1 and L2 norms are "\n "currently implemented.")\n\n # Scale perturbation to be the solution for the norm=eps rather than\n # norm=1 problem\n scaled_perturbation = utils_tf.mul(eps, optimal_perturbation)\n return scaled_perturbation\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/lbfgs.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.hop_skip_jump_attack
\n""" Boundary Attack++\n"""\nimport logging\nimport numpy as np\nimport tensorflow as tf\nfrom warnings import warn\nfrom cleverhans.attacks import Attack\nfrom cleverhans.model import CallableModelWrapper, Model, wrapper_warning_logits\nfrom cleverhans import utils, utils_tf\n\nnp_dtype = np.dtype('float32')\ntf_dtype = tf.as_dtype('float32')\n\n_logger = utils.create_logger("cleverhans.attacks.hop_skip_jump_attack")\n_logger.setLevel(logging.INFO)\n\n\n[docs]class HopSkipJumpAttack(Attack):\n """\n HopSkipJumpAttack was originally proposed by Chen, Jordan and Wainwright.\n It is a decision-based attack that requires access to output\n labels of a model alone.\n Paper link: https://arxiv.org/abs/1904.02144\n At a high level, this attack is an iterative attack composed of three\n steps: Binary search to approach the boundary; gradient estimation;\n stepsize search. HopSkipJumpAttack requires fewer model queries than\n Boundary Attack which was based on rejective sampling.\n :param model: cleverhans.model.Model\n :param sess: tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor.\n see parse_params for details.\n """\n\n def __init__(self, model, sess, dtypestr='float32', **kwargs):\n """\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n if not isinstance(model, Model):\n wrapper_warning_logits()\n model = CallableModelWrapper(model, 'logits')\n\n super(HopSkipJumpAttack, self).__init__(model, sess,\n dtypestr, **kwargs)\n\n self.feedable_kwargs = ('y_target', 'image_target')\n\n self.structural_kwargs = [\n 'stepsize_search',\n 'clip_min',\n 'clip_max',\n 'constraint',\n 'num_iterations',\n 'initial_num_evals',\n 'max_num_evals',\n 'batch_size',\n 'verbose',\n 'gamma',\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n :param x: A tensor with the inputs.\n :param kwargs: See `parse_params`\n """\n self.parse_params(**kwargs)\n shape = [int(i) for i in x.get_shape().as_list()[1:]]\n\n assert self.sess is not None, \\\n 'Cannot use `generate` when no `sess` was provided'\n _check_first_dimension(x, 'input')\n if self.y_target is not None:\n _check_first_dimension(self.y_target, 'y_target')\n assert self.image_target is not None, \\\n 'Require a target image for targeted attack.'\n _check_first_dimension(self.image_target, 'image_target')\n\n # Set shape and d.\n self.shape = shape\n self.d = int(np.prod(shape))\n\n # Set binary search threshold.\n if self.constraint == 'l2':\n self.theta = self.gamma / (np.sqrt(self.d) * self.d)\n else:\n self.theta = self.gamma / (self.d * self.d)\n\n # Construct input placeholder and output for decision function.\n self.input_ph = tf.placeholder(\n tf_dtype, [None] + list(self.shape), name='input_image')\n self.logits = self.model.get_logits(self.input_ph)\n\n def hsja_wrap(x, target_label, target_image):\n """ Wrapper to use tensors as input and output. """\n return np.array(self._hsja(x, target_label, target_image),\n dtype=self.np_dtype)\n\n if self.y_target is not None:\n # targeted attack that requires target label and image.\n wrap = tf.py_func(hsja_wrap,\n [x[0], self.y_target[0], self.image_target[0]],\n self.tf_dtype)\n else:\n if self.image_target is not None:\n # untargeted attack with an initialized image.\n wrap = tf.py_func(lambda x, target_image: hsja_wrap(x,\n None, target_image),\n [x[0], self.image_target[0]],\n self.tf_dtype)\n else:\n # untargeted attack without an initialized image.\n wrap = tf.py_func(lambda x: hsja_wrap(x, None, None),\n [x[0]],\n self.tf_dtype)\n\n wrap.set_shape(x.get_shape())\n\n return wrap\n\n[docs] def generate_np(self, x, **kwargs):\n """\n Generate adversarial images in a for loop.\n :param y: An array of shape (n, nb_classes) for true labels.\n :param y_target: An array of shape (n, nb_classes) for target labels.\n Required for targeted attack.\n :param image_target: An array of shape (n, **image shape) for initial\n target images. Required for targeted attack.\n\n See parse_params for other kwargs.\n\n """\n\n x_adv = []\n\n if 'image_target' in kwargs and kwargs['image_target'] is not None:\n image_target = np.copy(kwargs['image_target'])\n else:\n image_target = None\n if 'y_target' in kwargs and kwargs['y_target'] is not None:\n y_target = np.copy(kwargs['y_target'])\n else:\n y_target = None\n\n for i, x_single in enumerate(x):\n img = np.expand_dims(x_single, axis=0)\n if image_target is not None:\n single_img_target = np.expand_dims(image_target[i], axis=0)\n kwargs['image_target'] = single_img_target\n if y_target is not None:\n single_y_target = np.expand_dims(y_target[i], axis=0)\n kwargs['y_target'] = single_y_target\n\n adv_img = super(HopSkipJumpAttack,\n self).generate_np(img, **kwargs)\n x_adv.append(adv_img)\n\n return np.concatenate(x_adv, axis=0)\n\n[docs] def parse_params(self,\n y_target=None,\n image_target=None,\n initial_num_evals=100,\n max_num_evals=10000,\n stepsize_search='geometric_progression',\n num_iterations=64,\n gamma=1.0,\n constraint='l2',\n batch_size=128,\n verbose=True,\n clip_min=0,\n clip_max=1):\n """\n :param y: A tensor of shape (1, nb_classes) for true labels.\n :param y_target: A tensor of shape (1, nb_classes) for target labels.\n Required for targeted attack.\n :param image_target: A tensor of shape (1, **image shape) for initial\n target images. Required for targeted attack.\n :param initial_num_evals: initial number of evaluations for\n gradient estimation.\n :param max_num_evals: maximum number of evaluations for gradient estimation.\n :param stepsize_search: How to search for stepsize; choices are\n 'geometric_progression', 'grid_search'.\n 'geometric progression' initializes the stepsize\n by ||x_t - x||_p / sqrt(iteration), and keep\n decreasing by half until reaching the target\n side of the boundary. 'grid_search' chooses the\n optimal epsilon over a grid, in the scale of\n ||x_t - x||_p.\n :param num_iterations: The number of iterations.\n :param gamma: The binary search threshold theta is gamma / d^{3/2} for\n l2 attack and gamma / d^2 for linf attack.\n :param constraint: The distance to optimize; choices are 'l2', 'linf'.\n :param batch_size: batch_size for model prediction.\n :param verbose: (boolean) Whether distance at each step is printed.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # ignore the y and y_target argument\n self.y_target = y_target\n self.image_target = image_target\n self.initial_num_evals = initial_num_evals\n self.max_num_evals = max_num_evals\n self.stepsize_search = stepsize_search\n self.num_iterations = num_iterations\n self.gamma = gamma\n self.constraint = constraint\n self.batch_size = batch_size\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.verbose = verbose\n\n def _hsja(self, sample, target_label, target_image):\n """\n Main algorithm for HopSkipJumpAttack.\n\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n\n :param sample: input image. Without the batchsize dimension.\n :param target_label: integer for targeted attack,\n None for nontargeted attack. Without the batchsize dimension.\n :param target_image: an array with the same size as sample, or None.\n Without the batchsize dimension.\n\n\n Output:\n perturbed image.\n\n """\n\n # Original label required for untargeted attack.\n if target_label is None:\n original_label = np.argmax(\n self.sess.run(self.logits, feed_dict={self.input_ph: sample[None]})\n )\n else:\n target_label = np.argmax(target_label)\n\n def decision_function(images):\n """\n Decision function output 1 on the desired side of the boundary,\n 0 otherwise.\n """\n images = clip_image(images, self.clip_min, self.clip_max)\n prob = []\n for i in range(0, len(images), self.batch_size):\n batch = images[i:i+self.batch_size]\n prob_i = self.sess.run(self.logits, feed_dict={self.input_ph: batch})\n prob.append(prob_i)\n prob = np.concatenate(prob, axis=0)\n if target_label is None:\n return np.argmax(prob, axis=1) != original_label\n else:\n return np.argmax(prob, axis=1) == target_label\n\n # Initialize.\n if target_image is None:\n perturbed = initialize(decision_function, sample, self.shape,\n self.clip_min, self.clip_max)\n else:\n perturbed = target_image\n\n # Project the initialization to the boundary.\n perturbed, dist_post_update = binary_search_batch(sample,\n np.expand_dims(perturbed, 0),\n decision_function,\n self.shape,\n self.constraint,\n self.theta)\n\n dist = compute_distance(perturbed, sample, self.constraint)\n\n for j in np.arange(self.num_iterations):\n current_iteration = j + 1\n\n # Choose delta.\n delta = select_delta(dist_post_update, current_iteration,\n self.clip_max, self.clip_min, self.d,\n self.theta, self.constraint)\n\n # Choose number of evaluations.\n num_evals = int(min([self.initial_num_evals * np.sqrt(j+1),\n self.max_num_evals]))\n\n # approximate gradient.\n gradf = approximate_gradient(decision_function, perturbed, num_evals,\n delta, self.constraint, self.shape,\n self.clip_min, self.clip_max)\n if self.constraint == 'linf':\n update = np.sign(gradf)\n else:\n update = gradf\n\n # search step size.\n if self.stepsize_search == 'geometric_progression':\n # find step size.\n epsilon = geometric_progression_for_stepsize(perturbed,\n update, dist, decision_function, current_iteration)\n\n # Update the sample.\n perturbed = clip_image(perturbed + epsilon * update,\n self.clip_min, self.clip_max)\n\n # Binary search to return to the boundary.\n perturbed, dist_post_update = binary_search_batch(sample,\n perturbed[None],\n decision_function,\n self.shape,\n self.constraint,\n self.theta)\n\n elif self.stepsize_search == 'grid_search':\n # Grid search for stepsize.\n epsilons = np.logspace(-4, 0, num=20, endpoint=True) * dist\n epsilons_shape = [20] + len(self.shape) * [1]\n perturbeds = perturbed + epsilons.reshape(epsilons_shape) * update\n perturbeds = clip_image(perturbeds, self.clip_min, self.clip_max)\n idx_perturbed = decision_function(perturbeds)\n\n if np.sum(idx_perturbed) > 0:\n # Select the perturbation that yields the minimum distance # after binary search.\n perturbed, dist_post_update = binary_search_batch(sample,\n perturbeds[idx_perturbed],\n decision_function,\n self.shape,\n self.constraint,\n self.theta)\n\n # compute new distance.\n dist = compute_distance(perturbed, sample, self.constraint)\n if self.verbose:\n print('iteration: {:d}, {:s} distance {:.4E}'.format(\n j+1, self.constraint, dist))\n\n perturbed = np.expand_dims(perturbed, 0)\n return perturbed\n\n\n[docs]def BoundaryAttackPlusPlus(model, sess, dtypestr='float32', **kwargs):\n """\n A previous name used for HopSkipJumpAttack.\n """\n warn("BoundaryAttackPlusPlus will be removed after 2019-12-08; use HopSkipJumpAttack.")\n return HopSkipJumpAttack(model, sess, dtypestr, **kwargs)\n\ndef _check_first_dimension(x, tensor_name):\n message = "Tensor {} should have batch_size of 1.".format(tensor_name)\n if x.get_shape().as_list()[0] is None:\n check_batch = utils_tf.assert_equal(tf.shape(x)[0], 1, message=message)\n with tf.control_dependencies([check_batch]):\n x = tf.identity(x)\n elif x.get_shape().as_list()[0] != 1:\n raise ValueError(message)\n\n\ndef clip_image(image, clip_min, clip_max):\n """ Clip an image, or an image batch, with upper and lower threshold. """\n return np.minimum(np.maximum(clip_min, image), clip_max)\n\n\ndef compute_distance(x_ori, x_pert, constraint='l2'):\n """ Compute the distance between two images. """\n if constraint == 'l2':\n dist = np.linalg.norm(x_ori - x_pert)\n elif constraint == 'linf':\n dist = np.max(abs(x_ori - x_pert))\n return dist\n\ndef approximate_gradient(decision_function, sample, num_evals,\n delta, constraint, shape, clip_min, clip_max):\n """ Gradient direction estimation """\n # Generate random vectors.\n noise_shape = [num_evals] + list(shape)\n if constraint == 'l2':\n rv = np.random.randn(*noise_shape)\n elif constraint == 'linf':\n rv = np.random.uniform(low=-1, high=1, size=noise_shape)\n\n axis = tuple(range(1, 1 + len(shape)))\n rv = rv / np.sqrt(np.sum(rv ** 2, axis=axis, keepdims=True))\n perturbed = sample + delta * rv\n perturbed = clip_image(perturbed, clip_min, clip_max)\n rv = (perturbed - sample) / delta\n\n # query the model.\n decisions = decision_function(perturbed)\n decision_shape = [len(decisions)] + [1] * len(shape)\n fval = 2 * decisions.astype(np_dtype).reshape(decision_shape) - 1.0\n\n # Baseline subtraction (when fval differs)\n if np.mean(fval) == 1.0: # label changes.\n gradf = np.mean(rv, axis=0)\n elif np.mean(fval) == -1.0: # label not change.\n gradf = - np.mean(rv, axis=0)\n else:\n fval = fval - np.mean(fval)\n gradf = np.mean(fval * rv, axis=0)\n\n # Get the gradient direction.\n gradf = gradf / np.linalg.norm(gradf)\n\n return gradf\n\n\ndef project(original_image, perturbed_images, alphas, shape, constraint):\n """ Projection onto given l2 / linf balls in a batch. """\n alphas_shape = [len(alphas)] + [1] * len(shape)\n alphas = alphas.reshape(alphas_shape)\n if constraint == 'l2':\n projected = (1-alphas) * original_image + alphas * perturbed_images\n elif constraint == 'linf':\n projected = clip_image(\n perturbed_images,\n original_image - alphas,\n original_image + alphas\n )\n return projected\n\n\ndef binary_search_batch(original_image, perturbed_images, decision_function,\n shape, constraint, theta):\n """ Binary search to approach the boundary. """\n\n # Compute distance between each of perturbed image and original image.\n dists_post_update = np.array([\n compute_distance(\n original_image,\n perturbed_image,\n constraint\n )\n for perturbed_image in perturbed_images])\n\n # Choose upper thresholds in binary searchs based on constraint.\n if constraint == 'linf':\n highs = dists_post_update\n # Stopping criteria.\n thresholds = np.minimum(dists_post_update * theta, theta)\n else:\n highs = np.ones(len(perturbed_images))\n thresholds = theta\n\n lows = np.zeros(len(perturbed_images))\n\n while np.max((highs - lows) / thresholds) > 1:\n # projection to mids.\n mids = (highs + lows) / 2.0\n mid_images = project(original_image, perturbed_images,\n mids, shape, constraint)\n\n # Update highs and lows based on model decisions.\n decisions = decision_function(mid_images)\n lows = np.where(decisions == 0, mids, lows)\n highs = np.where(decisions == 1, mids, highs)\n\n out_images = project(original_image, perturbed_images,\n highs, shape, constraint)\n\n # Compute distance of the output image to select the best choice.\n # (only used when stepsize_search is grid_search.)\n dists = np.array([\n compute_distance(\n original_image,\n out_image,\n constraint\n )\n for out_image in out_images])\n idx = np.argmin(dists)\n\n dist = dists_post_update[idx]\n out_image = out_images[idx]\n return out_image, dist\n\n\ndef initialize(decision_function, sample, shape, clip_min, clip_max):\n """\n Efficient Implementation of BlendedUniformNoiseAttack in Foolbox.\n """\n success = 0\n num_evals = 0\n\n # Find a misclassified random noise.\n while True:\n random_noise = np.random.uniform(clip_min, clip_max, size=shape)\n success = decision_function(random_noise[None])[0]\n if success:\n break\n num_evals += 1\n message = "Initialization failed! Try to use a misclassified image as `target_image`"\n assert num_evals < 1e4, message\n\n # Binary search to minimize l2 distance to original image.\n low = 0.0\n high = 1.0\n while high - low > 0.001:\n mid = (high + low) / 2.0\n blended = (1 - mid) * sample + mid * random_noise\n success = decision_function(blended[None])[0]\n if success:\n high = mid\n else:\n low = mid\n\n initialization = (1 - high) * sample + high * random_noise\n return initialization\n\n\ndef geometric_progression_for_stepsize(x, update, dist, decision_function,\n current_iteration):\n """ Geometric progression to search for stepsize.\n Keep decreasing stepsize by half until reaching\n the desired side of the boundary.\n """\n epsilon = dist / np.sqrt(current_iteration)\n while True:\n updated = x + epsilon * update\n success = decision_function(updated[None])[0]\n if success:\n break\n else:\n epsilon = epsilon / 2.0\n\n return epsilon\n\n\ndef select_delta(dist_post_update, current_iteration,\n clip_max, clip_min, d, theta, constraint):\n """\n Choose the delta at the scale of distance\n between x and perturbed sample.\n """\n if current_iteration == 1:\n delta = 0.1 * (clip_max - clip_min)\n else:\n if constraint == 'l2':\n delta = np.sqrt(d) * theta * dist_post_update\n elif constraint == 'linf':\n delta = d * theta * dist_post_update\n\n return delta\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/madry_et_al.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.lbfgs
