├── CONTACT.md ├── Comparison of Attack Images ├── .idea │ ├── Q2_compare_MR_Lp.iml │ ├── inspectionProfiles │ │ └── profiles_settings.xml │ ├── misc.xml │ ├── modules.xml │ └── workspace.xml ├── README.md ├── attack.py ├── attack_evaluate.py ├── compare_result.txt ├── criteria.py ├── data │ └── use_to_upload_empty_floder.txt ├── deephunter_attack.py ├── mutators.py ├── test_example.sh └── util.py ├── Correlation ├── .idea │ ├── Figure 4 and figure 8.iml │ ├── inspectionProfiles │ │ └── profiles_settings.xml │ ├── misc.xml │ ├── modules.xml │ └── workspace.xml ├── ALL_ALL.eps ├── README.md ├── adv_train_example.py ├── attack.py ├── attack_evaluate.py ├── attack_evaluate_cifar.py ├── correlation.py ├── correlation.xlsx ├── correlation_sadl.py ├── cov_ALL_ALL.eps ├── coverage.py ├── coverage_cifar.py ├── data │ ├── cifar_data │ │ └── model │ │ │ └── use_to_upload_empty_floder.txt │ ├── mnist_data │ │ └── model │ │ │ └── use_to_upload_empty_floder.txt │ └── svhn_data │ │ └── model │ │ └── use_to_upload_empty_floder.txt ├── hotpicture.py ├── inner_correlation.py ├── inner_hotpicture.py ├── models.py ├── other_models_for_svhn.py ├── result_mnist │ ├── attack_evaluate_result.txt │ └── coverage_result.txt ├── result_svhn │ ├── attack_evaluate_result.txt │ └── coverage_result.txt ├── results_cifar │ ├── attack_evaluate_result.txt │ └── coverage_result.txt ├── test_example.sh ├── tmp │ └── image │ │ └── use_to_upload_empty_floder.txt └── util.py ├── Coverage VS. # Adv Examples ├── Q2_original │ ├── cov_kmnc.npy │ ├── cov_kmncl.npy │ ├── cov_nbc.npy │ ├── cov_nc1.npy │ ├── cov_nc2.npy │ ├── cov_snac.npy │ ├── cov_tknc.npy │ ├── cov_tknp.npy │ ├── tknp_all.npy │ └── xlabel.npy ├── README.md ├── coverage_curve.py ├── coverage_result.txt ├── figure 6.xlsx ├── figure 7.xlsx ├── testing_coverage_result.txt ├── tknp_testing.py └── util.py ├── Coverage and Robustness VS. Training Datasets ├── .idea │ ├── inspectionProfiles │ │ └── profiles_settings.xml │ ├── misc.xml │ ├── modules.xml │ ├── new_criteria.iml │ └── workspace.xml ├── Figure 2 and figure 3.xlsx ├── README.md ├── attack_evaluate_result.txt ├── compare_coverage.py ├── coverage_result.txt ├── exchange_testing_dataset.py ├── fuzzing.py ├── fuzzing │ ├── index.npy │ ├── nc_index_0.npy │ ├── nc_index_1.npy │ ├── nc_index_2.npy │ ├── nc_index_3.npy │ ├── nc_index_4.npy │ ├── nc_index_5.npy │ ├── nc_index_6.npy │ ├── nc_index_7.npy │ ├── nc_index_8.npy │ ├── nc_index_9.npy │ ├── nc_index_test_0.npy │ └── nc_index_test_1.npy ├── fuzzing_testset.py ├── mutators.py ├── new_model │ └── mnist │ │ ├── model_0.h5 │ │ ├── model_1.h5 │ │ ├── model_2.h5 │ │ ├── model_3.h5 │ │ ├── model_4.h5 │ │ ├── model_5.h5 │ │ ├── model_6.h5 │ │ ├── model_7.h5 │ │ ├── model_8.h5 │ │ └── model_9.h5 ├── retrain_robustness.py ├── robustness.py ├── tmp │ └── image │ │ └── use_to_upload_empty_floder.txt ├── util.py └── x_test_new.npy ├── LICENSE.md ├── Model Accuracy under Different Scenarios ├── .idea │ ├── inspectionProfiles │ │ └── profiles_settings.xml │ ├── misc.xml │ ├── modules.xml │ ├── new_criteria.iml │ └── workspace.xml ├── README.md ├── all.py ├── data │ └── use_to_upload_empty_floder.txt ├── deephunter_attack.py ├── fuzzing.py ├── fuzzing │ └── use_to_upload_empty_floder.txt ├── mutators.py ├── new_model │ └── use_to_upload_empty_floder.txt ├── pgd_attack.py ├── result.txt ├── retrain_robustness.py ├── test_example.sh ├── tmp │ └── image │ │ └── use_to_upload_empty_floder.txt └── util.py ├── README.md ├── data └── use_to_upload_empty_floder.txt ├── index.md └── requirements.txt /CONTACT.md: -------------------------------------------------------------------------------- 1 | Author: Shenao Yan (corresponding author) 2 | 3 | email: shenao.yan@rutgers.edu 4 | 5 | github ids: DNNTesting (https://github.com/DNNTesting) and Jethro85 (https://github.com/Jethro85) 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /Comparison of Attack Images/.idea/Q2_compare_MR_Lp.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /Comparison of Attack Images/.idea/inspectionProfiles/profiles_settings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 6 | -------------------------------------------------------------------------------- /Comparison of Attack Images/.