hyperparticle / one-pixel-attack-keras Goto Github PK

Keras implementation of "One pixel attack for fooling deep neural networks" using differential evolution on Cifar10 and ImageNet

Home Page: https://arxiv.org/abs/1710.08864

License: MIT License

Python 22.64% Jupyter Notebook 77.36%

cifar10 cnn deep-learning image-processing imagenet keras machine-learning neural-network nlp tensorflow

one-pixel-attack-keras's People

Contributors

Stargazers

Watchers

Forkers

fitrialif ghosthamlet zumbalamambo tigerneil davidsonggithub tim-young phpmind 10183308 sree181 tchen0123 mehrdad-shokri neuroradiology reyadrahman dineshresearch willgeary ourobouros shubhampachori12110095 y44k0v radovankavicky gapdata lovasoa russellcloud zpeng1989 daitomanabe snazz2001 hefv57 nsl2014fm wyw636 mysteriouseye siathalysedi hbcbh1999 youmuyou vishruit maxpv alexliyang timedcy gridl 5olegas raby heylypp ianswebpage wnagesh mamengyiyi jxcwu iscas007 jasperr gitter-badger zkq-hit-depart-info briando2005 smchester hush-z tony32769 terminiter rebecasarai sinianyutian hereismari bpdivito sakethkaparthi liviust feiwang2018 datomi79 myuluo duoergun0729 deelmind fendaq plume avain farmers-tan oleiva tzl0031 zekunstevenzhang rahulsoibam afcarl cheftimothyng haveon lichongyang96 tartaruszen yeying213 nippun99 sunshine352 tuchang keep-steady jossome wyvern92 simonsleo hongxin001 henlam tiran8188 jfchi tyleryzhu zc-authorization nnresearcher firesans lqktz p-shah mashmallowwor liuxuankai 459548764 lxsyz yw981

one-pixel-attack-keras's Issues

Replicate results seen in arXiv paper

There are some preliminary results of the one-pixel attack performed on Cifar10 in the repo, but it is not quite as comprehensive as seen in https://arxiv.org/abs/1710.08864. It would be nice to not only replicate the experiments but also match (or surpass) their metrics.

About the function `perturb_image`, should it return one image or multi image depending the parameter `xs`

def perturb_image(xs, img):
    # If this function is passed just one perturbation vector,
    # pack it in a list to keep the computation the same
    if xs.ndim < 2:
        xs = np.array([xs])

    # Copy the image n == len(xs) times so that we can 
    # create n new perturbed images
    tile = [len(xs)] + [1] * (xs.ndim + 1)
    imgs = np.tile(img, tile)

    # Make sure to floor the members of xs as int types
    xs = xs.astype(int)

    for x, img in zip(xs, imgs):
        # Split x into an array of 5-tuples (perturbation pixels)
        # i.e., [[x,y,r,g,b], ...]
        pixels = np.split(x, len(x) // 5)
        for pixel in pixels:
            # At each pixel's x,y position, assign its rgb value
            x_pos, y_pos, *rgb = pixel
            img[x_pos, y_pos] = rgb

    return imgs

AttributeError: 'ResNet' object has no attribute '_model'

When I run python train.py --model resnet --epochs 200 --batch_size 128
It occurs an error:

Traceback (most recent call last):
File "train.py", line 40, in
model.train()
File "/home/cvers/zgz/one-pixel-attack-keras-master/networks/resnet.py", line 162, in train
self.param_count = self._model.count_params()
AttributeError: 'ResNet' object has no attribute '_model'
Exception ignored in: <bound method BaseSession.del of <tensorflow.python.client.session.Session object at 0x7f9c07081be0>>
Traceback (most recent call last):
File "/home/cvers/anaconda3/envs/tensorflow/lib/python3.5/site-packages/tensorflow/python/client/session.py", line 701, in del
TypeError: 'NoneType' object is not callable

About dataset

Hello, I want to ask a question about the dataset.
Here, "Attack on 1,3,5 pixel perturbations (100 samples)" refers to the result of an attack on 100 images randomly selected from the original cifar10 dataset?
Or is it the result of generating 100 adversarial images for each of the 10,000 images in the cifar10 test dataset? Thank you！

How to use this code to attack VGG16?

Hello, could you please tell me about how to use? Thank you!

Bug on attack_all function

The previous commit ae232d7 partially fixes some wrong attributes usages. One usage is still not fixed, and is triggered when calling attack_all() with targeted=True:

one-pixel-attack-keras/attack.py

Lines 114 to 115 in 13d2587

 if targeted: 

 print('Attacking with target', class_names[target])

AttributeError: 'DenseNet' object has no attribute '_model'

pylint E0401:unable to import 'keras.utils'
unable to import networks.capsulenet.capsule_net
when i uesed ''python attack.py --model densenet capsnet'',the above problems appeared,Who can help me t how to solve it?tanks a lot

SyntaxError: invalid syntax

File "helper.py", line 32
x_pos, y_pos, *rgb = pixel
^
SyntaxError: invalid syntax
I met this problem while running the "imports" of "1_one-pixel-attack-cifar10", with both python2 and python3.

