Git Product home page Git Product logo

generative_adversary's Introduction

Constructing Unrestricted Adversarial Examples with Generative Models

This repo contains necessary code for reproducing main results in the paper Constructing Unrestricted Adversarial Examples with Generative Models, NIPS 2018, Montréal, Canada.

by Yang Song, Rui Shu, Nate Kushman and Stefano Ermon, Stanford AI Lab.


We propose Unrestricted Adversarial Examples, a new kind of adversarial examples to machine learning systems. Different from traditional adversarial examples that are crafted by adding norm-bounded perturbations to clean images, unrestricted adversarial examples are realistic images that are synthesized entirely from scratch, and not restricted to small norm-balls. This new attack demonstrates the danger of a stronger threat model, where traditional defense methods for perturbation-based adversarial examples fail.

Datasets

Here are links to the datasets used in our experiments:

Running Experiments

Training AC-GANs

In order to do unrestricted adversarial attack, we first need a good conditional generative model so that we can search on the manifold of realistic images to find the adversarial ones. You can use train_acgan.py to do this. For example, the following command

CUDA_VISIBLE_DEVICES=0 python train_acgan.py --dataset mnist --checkpoint_dir checkpoints/

will train an AC-GAN on the MNIST dataset with GPU #0 and output the weight files to the checkpoints/ directory.

Run python train_acgan.py --help to see more available argument options.

Unrestricted Adversarial Attack

After the AC-GAN is trained, you can use main.py to do targeted / untargeted attack. You can also use main.py to evaluate the accuracy and PGD-robustness of a trained neural network classifier. For example, the following command

CUDA_VISIBLE_DEVICES=0 python main.py --mode targeted_attack --dataset mnist --classifier zico --source 0 --target 1

attacks the provable defense method from Kolter & Wong, 2018 on the MNIST dataset, with the source class being 0 and target class being 1.

Run python main.py --help to view more argument options. For hyperparameters such as --noise, --lambda1, --lambda2, --eps, --z_eps, --lr, and --n_iters (in that order), please refer to Table. 4 in the Appendix of our paper.

Evaluating Unrestricted Adversarial Examples

In the paper, we use Amazon Mechanical Turk to evaluate whether our unrestricted adversarial examples are legitimate or not. We have provided html files for the labelling interface in folder amt_websites.

Samples

Perturbation-based adversarial examples (top row) VS unrestricted adversarial examples (bottom-row):

compare

Targeted unrestricted adversarial examples against robust classifiers on MNIST (Green borders denote legitimate unrestricted adversarial examples while red borders denote illegimate ones. The tiny white text at the top-left corder of a red image denotes the label given by the annotators. )

mnist

We also have samples for SVHN dataset:

svhn

Finally here are the results for CelebA

celeba

Citation

If you find the idea or code useful for your research, please consider citing our paper:

@inproceedings{song2018constructing,
  author={Song, Yang and Shu, Rui and Kushman, Nate and Ermon, Stefano},
  booktitle = {Advances in Neural Information Processing Systems (NIPS)},
  title = {Constructing Unrestricted Adversarial Examples with Generative Models},
  year = {2018},
}

generative_adversary's People

Contributors

yang-song avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

generative_adversary's Issues

Classifiers results

Hello,
Could we have a classification report from the mnist_zico used in the paper ? I want to have one similar in precision / recall.

Thanks :)

ckpt_state is always None.

When loading pre-trained classifiers such as those of Zico and Aditi, I always get the following error:
AttributeError: 'NoneType' object has no attribute 'model_checkpoint_path'

at line 540 in main.py: print('[*] Loading checkpoint %s' % ckpt_state.model_checkpoint_path)
i.e. ckpt_state is always None.

Training th resnet model

Due to lacking the code to train the model, I have written it by myself. However, I found when I set the parameter 'training = False', I always get the same output while when I set the parameter 'training = True', I can get the correct output. Do you have any idea about how to solve this problem?

Attack after training ACGAN

I face the following error on running main.py after performing the training:
ValueError: Variable discriminator/d_residual_block_shortcut/w already exists, disallowed. Did you mean to set reuse=True or reuse=tf.AUTO_REUSE in VarScope? Originally defined at:

Shouldn't the main.py file perform tf.reset_default_graph() to redefine the existing variables before their values are restored from the checkpoint?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.