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 6 | 7 | -------------------------------------------------------------------------------- /Comparison of Attack Images/.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /Comparison of Attack Images/README.md: -------------------------------------------------------------------------------- 1 | # Comparison of Attack Images (Table 2) 2 | 3 | --- 4 | ## Quick Start Based on Our Data: 5 | 6 | 1. Before the experiment, please be sure that the data is well prepared according to the tutorial in the main page of the repository. 7 | 8 | 2. We have put [commands](https://github.com/DNNTesting/CovTesting/blob/d462c59c1cbc00c2add20ee0eaf7a9966859788b/Table%202/test_example.sh#L32-L41) in 'test_example.sh' script for reference. Please run the following commands to get the comparison results of different models: 9 | 10 | ```python 11 | python criteria.py -dataset mnist -model lenet1 12 | python criteria.py -dataset mnist -model lenet4 13 | python criteria.py -dataset mnist -model lenet5 14 | 15 | python criteria.py -dataset cifar -model vgg16 16 | python criteria.py -dataset cifar -model resnet20 17 | 18 | python criteria.py -dataset svhn -model svhn_model 19 | python criteria.py -dataset svhn -model svhn_first 20 | python criteria.py -dataset svhn -model svhn_second 21 | ``` 22 | 23 | The results will be stored in 'compare_result.txt'. 24 | 25 | (We only keep the original Images dataset for CIFAR and SVHN models. We re-attack the MNIST models and use the newly generated dataset to do testing. So the results of MNIST is slightly different from those shown in our paper. But as you can see, the difference is acceptable and it will not affect our conclusion.) 26 | 27 | 28 | 29 | ## Experiment on Your Own Data: 30 | 31 | 1. Before the experiment, please be sure that the data is well prepared according to the tutorial in the main page of the repository. 32 | 33 | 34 | 35 | We also provide 'test_example.sh' script as next several steps' reference. 36 | 37 | 2. PGD attack the dataset: 38 | 39 | Please run the following commands to implement the PGD attack for different models: 40 | 41 | ```python 42 | python attack.py -dataset mnist -model lenet1 -attack PGD -batch_size 128 43 | python attack.py -dataset mnist -model lenet4 -attack PGD -batch_size 128 44 | python attack.py -dataset mnist -model lenet5 -attack PGD -batch_size 128 45 | 46 | python attack.py -dataset cifar -model vgg16 -attack PGD -batch_size 128 47 | python attack.py -dataset cifar -model resnet20 -attack PGD -batch_size 128 48 | 49 | python attack.py -dataset svhn -model svhn_model -attack PGD -batch_size 128 50 | python attack.py -dataset svhn -model svhn_first -attack PGD -batch_size 128 51 | python attack.py -dataset svhn -model svhn_second -attack PGD -batch_size 128 52 | ``` 53 | 54 | Attacked dataset will be stored as ('./data/' + args.dataset + '_data/model/' + args.model + _PGD.npy'). 55 | 56 | 3. Use DeepHunter to generate test cases: 57 | Please run the following commands to use DeepHunter to generate the test cases for different models. 58 | 59 | ```python 60 | python deephunter_attack.py -dataset mnist -model lenet1 61 | python deephunter_attack.py -dataset mnist -model lenet4 62 | python deephunter_attack.py -dataset mnist -model lenet5 63 | 64 | python deephunter_attack.py -dataset cifar -model vgg16 65 | python deephunter_attack.py -dataset cifar -model resnet20 66 | 67 | python deephunter_attack.py -dataset svhn -model svhn_model 68 | python deephunter_attack.py -dataset svhn -model svhn_first 69 | python deephunter_attack.py -dataset svhn -model svhn_second 70 | ``` 71 | 72 | 4. Compare DH and DP: 73 | 74 | Please run the following commands to compare DH and DP for different models. 75 | 76 | ```python 77 | python criteria.py -dataset mnist -model lenet1 78 | python criteria.py -dataset mnist -model lenet4 79 | python criteria.py -dataset mnist -model lenet5 80 | 81 | python criteria.py -dataset cifar -model vgg16 82 | python criteria.py -dataset cifar -model resnet20 83 | 84 | python criteria.py -dataset svhn -model svhn_model 85 | python criteria.py -dataset svhn -model svhn_first 86 | python criteria.py -dataset svhn -model svhn_second 87 | ``` 88 | 89 | The results will be stored in 'compare_result.txt'. 