\n"""The LBFGS attack\n"""\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_sum, softmax_cross_entropy_with_logits\nfrom cleverhans.model import CallableModelWrapper, Model, wrapper_warning\nfrom cleverhans import utils\nfrom cleverhans import utils_tf\n\n_logger = utils.create_logger("cleverhans.attacks.lbfgs")\ntf_dtype = tf.as_dtype('float32')\n\n\n[docs]class LBFGS(Attack):\n """\n LBFGS is the first adversarial attack for convolutional neural networks,\n and is a target & iterative attack.\n Paper link: "https://arxiv.org/pdf/1312.6199.pdf"\n :param model: cleverhans.model.Model\n :param sess: tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess, dtypestr='float32', **kwargs):\n if not isinstance(model, Model):\n wrapper_warning()\n model = CallableModelWrapper(model, 'probs')\n\n super(LBFGS, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.feedable_kwargs = ('y_target',)\n self.structural_kwargs = [\n 'batch_size', 'binary_search_steps', 'max_iterations',\n 'initial_const', 'clip_min', 'clip_max'\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n :param x: (required) A tensor with the inputs.\n :param kwargs: See `parse_params`\n """\n assert self.sess is not None, \\\n 'Cannot use `generate` when no `sess` was provided'\n self.parse_params(**kwargs)\n\n if self.y_target is None:\n self.y_target, nb_classes = self.get_or_guess_labels(x, kwargs)\n self.targeted_attack = False\n else:\n _, nb_classes = self.get_or_guess_labels(x, kwargs)\n self.targeted_attack = True\n\n attack = LBFGS_impl(\n self.sess, x, self.model.get_logits(x),\n self.y_target, self.targeted_attack,\n self.binary_search_steps, self.max_iterations, self.initial_const,\n self.clip_min, self.clip_max, nb_classes, self.batch_size)\n\n def lbfgs_wrap(x_val, y_val):\n """\n Wrapper creating TensorFlow interface for use with py_func\n """\n return np.array(attack.attack(x_val, y_val), dtype=self.np_dtype)\n\n wrap = tf.py_func(lbfgs_wrap, [x, self.y_target], self.tf_dtype)\n wrap.set_shape(x.get_shape())\n\n return wrap\n\n[docs] def parse_params(self,\n y_target=None,\n batch_size=1,\n binary_search_steps=5,\n max_iterations=1000,\n initial_const=1e-2,\n clip_min=0,\n clip_max=1):\n """\n :param y_target: (optional) A tensor with the one-hot target labels.\n :param batch_size: The number of inputs to include in a batch and\n process simultaneously.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the purturbation\n and cross-entropy loss of classification.\n :param max_iterations: The maximum number of iterations.\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the perturbation\n and cross-entropy loss of the classification.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n self.y_target = y_target\n self.batch_size = batch_size\n self.binary_search_steps = binary_search_steps\n self.max_iterations = max_iterations\n self.initial_const = initial_const\n self.clip_min = clip_min\n self.clip_max = clip_max\n\n\nclass LBFGS_impl(object):\n """\n Return a tensor that constructs adversarial examples for the given\n input. Generate uses tf.py_func in order to operate over tensors.\n :param sess: a TF session.\n :param x: A tensor with the inputs.\n :param logits: A tensor with model's output logits.\n :param targeted_label: A tensor with the target labels.\n :param binary_search_steps: The number of times we perform binary\n search to find the optimal tradeoff-\n constant between norm of the purturbation\n and cross-entropy loss of classification.\n :param max_iterations: The maximum number of iterations.\n :param initial_const: The initial tradeoff-constant to use to tune the\n relative importance of size of the purturbation\n and cross-entropy loss of the classification.\n :param clip_min: Minimum input component value\n :param clip_max: Maximum input component value\n :param num_labels: The number of classes in the model's output.\n :param batch_size: Number of attacks to run simultaneously.\n """\n\n def __init__(self, sess, x, logits, targeted_label, targeted_attack,\n binary_search_steps, max_iterations, initial_const, clip_min,\n clip_max, nb_classes, batch_size):\n self.sess = sess\n self.x = x\n self.logits = logits\n assert logits.op.type != 'Softmax'\n self.targeted_label = targeted_label\n self.targeted_attack = targeted_attack\n self.binary_search_steps = binary_search_steps\n self.max_iterations = max_iterations\n self.initial_const = initial_const\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.batch_size = batch_size\n\n self.repeat = self.binary_search_steps >= 10\n self.shape = tuple([self.batch_size] +\n list(self.x.get_shape().as_list()[1:]))\n self.ori_img = tf.Variable(\n np.zeros(self.shape), dtype=tf_dtype, name='ori_img')\n self.const = tf.Variable(\n np.zeros(self.batch_size), dtype=tf_dtype, name='const')\n\n self.score = softmax_cross_entropy_with_logits(\n labels=self.targeted_label, logits=self.logits)\n self.l2dist = reduce_sum(tf.square(self.x - self.ori_img))\n # small self.const will result small adversarial perturbation\n # targeted attack aims at minimize loss against target label\n # untargeted attack aims at maximize loss against True label\n if self.targeted_attack:\n self.loss = reduce_sum(self.score * self.const) + self.l2dist\n else:\n self.loss = -reduce_sum(self.score * self.const) + self.l2dist\n self.grad, = tf.gradients(self.loss, self.x)\n\n def attack(self, x_val, targets):\n """\n Perform the attack on the given instance for the given targets.\n """\n\n def lbfgs_objective(adv_x, self, targets, oimgs, CONST):\n """ returns the function value and the gradient for fmin_l_bfgs_b """\n loss = self.sess.run(\n self.loss,\n feed_dict={\n self.x: adv_x.reshape(oimgs.shape),\n self.targeted_label: targets,\n self.ori_img: oimgs,\n self.const: CONST\n })\n grad = self.sess.run(\n self.grad,\n feed_dict={\n self.x: adv_x.reshape(oimgs.shape),\n self.targeted_label: targets,\n self.ori_img: oimgs,\n self.const: CONST\n })\n return loss, grad.flatten().astype(float)\n\n def attack_success(out, target, targeted_attack):\n """ returns attack result """\n if targeted_attack:\n return out == target\n else:\n return out != target\n\n # begin the main part for the attack\n from scipy.optimize import fmin_l_bfgs_b\n oimgs = np.clip(x_val, self.clip_min, self.clip_max)\n CONST = np.ones(self.batch_size) * self.initial_const\n\n # set the lower and upper bounds accordingly\n lower_bound = np.zeros(self.batch_size)\n upper_bound = np.ones(self.batch_size) * 1e10\n\n # set the box constraints for the optimization function\n clip_min = self.clip_min * np.ones(oimgs.shape[:])\n clip_max = self.clip_max * np.ones(oimgs.shape[:])\n clip_bound = list(zip(clip_min.flatten(), clip_max.flatten()))\n\n # placeholders for the best l2 and instance attack found so far\n o_bestl2 = [1e10] * self.batch_size\n o_bestattack = np.copy(oimgs)\n\n for outer_step in range(self.binary_search_steps):\n _logger.debug(" Binary search step %s of %s",\n outer_step, self.binary_search_steps)\n\n # The last iteration (if we run many steps) repeat the search once.\n if self.repeat and outer_step == self.binary_search_steps - 1:\n CONST = upper_bound\n\n # optimization function\n adv_x, _, __ = fmin_l_bfgs_b(\n lbfgs_objective,\n oimgs.flatten().astype(float),\n args=(self, targets, oimgs, CONST),\n bounds=clip_bound,\n maxiter=self.max_iterations,\n iprint=0)\n\n adv_x = adv_x.reshape(oimgs.shape)\n assert np.amax(adv_x) <= self.clip_max and \\\n np.amin(adv_x) >= self.clip_min, \\\n 'fmin_l_bfgs_b returns are invalid'\n\n # adjust the best result (i.e., the adversarial example with the\n # smallest perturbation in terms of L_2 norm) found so far\n preds = np.atleast_1d(\n utils_tf.model_argmax(self.sess, self.x, self.logits,\n adv_x))\n _logger.debug("predicted labels are %s", preds)\n\n l2s = np.zeros(self.batch_size)\n for i in range(self.batch_size):\n l2s[i] = np.sum(np.square(adv_x[i] - oimgs[i]))\n\n for e, (l2, pred, ii) in enumerate(zip(l2s, preds, adv_x)):\n if l2 < o_bestl2[e] and attack_success(pred, np.argmax(targets[e]),\n self.targeted_attack):\n o_bestl2[e] = l2\n o_bestattack[e] = ii\n\n # adjust the constant as needed\n for e in range(self.batch_size):\n if attack_success(preds[e], np.argmax(targets[e]),\n self.targeted_attack):\n # success, divide const by two\n upper_bound[e] = min(upper_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n # failure, either multiply by 10 if no solution found yet\n # or do binary search with the known upper bound\n lower_bound[e] = max(lower_bound[e], CONST[e])\n if upper_bound[e] < 1e9:\n CONST[e] = (lower_bound[e] + upper_bound[e]) / 2\n else:\n CONST[e] *= 10\n\n _logger.debug(" Successfully generated adversarial examples "\n "on %s of %s instances.",\n sum(upper_bound < 1e9), self.batch_size)\n o_bestl2 = np.array(o_bestl2)\n mean = np.mean(np.sqrt(o_bestl2[o_bestl2 < 1e9]))\n _logger.debug(" Mean successful distortion: {:.4g}".format(mean))\n\n # return the best solution found\n o_bestl2 = np.array(o_bestl2)\n return o_bestattack\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/max_confidence.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.madry_et_al
\n"""\nThe MadryEtAl attack\n"""\n\nfrom cleverhans.attacks.projected_gradient_descent import ProjectedGradientDescent\n\n\n[docs]class MadryEtAl(ProjectedGradientDescent):\n """\n The attack from Madry et al 2017\n """\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n super(MadryEtAl, self).__init__(model, sess=sess,\n dtypestr=dtypestr,\n default_rand_init=True,\n **kwargs)\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/momentum_iterative_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.max_confidence
\n"""The MaxConfidence attack.\n"""\nimport warnings\n\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.attacks.projected_gradient_descent import ProjectedGradientDescent\nfrom cleverhans.model import Model\n\n\n[docs]class MaxConfidence(Attack):\n """\n The MaxConfidence attack.\n\n An attack designed for use against models that use confidence thresholding\n as a defense.\n If the underlying optimizer is optimal, this attack procedure gives the\n optimal failure rate for every confidence threshold t > 0.5.\n\n Publication: https://openreview.net/forum?id=H1g0piA9tQ\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.session.Session\n :param base_attacker: cleverhans.attacks.Attack\n """\n\n def __init__(self, model, sess=None, base_attacker=None):\n if not isinstance(model, Model):\n raise TypeError("Model must be cleverhans.model.Model, got " +\n str(type(model)))\n\n super(MaxConfidence, self).__init__(model, sess)\n if base_attacker is None:\n self.base_attacker = ProjectedGradientDescent(model, sess=sess)\n else:\n self.base_attacker = base_attacker\n self.structural_kwargs = self.base_attacker.structural_kwargs\n self.feedable_kwargs = self.base_attacker.feedable_kwargs\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: Keyword arguments for the base attacker\n """\n\n assert self.parse_params(**kwargs)\n labels, _nb_classes = self.get_or_guess_labels(x, kwargs)\n adv_x = self.attack(x, labels)\n\n return adv_x\n\n[docs] def parse_params(self, y=None, nb_classes=10, **kwargs):\n self.y = y\n self.nb_classes = nb_classes\n self.params = kwargs\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n return True\n\n[docs] def attack(self, x, true_y):\n """\n Runs the untargeted attack.\n :param x: The input\n :param true_y: The correct label for `x`. This attack aims to produce misclassification.\n """\n adv_x_cls = []\n prob_cls = []\n m = tf.shape(x)[0]\n true_y_idx = tf.argmax(true_y, axis=1)\n\n expanded_x = tf.concat([x] * self.nb_classes, axis=0)\n target_ys = [tf.to_float(tf.one_hot(tf.ones(m, dtype=tf.int32) * cls,\n self.nb_classes))\n for cls in range(self.nb_classes)]\n target_y = tf.concat(target_ys, axis=0)\n adv_x_cls = self.attack_class(expanded_x, target_y)\n expanded_all_probs = self.model.get_probs(adv_x_cls)\n\n adv_x_list = tf.split(adv_x_cls, self.nb_classes)\n all_probs_list = tf.split(expanded_all_probs, self.nb_classes)\n\n for cls in range(self.nb_classes):\n target_y = target_ys[cls]\n all_probs = all_probs_list[cls]\n # We don't actually care whether we hit the target class.\n # We care about the probability of the most likely wrong class\n cur_prob_cls = tf.reduce_max(all_probs - true_y, axis=1)\n # Knock out examples that are correctly classified.\n # This is not needed to be optimal for t >= 0.5, but may as well do it\n # to get better failure rate at lower thresholds.\n chosen_cls = tf.argmax(all_probs, axis=1)\n eligible = tf.to_float(tf.not_equal(true_y_idx, chosen_cls))\n cur_prob_cls = cur_prob_cls * eligible\n prob_cls.append(cur_prob_cls)\n\n probs = tf.concat([tf.expand_dims(e, 1) for e in prob_cls], axis=1)\n # Don't need to censor here because we knocked out the true class above\n # probs = probs - true_y\n most_confident = tf.argmax(probs, axis=1)\n fused_mask = tf.one_hot(most_confident, self.nb_classes)\n masks = tf.split(fused_mask, num_or_size_splits=self.nb_classes, axis=1)\n shape = [m] + [1] * (len(x.get_shape()) - 1)\n reshaped_masks = [tf.reshape(mask, shape) for mask in masks]\n out = sum(adv_x * rmask for adv_x,\n rmask in zip(adv_x_list, reshaped_masks))\n return out\n\n[docs] def attack_class(self, x, target_y):\n """\n Run the attack on a specific target class.\n :param x: tf Tensor. The input example.\n :param target_y: tf Tensor. The attacker's desired target class.\n Returns:\n A targeted adversarial example, intended to be classified as the target class.\n """\n adv = self.base_attacker.generate(x, y_target=target_y, **self.params)\n return adv\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/noise.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.momentum_iterative_method
\n"""The MomentumIterativeMethod attack.\n"""\n\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.attacks.fast_gradient_method import optimize_linear\nfrom cleverhans.compat import reduce_sum, reduce_mean, softmax_cross_entropy_with_logits\nfrom cleverhans import utils_tf\n\n\n[docs]class MomentumIterativeMethod(Attack):\n """\n The Momentum Iterative Method (Dong et al. 2017). This method won\n the first places in NIPS 2017 Non-targeted Adversarial Attacks and\n Targeted Adversarial Attacks. The original paper used hard labels\n for this attack; no label smoothing.\n Paper link: https://arxiv.org/pdf/1710.06081.pdf\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a MomentumIterativeMethod instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n\n super(MomentumIterativeMethod, self).__init__(model, sess, dtypestr,\n **kwargs)\n self.feedable_kwargs = ('eps', 'eps_iter', 'y', 'y_target', 'clip_min',\n 'clip_max')\n self.structural_kwargs = [\n 'ord', 'nb_iter', 'decay_factor', 'sanity_checks', 'clip_grad']\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: Keyword arguments. See `parse_params` for documentation.\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n asserts = []\n\n # If a data range was specified, check that the input was in that range\n if self.clip_min is not None:\n asserts.append(utils_tf.assert_greater_equal(x,\n tf.cast(self.clip_min,\n x.dtype)))\n\n if self.clip_max is not None:\n asserts.append(utils_tf.assert_less_equal(x,\n tf.cast(self.clip_max,\n x.dtype)))\n\n # Initialize loop variables\n momentum = tf.zeros_like(x)\n adv_x = x\n\n # Fix labels to the first model predictions for loss computation\n y, _nb_classes = self.get_or_guess_labels(x, kwargs)\n y = y / reduce_sum(y, 1, keepdims=True)\n targeted = (self.y_target is not None)\n\n def cond(i, _, __):\n """Iterate until number of iterations completed"""\n return tf.less(i, self.nb_iter)\n\n def body(i, ax, m):\n """Do a momentum step"""\n logits = self.model.get_logits(ax)\n loss = softmax_cross_entropy_with_logits(labels=y, logits=logits)\n if targeted:\n loss = -loss\n\n # Define gradient of loss wrt input\n grad, = tf.gradients(loss, ax)\n\n # Normalize current gradient and add it to the accumulated gradient\n red_ind = list(range(1, len(grad.get_shape())))\n avoid_zero_div = tf.cast(1e-12, grad.dtype)\n grad = grad / tf.maximum(\n avoid_zero_div,\n reduce_mean(tf.abs(grad), red_ind, keepdims=True))\n m = self.decay_factor * m + grad\n\n optimal_perturbation = optimize_linear(m, self.eps_iter, self.ord)\n if self.ord == 1:\n raise NotImplementedError("This attack hasn't been tested for ord=1."\n "It's not clear that FGM makes a good inner "\n "loop step for iterative optimization since "\n "it updates just one coordinate at a time.")\n\n # Update and clip adversarial example in current iteration\n ax = ax + optimal_perturbation\n ax = x + utils_tf.clip_eta(ax - x, self.ord, self.eps)\n\n if self.clip_min is not None and self.clip_max is not None:\n ax = utils_tf.clip_by_value(ax, self.clip_min, self.clip_max)\n\n ax = tf.stop_gradient(ax)\n\n return i + 1, ax, m\n\n _, adv_x, _ = tf.while_loop(\n cond, body, (tf.zeros([]), adv_x, momentum), back_prop=True,\n maximum_iterations=self.nb_iter)\n\n if self.sanity_checks:\n with tf.control_dependencies(asserts):\n adv_x = tf.identity(adv_x)\n\n return adv_x\n\n[docs] def parse_params(self,\n eps=0.3,\n eps_iter=0.06,\n nb_iter=10,\n y=None,\n ord=np.inf,\n decay_factor=1.0,\n clip_min=None,\n clip_max=None,\n y_target=None,\n sanity_checks=True,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float) maximum distortion of adversarial example\n compared to original input\n :param eps_iter: (optional float) step size for each attack iteration\n :param nb_iter: (optional int) Number of attack iterations.\n :param y: (optional) A tensor with the true labels.\n :param y_target: (optional) A tensor with the labels to target. Leave\n y_target=None if y is also set. Labels should be\n one-hot-encoded.\n :param ord: (optional) Order of the norm (mimics Numpy).\n Possible values: np.inf, 1 or 2.\n :param decay_factor: (optional) Decay factor for the momentum term.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # Save attack-specific parameters\n self.eps = eps\n self.eps_iter = eps_iter\n self.nb_iter = nb_iter\n self.y = y\n self.y_target = y_target\n self.ord = ord\n self.decay_factor = decay_factor\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.sanity_checks = sanity_checks\n\n if self.y is not None and self.y_target is not None:\n raise ValueError("Must not set both y and y_target")\n # Check if order of the norm is acceptable given current implementation\n if self.ord not in [np.inf, 1, 2]:\n raise ValueError("Norm order must be either np.inf, 1, or 2.")\n\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/projected_gradient_descent.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.noise