How does the targeted attack work?

Hello:
I feel puzzled about that if just changing one pixel can implement the targeted attack. I think only one-pixel change can not make the target that attacked with clear.
Please tell me how does the targeted attack work with so few pixel.
Thank you!

Demonstrate attack on vision transformers

I trained the transformer architecture in the below github repo:
https://github.com/keras-team/keras-io/blob/master/examples/vision/image_classification_with_vision_transformer.py

I also have a .h5 file of the saved model added to the networks/models

How do I try the attack on it?

Thanks

How to display the picture after the attack？

Hello, after running attack.py, the pkl file is saved. I would like to ask how to display the image after the attack? Attack is to perturb a single pixel. Has the value of other pixels in the image changed? Thank you and look forward to your reply.

Experiment on your own dataset

I want to conduct a single pixel attack experiment on my own data set. What should I do?

how can i calculate the value of success rate for target attack?

rerunning attack on the same images

Hi,

Just a suggestion:
numpy.random.choice(img_samples, samples) should be changed to numpy.random.choice(img_samples, samples, replace=False)

so images aren't duplicated during larger iterations.

The argument targeted

There is a argument，targeted，in the attack.py .

parser.add_argument('--targeted', action='store_false', help='Set this switch to test for targeted attacks.')

Please tell me,if the action = 'store_false',the attack is targeted or not?
Thank u for answering my issue.

how to fix RuntimeWarning: divide by zero encountered in double_scalars

using model lenet , when attacking it warns that "RuntimeWarning: divide by zero encountered in double_scalars" convergence=self.tol / convergence) is True):
it means covergence is zero? i dont know how to fix this please help me!
the error is appears in differential _evolution.py :585

One pixel and three pixel attacks are pretty hard to get it seems

Hey, @Hyperparticle.

Such a nice collection of materials, thank you!

I tried extending the CIFAR10 example to do some comparisons. It appears to me that for the kind of computational budget you followed, it's pretty hard to get a successful attack even on a small CNN (15722 learnable parameters).

Here's my notebook that does the comparison - https://colab.research.google.com/drive/1TKxtY63dqcuWAvrrDaDx3PQ3M7_xntQr?usp=sharing.

Am I missing out on something? One of the things I have changed is I have scaled the pixel values to be in the range of [0, 1]. Any help is much appreciated. Thanks!

Passing img instead of id

Function attack_success takes argument img which is an id of the image in the dataset. Wouldn't it be clearer if this variable is called img_id or something like this? Or we could pass the whole image from the dataset instead.

How to use gpu in the model ?

I try to use the gpu in the one-pixel attack for imagenet, because the model run on imagenet is too slow, but I use os.environ["CUDA_VISIBLE_DEVICES"] seems did not work, can you give some help. Thanks so much !

你们是用的是什么环境啊

我安装了requirement.txt里面的，但是它上面的没有完整的版本号

Try new Differential Evolution techniques seen in "Attacking Convolutional Neural Network using Differential Evolution"

The paper, Attacking Convolutional Neural Network using Differential Evolution, explains how to tweak the one pixel attack to produce adversarial images that minimize the amount of perturbation in an image. It would be nice to incorporate these changes.

Download ImageNet images automatically

Modify 2_one-pixel-attack-imagenet.ipynb to download a sample subset of ImageNet files with appropriate labels. The files should be preprocessed as to be ready for the attack.

Getting a lot of adversarial images

Hello everyone,

I am trying to fool the entire cifar10 data-set by using the one-pixel attack and download it for a project.
As I do not know how the attack function has been made, I will be glad to get help from someone.
I noticed that I can only fool one image per iteration. What I would do is to fool many image then download them.

Best regards

About image processing

Hello, I would like to ask why CIFAR-10 was not pre-processed in your code, while the image of ImageNet was pre-processed?
In addition, does the adversarial examples need to be pre-processed (such as normalization) before being fed into the model for reclassification?

Not able to reproduce Google Collab notebook

It seems like imports are broken, which version of tensorflow/keras has been used?

ImportError: cannot import name 'Adam' from 'keras.optimizers'

in line from networks.pure_cnn import PureCnn

Demonstrate attack on ImageNet

Similar to 1_one-pixel-attack-cifar10.ipynb, perform a series of targeted/targeted adversarial attacks using differential evolution and collect results. This is a continuation of #3.

	if targeted:
	print('Attacking with target', class_names[target])