90 | 91 | 92 | 93 | 94 | 95 | -------------------------------------------------------------------------------- /Comparison of Attack Images/attack.py: -------------------------------------------------------------------------------- 1 | from __future__ import absolute_import 2 | from __future__ import division 3 | from __future__ import print_function 4 | from __future__ import unicode_literals 5 | 6 | from cleverhans.utils_keras import KerasModelWrapper 7 | from cleverhans.attacks import CarliniWagnerL2 8 | from cleverhans.attacks import SaliencyMapMethod 9 | from cleverhans.attacks import FastGradientMethod 10 | from cleverhans.attacks import BasicIterativeMethod 11 | from cleverhans.attacks import ProjectedGradientDescent 12 | 13 | import tensorflow as tf 14 | import os 15 | 16 | os.environ["CUDA_VISIBLE_DEVICES"] = "0" 17 | 18 | ####for solving some specific problems, don't care 19 | config = tf.ConfigProto() 20 | config.gpu_options.allow_growth = True 21 | sess = tf.Session(config=config) 22 | 23 | import keras 24 | from keras import backend as K 25 | import numpy as np 26 | import time 27 | import sys 28 | import argparse 29 | 30 | 31 | # def JSMA(model, x, y): 32 | # sess = K.get_session() 33 | # model_wrap = KerasModelWrapper(model) 34 | # jsma = SaliencyMapMethod(model_wrap, sess=sess) 35 | # jsma_params = {'theta':1., 'gamma': 0.1, 'clip_min':0., 'clip_max':1.} 36 | # adv = jsma.generate_np(x, **jsma_params) 37 | # return adv 38 | # 39 | # 40 | # def FGSM(model, x, y): 41 | # sess = K.get_session() 42 | # model_wrap = KerasModelWrapper(model) 43 | # fgsm = FastGradientMethod(model_wrap, sess=sess) 44 | # fgsm_params={'y':y, 'eps':0.2, 'clip_min':0., 'clip_max': 1.} 45 | # adv = fgsm.generate_np(x, **fgsm_params) 46 | # return adv 47 | # 48 | # 49 | # def BIM(model, x, y): 50 | # sess = K.get_session() 51 | # model_wrap = KerasModelWrapper(model) 52 | # bim = BasicIterativeMethod(model_wrap, sess=sess) 53 | # bim_params={'eps_iter': 0.03, 'nb_iter': 10, 'y':y, 'clip_min': 0., 'clip_max': 1.} 54 | # adv = bim.generate_np(x, **bim_params) 55 | # return adv 56 | 57 | # # invoke the method for many times leads to multiple symbolic graph and may cause OOM 58 | # def CW(model, x, y, batch): 59 | # sess = K.get_session() 60 | # model_wrap = KerasModelWrapper(model) 61 | # cw = CarliniWagnerL2(model_wrap, sess=sess) 62 | # cw_params = {'binary_search_steps': 1, 63 | # 'y': y, 64 | # 'learning_rate': .1, 65 | # 'max_iterations': 50, 66 | # 'initial_const': 10, 67 | # 'batch_size': batch, 68 | # 'clip_min': -0.5, 69 | # 'clip_max': 0.5} 70 | # adv = cw.generate_np(x, **cw_params)# invoke the method for many times leads to multiple symbolic graph and may cause OOM 71 | # # def CW(model, x, y, batch): 72 | # # sess = K.get_session() 73 | # # model_wrap = KerasModelWrapper(model) 74 | # # cw = CarliniWagnerL2(model_wrap, sess=sess) 75 | # # cw_params = {'binary_search_steps': 1, 76 | # # 'y': y, 77 | # # 'learning_rate': .1, 78 | # # 'max_iterations': 50, 79 | # # 'initial_const': 10, 80 | # # 'batch_size': batch, 81 | # # 'clip_min': -0.5, 82 | # # 'clip_max': 0.5} 83 | # # adv = cw.generate_np(x, **cw_params) 84 | # # return adv 85 | # # 86 | # # 87 | # # # for mnist, eps=.3, eps_iter=.03, nb_iter=10 88 | # # # for cifar and svhn, eps=8/255, eps_iter=.01, nb_iter=30 89 | # # def PGD(model, x, y, batch): 90 | # # sess = K.get_session() 91 | # # model_wrap = KerasModelWrapper(model) 92 | # # pgd = ProjectedGradientDescent(model_wrap, sess=sess) 93 | # # pgd_params = {'eps': 8. / 255., 94 | # # 'eps_iter': .01, 95 | # # 'nb_iter': 30., 96 | # # 'clip_min': -0.5, 97 | # # 'clip_max': 0.5, 98 | # # 'y': y} 99 | # # adv = pgd.generate_np(x, **pgd_params) 100 | # # return adv 101 | # return adv 102 | # 103 | # 104 | # # for mnist, eps=.3, eps_iter=.03, nb_iter=10 105 | # # for cifar and svhn, eps=8/255, eps_iter=.01, nb_iter=30 106 | # def PGD(model, x, y, batch): 107 | # sess = K.get_session() 