\n"""The Noise attack\n\n"""\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\n\n\n[docs]class Noise(Attack):\n """\n A weak attack that just picks a random point in the attacker's action space.\n When combined with an attack bundling function, this can be used to implement\n random search.\n\n References:\n https://arxiv.org/abs/1802.00420 recommends random search to help identify\n gradient masking.\n https://openreview.net/forum?id=H1g0piA9tQ recommends using noise as part\n of an attack bundling recipe combining many different optimizers to yield\n a stronger optimizer.\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32',\n **kwargs):\n\n super(Noise, self).__init__(model, sess=sess, dtypestr=dtypestr, **kwargs)\n self.feedable_kwargs = ('eps', 'clip_min', 'clip_max')\n self.structural_kwargs = ['ord']\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n if self.ord != np.inf:\n raise NotImplementedError(self.ord)\n eta = tf.random_uniform(tf.shape(x), -self.eps, self.eps,\n dtype=self.tf_dtype)\n adv_x = x + eta\n if self.clip_min is not None or self.clip_max is not None:\n assert self.clip_min is not None and self.clip_max is not None\n adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n return adv_x\n\n[docs] def parse_params(self,\n eps=0.3,\n ord=np.inf,\n clip_min=None,\n clip_max=None,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float) maximum distortion of adversarial example\n compared to original input\n :param ord: (optional) Order of the norm (mimics Numpy).\n Possible values: np.inf\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n """\n\n # Save attack-specific parameters\n self.eps = eps\n self.ord = ord\n self.clip_min = clip_min\n self.clip_max = clip_max\n\n # Check if order of the norm is acceptable given current implementation\n if self.ord not in [np.inf]:\n raise ValueError("Norm order must be np.inf")\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/saliency_map_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.projected_gradient_descent
\n"""\nThe ProjectedGradientDescent attack.\n"""\n\nimport warnings\n\nimport numpy as np\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.attacks.fast_gradient_method import FastGradientMethod\nfrom cleverhans import utils_tf\nfrom cleverhans.compat import softmax_cross_entropy_with_logits\nfrom cleverhans.utils_tf import clip_eta, random_lp_vector\n\n\n[docs]class ProjectedGradientDescent(Attack):\n """\n This class implements either the Basic Iterative Method\n (Kurakin et al. 2016) when rand_init is set to 0. or the\n Madry et al. (2017) method when rand_minmax is larger than 0.\n Paper link (Kurakin et al. 2016): https://arxiv.org/pdf/1607.02533.pdf\n Paper link (Madry et al. 2017): https://arxiv.org/pdf/1706.06083.pdf\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param default_rand_init: whether to use random initialization by default\n :param kwargs: passed through to super constructor\n """\n\n FGM_CLASS = FastGradientMethod\n\n def __init__(self, model, sess=None, dtypestr='float32',\n default_rand_init=True, **kwargs):\n """\n Create a ProjectedGradientDescent instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n\n super(ProjectedGradientDescent, self).__init__(model, sess=sess,\n dtypestr=dtypestr, **kwargs)\n self.feedable_kwargs = ('eps', 'eps_iter', 'y', 'y_target', 'clip_min',\n 'clip_max')\n self.structural_kwargs = ['ord', 'nb_iter', 'rand_init', 'clip_grad',\n 'sanity_checks', 'loss_fn']\n self.default_rand_init = default_rand_init\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n asserts = []\n\n # If a data range was specified, check that the input was in that range\n if self.clip_min is not None:\n asserts.append(utils_tf.assert_greater_equal(x,\n tf.cast(self.clip_min,\n x.dtype)))\n\n if self.clip_max is not None:\n asserts.append(utils_tf.assert_less_equal(x,\n tf.cast(self.clip_max,\n x.dtype)))\n\n # Initialize loop variables\n if self.rand_init:\n eta = random_lp_vector(tf.shape(x), self.ord,\n tf.cast(self.rand_init_eps, x.dtype),\n dtype=x.dtype)\n else:\n eta = tf.zeros(tf.shape(x))\n\n # Clip eta\n eta = clip_eta(eta, self.ord, self.eps)\n adv_x = x + eta\n if self.clip_min is not None or self.clip_max is not None:\n adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n if self.y_target is not None:\n y = self.y_target\n targeted = True\n elif self.y is not None:\n y = self.y\n targeted = False\n else:\n model_preds = self.model.get_probs(x)\n preds_max = tf.reduce_max(model_preds, 1, keepdims=True)\n y = tf.to_float(tf.equal(model_preds, preds_max))\n y = tf.stop_gradient(y)\n targeted = False\n del model_preds\n\n y_kwarg = 'y_target' if targeted else 'y'\n\n fgm_params = {\n 'eps': self.eps_iter,\n y_kwarg: y,\n 'ord': self.ord,\n 'loss_fn': self.loss_fn,\n 'clip_min': self.clip_min,\n 'clip_max': self.clip_max,\n 'clip_grad': self.clip_grad\n }\n if self.ord == 1:\n raise NotImplementedError("FGM is not a good inner loop step for PGD "\n " when ord=1, because ord=1 FGM changes only "\n " one pixel at a time. Use the SparseL1Descent "\n " attack instead, which allows fine-grained "\n " control over the sparsity of the gradient "\n " updates.")\n\n # Use getattr() to avoid errors in eager execution attacks\n FGM = self.FGM_CLASS(\n self.model,\n sess=getattr(self, 'sess', None),\n dtypestr=self.dtypestr)\n\n def cond(i, _):\n """Iterate until requested number of iterations is completed"""\n return tf.less(i, self.nb_iter)\n\n def body(i, adv_x):\n """Do a projected gradient step"""\n adv_x = FGM.generate(adv_x, **fgm_params)\n\n # Clipping perturbation eta to self.ord norm ball\n eta = adv_x - x\n eta = clip_eta(eta, self.ord, self.eps)\n adv_x = x + eta\n\n # Redo the clipping.\n # FGM already did it, but subtracting and re-adding eta can add some\n # small numerical error.\n if self.clip_min is not None or self.clip_max is not None:\n adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n return i + 1, adv_x\n\n _, adv_x = tf.while_loop(cond, body, (tf.zeros([]), adv_x), back_prop=True,\n maximum_iterations=self.nb_iter)\n\n # Asserts run only on CPU.\n # When multi-GPU eval code tries to force all PGD ops onto GPU, this\n # can cause an error.\n common_dtype = tf.float32\n asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps_iter,\n dtype=common_dtype),\n tf.cast(self.eps, dtype=common_dtype)))\n if self.ord == np.inf and self.clip_min is not None:\n # The 1e-6 is needed to compensate for numerical error.\n # Without the 1e-6 this fails when e.g. eps=.2, clip_min=.5,\n # clip_max=.7\n asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps, x.dtype),\n 1e-6 + tf.cast(self.clip_max,\n x.dtype)\n - tf.cast(self.clip_min,\n x.dtype)))\n\n if self.sanity_checks:\n with tf.control_dependencies(asserts):\n adv_x = tf.identity(adv_x)\n\n return adv_x\n\n[docs] def parse_params(self,\n eps=0.3,\n eps_iter=0.05,\n nb_iter=10,\n y=None,\n ord=np.inf,\n loss_fn=softmax_cross_entropy_with_logits,\n clip_min=None,\n clip_max=None,\n y_target=None,\n rand_init=None,\n rand_init_eps=None,\n clip_grad=False,\n sanity_checks=True,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float) maximum distortion of adversarial example\n compared to original input\n :param eps_iter: (optional float) step size for each attack iteration\n :param nb_iter: (optional int) Number of attack iterations.\n :param y: (optional) A tensor with the true labels.\n :param y_target: (optional) A tensor with the labels to target. Leave\n y_target=None if y is also set. Labels should be\n one-hot-encoded.\n :param ord: (optional) Order of the norm (mimics Numpy).\n Possible values: np.inf, 1 or 2.\n :param loss_fn: Loss function that takes (labels, logits) as arguments and returns loss\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n :param rand_init: (optional) Start the gradient descent from a point chosen\n uniformly at random in the norm ball of radius\n rand_init_eps\n :param rand_init_eps: (optional float) size of the norm ball from which\n the initial starting point is chosen. Defaults to eps\n :param clip_grad: (optional bool) Ignore gradient components at positions\n where the input is already at the boundary of the domain,\n and the update step will get clipped out.\n :param sanity_checks: bool Insert tf asserts checking values\n (Some tests need to run with no sanity checks because the\n tests intentionally configure the attack strangely)\n """\n\n # Save attack-specific parameters\n self.eps = eps\n if rand_init is None:\n rand_init = self.default_rand_init\n self.rand_init = rand_init\n if rand_init_eps is None:\n rand_init_eps = self.eps\n self.rand_init_eps = rand_init_eps\n\n self.eps_iter = eps_iter\n self.nb_iter = nb_iter\n self.y = y\n self.y_target = y_target\n self.ord = ord\n self.loss_fn = loss_fn\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.clip_grad = clip_grad\n\n if isinstance(eps, float) and isinstance(eps_iter, float):\n # If these are both known at compile time, we can check before anything\n # is run. If they are tf, we can't check them yet.\n assert eps_iter <= eps, (eps_iter, eps)\n\n if self.y is not None and self.y_target is not None:\n raise ValueError("Must not set both y and y_target")\n # Check if order of the norm is acceptable given current implementation\n if self.ord not in [np.inf, 1, 2]:\n raise ValueError("Norm order must be either np.inf, 1, or 2.")\n\n if self.clip_grad and (self.clip_min is None or self.clip_max is None):\n raise ValueError("Must set clip_min and clip_max if clip_grad is set")\n\n self.sanity_checks = sanity_checks\n\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/semantic.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.saliency_map_method
\n"""The SalienceMapMethod attack\n"""\n# pylint: disable=missing-docstring\nimport warnings\n\nimport numpy as np\nfrom six.moves import xrange\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_sum, reduce_max, reduce_any\n\ntf_dtype = tf.as_dtype('float32')\n\n\n[docs]class SaliencyMapMethod(Attack):\n """\n The Jacobian-based Saliency Map Method (Papernot et al. 2016).\n Paper link: https://arxiv.org/pdf/1511.07528.pdf\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n\n :note: When not using symbolic implementation in `generate`, `sess` should\n be provided\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a SaliencyMapMethod instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n\n super(SaliencyMapMethod, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.feedable_kwargs = ('y_target',)\n self.structural_kwargs = [\n 'theta', 'gamma', 'clip_max', 'clip_min', 'symbolic_impl'\n ]\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n if self.symbolic_impl:\n # Create random targets if y_target not provided\n if self.y_target is None:\n from random import randint\n\n def random_targets(gt):\n result = gt.copy()\n nb_s = gt.shape[0]\n nb_classes = gt.shape[1]\n\n for i in range(nb_s):\n result[i, :] = np.roll(result[i, :],\n randint(1, nb_classes - 1))\n\n return result\n\n labels, nb_classes = self.get_or_guess_labels(x, kwargs)\n self.y_target = tf.py_func(random_targets, [labels],\n self.tf_dtype)\n self.y_target.set_shape([None, nb_classes])\n\n x_adv = jsma_symbolic(\n x,\n model=self.model,\n y_target=self.y_target,\n theta=self.theta,\n gamma=self.gamma,\n clip_min=self.clip_min,\n clip_max=self.clip_max)\n else:\n raise NotImplementedError("The jsma_batch function has been removed."\n " The symbolic_impl argument to SaliencyMapMethod will be removed"\n " on 2019-07-18 or after. Any code that depends on the non-symbolic"\n " implementation of the JSMA should be revised. Consider using"\n " SaliencyMapMethod.generate_np() instead.")\n\n return x_adv\n\n[docs] def parse_params(self,\n theta=1.,\n gamma=1.,\n clip_min=0.,\n clip_max=1.,\n y_target=None,\n symbolic_impl=True,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param theta: (optional float) Perturbation introduced to modified\n components (can be positive or negative)\n :param gamma: (optional float) Maximum percentage of perturbed features\n :param clip_min: (optional float) Minimum component value for clipping\n :param clip_max: (optional float) Maximum component value for clipping\n :param y_target: (optional) Target tensor if the attack is targeted\n """\n self.theta = theta\n self.gamma = gamma\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.y_target = y_target\n self.symbolic_impl = symbolic_impl\n\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n\ndef jsma_batch(*args, **kwargs):\n raise NotImplementedError(\n "The jsma_batch function has been removed. Any code that depends on it should be revised.")\n\n\ndef jsma_symbolic(x, y_target, model, theta, gamma, clip_min, clip_max):\n """\n TensorFlow implementation of the JSMA (see https://arxiv.org/abs/1511.07528\n for details about the algorithm design choices).\n\n :param x: the input placeholder\n :param y_target: the target tensor\n :param model: a cleverhans.model.Model object.\n :param theta: delta for each feature adjustment\n :param gamma: a float between 0 - 1 indicating the maximum distortion\n percentage\n :param clip_min: minimum value for components of the example returned\n :param clip_max: maximum value for components of the example returned\n :return: a tensor for the adversarial example\n """\n\n nb_classes = int(y_target.shape[-1].value)\n nb_features = int(np.product(x.shape[1:]).value)\n\n if x.dtype == tf.float32 and y_target.dtype == tf.int64:\n y_target = tf.cast(y_target, tf.int32)\n\n if x.dtype == tf.float32 and y_target.dtype == tf.float64:\n warnings.warn("Downcasting labels---this should be harmless unless"\n " they are smoothed")\n y_target = tf.cast(y_target, tf.float32)\n\n max_iters = np.floor(nb_features * gamma / 2)\n increase = bool(theta > 0)\n\n tmp = np.ones((nb_features, nb_features), int)\n np.fill_diagonal(tmp, 0)\n zero_diagonal = tf.constant(tmp, tf_dtype)\n\n # Compute our initial search domain. We optimize the initial search domain\n # by removing all features that are already at their maximum values (if\n # increasing input features---otherwise, at their minimum value).\n if increase:\n search_domain = tf.reshape(\n tf.cast(x < clip_max, tf_dtype), [-1, nb_features])\n else:\n search_domain = tf.reshape(\n tf.cast(x > clip_min, tf_dtype), [-1, nb_features])\n\n # Loop variables\n # x_in: the tensor that holds the latest adversarial outputs that are in\n # progress.\n # y_in: the tensor for target labels\n # domain_in: the tensor that holds the latest search domain\n # cond_in: the boolean tensor to show if more iteration is needed for\n # generating adversarial samples\n def condition(x_in, y_in, domain_in, i_in, cond_in):\n # Repeat the loop until we have achieved misclassification or\n # reaches the maximum iterations\n return tf.logical_and(tf.less(i_in, max_iters), cond_in)\n\n # Same loop variables as above\n def body(x_in, y_in, domain_in, i_in, cond_in):\n # Create graph for model logits and predictions\n logits = model.get_logits(x_in)\n preds = tf.nn.softmax(logits)\n preds_onehot = tf.one_hot(tf.argmax(preds, axis=1), depth=nb_classes)\n\n # create the Jacobian graph\n list_derivatives = []\n for class_ind in xrange(nb_classes):\n derivatives = tf.gradients(logits[:, class_ind], x_in)\n list_derivatives.append(derivatives[0])\n grads = tf.reshape(\n tf.stack(list_derivatives), shape=[nb_classes, -1, nb_features])\n\n # Compute the Jacobian components\n # To help with the computation later, reshape the target_class\n # and other_class to [nb_classes, -1, 1].\n # The last dimention is added to allow broadcasting later.\n target_class = tf.reshape(\n tf.transpose(y_in, perm=[1, 0]), shape=[nb_classes, -1, 1])\n other_classes = tf.cast(tf.not_equal(target_class, 1), tf_dtype)\n\n grads_target = reduce_sum(grads * target_class, axis=0)\n grads_other = reduce_sum(grads * other_classes, axis=0)\n\n # Remove the already-used input features from the search space\n # Subtract 2 times the maximum value from those value so that\n # they won't be picked later\n increase_coef = (4 * int(increase) - 2) \\\n * tf.cast(tf.equal(domain_in, 0), tf_dtype)\n\n target_tmp = grads_target\n target_tmp -= increase_coef \\\n * reduce_max(tf.abs(grads_target), axis=1, keepdims=True)\n target_sum = tf.reshape(target_tmp, shape=[-1, nb_features, 1]) \\\n + tf.reshape(target_tmp, shape=[-1, 1, nb_features])\n\n other_tmp = grads_other\n other_tmp += increase_coef \\\n * reduce_max(tf.abs(grads_other), axis=1, keepdims=True)\n other_sum = tf.reshape(other_tmp, shape=[-1, nb_features, 1]) \\\n + tf.reshape(other_tmp, shape=[-1, 1, nb_features])\n\n # Create a mask to only keep features that match conditions\n if increase:\n scores_mask = ((target_sum > 0) & (other_sum < 0))\n else:\n scores_mask = ((target_sum < 0) & (other_sum > 0))\n\n # Create a 2D numpy array of scores for each pair of candidate features\n scores = tf.cast(scores_mask, tf_dtype) \\\n * (-target_sum * other_sum) * zero_diagonal\n\n # Extract the best two pixels\n best = tf.argmax(\n tf.reshape(scores, shape=[-1, nb_features * nb_features]), axis=1)\n\n p1 = tf.mod(best, nb_features)\n p2 = tf.floordiv(best, nb_features)\n p1_one_hot = tf.one_hot(p1, depth=nb_features)\n p2_one_hot = tf.one_hot(p2, depth=nb_features)\n\n # Check if more modification is needed for each sample\n mod_not_done = tf.equal(reduce_sum(y_in * preds_onehot, axis=1), 0)\n cond = mod_not_done & (reduce_sum(domain_in, axis=1) >= 2)\n\n # Update the search domain\n cond_float = tf.reshape(tf.cast(cond, tf_dtype), shape=[-1, 1])\n to_mod = (p1_one_hot + p2_one_hot) * cond_float\n\n domain_out = domain_in - to_mod\n\n # Apply the modification to the images\n to_mod_reshape = tf.reshape(\n to_mod, shape=([-1] + x_in.shape[1:].as_list()))\n if increase:\n x_out = tf.minimum(clip_max, x_in + to_mod_reshape * theta)\n else:\n x_out = tf.maximum(clip_min, x_in - to_mod_reshape * theta)\n\n # Increase the iterator, and check if all misclassifications are done\n i_out = tf.add(i_in, 1)\n cond_out = reduce_any(cond)\n\n return x_out, y_in, domain_out, i_out, cond_out\n\n # Run loop to do JSMA\n x_adv, _, _, _, _ = tf.while_loop(\n condition,\n body, [x, y_target, search_domain, 0, True],\n parallel_iterations=1)\n\n return x_adv\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/sparse_l1_descent.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.semantic
\n"""Semantic adversarial examples\n"""\n\nfrom cleverhans.attacks.attack import Attack\n\n\n[docs]class Semantic(Attack):\n """\n Semantic adversarial examples\n\n https://arxiv.org/abs/1703.06857\n\n Note: data must either be centered (so that the negative image can be\n made by simple negation) or must be in the interval [-1, 1]\n\n :param model: cleverhans.model.Model\n :param center: bool\n If True, assumes data has 0 mean so the negative image is just negation.\n If False, assumes data is in the interval [0, max_val]\n :param max_val: float\n Maximum value allowed in the input data\n :param sess: optional tf.Session\n :param dtypestr: dtype of data\n :param kwargs: passed through to the super constructor\n """\n\n def __init__(self, model, center, max_val=1., sess=None, dtypestr='float32',\n **kwargs):\n super(Semantic, self).__init__(model, sess, dtypestr, **kwargs)\n self.center = center\n self.max_val = max_val\n if hasattr(model, 'dataset_factory'):\n if 'center' in model.dataset_factory.kwargs:\n assert center == model.dataset_factory.kwargs['center']\n\n\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/spatial_transformation_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.sparse_l1_descent
\n"""\nThe SparseL1Descent attack.\n"""\n\nimport warnings\nfrom distutils.version import LooseVersion\n\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans import utils_tf\nfrom cleverhans.utils_tf import clip_eta, random_lp_vector\nfrom cleverhans.compat import reduce_max, reduce_sum, \\\n softmax_cross_entropy_with_logits\n\n\n[docs]class SparseL1Descent(Attack):\n """\n This class implements a variant of Projected Gradient Descent for the l1-norm\n (Tramer and Boneh 2019). The l1-norm case is more tricky than the l-inf and l2\n cases covered by the ProjectedGradientDescent class, because the steepest\n descent direction for the l1-norm is too sparse (it updates a single\n coordinate in the adversarial perturbation in each step). This attack has an\n additional parameter that controls the sparsity of the update step. For\n moderately sparse update steps, the attack vastly outperforms Projected\n Steepest Descent and is competitive with other attacks targeted at the l1-norm\n such as the ElasticNetMethod attack (which is much more computationally\n expensive).\n Paper link (Tramer and Boneh 2019): https://arxiv.org/pdf/1904.13000.pdf\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a SparseL1Descent instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n\n super(SparseL1Descent, self).__init__(model, sess=sess,\n dtypestr=dtypestr, **kwargs)\n self.feedable_kwargs = ('eps', 'eps_iter', 'y', 'y_target', 'clip_min',\n 'clip_max', 'grad_sparsity')\n self.structural_kwargs = ['nb_iter', 'rand_init', 'clip_grad',\n 'sanity_checks']\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n asserts = []\n\n # If a data range was specified, check that the input was in that range\n if self.clip_min is not None:\n asserts.append(utils_tf.assert_greater_equal(x,\n tf.cast(self.clip_min,\n x.dtype)))\n\n if self.clip_max is not None:\n asserts.append(utils_tf.assert_less_equal(x,\n tf.cast(self.clip_max,\n x.dtype)))\n\n # Initialize loop variables\n if self.rand_init:\n eta = random_lp_vector(tf.shape(x), ord=1,\n eps=tf.cast(self.eps, x.dtype), dtype=x.dtype)\n else:\n eta = tf.zeros(tf.shape(x))\n\n # Clip eta\n eta = clip_eta(eta, ord=1, eps=self.eps)\n adv_x = x + eta\n if self.clip_min is not None or self.clip_max is not None:\n adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n if self.y_target is not None:\n y = self.y_target\n targeted = True\n elif self.y is not None:\n y = self.y\n targeted = False\n else:\n model_preds = self.model.get_probs(x)\n preds_max = tf.reduce_max(model_preds, 1, keepdims=True)\n y = tf.to_float(tf.equal(model_preds, preds_max))\n y = tf.stop_gradient(y)\n targeted = False\n del model_preds\n\n y_kwarg = 'y_target' if targeted else 'y'\n\n def cond(i, _):\n """Iterate until requested number of iterations is completed"""\n return tf.less(i, self.nb_iter)\n\n def body(i, adv_x):\n """Do a projected gradient step"""\n\n labels, _ = self.get_or_guess_labels(adv_x, {y_kwarg: y})\n logits = self.model.get_logits(adv_x)\n\n adv_x = sparse_l1_descent(adv_x,\n logits,\n y=labels,\n eps=self.eps_iter,\n q=self.grad_sparsity,\n clip_min=self.clip_min,\n clip_max=self.clip_max,\n clip_grad=self.clip_grad,\n targeted=(self.y_target is not None),\n sanity_checks=self.sanity_checks)\n\n # Clipping perturbation eta to the l1-ball\n eta = adv_x - x\n eta = clip_eta(eta, ord=1, eps=self.eps)\n adv_x = x + eta\n\n # Redo the clipping.\n # Subtracting and re-adding eta can add some small numerical error.\n if self.clip_min is not None or self.clip_max is not None:\n adv_x = utils_tf.clip_by_value(adv_x, self.clip_min, self.clip_max)\n\n return i + 1, adv_x\n\n _, adv_x = tf.while_loop(cond, body, (tf.zeros([]), adv_x), back_prop=True,\n maximum_iterations=self.nb_iter)\n\n # Asserts run only on CPU.\n # When multi-GPU eval code tries to force all PGD ops onto GPU, this\n # can cause an error.\n common_dtype = tf.float32\n asserts.append(utils_tf.assert_less_equal(tf.cast(self.eps_iter,\n dtype=common_dtype),\n tf.cast(self.eps, dtype=common_dtype)))\n\n if self.sanity_checks:\n with tf.control_dependencies(asserts):\n adv_x = tf.identity(adv_x)\n\n return adv_x\n\n[docs] def parse_params(self,\n eps=10.0,\n eps_iter=1.0,\n nb_iter=20,\n y=None,\n clip_min=None,\n clip_max=None,\n y_target=None,\n rand_init=False,\n clip_grad=False,\n grad_sparsity=99,\n sanity_checks=True,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float) maximum distortion of adversarial example\n compared to original input\n :param eps_iter: (optional float) step size for each attack iteration\n :param nb_iter: (optional int) Number of attack iterations.\n :param y: (optional) A tensor with the true labels.\n :param y_target: (optional) A tensor with the labels to target. Leave\n y_target=None if y is also set. Labels should be\n one-hot-encoded.\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n :param clip_grad: (optional bool) Ignore gradient components\n at positions where the input is already at the boundary\n of the domain, and the update step will get clipped out.\n :param grad_sparsity (optional) Relative sparsity of the gradient update\n step, in percent. Only gradient values larger\n than this percentile are retained. This parameter can\n be a scalar, or a vector of the same length as the\n input batch dimension.\n :param sanity_checks: bool Insert tf asserts checking values\n (Some tests need to run with no sanity checks because the\n tests intentionally configure the attack strangely)\n """\n\n # Save attack-specific parameters\n self.eps = eps\n self.rand_init = rand_init\n self.eps_iter = eps_iter\n self.nb_iter = nb_iter\n self.y = y\n self.y_target = y_target\n self.clip_min = clip_min\n self.clip_max = clip_max\n self.clip_grad = clip_grad\n self.grad_sparsity = grad_sparsity\n\n if isinstance(eps, float) and isinstance(eps_iter, float):\n # If these are both known at compile time, we can check before anything\n # is run. If they are tf, we can't check them yet.\n assert eps_iter <= eps, (eps_iter, eps)\n\n if self.y is not None and self.y_target is not None:\n raise ValueError("Must not set both y and y_target")\n\n if self.clip_grad and (self.clip_min is None or self.clip_max is None):\n raise ValueError("Must set clip_min and clip_max if clip_grad is set")\n\n # The grad_sparsity argument governs the sparsity of the gradient\n # update. It indicates the percentile value above which gradient entries\n # are retained. It can be specified as a scalar or as a 1-dimensional\n # vector of the same size as the input's batch dimension.\n if isinstance(self.grad_sparsity, int) or \\\n isinstance(self.grad_sparsity, float):\n if not 0 < self.grad_sparsity < 100:\n raise ValueError("grad_sparsity should be in (0, 100)")\n else:\n self.grad_sparsity = tf.convert_to_tensor(self.grad_sparsity)\n if len(self.grad_sparsity.shape) > 1:\n raise ValueError("grad_sparsity should either be a scalar or a vector")\n\n\n self.sanity_checks = sanity_checks\n\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n\n return True\n\n\ndef sparse_l1_descent(x,\n logits,\n y=None,\n eps=1.0,\n q=99,\n clip_min=None,\n clip_max=None,\n clip_grad=False,\n targeted=False,\n sanity_checks=True):\n """\n TensorFlow implementation of the Dense L1 Descent Method.\n :param x: the input placeholder\n :param logits: output of model.get_logits\n :param y: (optional) A placeholder for the true labels. If targeted\n is true, then provide the target label. Otherwise, only provide\n this parameter if you'd like to use true labels when crafting\n adversarial samples. Otherwise, model predictions are used as\n labels to avoid the "label leaking" effect (explained in this\n paper: https://arxiv.org/abs/1611.01236). Default is None.\n Labels should be one-hot-encoded.\n :param eps: the epsilon (input variation parameter)\n :param q: the percentile above which gradient values are retained. Either a\n scalar or a vector of same length as the input batch dimension.\n :param clip_min: Minimum float value for adversarial example components\n :param clip_max: Maximum float value for adversarial example components\n :param clip_grad: (optional bool) Ignore gradient components\n at positions where the input is already at the boundary\n of the domain, and the update step will get clipped out.\n :param targeted: Is the attack targeted or untargeted? Untargeted, the\n default, will try to make the label incorrect. Targeted\n will instead try to move in the direction of being more\n like y.\n :return: a tensor for the adversarial example\n """\n\n asserts = []\n\n # If a data range was specified, check that the input was in that range\n if clip_min is not None:\n asserts.append(utils_tf.assert_greater_equal(\n x, tf.cast(clip_min, x.dtype)))\n\n if clip_max is not None:\n asserts.append(utils_tf.assert_less_equal(x, tf.cast(clip_max, x.dtype)))\n\n # Make sure the caller has not passed probs by accident\n assert logits.op.type != 'Softmax'\n\n if y is None:\n # Using model predictions as ground truth to avoid label leaking\n preds_max = reduce_max(logits, 1, keepdims=True)\n y = tf.to_float(tf.equal(logits, preds_max))\n y = tf.stop_gradient(y)\n y = y / reduce_sum(y, 1, keepdims=True)\n\n # Compute loss\n loss = softmax_cross_entropy_with_logits(labels=y, logits=logits)\n if targeted:\n loss = -loss\n\n # Define gradient of loss wrt input\n grad, = tf.gradients(loss, x)\n\n if clip_grad:\n grad = utils_tf.zero_out_clipped_grads(grad, x, clip_min, clip_max)\n\n red_ind = list(range(1, len(grad.get_shape())))\n dim = tf.reduce_prod(tf.shape(x)[1:])\n\n abs_grad = tf.reshape(tf.abs(grad), (-1, dim))\n\n # if q is a scalar, broadcast it to a vector of same length as the batch dim\n q = tf.cast(tf.broadcast_to(q, tf.shape(x)[0:1]), tf.float32)\n k = tf.cast(tf.floor(q / 100 * tf.cast(dim, tf.float32)), tf.int32)\n\n # `tf.sort` is much faster than `tf.contrib.distributions.percentile`.\n # For TF <= 1.12, use `tf.nn.top_k` as `tf.sort` is not implemented.\n if LooseVersion(tf.__version__) <= LooseVersion('1.12.0'):\n # `tf.sort` is only available in TF 1.13 onwards\n sorted_grad = -tf.nn.top_k(-abs_grad, k=dim, sorted=True)[0]\n else:\n sorted_grad = tf.sort(abs_grad, axis=-1)\n\n idx = tf.stack((tf.range(tf.shape(abs_grad)[0]), k), -1)\n percentiles = tf.gather_nd(sorted_grad, idx)\n tied_for_max = tf.greater_equal(abs_grad, tf.expand_dims(percentiles, -1))\n tied_for_max = tf.reshape(tf.cast(tied_for_max, x.dtype), tf.shape(grad))\n num_ties = tf.reduce_sum(tied_for_max, red_ind, keepdims=True)\n\n optimal_perturbation = tf.sign(grad) * tied_for_max / num_ties\n\n # Add perturbation to original example to obtain adversarial example\n adv_x = x + utils_tf.mul(eps, optimal_perturbation)\n\n # If clipping is needed, reset all values outside of [clip_min, clip_max]\n if (clip_min is not None) or (clip_max is not None):\n # We don't currently support one-sided clipping\n assert clip_min is not None and clip_max is not None\n adv_x = utils_tf.clip_by_value(adv_x, clip_min, clip_max)\n\n if sanity_checks:\n with tf.control_dependencies(asserts):\n adv_x = tf.identity(adv_x)\n\n return adv_x\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/spsa.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.spatial_transformation_method
\n"""The SpatialTransformationMethod attack\n"""\nimport warnings\n\nfrom cleverhans.attacks.attack import Attack\n\n\n[docs]class SpatialTransformationMethod(Attack):\n """\n Spatial transformation attack\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Create a SpatialTransformationMethod instance.\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n super(SpatialTransformationMethod, self).__init__(\n model, sess, dtypestr, **kwargs)\n self.feedable_kwargs = ('n_samples', 'dx_min', 'dx_max', 'n_dxs', 'dy_min',\n 'dy_max', 'n_dys', 'angle_min', 'angle_max',\n 'n_angles', 'black_border_size')\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n from cleverhans.attacks_tf import spm\n\n labels, _ = self.get_or_guess_labels(x, kwargs)\n\n return spm(\n x,\n self.model,\n y=labels,\n n_samples=self.n_samples,\n dx_min=self.dx_min, dx_max=self.dx_max, n_dxs=self.n_dxs,\n dy_min=self.dy_min, dy_max=self.dy_max, n_dys=self.n_dys,\n angle_min=self.angle_min, angle_max=self.angle_max,\n n_angles=self.n_angles, black_border_size=self.black_border_size)\n\n[docs] def parse_params(self,\n n_samples=None,\n dx_min=-0.1,\n dx_max=0.1,\n n_dxs=2,\n dy_min=-0.1,\n dy_max=0.1,\n n_dys=2,\n angle_min=-30,\n angle_max=30,\n n_angles=6,\n black_border_size=0,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n :param n_samples: (optional) The number of transformations sampled to\n construct the attack. Set it to None to run\n full grid attack.\n :param dx_min: (optional float) Minimum translation ratio along x-axis.\n :param dx_max: (optional float) Maximum translation ratio along x-axis.\n :param n_dxs: (optional int) Number of discretized translation ratios\n along x-axis.\n :param dy_min: (optional float) Minimum translation ratio along y-axis.\n :param dy_max: (optional float) Maximum translation ratio along y-axis.\n :param n_dys: (optional int) Number of discretized translation ratios\n along y-axis.\n :param angle_min: (optional float) Largest counter-clockwise rotation\n angle.\n :param angle_max: (optional float) Largest clockwise rotation angle.\n :param n_angles: (optional int) Number of discretized angles.\n :param black_border_size: (optional int) size of the black border in pixels.\n """\n self.n_samples = n_samples\n self.dx_min = dx_min\n self.dx_max = dx_max\n self.n_dxs = n_dxs\n self.dy_min = dy_min\n self.dy_max = dy_max\n self.n_dys = n_dys\n self.angle_min = angle_min\n self.angle_max = angle_max\n self.n_angles = n_angles\n self.black_border_size = black_border_size\n\n if self.dx_min < -1 or self.dy_min < -1 or \\\n self.dx_max > 1 or self.dy_max > 1:\n raise ValueError("The value of translation must be bounded "\n "within [-1, 1]")\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n return True\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/attacks/virtual_adversarial_method.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.spsa
\n"""The SPSA attack\n"""\n# pylint: disable=missing-docstring\nimport warnings\n\nimport numpy as np\nfrom six.moves import xrange\nimport tensorflow as tf\n# import tensorflow_addons as tfa\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.compat import reduce_mean, reduce_sum, reduce_max\nfrom cleverhans.model import Model\nfrom cleverhans import utils_tf\n\ntf_dtype = tf.as_dtype('float32')\n\n\n[docs]class SPSA(Attack):\n """\n This implements the SPSA adversary, as in https://arxiv.org/abs/1802.05666\n (Uesato et al. 2018). SPSA is a gradient-free optimization method, which\n is useful when the model is non-differentiable, or more generally, the\n gradients do not point in useful directions.\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n DEFAULT_SPSA_SAMPLES = 128\n DEFAULT_SPSA_ITERS = 1\n DEFAULT_DELTA = 0.01\n DEFAULT_LEARNING_RATE = 0.01\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n super(SPSA, self).__init__(model, sess, dtypestr, **kwargs)\n\n self.feedable_kwargs = ('eps', 'clip_min', 'clip_max', 'y', 'y_target')\n self.structural_kwargs = [\n 'nb_iter',\n 'spsa_samples',\n 'spsa_iters',\n 'early_stop_loss_threshold',\n 'is_debug',\n 'is_targeted',\n ]\n\n assert isinstance(self.model, Model)\n\n[docs] def generate(self,\n x,\n y=None,\n y_target=None,\n eps=None,\n clip_min=None,\n clip_max=None,\n nb_iter=None,\n is_targeted=None,\n early_stop_loss_threshold=None,\n learning_rate=DEFAULT_LEARNING_RATE,\n delta=DEFAULT_DELTA,\n spsa_samples=DEFAULT_SPSA_SAMPLES,\n batch_size=None,\n spsa_iters=DEFAULT_SPSA_ITERS,\n is_debug=False,\n epsilon=None,\n num_steps=None):\n """\n Generate symbolic graph for adversarial examples.\n\n :param x: The model's symbolic inputs. Must be a batch of size 1.\n :param y: A Tensor or None. The index of the correct label.\n :param y_target: A Tensor or None. The index of the target label in a\n targeted attack.\n :param eps: The size of the maximum perturbation, measured in the\n L-infinity norm.\n :param clip_min: If specified, the minimum input value\n :param clip_max: If specified, the maximum input value\n :param nb_iter: The number of optimization steps.\n :param early_stop_loss_threshold: A float or None. If specified, the\n attack will end as soon as the loss\n is below `early_stop_loss_threshold`.\n :param learning_rate: Learning rate of ADAM optimizer.\n :param delta: Perturbation size used for SPSA approximation.\n :param spsa_samples: Number of inputs to evaluate at a single time.\n The true batch size (the number of evaluated\n inputs for each update) is `spsa_samples *\n spsa_iters`\n :param batch_size: Deprecated param that is an alias for spsa_samples\n :param spsa_iters: Number of model evaluations before performing an\n update, where each evaluation is on `spsa_samples`\n different inputs.\n :param is_debug: If True, print the adversarial loss after each update.\n :param epsilon: Deprecated alias for `eps`\n :param num_steps: Deprecated alias for `nb_iter`.