108 | # model_wrap = KerasModelWrapper(model) 109 | # pgd = ProjectedGradientDescent(model_wrap, sess=sess) 110 | # pgd_params = {'eps': 8. / 255., 111 | # 'eps_iter': .01, 112 | # 'nb_iter': 30., 113 | # 'clip_min': -0.5, 114 | # 'clip_max': 0.5, 115 | # 'y': y} 116 | # adv = pgd.generate_np(x, **pgd_params) 117 | # return adv 118 | 119 | 120 | # integrate all attack method in one function and only construct graph once 121 | def gen_adv_data(model, x, y, method, dataset, batch=2048): 122 | sess = K.get_session() 123 | model_wrap = KerasModelWrapper(model) 124 | if method.upper() == 'CW': 125 | params = {'binary_search_steps': 1, 126 | 'y': y, 127 | 'learning_rate': .1, 128 | 'max_iterations': 50, 129 | 'initial_const': 10, 130 | 'batch_size': batch, 131 | # 'clip_min': -0.5, 132 | # 'clip_max': 0.5 133 | } 134 | attack = CarliniWagnerL2(model_wrap, sess=sess) 135 | 136 | data_num = x.shape[0] 137 | begin, end = 0, batch 138 | adv_x_all = np.zeros_like(x) 139 | # every time process batch_size 140 | while end < data_num: 141 | start_time = time.time() 142 | params['y'] = y[begin:end] 143 | adv_x = attack.generate_np(x[begin:end], **params) 144 | adv_x_all[begin: end] = adv_x 145 | print(begin, end, "done") 146 | begin += batch 147 | end += batch 148 | end_time = time.time() 149 | print("time: ", end_time - start_time) 150 | 151 | # process the remaining 152 | if begin < data_num: 153 | start_time = time.time() 154 | params['y'] = y[begin:] 155 | params['batch_size'] = data_num - begin 156 | adv_x = attack.generate_np(x[begin:], **params) 157 | adv_x_all[begin:] = adv_x 158 | print(begin, data_num, "done") 159 | end_time = time.time() 160 | print("time: ", end_time - start_time) 161 | 162 | elif method.upper() == 'PGD': 163 | if dataset == 'cifar': 164 | params = {'eps': 8. / 255., 165 | 'eps_iter': 2. / 255., 166 | 'nb_iter': 300., 167 | # 'clip_min': -0.5, 168 | # 'clip_max': 0.5, 169 | 'y': y} 170 | attack = ProjectedGradientDescent(model_wrap, sess=sess) 171 | elif dataset == 'mnist': 172 | params = {'eps': .3, 173 | 'eps_iter': .03, 174 | 'nb_iter': 500., 175 | 'clip_min': -0.5, 176 | 'clip_max': 0.5, 177 | 'y': y} 178 | attack = ProjectedGradientDescent(model_wrap, sess=sess) 179 | elif dataset == 'svhn': 180 | params = {'eps': 8. / 255., 181 | 'eps_iter': 0.01, 182 | 'nb_iter': 500., 183 | 'clip_min': -0.5, 184 | 'clip_max': 0.5, 185 | 'y': y} 186 | attack = ProjectedGradientDescent(model_wrap, sess=sess) 187 | 188 | data_num = x.shape[0] 189 | begin, end = 0, batch 190 | adv_x_all = np.zeros_like(x) 191 | # every time process batch_size 192 | while end < data_num: 193 | start_time = time.time() 194 | params['y'] = y[begin:end] 195 | adv_x = attack.generate_np(x[begin:end], **params) 196 | adv_x_all[begin: end] = adv_x 197 | print(begin, end, "done") 198 | begin += batch 199 | end += batch 200 | end_time = time.time() 201 | print("time: ", end_time - start_time) 202 | 203 | # process the remaining 204 | if begin < data_num: 205 | start_time = time.time() 206 | params['y'] = y[begin:] 207 | adv_x = attack.generate_np(x[begin:], **params) 208 | adv_x_all[begin:] = adv_x 209 | print(begin, data_num, "done") 210 | end_time = time.time() 211 | print("time: ", end_time - start_time) 212 | 213 | else: 214 | print('Unsupported attack') 215 | sys.exit(1) 216 | 217 | return adv_x_all 218 | 219 | 220 | # def gen_adv_data(model, x, y, method, batch=4000): 221 | # data_num = x.shape[0] 222 | # begin, end = 0, batch 223 | # adv_x_all = np.zeros_like(x) 224 | # while begin < data_num: 225 | # start_time = time.time() 226 | # adv_x = method(model, x[begin:end], y[begin:end], end-begin) 227 | # adv_x_all[begin: end] = adv_x 228 | # print(begin, end, "done") 229 | # begin += batch 230 | # end += batch 231 | # if end >= data_num: 232 | # end = data_num 233 | # end_time = time.time() 234 | # print("time: ", end_time - start_time) 235 | # return adv_x_all 236 | 237 | 238 | # the data is in range(-.5, .5) 239 | def load_data(name): 240 | assert (name.upper() in ['MNIST', 'CIFAR', 'SVHN']) 241 | name = name.lower() 242 | x_train = np.load('./data/' + name + '_data/' + name + '_x_train.npy') 243 | y_train = np.load('./data/' + name + '_data/' + name + '_y_train.npy') 244 | x_test = np.load('./data/' + name + '_data/' + name + '_x_test.npy') 245 | y_test = np.load('./data/' + name + '_data/' + name + '_y_test.npy') 246 | return x_train, y_train, x_test, y_test 247 | 248 | 249 | def softmax(x): 250 | exp_x = np.exp(x) 251 | return exp_x / np.sum(exp_x) 252 | 253 | 254 | def accuracy(model, x, labels): 255 | assert (x.shape[0] == labels.shape[0]) 256 | num = x.shape[0] 257 | y = model.predict(x) 258 | y = y.argmax(axis=-1) 259 | labels = labels.argmax(axis=-1) 260 | idx = (labels == y) 261 | print(np.sum(idx) / num) 262 | 263 | 264 | if __name__ == '__main__': 265 | parser = argparse.ArgumentParser(description='attack for DNN') 266 | parser.add_argument('-dataset', help="dataset to use", choices=['mnist', 'cifar', 'svhn']) 267 | parser.add_argument('-model', help="target model to attack", choices=['vgg16', 'resnet20', 'lenet1', 'lenet4', 'lenet5', 'adv_lenet1', 'adv_lenet4', 'adv_lenet5', 'adv_vgg16', 'adv_resnet20', 'svhn_model', 'adv_svhn_model', 'svhn_first', 'adv_svhn_first', 'svhn_second','adv_svhn_second']) 268 | parser.add_argument('-attack', help="attack model", choices=['CW', 'PGD']) 269 | parser.add_argument('-batch_size', help="attack batch size", type=int, default=32) 270 | 271 | args = parser.parse_args() 272 | # args.dataset = 'cifar' 273 | # args.attack = 'PGD' 274 | 275 | # ## get MNIST or SVHN 276 | x_train, y_train, x_test, y_test = load_data(args.dataset) 277 | 278 | ## get CIFAR 279 | # from util import get_data 280 | # x_train, y_train, x_test, y_test = get_data(args.dataset) 281 | 282 | # ## load Xuwei's trained svhn model 283 | # model = get_model(args.dataset, True) 284 | # model.load_weights('./data/' + args.dataset + '_data/model/' + args.model + '.h5') 285 | # model.compile( 286 | # loss='categorical_crossentropy', 287 | # # optimizer='adadelta', 288 | # optimizer='adam', 289 | # metrics=['accuracy'] 290 | # ) 291 | 292 | ## load mine trained model 293 | from keras.models import load_model 294 | model = load_model('./data/' + args.dataset + '_data/model/' + args.model + '.h5') 295 | model.summary() 296 | 297 | accuracy(model, x_test, y_test) 298 | 299 | adv = gen_adv_data(model, x_test[:1000], y_test[:1000], args.attack, args.dataset, args.batch_size) 300 | 301 | # accuracy(model, adv, y_test) 302 | # np.save('./data/cifar_data/model/test_adv_PGD', adv) 303 | np.save('./data/' + args.dataset + '_data/model/' + args.model + '_' + args.attack + '.npy', adv) 304 | 305 | # y_res = model.predict(x_train) 306 | # y_res = softmax(y_res) 307 | # y_res = y_res.argmax(axis=-1) 308 | # y = y_train.argmax(axis=-1) 309 | # idx = (y_res == y) 310 | -------------------------------------------------------------------------------- /Comparison of Attack Images/compare_result.txt: -------------------------------------------------------------------------------- 1 | 2 | ------------------------------------------------------------------------------ 3 | the result of mnist lenet1 is: 4 | MR of DH is 0.097 5 | MR of DP is 1.0 6 | Linf of DH is 251.0 7 | Linf of DP is 77.0 8 | 9 | ------------------------------------------------------------------------------ 10 | the result of mnist lenet4 is: 11 | MR of DH is 0.036 12 | MR of DP is 1.0 13 | Linf of DH is 248.16666666666666 14 | Linf of DP is 77.0 15 | 16 | ------------------------------------------------------------------------------ 17 | the result of mnist lenet5 is: 18 | MR of DH is 0.042 19 | MR of DP is 0.999 20 | Linf of DH is 249.6551724137931 21 | Linf of DP is 77.0 22 | 23 | ------------------------------------------------------------------------------ 24 | the result of cifar vgg16 is: 25 | MR of DH is 0.429 26 | MR of DP is 0.898 27 | Linf of DH is 106.45648810392643 28 | Linf of DP is 8.0 29 | 30 | ------------------------------------------------------------------------------ 31 | the result of cifar resnet20 is: 32 | MR of DH is 0.422 33 | MR of DP is 0.999 34 | Linf of DH is 92.61751249519415 35 | Linf of DP is 8.0 36 | 37 | ------------------------------------------------------------------------------ 38 | the result of svhn