\n :param is_targeted: Deprecated argument. Ignored.\n """\n\n if epsilon is not None:\n if eps is not None:\n raise ValueError("Should not specify both eps and its deprecated "\n "alias, epsilon")\n warnings.warn("`epsilon` is deprecated. Switch to `eps`. `epsilon` may "\n "be removed on or after 2019-04-15.")\n eps = epsilon\n del epsilon\n\n if num_steps is not None:\n if nb_iter is not None:\n raise ValueError("Should not specify both nb_iter and its deprecated "\n "alias, num_steps")\n warnings.warn("`num_steps` is deprecated. Switch to `nb_iter`. "\n "`num_steps` may be removed on or after 2019-04-15.")\n nb_iter = num_steps\n del num_steps\n assert nb_iter is not None\n\n if (y is not None) + (y_target is not None) != 1:\n raise ValueError("Must specify exactly one of y (untargeted attack, "\n "cause the input not to be classified as this true "\n "label) and y_target (targeted attack, cause the "\n "input to be classified as this target label).")\n\n if is_targeted is not None:\n warnings.warn("`is_targeted` is deprecated. Simply do not specify it."\n " It may become an error to specify it on or after "\n "2019-04-15.")\n assert is_targeted == y_target is not None\n\n is_targeted = y_target is not None\n\n if x.get_shape().as_list()[0] is None:\n check_batch = utils_tf.assert_equal(tf.shape(x)[0], 1)\n with tf.control_dependencies([check_batch]):\n x = tf.identity(x)\n elif x.get_shape().as_list()[0] != 1:\n raise ValueError("For SPSA, input tensor x must have batch_size of 1.")\n\n if batch_size is not None:\n warnings.warn(\n 'The "batch_size" argument to SPSA is deprecated, and will '\n 'be removed on 2019-03-17. '\n 'Please use spsa_samples instead.')\n spsa_samples = batch_size\n\n optimizer = SPSAAdam(\n lr=learning_rate,\n delta=delta,\n num_samples=spsa_samples,\n num_iters=spsa_iters)\n\n def loss_fn(x, label):\n """\n Margin logit loss, with correct sign for targeted vs untargeted loss.\n """\n logits = self.model.get_logits(x)\n loss_multiplier = 1 if is_targeted else -1\n return loss_multiplier * margin_logit_loss(\n logits, label,\n nb_classes=self.model.nb_classes or logits.get_shape()[-1])\n\n y_attack = y_target if is_targeted else y\n adv_x = projected_optimization(\n loss_fn,\n x,\n y_attack,\n eps,\n num_steps=nb_iter,\n optimizer=optimizer,\n early_stop_loss_threshold=early_stop_loss_threshold,\n is_debug=is_debug,\n clip_min=clip_min,\n clip_max=clip_max\n )\n return adv_x\n\n[docs] def generate_np(self, x_val, **kwargs):\n if "epsilon" in kwargs:\n warnings.warn("Using deprecated argument: see `generate`")\n assert "eps" not in kwargs\n kwargs["eps"] = kwargs["epsilon"]\n del kwargs["epsilon"]\n assert "eps" in kwargs\n\n if "num_steps" in kwargs:\n warnings.warn("Using deprecated argument: see `generate`")\n assert "nb_iter" not in kwargs\n kwargs["nb_iter"] = kwargs["num_steps"]\n del kwargs["num_steps"]\n\n if 'y' in kwargs and kwargs['y'] is not None:\n assert kwargs['y'].dtype in [np.int32, np.int64]\n if 'y_target' in kwargs and kwargs['y_target'] is not None:\n assert kwargs['y_target'].dtype in [np.int32, np.int64]\n\n # Call self.generate() sequentially for each image in the batch\n x_adv = []\n batch_size = x_val.shape[0]\n y = kwargs.pop('y', [None] * batch_size)\n assert len(x_val) == len(y), '# of images and labels should match'\n for x_single, y_single in zip(x_val, y):\n x = np.expand_dims(x_single, axis=0)\n adv_img = super(SPSA, self).generate_np(x, y=y_single, **kwargs)\n x_adv.append(adv_img)\n return np.concatenate(x_adv, axis=0)\n\n\ndef _project_perturbation(perturbation, epsilon, input_image, clip_min=None,\n clip_max=None):\n """Project `perturbation` onto L-infinity ball of radius `epsilon`.\n Also project into hypercube such that the resulting adversarial example\n is between clip_min and clip_max, if applicable.\n """\n\n if clip_min is None or clip_max is None:\n raise NotImplementedError("_project_perturbation currently has clipping "\n "hard-coded in.")\n\n # Ensure inputs are in the correct range\n with tf.control_dependencies([\n utils_tf.assert_less_equal(input_image,\n tf.cast(clip_max, input_image.dtype)),\n utils_tf.assert_greater_equal(input_image,\n tf.cast(clip_min, input_image.dtype))\n ]):\n clipped_perturbation = utils_tf.clip_by_value(\n perturbation, -epsilon, epsilon)\n new_image = utils_tf.clip_by_value(\n input_image + clipped_perturbation, clip_min, clip_max)\n return new_image - input_image\n\n\nclass TensorOptimizer(object):\n """Optimizer for Tensors rather than tf.Variables.\n\n TensorOptimizers implement optimizers where the values being optimized\n are ordinary Tensors, rather than Variables. TF Variables can have strange\n behaviors when being assigned multiple times within a single sess.run()\n call, particularly in Distributed TF, so this avoids thinking about those\n issues. These are helper classes for the `projected_optimization`\n method. Apart from not using Variables, they follow an interface very\n similar to tf.Optimizer.\n """\n\n def _compute_gradients(self, loss_fn, x, unused_optim_state):\n """Compute a new value of `x` to minimize `loss_fn`.\n\n Args:\n loss_fn: a callable that takes `x`, a batch of images, and returns\n a batch of loss values. `x` will be optimized to minimize\n `loss_fn(x)`.\n x: A list of Tensors, the values to be updated. This is analogous\n to the `var_list` argument in standard TF Optimizer.\n unused_optim_state: A (possibly nested) dict, containing any state\n info needed for the optimizer.\n\n Returns:\n new_x: A list of Tensors, the same length as `x`, which are updated\n new_optim_state: A dict, with the same structure as `optim_state`,\n which have been updated.\n """\n\n # Assumes `x` is a list,\n # and contains a tensor representing a batch of images\n assert len(x) == 1 and isinstance(x, list), \\\n 'x should be a list and contain only one image tensor'\n x = x[0]\n loss = reduce_mean(loss_fn(x), axis=0)\n return tf.gradients(loss, x)\n\n def _apply_gradients(self, grads, x, optim_state):\n """\n Given a gradient, make one optimization step.\n\n :param grads: list of tensors, same length as `x`, containing the corresponding gradients\n :param x: list of tensors to update\n :param optim_state: dict\n\n Returns:\n new_x: list of tensors, updated version of `x`\n new_optim_state: dict, updated version of `optim_state`\n """\n raise NotImplementedError(\n "_apply_gradients should be defined in each subclass")\n\n def minimize(self, loss_fn, x, optim_state):\n """\n Analogous to tf.Optimizer.minimize\n\n :param loss_fn: tf Tensor, representing the loss to minimize\n :param x: list of Tensor, analogous to tf.Optimizer's var_list\n :param optim_state: A possibly nested dict, containing any optimizer state.\n\n Returns:\n new_x: list of Tensor, updated version of `x`\n new_optim_state: dict, updated version of `optim_state`\n """\n grads = self._compute_gradients(loss_fn, x, optim_state)\n return self._apply_gradients(grads, x, optim_state)\n\n def init_state(self, x):\n """Returns the initial state of the optimizer.\n\n Args:\n x: A list of Tensors, which will be optimized.\n\n Returns:\n A dictionary, representing the initial state of the optimizer.\n """\n raise NotImplementedError(\n "init_state should be defined in each subclass")\n\n\nclass TensorGradientDescent(TensorOptimizer):\n """Vanilla Gradient Descent TensorOptimizer."""\n\n def __init__(self, lr):\n self._lr = lr\n\n def init_state(self, x):\n return {}\n\n def _apply_gradients(self, grads, x, optim_state):\n new_x = [None] * len(x)\n for i in xrange(len(x)):\n new_x[i] = x[i] - self._lr * grads[i]\n return new_x, optim_state\n\n\nclass TensorAdam(TensorOptimizer):\n """The Adam optimizer defined in https://arxiv.org/abs/1412.6980."""\n\n def __init__(self, lr=0.001, beta1=0.9, beta2=0.999, epsilon=1e-9):\n self._lr = lr\n self._beta1 = beta1\n self._beta2 = beta2\n self._epsilon = epsilon\n\n def init_state(self, x):\n """\n Initialize t, m, and u\n """\n optim_state = {}\n optim_state["t"] = 0.\n optim_state["m"] = [tf.zeros_like(v) for v in x]\n optim_state["u"] = [tf.zeros_like(v) for v in x]\n return optim_state\n\n def _apply_gradients(self, grads, x, optim_state):\n """Refer to parent class documentation."""\n new_x = [None] * len(x)\n new_optim_state = {\n "t": optim_state["t"] + 1.,\n "m": [None] * len(x),\n "u": [None] * len(x)\n }\n t = new_optim_state["t"]\n for i in xrange(len(x)):\n g = grads[i]\n m_old = optim_state["m"][i]\n u_old = optim_state["u"][i]\n new_optim_state["m"][i] = (\n self._beta1 * m_old + (1. - self._beta1) * g)\n new_optim_state["u"][i] = (\n self._beta2 * u_old + (1. - self._beta2) * g * g)\n m_hat = new_optim_state["m"][i] / (1. - tf.pow(self._beta1, t))\n u_hat = new_optim_state["u"][i] / (1. - tf.pow(self._beta2, t))\n new_x[i] = (\n x[i] - self._lr * m_hat / (tf.sqrt(u_hat) + self._epsilon))\n return new_x, new_optim_state\n\n\nclass SPSAAdam(TensorAdam):\n """Optimizer for gradient-free attacks in https://arxiv.org/abs/1802.05666.\n\n Gradients estimates are computed using Simultaneous Perturbation Stochastic\n Approximation (SPSA), combined with the ADAM update rule.\n """\n\n def __init__(self,\n lr=0.01,\n delta=0.01,\n num_samples=128,\n num_iters=1,\n compare_to_analytic_grad=False):\n super(SPSAAdam, self).__init__(lr=lr)\n assert num_samples % 2 == 0, "number of samples must be even"\n self._delta = delta\n self._num_samples = num_samples // 2 # Since we mirror +/- delta later\n self._num_iters = num_iters\n self._compare_to_analytic_grad = compare_to_analytic_grad\n\n def _get_delta(self, x, delta):\n x_shape = x.get_shape().as_list()\n delta_x = delta * tf.sign(\n tf.random_uniform(\n [self._num_samples] + x_shape[1:],\n minval=-1.,\n maxval=1.,\n dtype=tf_dtype))\n return delta_x\n\n def _compute_gradients(self, loss_fn, x, unused_optim_state):\n """Compute gradient estimates using SPSA."""\n # Assumes `x` is a list, containing a [1, H, W, C] image\n # If static batch dimension is None, tf.reshape to batch size 1\n # so that static shape can be inferred\n assert len(x) == 1\n static_x_shape = x[0].get_shape().as_list()\n if static_x_shape[0] is None:\n x[0] = tf.reshape(x[0], [1] + static_x_shape[1:])\n assert x[0].get_shape().as_list()[0] == 1\n x = x[0]\n x_shape = x.get_shape().as_list()\n\n def body(i, grad_array):\n delta = self._delta\n delta_x = self._get_delta(x, delta)\n delta_x = tf.concat([delta_x, -delta_x], axis=0)\n loss_vals = tf.reshape(\n loss_fn(x + delta_x),\n [2 * self._num_samples] + [1] * (len(x_shape) - 1))\n avg_grad = reduce_mean(loss_vals * delta_x, axis=0) / delta\n avg_grad = tf.expand_dims(avg_grad, axis=0)\n new_grad_array = grad_array.write(i, avg_grad)\n return i + 1, new_grad_array\n\n def cond(i, _):\n return i < self._num_iters\n\n _, all_grads = tf.while_loop(\n cond,\n body,\n loop_vars=[\n 0, tf.TensorArray(size=self._num_iters, dtype=tf_dtype)\n ],\n back_prop=False,\n parallel_iterations=1)\n avg_grad = reduce_sum(all_grads.stack(), axis=0)\n return [avg_grad]\n\n\ndef margin_logit_loss(model_logits, label, nb_classes=10, num_classes=None):\n """Computes difference between logit for `label` and next highest logit.\n\n The loss is high when `label` is unlikely (targeted by default).\n This follows the same interface as `loss_fn` for TensorOptimizer and\n projected_optimization, i.e. it returns a batch of loss values.\n """\n if num_classes is not None:\n warnings.warn("`num_classes` is depreciated. Switch to `nb_classes`."\n " `num_classes` may be removed on or after 2019-04-23.")\n nb_classes = num_classes\n del num_classes\n if 'int' in str(label.dtype):\n logit_mask = tf.one_hot(label, depth=nb_classes, axis=-1)\n else:\n logit_mask = label\n if 'int' in str(logit_mask.dtype):\n logit_mask = tf.to_float(logit_mask)\n try:\n label_logits = reduce_sum(logit_mask * model_logits, axis=-1)\n except TypeError:\n raise TypeError("Could not take row-wise dot product between "\n "logit mask, of dtype " + str(logit_mask.dtype)\n + " and model_logits, of dtype "\n + str(model_logits.dtype))\n logits_with_target_label_neg_inf = model_logits - logit_mask * 99999\n highest_nonlabel_logits = reduce_max(\n logits_with_target_label_neg_inf, axis=-1)\n loss = highest_nonlabel_logits - label_logits\n return loss\n\n\ndef _apply_black_border(x, border_size):\n orig_height = x.get_shape().as_list()[1]\n orig_width = x.get_shape().as_list()[2]\n x = tf.image.resize_images(x, (orig_width - 2*border_size,\n orig_height - 2*border_size))\n\n return tf.pad(x, [[0, 0],\n [border_size, border_size],\n [border_size, border_size],\n [0, 0]], 'CONSTANT')\n\n\ndef _apply_transformation(inputs):\n x, trans = inputs[0], inputs[1]\n dx, dy, angle = trans[0], trans[1], trans[2]\n height = x.get_shape().as_list()[1]\n width = x.get_shape().as_list()[2]\n\n # Pad the image to prevent two-step rotation / translation from truncating\n # corners\n max_dist_from_center = np.sqrt(height**2+width**2) / 2\n min_edge_from_center = float(np.min([height, width])) / 2\n padding = np.ceil(max_dist_from_center -\n min_edge_from_center).astype(np.int32)\n x = tf.pad(x, [[0, 0],\n [padding, padding],\n [padding, padding],\n [0, 0]],\n 'CONSTANT')\n\n # Apply rotation\n angle *= np.pi / 180\n x = tfa.image.rotate(x, angle, interpolation='BILINEAR')\n\n # Apply translation\n dx_in_px = -dx * height\n dy_in_px = -dy * width\n translation = tf.convert_to_tensor([dx_in_px, dy_in_px])\n\n try:\n x = tfa.image.translate(x, translation, interpolation='BILINEAR')\n except AttributeError as e:\n print("WARNING: SpatialAttack requires tf 1.6 or higher")\n raise e\n x = tfa.image.translate(x, translation, interpolation='BILINEAR')\n return tf.image.resize_image_with_crop_or_pad(x, height, width)\n\n\ndef spm(x, model, y=None, n_samples=None, dx_min=-0.1,\n dx_max=0.1, n_dxs=5, dy_min=-0.1, dy_max=0.1, n_dys=5,\n angle_min=-30, angle_max=30, n_angles=31, black_border_size=0):\n """\n TensorFlow implementation of the Spatial Transformation Method.\n :return: a tensor for the adversarial example\n """\n if y is None:\n preds = model.get_probs(x)\n # Using model predictions as ground truth to avoid label leaking\n preds_max = reduce_max(preds, 1, keepdims=True)\n y = tf.to_float(tf.equal(preds, preds_max))\n y = tf.stop_gradient(y)\n del preds\n y = y / reduce_sum(y, 1, keepdims=True)\n\n # Define the range of transformations\n dxs = np.linspace(dx_min, dx_max, n_dxs)\n dys = np.linspace(dy_min, dy_max, n_dys)\n angles = np.linspace(angle_min, angle_max, n_angles)\n\n if n_samples is None:\n import itertools\n transforms = list(itertools.product(*[dxs, dys, angles]))\n else:\n sampled_dxs = np.random.choice(dxs, n_samples)\n sampled_dys = np.random.choice(dys, n_samples)\n sampled_angles = np.random.choice(angles, n_samples)\n transforms = zip(sampled_dxs, sampled_dys, sampled_angles)\n transformed_ims = parallel_apply_transformations(\n x, transforms, black_border_size)\n\n def _compute_xent(x):\n preds = model.get_logits(x)\n return tf.nn.softmax_cross_entropy_with_logits_v2(\n labels=y, logits=preds)\n\n all_xents = tf.map_fn(\n _compute_xent,\n transformed_ims,\n parallel_iterations=1) # Must be 1 to avoid keras race conditions\n\n # Return the adv_x with worst accuracy\n\n # all_xents is n_total_samples x batch_size (SB)\n all_xents = tf.stack(all_xents) # SB\n\n # We want the worst case sample, with the largest xent_loss\n worst_sample_idx = tf.argmax(all_xents, axis=0) # B\n\n batch_size = tf.shape(x)[0]\n keys = tf.stack([\n tf.range(batch_size, dtype=tf.int32),\n tf.cast(worst_sample_idx, tf.int32)\n ], axis=1)\n transformed_ims_bshwc = tf.einsum('sbhwc->bshwc', transformed_ims)\n after_lookup = tf.gather_nd(transformed_ims_bshwc, keys) # BHWC\n return after_lookup\n\n\ndef parallel_apply_transformations(x, transforms, black_border_size=0):\n """\n Apply image transformations in parallel.\n :param transforms: TODO\n :param black_border_size: int, size of black border to apply\n Returns:\n Transformed images\n """\n transforms = tf.convert_to_tensor(transforms, dtype=tf.float32)\n x = _apply_black_border(x, black_border_size)\n\n num_transforms = transforms.get_shape().as_list()[0]\n im_shape = x.get_shape().as_list()[1:]\n\n # Pass a copy of x and a transformation to each iteration of the map_fn\n # callable\n tiled_x = tf.reshape(\n tf.tile(x, [num_transforms, 1, 1, 1]),\n [num_transforms, -1] + im_shape)\n elems = [tiled_x, transforms]\n transformed_ims = tf.map_fn(\n _apply_transformation,\n elems,\n dtype=tf.float32,\n parallel_iterations=1, # Must be 1 to avoid keras race conditions\n )\n return transformed_ims\n\n\n[docs]def projected_optimization(loss_fn,\n input_image,\n label,\n epsilon,\n num_steps,\n clip_min=None,\n clip_max=None,\n optimizer=TensorAdam(),\n project_perturbation=_project_perturbation,\n early_stop_loss_threshold=None,\n is_debug=False):\n """Generic projected optimization, generalized to work with approximate\n gradients. Used for e.g. the SPSA attack.\n\n Args:\n :param loss_fn: A callable which takes `input_image` and `label` as\n arguments, and returns a batch of loss values. Same\n interface as TensorOptimizer.\n :param input_image: Tensor, a batch of images\n :param label: Tensor, a batch of labels\n :param epsilon: float, the L-infinity norm of the maximum allowable\n perturbation\n :param num_steps: int, the number of steps of gradient descent\n :param clip_min: float, minimum pixel value\n :param clip_max: float, maximum pixel value\n :param optimizer: A `TensorOptimizer` object\n :param project_perturbation: A function, which will be used to enforce\n some constraint. It should have the same\n signature as `_project_perturbation`.\n :param early_stop_loss_threshold: A float or None. If specified, the attack will end if the loss is below\n `early_stop_loss_threshold`.\n Enabling this option can have several different effects:\n - Setting the threshold to 0. guarantees that if a successful attack is found, it is returned.\n This increases the attack success rate, because without early stopping the optimizer can accidentally\n bounce back to a point where the attack fails.\n - Early stopping can make the attack run faster because it may run for fewer steps.\n - Early stopping can make the attack run slower because the loss must be calculated at each step.\n The loss is not calculated as part of the normal SPSA optimization procedure.\n For most reasonable choices of hyperparameters, early stopping makes the attack much faster because\n it decreases the number of steps dramatically.\n :param is_debug: A bool. If True, print debug info for attack progress.\n\n Returns:\n adversarial version of `input_image`, with L-infinity difference less than\n epsilon, which tries to minimize loss_fn.\n\n Note that this function is not intended as an Attack by itself. Rather, it\n is designed as a helper function which you can use to write your own attack\n methods. The method uses a tf.while_loop to optimize a loss function in\n a single sess.run() call.\n """\n assert num_steps is not None\n if is_debug:\n with tf.device("/cpu:0"):\n input_image = tf.Print(\n input_image, [],\n "Starting PGD attack with epsilon: %s" % epsilon)\n\n init_perturbation = tf.random_uniform(\n tf.shape(input_image),\n minval=tf.cast(-epsilon, input_image.dtype),\n maxval=tf.cast(epsilon, input_image.dtype),\n dtype=input_image.dtype)\n init_perturbation = project_perturbation(init_perturbation, epsilon,\n input_image, clip_min=clip_min,\n clip_max=clip_max)\n init_optim_state = optimizer.init_state([init_perturbation])\n nest = tf.nest\n\n def loop_body(i, perturbation, flat_optim_state):\n """Update perturbation to input image."""\n optim_state = nest.pack_sequence_as(\n structure=init_optim_state, flat_sequence=flat_optim_state)\n\n def wrapped_loss_fn(x):\n return loss_fn(input_image + x, label)\n\n new_perturbation_list, new_optim_state = optimizer.minimize(\n wrapped_loss_fn, [perturbation], optim_state)\n projected_perturbation = project_perturbation(new_perturbation_list[0],\n epsilon, input_image,\n clip_min=clip_min,\n clip_max=clip_max)\n\n # Be careful with this bool. A value of 0. is a valid threshold but evaluates to False, so we must explicitly\n # check whether the value is None.\n early_stop = early_stop_loss_threshold is not None\n compute_loss = is_debug or early_stop\n # Don't waste time building the loss graph if we're not going to use it\n if compute_loss:\n # NOTE: this step is not actually redundant with the optimizer step.\n # SPSA calculates the loss at randomly perturbed points but doesn't calculate the loss at the current point.\n loss = reduce_mean(wrapped_loss_fn(projected_perturbation), axis=0)\n\n if is_debug:\n with tf.device("/cpu:0"):\n loss = tf.Print(loss, [loss], "Total batch loss")\n\n if early_stop:\n i = tf.cond(tf.less(loss, early_stop_loss_threshold),\n lambda: float(num_steps), lambda: i)\n\n return i + 1, projected_perturbation, nest.flatten(new_optim_state)\n\n def cond(i, *_):\n return tf.less(i, num_steps)\n\n flat_init_optim_state = nest.flatten(init_optim_state)\n _, final_perturbation, _ = tf.while_loop(\n cond,\n loop_body,\n loop_vars=(tf.constant(0.), init_perturbation, flat_init_optim_state),\n parallel_iterations=1,\n back_prop=False,\n maximum_iterations=num_steps)\n if project_perturbation is _project_perturbation:\n # TODO: this assert looks totally wrong.\n # Not bothering to fix it now because it's only an assert.\n # 1) Multiplying by 1.1 gives a huge margin of error. This should probably\n # take the difference and allow a tolerance of 1e-6 or something like\n # that.\n # 2) I think it should probably check the *absolute value* of\n # final_perturbation\n perturbation_max = epsilon * 1.1\n check_diff = utils_tf.assert_less_equal(\n final_perturbation,\n tf.cast(perturbation_max, final_perturbation.dtype),\n message="final_perturbation must change no pixel by more than "\n "%s" % perturbation_max)\n else:\n # TODO: let caller pass in a check_diff function as well as\n # project_perturbation\n check_diff = tf.no_op()\n\n if clip_min is None or clip_max is None:\n raise NotImplementedError("This function only supports clipping for now")\n check_range = [utils_tf.assert_less_equal(input_image,\n tf.cast(clip_max,\n input_image.dtype)),\n utils_tf.assert_greater_equal(input_image,\n tf.cast(clip_min,\n input_image.dtype))]\n\n with tf.control_dependencies([check_diff] + check_range):\n adversarial_image = input_image + final_perturbation\n return tf.stop_gradient(adversarial_image)\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/compat.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.attacks.virtual_adversarial_method
\n"""The VirtualAdversarialMethod attack\n\n"""\n\nimport warnings\n\nimport tensorflow as tf\n\nfrom cleverhans.attacks.attack import Attack\nfrom cleverhans.model import Model, CallableModelWrapper\nfrom cleverhans.model import wrapper_warning_logits\nfrom cleverhans import utils_tf\n\ntf_dtype = tf.as_dtype('float32')\n\n[docs]class VirtualAdversarialMethod(Attack):\n """\n This attack was originally proposed by Miyato et al. (2016) and was used\n for virtual adversarial training.\n Paper link: https://arxiv.org/abs/1507.00677\n\n :param model: cleverhans.model.Model\n :param sess: optional tf.Session\n :param dtypestr: dtype of the data\n :param kwargs: passed through to super constructor\n """\n\n def __init__(self, model, sess=None, dtypestr='float32', **kwargs):\n """\n Note: the model parameter should be an instance of the\n cleverhans.model.Model abstraction provided by CleverHans.\n """\n if not isinstance(model, Model):\n wrapper_warning_logits()\n model = CallableModelWrapper(model, 'logits')\n\n super(VirtualAdversarialMethod, self).__init__(model, sess, dtypestr,\n **kwargs)\n\n self.feedable_kwargs = ('eps', 'xi', 'clip_min', 'clip_max')\n self.structural_kwargs = ['num_iterations']\n\n[docs] def generate(self, x, **kwargs):\n """\n Generate symbolic graph for adversarial examples and return.\n\n :param x: The model's symbolic inputs.\n :param kwargs: See `parse_params`\n """\n # Parse and save attack-specific parameters\n assert self.parse_params(**kwargs)\n\n return vatm(\n self.model,\n x,\n self.model.get_logits(x),\n eps=self.eps,\n num_iterations=self.num_iterations,\n xi=self.xi,\n clip_min=self.clip_min,\n clip_max=self.clip_max)\n\n[docs] def parse_params(self,\n eps=2.0,\n nb_iter=None,\n xi=1e-6,\n clip_min=None,\n clip_max=None,\n num_iterations=None,\n **kwargs):\n """\n Take in a dictionary of parameters and applies attack-specific checks\n before saving them as attributes.\n\n Attack-specific parameters:\n\n :param eps: (optional float )the epsilon (input variation parameter)\n :param nb_iter: (optional) the number of iterations\n Defaults to 1 if not specified\n :param xi: (optional float) the finite difference parameter\n :param clip_min: (optional float) Minimum input component value\n :param clip_max: (optional float) Maximum input component value\n :param num_iterations: Deprecated alias for `nb_iter`\n """\n # Save attack-specific parameters\n self.eps = eps\n if num_iterations is not None:\n warnings.warn("`num_iterations` is deprecated. Switch to `nb_iter`."\n " The old name will be removed on or after 2019-04-26.")\n # Note: when we remove the deprecated alias, we can put the default\n # value of 1 for nb_iter back in the method signature\n assert nb_iter is None\n nb_iter = num_iterations\n del num_iterations\n if nb_iter is None:\n nb_iter = 1\n self.num_iterations = nb_iter\n self.xi = xi\n self.clip_min = clip_min\n self.clip_max = clip_max\n if len(kwargs.keys()) > 0:\n warnings.warn("kwargs is unused and will be removed on or after "\n "2019-04-26.")\n return True\n\n\n[docs]def vatm(model,\n x,\n logits,\n eps,\n num_iterations=1,\n xi=1e-6,\n clip_min=None,\n clip_max=None,\n scope=None):\n """\n Tensorflow implementation of the perturbation method used for virtual\n adversarial training: https://arxiv.org/abs/1507.00677\n :param model: the model which returns the network unnormalized logits\n :param x: the input placeholder\n :param logits: the model's unnormalized output tensor (the input to\n the softmax layer)\n :param eps: the epsilon (input variation parameter)\n :param num_iterations: the number of iterations\n :param xi: the finite difference parameter\n :param clip_min: optional parameter that can be used to set a minimum\n value for components of the example returned\n :param clip_max: optional parameter that can be used to set a maximum\n value for components of the example returned\n :param seed: the seed for random generator\n :return: a tensor for the adversarial example\n """\n with tf.name_scope(scope, "virtual_adversarial_perturbation"):\n d = tf.random_normal(tf.shape(x), dtype=tf_dtype)\n for _ in range(num_iterations):\n d = xi * utils_tf.l2_batch_normalize(d)\n logits_d = model.get_logits(x + d)\n kl = utils_tf.kl_with_logits(logits, logits_d)\n Hd = tf.gradients(kl, d)[0]\n d = tf.stop_gradient(Hd)\n d = eps * utils_tf.l2_batch_normalize(d)\n adv_x = x + d\n if (clip_min is not None) and (clip_max is not None):\n adv_x = tf.clip_by_value(adv_x, clip_min, clip_max)\n return adv_x\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/model.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.compat
\n"""\nWrapper functions for writing code that is compatible with many versions\nof TensorFlow.\n"""\nimport warnings\nimport tensorflow as tf\n# The following 2 imports are not used in this module. They are imported so that users of cleverhans.compat can\n# get access to device_lib, app, and flags. A pylint bug makes these imports cause errors when using python3+tf1.8.\n# Doing the sanitized import here once makes it possible to do "from cleverhans.compat import flags" throughout the\n# library without needing to repeat the pylint boilerplate.\nfrom tensorflow.python.client import device_lib # pylint: disable=no-name-in-module,unused-import\nfrom tensorflow.python.platform import app, flags # pylint: disable=no-name-in-module,unused-import\n\ndef _wrap(f):\n """\n Wraps a callable `f` in a function that warns that the function is deprecated.\n """\n def wrapper(*args, **kwargs):\n """\n Issues a deprecation warning and passes through the arguments.\n """\n warnings.warn(str(f) + " is deprecated. Switch to calling the equivalent function in tensorflow. "\n " This function was originally needed as a compatibility layer for old versions of tensorflow, "\n " but support for those versions has now been dropped.")\n return f(*args, **kwargs)\n return wrapper\n\nreduce_sum = _wrap(tf.reduce_sum)\nreduce_max = _wrap(tf.reduce_max)\nreduce_min = _wrap(tf.reduce_min)\nreduce_mean = _wrap(tf.reduce_mean)\nreduce_prod = _wrap(tf.reduce_prod)\nreduce_any = _wrap(tf.reduce_any)\n\ndef reduce_function(op_func, input_tensor, axis=None, keepdims=None,\n name=None, reduction_indices=None):\n """\n This function used to be needed to support tf 1.4 and early, but support for tf 1.4 and earlier is now dropped.\n :param op_func: expects the function to handle eg: tf.reduce_sum.\n :param input_tensor: The tensor to reduce. Should have numeric type.\n :param axis: The dimensions to reduce. If None (the default),\n reduces all dimensions. Must be in the range\n [-rank(input_tensor), rank(input_tensor)).\n :param keepdims: If true, retains reduced dimensions with length 1.\n :param name: A name for the operation (optional).\n :param reduction_indices: The old (deprecated) name for axis.\n :return: outputs same value as op_func.\n """\n\n warnings.warn("`reduce_function` is deprecated and may be removed on or after 2019-09-08.")\n\n out = op_func(input_tensor, axis=axis, keepdims=keepdims, name=name, reduction_indices=reduction_indices)\n\n return out\n\n[docs]def softmax_cross_entropy_with_logits(sentinel=None,\n labels=None,\n logits=None,\n dim=-1):\n """\n Wrapper around tf.nn.softmax_cross_entropy_with_logits_v2 to handle\n deprecated warning\n """\n # Make sure that all arguments were passed as named arguments.\n if sentinel is not None:\n name = "softmax_cross_entropy_with_logits"\n raise ValueError("Only call `%s` with "\n "named arguments (labels=..., logits=..., ...)"\n % name)\n if labels is None or logits is None:\n raise ValueError("Both labels and logits must be provided.")\n\n try:\n f = tf.nn.softmax_cross_entropy_with_logits_v2\n except AttributeError:\n raise RuntimeError("This version of TensorFlow is no longer supported. See cleverhans/README.md")\n\n labels = tf.stop_gradient(labels)\n loss = f(labels=labels, logits=logits, dim=dim)\n\n return loss\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/cleverhans/utils_tf.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.model
\n"""\nThe Model class and related functionality.\n"""\nfrom abc import ABCMeta\nimport warnings\n\nimport tensorflow as tf\n\nfrom cleverhans import utils_tf\n\n\n[docs]class Model(object):\n """\n An abstract interface for model wrappers that exposes model symbols\n needed for making an attack. This abstraction removes the dependency on\n any specific neural network package (e.g. Keras) from the core\n code of CleverHans. It can also simplify exposing the hidden features of a\n model when a specific package does not directly expose them.\n """\n __metaclass__ = ABCMeta\n O_LOGITS, O_PROBS, O_FEATURES = 'logits probs features'.split()\n\n def __init__(self, scope=None, nb_classes=None, hparams=None,\n needs_dummy_fprop=False):\n """\n Constructor.\n :param scope: str, the name of model.\n :param nb_classes: integer, the number of classes.\n :param hparams: dict, hyper-parameters for the model.\n :needs_dummy_fprop: bool, if True the model's parameters are not\n created until fprop is called.\n """\n self.scope = scope or self.__class__.__name__\n self.nb_classes = nb_classes\n self.hparams = hparams or {}\n self.needs_dummy_fprop = needs_dummy_fprop\n\n def __call__(self, *args, **kwargs):\n """\n For compatibility with functions used as model definitions (taking\n an input tensor and returning the tensor giving the output\n of the model on that input).\n """\n\n warnings.warn("Model.__call__ is deprecated. "\n "The call is ambiguous as to whether the output should "\n "be logits or probabilities, and getting the wrong one "\n "can cause serious problems. "\n "The output actually is probabilities, which are a very "\n "dangerous thing to use as part of any interface for "\n "cleverhans, because softmax probabilities are prone "\n "to gradient masking."\n "On or after 2019-04-24, this method will change to raise "\n "an exception explaining why Model.__call__ should not be "\n "used.")\n\n return self.get_probs(*args, **kwargs)\n\n[docs] def get_logits(self, x, **kwargs):\n """\n :param x: A symbolic representation (Tensor) of the network input\n :return: A symbolic representation (Tensor) of the output logits\n (i.e., the values fed as inputs to the softmax layer).\n """\n outputs = self.fprop(x, **kwargs)\n if self.O_LOGITS in outputs:\n return outputs[self.O_LOGITS]\n raise NotImplementedError(str(type(self)) + "must implement `get_logits`"\n " or must define a " + self.O_LOGITS +\n " output in `fprop`")\n\n[docs] def get_predicted_class(self, x, **kwargs):\n """\n :param x: A symbolic representation (Tensor) of the network input\n :return: A symbolic representation (Tensor) of the predicted label\n """\n return tf.argmax(self.get_logits(x, **kwargs), axis=1)\n\n[docs] def get_probs(self, x, **kwargs):\n """\n :param x: A symbolic representation (Tensor) of the network input\n :return: A symbolic representation (Tensor) of the output\n probabilities (i.e., the output values produced by the softmax layer).\n """\n d = self.fprop(x, **kwargs)\n if self.O_PROBS in d:\n output = d[self.O_PROBS]\n min_prob = tf.reduce_min(output)\n max_prob = tf.reduce_max(output)\n asserts = [utils_tf.assert_greater_equal(min_prob,\n tf.cast(0., min_prob.dtype)),\n utils_tf.assert_less_equal(max_prob,\n tf.cast(1., min_prob.dtype))]\n with tf.control_dependencies(asserts):\n output = tf.identity(output)\n return output\n elif self.O_LOGITS in d:\n return tf.nn.softmax(logits=d[self.O_LOGITS])\n else:\n raise ValueError('Cannot find probs or logits.')\n\n[docs] def fprop(self, x, **kwargs):\n """\n Forward propagation to compute the model outputs.\n :param x: A symbolic representation of the network input\n :return: A dictionary mapping layer names to the symbolic\n representation of their output.\n """\n raise NotImplementedError('`fprop` not implemented.')\n\n[docs] def get_params(self):\n """\n Provides access to the model's parameters.\n :return: A list of all Variables defining the model parameters.\n """\n\n if hasattr(self, 'params'):\n return list(self.params)\n\n # Catch eager execution and assert function overload.\n try:\n if tf.executing_eagerly():\n raise NotImplementedError("For Eager execution - get_params "\n "must be overridden.")\n except AttributeError:\n pass\n\n # For graph-based execution\n scope_vars = tf.get_collection(tf.GraphKeys.TRAINABLE_VARIABLES,\n self.scope + "/")\n\n if len(scope_vars) == 0:\n self.make_params()\n scope_vars = tf.get_collection(tf.GraphKeys.TRAINABLE_VARIABLES,\n self.scope + "/")\n assert len(scope_vars) > 0\n\n # Make sure no parameters have been added or removed\n if hasattr(self, "num_params"):\n if self.num_params != len(scope_vars):\n print("Scope: ", self.scope)\n print("Expected " + str(self.num_params) + " variables")\n print("Got " + str(len(scope_vars)))\n for var in scope_vars:\n print("\\t" + str(var))\n assert False\n else:\n self.num_params = len(scope_vars)\n\n return scope_vars\n\n[docs] def make_params(self):\n """\n Create all Variables to be returned later by get_params.\n By default this is a no-op.\n Models that need their fprop to be called for their params to be\n created can set `needs_dummy_fprop=True` in the constructor.\n """\n\n if self.needs_dummy_fprop:\n if hasattr(self, "_dummy_input"):\n return\n self._dummy_input = self.make_input_placeholder()\n self.fprop(self._dummy_input)\n\n[docs] def get_layer_names(self):\n """Return the list of exposed layers for this model."""\n raise NotImplementedError\n\n[docs] def get_layer(self, x, layer, **kwargs):\n """Return a layer output.