svhn_model is: 39 | MR of DH is 0.235 40 | MR of DP is 1.0 41 | Linf of DH is 166.21212121212122 42 | Linf of DP is 8.896969696969697 43 | 44 | ------------------------------------------------------------------------------ 45 | the result of svhn svhn_first is: 46 | MR of DH is 0.296 47 | MR of DP is 0.999 48 | Linf of DH is 174.80444444444444 49 | Linf of DP is 8.911111111111111 50 | 51 | ------------------------------------------------------------------------------ 52 | the result of svhn svhn_second is: 53 | MR of DH is 0.211 54 | MR of DP is 1.0 55 | Linf of DH is 168.80232558139534 56 | Linf of DP is 8.94186046511628 57 | -------------------------------------------------------------------------------- /Comparison of Attack Images/criteria.py: -------------------------------------------------------------------------------- 1 | import numpy as np 2 | import tensorflow as tf 3 | import os 4 | from attack_evaluate import AttackEvaluate 5 | import argparse 6 | 7 | import matplotlib.pyplot as plt 8 | 9 | from skimage import data, img_as_float 10 | from skimage.metrics import structural_similarity as ssim 11 | 12 | 13 | os.environ["CUDA_VISIBLE_DEVICES"] = "0" 14 | 15 | ####for solving some specific problems, don't care 16 | config = tf.ConfigProto() 17 | config.gpu_options.allow_growth = True 18 | sess = tf.Session(config=config) 19 | 20 | def lp_distance(pic1, pic2): 21 | pic1 = np.round(pic1*255) 22 | pic2 = np.round(pic2*255) 23 | 24 | 25 | dist_li = np.linalg.norm(np.reshape(pic1 - pic2, -1), ord=np.inf) 26 | 27 | return dist_li 28 | 29 | def softmax(x): 30 | exp_x = np.exp(x) 31 | return exp_x / np.sum(exp_x) 32 | 33 | def load_data(name): 34 | assert (name.upper() in ['MNIST', 'CIFAR', 'SVHN']) 35 | name = name.lower() 36 | x_train = np.load('./data/' + name + '_data/' + name + '_x_train.npy') 37 | y_train = np.load('./data/' + name + '_data/' + name + '_y_train.npy') 38 | x_test = np.load('./data/' + name + '_data/' + name + '_x_test.npy') 39 | y_test = np.load('./data/' + name + '_data/' + name + '_y_test.npy') 40 | return x_train, y_train, x_test, y_test 41 | 42 | 43 | if __name__ == '__main__': 44 | parser = argparse.ArgumentParser(description='MR and Linf') 45 | parser.add_argument('-dataset', help="dataset to use", choices=['mnist', 'cifar', 'svhn']) 46 | parser.add_argument('-model', help="target model to attack", 47 | choices=['vgg16', 'resnet20', 'lenet1', 'lenet4', 'lenet5', 'svhn_model', 48 | 'svhn_first', 'svhn_second']) 49 | 50 | args = parser.parse_args() 51 | 52 | attack = 'PGD' 53 | dataset = args.dataset 54 | model_name = args.model 55 | # print(args.dataset) 56 | 57 | 58 | ### load deephunter adv 59 | x_adv_deep = np.load('./data/' + dataset + '_data/model/' + 'deephunter_adv_test_' + model_name + '.npy') 60 | 61 | 62 | ### load PGD adv 63 | x_adv_pgd = np.load('./data/' + dataset + '_data/model/' + model_name + '_' + attack + '.npy') 64 | 65 | 66 | # load dataset 67 | x_train, y_train, x_test, y_test = load_data(dataset) 68 | 69 | # import model 70 | from keras.models import load_model 71 | model = load_model('./data/' + dataset + '_data/model/' + model_name + '.h5') 72 | model.summary() 73 | 74 | 75 | ## compare MR 76 | criteria1 = AttackEvaluate(model, x_test, y_test, x_adv_deep[:1000]) 77 | MR_deep = criteria1.misclassification_rate() 78 | print(MR_deep) 79 | 80 | criteria2 = AttackEvaluate(model, x_test, y_test, x_adv_pgd[:1000]) 81 | MR_pgd = criteria2.misclassification_rate() 82 | print(MR_pgd) 83 | 84 | li_deep = 0 85 | li_pgd = 0 86 | 87 | num = 0 88 | 89 | for i in range(1000): 90 | if softmax(model.predict(np.expand_dims(x_adv_deep[i], axis=0))).argmax(axis=-1) != softmax(model.predict(np.expand_dims(x_test[i], axis=0))).argmax(axis=-1): 91 | num += 1 92 | 93 | ## compare Lp 94 | li_deep_new = lp_distance(x_test[i], x_adv_deep[i]) 95 | li_pgd_new = lp_distance(x_test[i], x_adv_pgd[i]) 96 | 97 | li_deep += li_deep_new 98 | li_pgd += li_pgd_new 99 | 100 | if dataset == 'cifar': 101 | li_deep = li_deep/255 102 | 103 | with open("compare_result.txt", "a") as f: 104 | f.write("\n------------------------------------------------------------------------------\n") 105 | f.write('the result of {} {} is: \n'.format(args.dataset, args.model)) 106 | f.write('MR of DH is {} \n'.format(MR_deep)) 107 | f.write('MR of DP is {} \n'.format(MR_pgd)) 108 | f.write('Linf of DH is {} \n'.format(li_deep/num)) 109 | f.write('Linf of DP is {} \n'.format(li_pgd/num)) 110 | 111 | 112 | print("li of deephunter is: {}".format(li_deep/num)) 113 | print("li of pgd is: {}".format(li_pgd/num)) 114 | 115 | 116 | 117 | 118 | -------------------------------------------------------------------------------- /Comparison of Attack Images/data/use_to_upload_empty_floder.txt: -------------------------------------------------------------------------------- 1 | . 2 | -------------------------------------------------------------------------------- /Comparison of Attack Images/mutators.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from importlib import reload 3 | import sys 4 | import cv2 5 | import numpy as np 6 | import random 7 | import time 8 | import copy 9 | reload(sys) 10 | # sys.setdefaultencoding('utf8') 11 | 12 | 13 | 14 | # keras 1.2.2 tf:1.2.0 15 | class Mutators(): 16 | def image_translation(img, params): 17 | 18 | rows, cols, ch = img.shape 19 | # rows, cols = img.shape 20 | 21 | # M = np.float32([[1, 0, params[0]], [0, 1, params[1]]]) 22 | M = np.float32([[1, 0, params], [0, 1, params]]) 23 | dst = cv2.warpAffine(img, M, (cols, rows)) 24 | return dst 25 | 26 | def image_scale(img, params): 27 | 28 | # res = cv2.resize(img, None, fx=params[0], fy=params[1], interpolation=cv2.INTER_CUBIC) 29 | rows, cols, ch = img.shape 30 | res = cv2.resize(img, None, fx=params, fy=params, interpolation=cv2.INTER_CUBIC) 31 | res = res.reshape((res.shape[0],res.shape[1],ch)) 32 | y, x, z = res.shape 33 | if params > 1: # need to crop 34 | startx = x // 2 - cols // 2 35 | starty = y // 2 - rows // 2 36 | return res[starty:starty + rows, startx:startx + cols] 37 | elif params < 1: # need to pad 38 | sty = (rows - y) // 2 39 | stx = (cols - x) // 2 40 | return np.pad(res, [(sty, rows - y - sty), (stx, cols - x - stx), (0, 0)], mode='constant', constant_values=0) 41 | return res 42 | 43 | def image_shear(img, params): 44 | rows, cols, ch = img.shape 45 | # rows, cols = img.shape 46 | factor = params * (-1.0) 47 | M = np.float32([[1, factor, 0], [0, 1, 0]]) 48 | dst = cv2.warpAffine(img, M, (cols, rows)) 49 | return dst 50 | 51 | def image_rotation(img, params): 52 | rows, cols, ch = img.shape 53 | # rows, cols = img.shape 54 | M = cv2.getRotationMatrix2D((cols / 2, rows / 2), params, 1) 55 | dst = cv2.warpAffine(img, M, (cols, rows), flags=cv2.INTER_AREA) 56 | return dst 57 | 58 | def image_contrast(img, params): 59 | alpha = params 60 | new_img = cv2.multiply(img, np.array([alpha])) # mul_img = img*alpha 61 | # new_img = cv2.add(mul_img, beta) # new_img = img*alpha + beta 62 | 63 | return new_img 64 | 65 | def image_brightness(img, params): 66 | beta = params 67 | new_img = cv2.add(img, beta) # new_img = img*alpha + beta 68 | return new_img 69 | 70 | def image_blur(img, params): 71 | 72 | # print("blur") 73 | blur = [] 74 | if params == 1: 75 | blur = cv2.blur(img, (3, 3)) 76 | if params == 2: 77 | blur = cv2.blur(img, (4, 4)) 78 | if params == 3: 79 | blur = cv2.blur(img, (5, 5)) 80 | if params == 4: 81 | blur = cv2.GaussianBlur(img, (3, 3), 0) 82 | if params == 5: 83 | blur = cv2.GaussianBlur(img, (5, 5), 0) 84 | if params == 6: 85 | blur = cv2.GaussianBlur(img, (7, 7), 0) 86 | if params == 7: 87 | blur = cv2.medianBlur(img, 3) 88 | if params == 8: 89 | blur = cv2.medianBlur(img, 5) 90 | # if params == 9: 91 | # blur = cv2.blur(img, (6, 6)) 92 | if params == 9: 93 | blur = cv2.bilateralFilter(img, 6, 50, 50) 94 | # blur = cv2.bilateralFilter(img, 9, 75, 75) 95 | return blur 96 | 97 | def image_pixel_change(img, params): 98 | # random change 1 - 5 pixels from 0 -255 99 | img_shape = img.shape 100 | img1d = np.ravel(img) 101 | arr = np.random.randint(0, len(img1d), params) 102 | for i in arr: 103 | img1d[i] = np.random.randint(0, 256) 104 | new_img = img1d.reshape(img_shape) 105 | return new_img 106 | 107 | def image_noise(img, params): 108 | if params == 1: # Gaussian-distributed additive noise. 