\n :param x: tensor, the input to the network.\n :param layer: str, the name of the layer to compute.\n :param **kwargs: dict, extra optional params to pass to self.fprop.\n :return: the content of layer `layer`\n """\n return self.fprop(x, **kwargs)[layer]\n\n[docs] def make_input_placeholder(self):\n """Create and return a placeholder representing an input to the model.\n\n This method should respect context managers (e.g. "with tf.device")\n and should not just return a reference to a single pre-created\n placeholder.\n """\n\n raise NotImplementedError(str(type(self)) + " does not implement "\n "make_input_placeholder")\n\n[docs] def make_label_placeholder(self):\n """Create and return a placeholder representing class labels.\n\n This method should respect context managers (e.g. "with tf.device")\n and should not just return a reference to a single pre-created\n placeholder.\n """\n\n raise NotImplementedError(str(type(self)) + " does not implement "\n "make_label_placeholder")\n\n def __hash__(self):\n return hash(id(self))\n\n def __eq__(self, other):\n return self is other\n\n\n[docs]class CallableModelWrapper(Model):\n """A wrapper that turns a callable into a valid Model"""\n\n def __init__(self, callable_fn, output_layer):\n """\n Wrap a callable function that takes a tensor as input and returns\n a tensor as output with the given layer name.\n :param callable_fn: The callable function taking a tensor and\n returning a given layer as output.\n :param output_layer: A string of the output layer returned by the\n function. (Usually either "probs" or "logits".)\n """\n\n super(CallableModelWrapper, self).__init__()\n self.output_layer = output_layer\n self.callable_fn = callable_fn\n\n[docs] def fprop(self, x, **kwargs):\n output = self.callable_fn(x, **kwargs)\n\n # Do some sanity checking to reduce the chance that probs are used\n # as logits accidentally or vice versa\n if self.output_layer == 'probs':\n assert output.op.type == "Softmax"\n min_prob = tf.reduce_min(output)\n max_prob = tf.reduce_max(output)\n asserts = [utils_tf.assert_greater_equal(min_prob,\n tf.cast(0., min_prob.dtype)),\n utils_tf.assert_less_equal(max_prob,\n tf.cast(1., max_prob.dtype))]\n with tf.control_dependencies(asserts):\n output = tf.identity(output)\n elif self.output_layer == 'logits':\n assert output.op.type != 'Softmax'\n\n return {self.output_layer: output}\n\n[docs]def wrapper_warning():\n """\n Issue a deprecation warning. Used in multiple places that implemented\n attacks by automatically wrapping a user-supplied callable with a\n CallableModelWrapper with output_layer="probs".\n Using "probs" as any part of the attack interface is dangerous.\n We can't just change output_layer to logits because:\n - that would be a silent interface change. We'd have no way of detecting\n code that still means to use probs. Note that we can't just check whether\n the final output op is a softmax---for example, Inception puts a reshape\n after the softmax.\n - automatically wrapping user-supplied callables with output_layer='logits'\n is even worse, see `wrapper_warning_logits`\n Note: this function will be removed at the same time as the code that\n calls it.\n """\n warnings.warn("Passing a callable is deprecated, because using"\n " probabilities is dangerous. It has a high risk "\n " of causing gradient masking due to loss of precision "\n " in the softmax op. Passing a callable rather than a "\n " Model subclass will become an error on or after "\n " 2019-04-24.")\n\n[docs]def wrapper_warning_logits():\n """\n Issue a deprecation warning. Used in multiple places that implemented\n attacks by automatically wrapping a user-supplied callable with a\n CallableModelWrapper with output_layer="logits".\n This is dangerous because it is under-the-hood automagic that the user\n may not realize has been invoked for them. If they pass a callable\n that actually outputs probs, the probs will be treated as logits,\n resulting in an incorrect cross-entropy loss and severe gradient\n masking.\n """\n warnings.warn("Passing a callable is deprecated, because it runs the "\n "risk of accidentally using probabilities in the place "\n "of logits. Please switch to passing a Model subclass "\n "so that you clearly specify which values are the logits. "\n "Passing a callable rather than a Model subclass will become "\n "an error on or after 2019-04-24.")\n\n\n[docs]class NoSuchLayerError(ValueError):\n """Raised when a layer that does not exist is requested."""\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_modules/index.html",
"content": "\n\n\n\n \n \n \n \n
\n \n \n \n \n\n
\n \n \n \n\n
\n \n Source code for cleverhans.utils_tf
\n"""Utility functions for writing TensorFlow code"""\nfrom __future__ import absolute_import\nfrom __future__ import division\nfrom __future__ import print_function\nfrom __future__ import unicode_literals\n\nimport logging\nimport math\nimport os\nimport time\nimport warnings\n\nimport numpy as np\nimport six\nfrom six.moves import xrange\nimport tensorflow as tf\n\nfrom cleverhans.compat import device_lib\nfrom cleverhans.compat import reduce_sum, reduce_mean\nfrom cleverhans.compat import reduce_max\nfrom cleverhans.compat import softmax_cross_entropy_with_logits\nfrom cleverhans.utils import batch_indices, _ArgsWrapper, create_logger\n\n_logger = create_logger("cleverhans.utils.tf")\n_logger.setLevel(logging.INFO)\n\n\ndef model_loss(y, model, mean=True):\n """\n Define loss of TF graph\n :param y: correct labels\n :param model: output of the model\n :param mean: boolean indicating whether should return mean of loss\n or vector of losses for each input of the batch\n :return: return mean of loss if True, otherwise return vector with per\n sample loss\n """\n warnings.warn("This function is deprecated and will be removed on or after"\n " 2019-04-05. Switch to cleverhans.train.train.")\n op = model.op\n if op.type == "Softmax":\n logits, = op.inputs\n else:\n logits = model\n\n out = softmax_cross_entropy_with_logits(logits=logits, labels=y)\n\n if mean:\n out = reduce_mean(out)\n return out\n\n\ndef initialize_uninitialized_global_variables(sess):\n """\n Only initializes the variables of a TensorFlow session that were not\n already initialized.\n :param sess: the TensorFlow session\n :return:\n """\n # List all global variables\n global_vars = tf.global_variables()\n\n # Find initialized status for all variables\n is_var_init = [tf.is_variable_initialized(var) for var in global_vars]\n is_initialized = sess.run(is_var_init)\n\n # List all variables that were not initialized previously\n not_initialized_vars = [var for (var, init) in\n zip(global_vars, is_initialized) if not init]\n\n # Initialize all uninitialized variables found, if any\n if len(not_initialized_vars):\n sess.run(tf.variables_initializer(not_initialized_vars))\n\n\ndef train(sess, loss, x, y, X_train, Y_train, save=False,\n init_all=False, evaluate=None, feed=None, args=None,\n rng=None, var_list=None, fprop_args=None, optimizer=None):\n """\n Train a TF graph.\n This function is deprecated. Prefer cleverhans.train.train when possible.\n cleverhans.train.train supports multiple GPUs but this function is still\n needed to support legacy models that do not support calling fprop more\n than once.\n\n :param sess: TF session to use when training the graph\n :param loss: tensor, the model training loss.\n :param x: input placeholder\n :param y: output placeholder (for labels)\n :param X_train: numpy array with training inputs\n :param Y_train: numpy array with training outputs\n :param save: boolean controlling the save operation\n :param init_all: (boolean) If set to true, all TF variables in the session\n are (re)initialized, otherwise only previously\n uninitialized variables are initialized before training.\n :param evaluate: function that is run after each training iteration\n (typically to display the test/validation accuracy).\n :param feed: An optional dictionary that is appended to the feeding\n dictionary before the session runs. Can be used to feed\n the learning phase of a Keras model for instance.\n :param args: dict or argparse `Namespace` object.\n Should contain `nb_epochs`, `learning_rate`,\n `batch_size`\n If save is True, should also contain 'train_dir'\n and 'filename'\n :param rng: Instance of numpy.random.RandomState\n :param var_list: Optional list of parameters to train.\n :param fprop_args: dict, extra arguments to pass to fprop (loss and model).\n :param optimizer: Optimizer to be used for training\n :return: True if model trained\n """\n warnings.warn("This function is deprecated and will be removed on or after"\n " 2019-04-05. Switch to cleverhans.train.train.")\n\n args = _ArgsWrapper(args or {})\n fprop_args = fprop_args or {}\n\n # Check that necessary arguments were given (see doc above)\n assert args.nb_epochs, "Number of epochs was not given in args dict"\n if optimizer is None:\n assert args.learning_rate is not None, ("Learning rate was not given "\n "in args dict")\n assert args.batch_size, "Batch size was not given in args dict"\n\n if save:\n assert args.train_dir, "Directory for save was not given in args dict"\n assert args.filename, "Filename for save was not given in args dict"\n\n if rng is None:\n rng = np.random.RandomState()\n\n # Define optimizer\n loss_value = loss.fprop(x, y, **fprop_args)\n if optimizer is None:\n optimizer = tf.train.AdamOptimizer(learning_rate=args.learning_rate)\n else:\n if not isinstance(optimizer, tf.train.Optimizer):\n raise ValueError("optimizer object must be from a child class of "\n "tf.train.Optimizer")\n # Trigger update operations within the default graph (such as batch_norm).\n with tf.control_dependencies(tf.get_collection(tf.GraphKeys.UPDATE_OPS)):\n train_step = optimizer.minimize(loss_value, var_list=var_list)\n\n with sess.as_default():\n if hasattr(tf, "global_variables_initializer"):\n if init_all:\n tf.global_variables_initializer().run()\n else:\n initialize_uninitialized_global_variables(sess)\n else:\n warnings.warn("Update your copy of tensorflow; future versions of "\n "CleverHans may drop support for this version.")\n sess.run(tf.initialize_all_variables())\n\n for epoch in xrange(args.nb_epochs):\n # Compute number of batches\n nb_batches = int(math.ceil(float(len(X_train)) / args.batch_size))\n assert nb_batches * args.batch_size >= len(X_train)\n\n # Indices to shuffle training set\n index_shuf = list(range(len(X_train)))\n rng.shuffle(index_shuf)\n\n prev = time.time()\n for batch in range(nb_batches):\n\n # Compute batch start and end indices\n start, end = batch_indices(\n batch, len(X_train), args.batch_size)\n\n # Perform one training step\n feed_dict = {x: X_train[index_shuf[start:end]],\n y: Y_train[index_shuf[start:end]]}\n if feed is not None:\n feed_dict.update(feed)\n train_step.run(feed_dict=feed_dict)\n assert end >= len(X_train) # Check that all examples were used\n cur = time.time()\n _logger.info("Epoch " + str(epoch) + " took " +\n str(cur - prev) + " seconds")\n if evaluate is not None:\n evaluate()\n\n if save:\n save_path = os.path.join(args.train_dir, args.filename)\n saver = tf.train.Saver()\n saver.save(sess, save_path)\n _logger.info("Completed model training and saved at: " +\n str(save_path))\n else:\n _logger.info("Completed model training.")\n\n return True\n\n\ndef model_eval(sess, x, y, predictions, X_test=None, Y_test=None,\n feed=None, args=None):\n """\n Compute the accuracy of a TF model on some data\n :param sess: TF session to use\n :param x: input placeholder\n :param y: output placeholder (for labels)\n :param predictions: model output predictions\n :param X_test: numpy array with training inputs\n :param Y_test: numpy array with training outputs\n :param feed: An optional dictionary that is appended to the feeding\n dictionary before the session runs. Can be used to feed\n the learning phase of a Keras model for instance.\n :param args: dict or argparse `Namespace` object.\n Should contain `batch_size`\n :return: a float with the accuracy value\n """\n global _model_eval_cache\n args = _ArgsWrapper(args or {})\n\n assert args.batch_size, "Batch size was not given in args dict"\n if X_test is None or Y_test is None:\n raise ValueError("X_test argument and Y_test argument "\n "must be supplied.")\n\n # Define accuracy symbolically\n key = (y, predictions)\n if key in _model_eval_cache:\n correct_preds = _model_eval_cache[key]\n else:\n correct_preds = tf.equal(tf.argmax(y, axis=-1),\n tf.argmax(predictions, axis=-1))\n _model_eval_cache[key] = correct_preds\n\n # Init result var\n accuracy = 0.0\n\n with sess.as_default():\n # Compute number of batches\n nb_batches = int(math.ceil(float(len(X_test)) / args.batch_size))\n assert nb_batches * args.batch_size >= len(X_test)\n\n X_cur = np.zeros((args.batch_size,) + X_test.shape[1:],\n dtype=X_test.dtype)\n Y_cur = np.zeros((args.batch_size,) + Y_test.shape[1:],\n dtype=Y_test.dtype)\n for batch in range(nb_batches):\n if batch % 100 == 0 and batch > 0:\n _logger.debug("Batch " + str(batch))\n\n # Must not use the `batch_indices` function here, because it\n # repeats some examples.\n # It's acceptable to repeat during training, but not eval.\n start = batch * args.batch_size\n end = min(len(X_test), start + args.batch_size)\n\n # The last batch may be smaller than all others. This should not\n # affect the accuarcy disproportionately.\n cur_batch_size = end - start\n X_cur[:cur_batch_size] = X_test[start:end]\n Y_cur[:cur_batch_size] = Y_test[start:end]\n feed_dict = {x: X_cur, y: Y_cur}\n if feed is not None:\n feed_dict.update(feed)\n cur_corr_preds = correct_preds.eval(feed_dict=feed_dict)\n\n accuracy += cur_corr_preds[:cur_batch_size].sum()\n\n assert end >= len(X_test)\n\n # Divide by number of examples to get final value\n accuracy /= len(X_test)\n\n return accuracy\n\n_model_eval_cache = {}\n\n\ndef tf_model_load(sess, file_path=None):\n """\n\n :param sess: the session object to restore\n :param file_path: path to the restored session, if None is\n taken from FLAGS.train_dir and FLAGS.filename\n :return:\n """\n with sess.as_default():\n saver = tf.train.Saver()\n if file_path is None:\n error = 'file_path argument is missing.'\n raise ValueError(error)\n saver.restore(sess, file_path)\n\n return True\n\n\ndef batch_eval(*args, **kwargs):\n """\n Wrapper around deprecated function.\n """\n # Inside function to avoid circular import\n from cleverhans.evaluation import batch_eval as new_batch_eval\n warnings.warn("batch_eval has moved to cleverhans.evaluation. "\n "batch_eval will be removed from utils_tf on or after "\n "2019-03-09.")\n return new_batch_eval(*args, **kwargs)\n\n\ndef model_argmax(sess, x, predictions, samples, feed=None):\n """\n Helper function that computes the current class prediction\n :param sess: TF session\n :param x: the input placeholder\n :param predictions: the model's symbolic output\n :param samples: numpy array with input samples (dims must match x)\n :param feed: An optional dictionary that is appended to the feeding\n dictionary before the session runs. Can be used to feed\n the learning phase of a Keras model for instance.\n :return: the argmax output of predictions, i.e. the current predicted class\n """\n feed_dict = {x: samples}\n if feed is not None:\n feed_dict.update(feed)\n probabilities = sess.run(predictions, feed_dict)\n\n if samples.shape[0] == 1:\n return np.argmax(probabilities)\n else:\n return np.argmax(probabilities, axis=1)\n\n\ndef l2_batch_normalize(x, epsilon=1e-12, scope=None):\n """\n Helper function to normalize a batch of vectors.\n :param x: the input placeholder\n :param epsilon: stabilizes division\n :return: the batch of l2 normalized vector\n """\n with tf.name_scope(scope, "l2_batch_normalize") as name_scope:\n x_shape = tf.shape(x)\n x = tf.contrib.layers.flatten(x)\n x /= (epsilon + reduce_max(tf.abs(x), 1, keepdims=True))\n square_sum = reduce_sum(tf.square(x), 1, keepdims=True)\n x_inv_norm = tf.rsqrt(np.sqrt(epsilon) + square_sum)\n x_norm = tf.multiply(x, x_inv_norm)\n return tf.reshape(x_norm, x_shape, name_scope)\n\n\ndef kl_with_logits(p_logits, q_logits, scope=None,\n loss_collection=tf.GraphKeys.REGULARIZATION_LOSSES):\n """Helper function to compute kl-divergence KL(p || q)\n """\n with tf.name_scope(scope, "kl_divergence") as name:\n p = tf.nn.softmax(p_logits)\n p_log = tf.nn.log_softmax(p_logits)\n q_log = tf.nn.log_softmax(q_logits)\n loss = reduce_mean(reduce_sum(p * (p_log - q_log), axis=1),\n name=name)\n tf.losses.add_loss(loss, loss_collection)\n return loss\n\n\n[docs]def clip_eta(eta, ord, eps):\n """\n Helper function to clip the perturbation to epsilon norm ball.\n :param eta: A tensor with the current perturbation.\n :param ord: Order of the norm (mimics Numpy).\n Possible values: np.inf, 1 or 2.\n :param eps: Epsilon, bound of the perturbation.\n """\n\n # Clipping perturbation eta to self.ord norm ball\n if ord not in [np.inf, 1, 2]:\n raise ValueError('ord must be np.inf, 1, or 2.')\n reduc_ind = list(xrange(1, len(eta.get_shape())))\n avoid_zero_div = 1e-12\n if ord == np.inf:\n eta = clip_by_value(eta, -eps, eps)\n elif ord == 1:\n # Implements a projection algorithm onto the l1-ball from\n # (Duchi et al. 2008) that runs in time O(d*log(d)) where d is the\n # input dimension.\n # Paper link (Duchi et al. 2008): https://dl.acm.org/citation.cfm?id=1390191\n\n eps = tf.cast(eps, eta.dtype)\n\n dim = tf.reduce_prod(tf.shape(eta)[1:])\n eta_flat = tf.reshape(eta, (-1, dim))\n abs_eta = tf.abs(eta_flat)\n\n if 'sort' in dir(tf):\n mu = -tf.sort(-abs_eta, axis=-1)\n else:\n # `tf.sort` is only available in TF 1.13 onwards\n mu = tf.nn.top_k(abs_eta, k=dim, sorted=True)[0]\n cumsums = tf.cumsum(mu, axis=-1)\n js = tf.cast(tf.divide(1, tf.range(1, dim + 1)), eta.dtype)\n t = tf.cast(tf.greater(mu - js * (cumsums - eps), 0), eta.dtype)\n\n rho = tf.argmax(t * cumsums, axis=-1)\n rho_val = tf.reduce_max(t * cumsums, axis=-1)\n theta = tf.divide(rho_val - eps, tf.cast(1 + rho, eta.dtype))\n\n eta_sgn = tf.sign(eta_flat)\n eta_proj = eta_sgn * tf.maximum(abs_eta - theta[:, tf.newaxis], 0)\n eta_proj = tf.reshape(eta_proj, tf.shape(eta))\n\n norm = tf.reduce_sum(tf.abs(eta), reduc_ind)\n eta = tf.where(tf.greater(norm, eps), eta_proj, eta)\n\n elif ord == 2:\n # avoid_zero_div must go inside sqrt to avoid a divide by zero\n # in the gradient through this operation\n norm = tf.sqrt(tf.maximum(avoid_zero_div,\n reduce_sum(tf.square(eta),\n reduc_ind,\n keepdims=True)))\n # We must *clip* to within the norm ball, not *normalize* onto the\n # surface of the ball\n factor = tf.minimum(1., div(eps, norm))\n eta = eta * factor\n return eta\n\n\ndef zero_out_clipped_grads(grad, x, clip_min, clip_max):\n """\n Helper function to erase entries in the gradient where the update would be\n clipped.\n :param grad: The gradient\n :param x: The current input\n :param clip_min: Minimum input component value\n :param clip_max: Maximum input component value\n """\n signed_grad = tf.sign(grad)\n\n # Find input components that lie at the boundary of the input range, and\n # where the gradient points in the wrong direction.\n clip_low = tf.logical_and(tf.less_equal(x, tf.cast(clip_min, x.dtype)),\n tf.less(signed_grad, 0))\n clip_high = tf.logical_and(tf.greater_equal(x, tf.cast(clip_max, x.dtype)),\n tf.greater(signed_grad, 0))\n clip = tf.logical_or(clip_low, clip_high)\n grad = tf.where(clip, mul(grad, 0), grad)\n\n return grad\n\n\ndef random_exponential(shape, rate=1.0, dtype=tf.float32, seed=None):\n """\n Helper function to sample from the exponential distribution, which is not\n included in core TensorFlow.\n """\n return tf.random_gamma(shape, alpha=1, beta=1. / rate, dtype=dtype, seed=seed)\n\n\ndef random_laplace(shape, loc=0.0, scale=1.0, dtype=tf.float32, seed=None):\n """\n Helper function to sample from the Laplace distribution, which is not\n included in core TensorFlow.\n """\n z1 = random_exponential(shape, loc, dtype=dtype, seed=seed)\n z2 = random_exponential(shape, scale, dtype=dtype, seed=seed)\n return z1 - z2\n\n\ndef random_lp_vector(shape, ord, eps, dtype=tf.float32, seed=None):\n """\n Helper function to generate uniformly random vectors from a norm ball of\n radius epsilon.\n :param shape: Output shape of the random sample. The shape is expected to be\n of the form `(n, d1, d2, ..., dn)` where `n` is the number of\n i.i.d. samples that will be drawn from a norm ball of dimension\n `d1*d1*...*dn`.\n :param ord: Order of the norm (mimics Numpy).\n Possible values: np.inf, 1 or 2.\n :param eps: Epsilon, radius of the norm ball.\n """\n if ord not in [np.inf, 1, 2]:\n raise ValueError('ord must be np.inf, 1, or 2.')\n\n if ord == np.inf:\n r = tf.random_uniform(shape, -eps, eps, dtype=dtype, seed=seed)\n else:\n\n # For ord=1 and ord=2, we use the generic technique from\n # (Calafiore et al. 1998) to sample uniformly from a norm ball.\n # Paper link (Calafiore et al. 1998):\n # https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=758215&tag=1\n # We first sample from the surface of the norm ball, and then scale by\n # a factor `w^(1/d)` where `w~U[0,1]` is a standard uniform random variable\n # and `d` is the dimension of the ball. In high dimensions, this is roughly\n # equivalent to sampling from the surface of the ball.\n\n dim = tf.reduce_prod(shape[1:])\n\n if ord == 1:\n x = random_laplace((shape[0], dim), loc=1.0, scale=1.0, dtype=dtype,\n seed=seed)\n norm = tf.reduce_sum(tf.abs(x), axis=-1, keepdims=True)\n elif ord == 2:\n x = tf.random_normal((shape[0], dim), dtype=dtype, seed=seed)\n norm = tf.sqrt(tf.reduce_sum(tf.square(x), axis=-1, keepdims=True))\n else:\n raise ValueError('ord must be np.inf, 1, or 2.')\n\n w = tf.pow(tf.random.uniform((shape[0], 1), dtype=dtype, seed=seed),\n 1.0 / tf.cast(dim, dtype))\n r = eps * tf.reshape(w * x / norm, shape)\n\n return r\n\n\ndef model_train(sess, x, y, predictions, X_train, Y_train, save=False,\n predictions_adv=None, init_all=True, evaluate=None,\n feed=None, args=None, rng=None, var_list=None):\n """\n Train a TF graph\n :param sess: TF session to use when training the graph\n :param x: input placeholder\n :param y: output placeholder (for labels)\n :param predictions: model output predictions\n :param X_train: numpy array with training inputs\n :param Y_train: numpy array with training outputs\n :param save: boolean controlling the save operation\n :param predictions_adv: if set with the adversarial example tensor,\n will run adversarial training\n :param init_all: (boolean) If set to true, all TF variables in the session\n are (re)initialized, otherwise only previously\n uninitialized variables are initialized before training.\n :param evaluate: function that is run after each training iteration\n (typically to display the test/validation accuracy).\n :param feed: An optional dictionary that is appended to the feeding\n dictionary before the session runs. Can be used to feed\n the learning phase of a Keras model for instance.\n :param args: dict or argparse `Namespace` object.\n Should contain `nb_epochs`, `learning_rate`,\n `batch_size`\n If save is True, should also contain 'train_dir'\n and 'filename'\n :param rng: Instance of numpy.random.RandomState\n :param var_list: Optional list of parameters to train.\n :return: True if model trained\n """\n warnings.warn("This function is deprecated and will be removed on or after"\n " 2019-04-05. Switch to cleverhans.train.train.")\n args = _ArgsWrapper(args or {})\n\n # Check that necessary arguments were given (see doc above)\n assert args.nb_epochs, "Number of epochs was not given in args dict"\n assert args.learning_rate, "Learning rate was not given in args dict"\n assert args.batch_size, "Batch size was not given in args dict"\n\n if save:\n assert args.train_dir, "Directory for save was not given in args dict"\n assert args.filename, "Filename for save was not given in args dict"\n\n if rng is None:\n rng = np.random.RandomState()\n\n # Define loss\n loss = model_loss(y, predictions)\n if predictions_adv is not None:\n loss = (loss + model_loss(y, predictions_adv)) / 2\n\n train_step = tf.train.AdamOptimizer(learning_rate=args.learning_rate)\n train_step = train_step.minimize(loss, var_list=var_list)\n\n with sess.as_default():\n if hasattr(tf, "global_variables_initializer"):\n if init_all:\n tf.global_variables_initializer().run()\n else:\n initialize_uninitialized_global_variables(sess)\n else:\n warnings.warn("Update your copy of tensorflow; future versions of "\n "CleverHans may drop support for this version.")\n sess.run(tf.initialize_all_variables())\n\n for epoch in xrange(args.nb_epochs):\n # Compute number of batches\n nb_batches = int(math.ceil(float(len(X_train)) / args.batch_size))\n assert nb_batches * args.batch_size >= len(X_train)\n\n # Indices to shuffle training set\n index_shuf = list(range(len(X_train)))\n rng.shuffle(index_shuf)\n\n prev = time.time()\n for batch in range(nb_batches):\n\n # Compute batch start and end indices\n start, end = batch_indices(\n batch, len(X_train), args.batch_size)\n\n # Perform one training step\n feed_dict = {x: X_train[index_shuf[start:end]],\n y: Y_train[index_shuf[start:end]]}\n if feed is not None:\n feed_dict.update(feed)\n train_step.run(feed_dict=feed_dict)\n assert end >= len(X_train) # Check that all examples were used\n cur = time.time()\n _logger.info("Epoch " + str(epoch) + " took " +\n str(cur - prev) + " seconds")\n if evaluate is not None:\n evaluate()\n\n if save:\n save_path = os.path.join(args.train_dir, args.filename)\n saver = tf.train.Saver()\n saver.save(sess, save_path)\n _logger.info("Completed model training and saved at: " +\n str(save_path))\n else:\n _logger.info("Completed model training.")\n\n return True\n\n\ndef infer_devices(devices=None):\n """\n Returns the list of devices that multi-replica code should use.\n :param devices: list of string device names, e.g. ["/GPU:0"]\n If the user specifies this, `infer_devices` checks that it is\n valid, and then uses this user-specified list.\n If the user does not specify this, infer_devices uses:\n - All available GPUs, if there are any\n - CPU otherwise\n """\n if devices is None:\n devices = get_available_gpus()\n if len(devices) == 0:\n warnings.warn("No GPUS, running on CPU")\n # Set device to empy string, tf will figure out whether to use\n # XLA or not, etc., automatically\n devices = [""]\n else:\n assert len(devices) > 0\n for device in devices:\n assert isinstance(device, six.string_types), type(device)\n return devices\n\n\ndef get_available_gpus():\n """\n Returns a list of string names of all available GPUs\n """\n local_device_protos = device_lib.list_local_devices()\n return [x.name for x in local_device_protos if x.device_type == 'GPU']\n\n\ndef silence():\n """\n Silences tensorflaw's default printed messages\n """\n os.environ['TF_CPP_MIN_LOG_LEVEL'] = '3'\n\ndef clip_by_value(t, clip_value_min, clip_value_max, name=None):\n """\n A wrapper for clip_by_value that casts the clipping range if needed.\n """\n def cast_clip(clip):\n """\n Cast clipping range argument if needed.\n """\n if t.dtype in (tf.float32, tf.float64):\n if hasattr(clip, 'dtype'):\n # Convert to tf dtype in case this is a numpy dtype\n clip_dtype = tf.as_dtype(clip.dtype)\n if clip_dtype != t.dtype:\n return tf.cast(clip, t.dtype)\n return clip\n\n clip_value_min = cast_clip(clip_value_min)\n clip_value_max = cast_clip(clip_value_max)\n\n return tf.clip_by_value(t, clip_value_min, clip_value_max, name)\n\ndef mul(a, b):\n """\n A wrapper around tf multiplication that does more automatic casting of\n the input.\n """\n def multiply(a, b):\n """Multiplication"""\n return a * b\n return op_with_scalar_cast(a, b, multiply)\n\ndef div(a, b):\n """\n A wrapper around tf division that does more automatic casting of\n the input.\n """\n def divide(a, b):\n """Division"""\n return a / b\n return op_with_scalar_cast(a, b, divide)\n\ndef op_with_scalar_cast(a, b, f):\n """\n Builds the graph to compute f(a, b).\n If only one of the two arguments is a scalar and the operation would\n cause a type error without casting, casts the scalar to match the\n tensor.\n :param a: a tf-compatible array or scalar\n :param b: a tf-compatible array or scalar\n """\n\n try:\n return f(a, b)\n except (TypeError, ValueError):\n pass\n\n def is_scalar(x):\n """Return True if `x` is a scalar"""\n if hasattr(x, "get_shape"):\n shape = x.get_shape()\n return shape.ndims == 0\n if hasattr(x, "ndim"):\n return x.ndim == 0\n assert isinstance(x, (int, float))\n return True\n\n a_scalar = is_scalar(a)\n b_scalar = is_scalar(b)\n\n if a_scalar and b_scalar:\n raise TypeError("Trying to apply " + str(f) + " with mixed types")\n\n if a_scalar and not b_scalar:\n a = tf.cast(a, b.dtype)\n\n if b_scalar and not a_scalar:\n b = tf.cast(b, a.dtype)\n\n return f(a, b)\n\ndef assert_less_equal(*args, **kwargs):\n """\n Wrapper for tf.assert_less_equal\n Overrides tf.device so that the assert always goes on CPU.\n The unwrapped version raises an exception if used with tf.device("/GPU:x").\n """\n with tf.device("/CPU:0"):\n return tf.assert_less_equal(*args, **kwargs)\n\ndef assert_greater_equal(*args, **kwargs):\n """\n Wrapper for tf.assert_greater_equal.\n Overrides tf.device so that the assert always goes on CPU.\n The unwrapped version raises an exception if used with tf.device("/GPU:x").\n """\n with tf.device("/CPU:0"):\n return tf.assert_greater_equal(*args, **kwargs)\n\ndef assert_equal(*args, **kwargs):\n """\n Wrapper for tf.assert_equal.\n Overrides tf.device so that the assert always goes on CPU.\n The unwrapped version raises an exception if used with tf.device("/GPU:x").\n """\n with tf.device("/CPU:0"):\n return tf.assert_equal(*args, **kwargs)\n\ndef jacobian_graph(predictions, x, nb_classes):\n """\n Create the Jacobian graph to be ran later in a TF session\n :param predictions: the model's symbolic output (linear output,\n pre-softmax)\n :param x: the input placeholder\n :param nb_classes: the number of classes the model has\n :return:\n """\n\n # This function will return a list of TF gradients\n list_derivatives = []\n\n # Define the TF graph elements to compute our derivatives for each class\n for class_ind in xrange(nb_classes):\n derivatives, = tf.gradients(predictions[:, class_ind], x)\n list_derivatives.append(derivatives)\n\n return list_derivatives\n\ndef jacobian_augmentation(sess,\n x,\n X_sub_prev,\n Y_sub,\n grads,\n lmbda,\n aug_batch_size=512,\n feed=None):\n """\n Augment an adversary's substitute training set using the Jacobian\n of a substitute model to generate new synthetic inputs.\n See https://arxiv.org/abs/1602.02697 for more details.\n See cleverhans_tutorials/mnist_blackbox.py for example use case\n :param sess: TF session in which the substitute model is defined\n :param x: input TF placeholder for the substitute model\n :param X_sub_prev: substitute training data available to the adversary\n at the previous iteration\n :param Y_sub: substitute training labels available to the adversary\n at the previous iteration\n :param grads: Jacobian symbolic graph for the substitute\n (should be generated using utils_tf.jacobian_graph)\n :return: augmented substitute data (will need to be labeled by oracle)\n """\n assert len(x.get_shape()) == len(np.shape(X_sub_prev))\n assert len(grads) >= np.max(Y_sub) + 1\n assert len(X_sub_prev) == len(Y_sub)\n\n aug_batch_size = min(aug_batch_size, X_sub_prev.shape[0])\n\n # Prepare input_shape (outside loop) for feeding dictionary below\n input_shape = list(x.get_shape())\n input_shape[0] = 1\n\n # Create new numpy array for adversary training data\n # with twice as many components on the first dimension.\n X_sub = np.vstack([X_sub_prev, X_sub_prev])\n num_samples = X_sub_prev.shape[0]\n\n # Creating and processing as batch\n for p_idxs in range(0, num_samples, aug_batch_size):\n X_batch = X_sub_prev[p_idxs:p_idxs + aug_batch_size, ...]\n feed_dict = {x: X_batch}\n if feed is not None:\n feed_dict.update(feed)\n\n # Compute sign matrix\n grad_val = sess.run([tf.sign(grads)], feed_dict=feed_dict)[0]\n\n # Create new synthetic point in adversary substitute training set\n for (indx, ind) in zip(range(p_idxs, p_idxs + X_batch.shape[0]),\n range(X_batch.shape[0])):\n X_sub[num_samples + indx] = (\n X_batch[ind] + lmbda * grad_val[Y_sub[indx], ind, ...])\n\n # Return augmented training data (needs to be labeled afterwards)\n return X_sub\n\n
\n\n\n \n"
},
{
"path": "cleverhans_v3.1.0/docs/_sources/README.md.txt",
"content": "# Generate documentation\r\n\r\nTo generate the documentation do:\r\n`make github`\r\n\r\nThe documentation files will be copied to the `cleverhans/docs` directory.\r\n\r\n### Preparation\r\n\r\nPlease do:\r\n`pip install sphinx`\r\n\r\nAdd a `.nojekyll` file in the `cleverhans/docs` directory. When GitHub sees\r\na `.nojekyll` file, it serves the root `index.html` file. The `.nojekyll` file\r\nindicates that we are not using Jekyll as our static site generator in this\r\nrepository.\r\n\r\n### Enable GitHub Pages for the GitHub repository\r\n\r\n1. Go to the repository on the GitHub website and make sure you are logged in.\r\n2. Add a /docs directory to the master branch. Otherwise you do not get the\r\n master branch /docs folder for the Source option in the drop-down list.\r\n3. Click the Settings tab. You first go to the Options section.\r\n4. Scroll down to the GitHub Pages section and choose the drop-down list under\r\n Source. Note: Your choices will differ based on whether you’re in a User repo\r\n or an Org repository.\r\n5. To keep source and output HTML separate, choose master branch /docs folder\r\n for Source.\r\n\r\n### Build Sphinx locally and publish on GitHub Pages\r\n\r\nWe keep the source docsource and output docs separate, but still are able to\r\npublish on GitHub Pages and preview builds locally.\r\n\r\nWe have the following option in the Makefile:\r\n\r\n```\r\n github:\r\n @make html\r\n @cp -a _build/html/. ../docs\r\n```\r\n\r\nThus, we can run `make github` from the `docsource` directory to generate a\r\nlocal preview and move the docs where GitHub wants to serve them from.\r\n\r\n### Hacks\r\n\r\nIf you cannot build the docs for attacks, uncomment\r\n`import tensorflow_addons as tfa` in `cleverhans/attacks/spsa.py`.\r\n\r\nOtherwise:\r\n\r\n```angular2html\r\nWARNING: autodoc: failed to import module 'attacks' from module 'cleverhans'; the following exception was raised:\r\ncannot import name 'keras_tensor'\r\n```\r\n\r\nIt is convenient to create a virtual environment to install all the specific\r\nlibraries (e.g. virutalen cleverhans).\r\n"
},
{
"path": "cleverhans_v3.1.0/docs/_sources/index.md.txt",
"content": ".. CleverHans documentation master file, created by\n sphinx-quickstart on Wed Sep 20 15:14:07 2017.\n You can adapt this file completely to your liking, but it should at least\n contain the root `toctree` directive.\n\n WARNING: This file has a markdown suffix, but is in fact .rst\n\nCleverHans Documentation\n======================================\n\n\nThis documentation is auto-generated from the docstrings of modules of the current `master` branch of `cleverhans\n\n
\n \n \n \n \n\n
\n \n \n
\n \n All modules for which code is available
\n- abc \n
- builtins \n
- cleverhans.attacks.attack \n
- cleverhans.attacks.basic_iterative_method \n
- cleverhans.attacks.carlini_wagner_l2 \n
- cleverhans.attacks.deep_fool \n
- cleverhans.attacks.elastic_net_method \n
- cleverhans.attacks.fast_feature_adversaries \n
- cleverhans.attacks.fast_gradient_method \n
- cleverhans.attacks.hop_skip_jump_attack \n
- cleverhans.attacks.lbfgs \n
- cleverhans.attacks.madry_et_al \n
- cleverhans.attacks.max_confidence \n
- cleverhans.attacks.momentum_iterative_method \n
- cleverhans.attacks.noise \n
- cleverhans.attacks.projected_gradient_descent \n
- cleverhans.attacks.saliency_map_method \n
- cleverhans.attacks.semantic \n
- cleverhans.attacks.sparse_l1_descent \n
- cleverhans.attacks.spatial_transformation_method \n
- cleverhans.attacks.spsa \n
- cleverhans.attacks.virtual_adversarial_method \n
- cleverhans.compat \n
- cleverhans.model \n
- cleverhans.utils_tf \n