109 | row, col, ch = img.shape 110 | mean = 0 111 | var = 0.1 112 | sigma = var ** 0.5 113 | gauss = np.random.normal(mean, sigma, (row, col, ch)) 114 | gauss = gauss.reshape(row, col, ch) 115 | noisy = img + gauss 116 | return noisy.astype(np.uint8) 117 | elif params == 2: # Replaces random pixels with 0 or 1. 118 | s_vs_p = 0.5 119 | amount = 0.004 120 | out = np.copy(img) 121 | # Salt mode 122 | num_salt = np.ceil(amount * img.size * s_vs_p) 123 | coords = [np.random.randint(0, i, int(num_salt)) 124 | for i in img.shape] 125 | out[tuple(coords)] = 1 126 | 127 | # Pepper mode 128 | num_pepper = np.ceil(amount * img.size * (1. - s_vs_p)) 129 | coords = [np.random.randint(0, i, int(num_pepper)) 130 | for i in img.shape] 131 | out[tuple(coords)] = 0 132 | return out 133 | elif params == 3: # Multiplicative noise using out = image + n*image,where n is uniform noise with specified mean & variance. 134 | row, col, ch = img.shape 135 | gauss = np.random.randn(row, col, ch) 136 | gauss = gauss.reshape(row, col, ch) 137 | noisy = img + img * gauss 138 | return noisy.astype(np.uint8) 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | -------------------------------------------------------------------------------- /Comparison of Attack Images/test_example.sh: -------------------------------------------------------------------------------- 1 | : ' 2 | parser.add_argument('-dataset', help="dataset to use", choices=['mnist', 'cifar']) 3 | parser.add_argument('-model', help="target model to attack", choices=['vgg16', 'resnet20', 'lenet1', 'lenet4', 'lenet5', 'svhn_model', 'svhn_first', 'svhn_second']) 4 | 5 | ' 6 | 7 | #: 'attack' 8 | #python attack.py -dataset mnist -model lenet1 -attack PGD -batch_size 128 9 | #python attack.py -dataset mnist -model lenet4 -attack PGD -batch_size 128 10 | #python attack.py -dataset mnist -model lenet5 -attack PGD -batch_size 128 11 | 12 | #python attack.py -dataset cifar -model vgg16 -attack PGD -batch_size 128 13 | #python attack.py -dataset cifar -model resnet20 -attack PGD -batch_size 128 14 | 15 | #python attack.py -dataset svhn -model svhn_model -attack PGD -batch_size 128 16 | #python attack.py -dataset svhn -model svhn_first -attack PGD -batch_size 128 17 | #python attack.py -dataset svhn -model svhn_second -attack PGD -batch_size 128 18 | 19 | ## DH 20 | #python deephunter_attack.py -dataset mnist -model lenet1 21 | #python deephunter_attack.py -dataset mnist -model lenet4 22 | #python deephunter_attack.py -dataset mnist -model lenet5 23 | 24 | #python deephunter_attack.py -dataset cifar -model vgg16 25 | #python deephunter_attack.py -dataset cifar -model resnet20 26 | 27 | #python deephunter_attack.py -dataset svhn -model svhn_model 28 | #python deephunter_attack.py -dataset svhn -model svhn_first 29 | #python deephunter_attack.py -dataset svhn -model svhn_second 30 | 31 | # criteria 32 | python criteria.py -dataset mnist -model lenet1 33 | python criteria.py -dataset mnist -model lenet4 34 | python criteria.py -dataset mnist -model lenet5 35 | 36 | python criteria.py -dataset cifar -model vgg16 37 | python criteria.py -dataset cifar -model resnet20 38 | 39 | python criteria.py -dataset svhn -model svhn_model 40 | python criteria.py -dataset svhn -model svhn_first 41 | python criteria.py -dataset svhn -model svhn_second 42 | 43 | 44 | 45 | echo 'Finish!' 46 | 47 | -------------------------------------------------------------------------------- /Correlation/.idea/Figure 4 and figure 8.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 12 | -------------------------------------------------------------------------------- /Correlation/.idea/inspectionProfiles/profiles_settings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 6 | -------------------------------------------------------------------------------- /Correlation/.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 6 | 7 | -------------------------------------------------------------------------------- /Correlation/.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /Correlation/.idea/workspace.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 11 | 12 | 16 | 17 | 18 | 19 | 20 | 21 | 22 |