├── README.md ├── train_within_block_subject.py ├── train_within_block_subject1.py ├── train_within_block_subject2.py ├── tlm_uap_nontarget_cross.py ├── tlm_uap_target_within.py ├── tlm_uap_nontarget_within.py ├── tlm_uap_target_cross.py ├── tlm_uap_target_within_block.py ├── df_uap_within.py ├── tlm_uap_nontarget_within_block.py ├── adv_patch_target_cross_train.py ├── df_uap_cross.py ├── adv_patch_target_cross_test.py ├── df_uap_within_block.py ├── old_models.py └── utils.py /README.md: -------------------------------------------------------------------------------- 1 | # UAP_EEG 2 | Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs 3 | -------------------------------------------------------------------------------- /train_within_block_subject.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | from keras.callbacks import EarlyStopping, ModelCheckpoint 3 | import keras.backend as K 4 | import os 5 | import utils 6 | import numpy as np 7 | from scipy.io import loadmat 8 | import tensorflow as tf 9 | from sklearn.model_selection import KFold 10 | 11 | K.set_image_data_format('channels_first') 12 | 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '0' 15 | 16 | config = tf.ConfigProto() 17 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 18 | config.gpu_options.per_process_gpu_memory_fraction = 0.32 19 | config.gpu_options.allow_growth = True 20 | K.set_session(tf.Session(config=config)) 21 | 22 | gpuConfig = tf.ConfigProto(allow_soft_placement=True) 23 | gpuConfig.gpu_options.allow_growth = True 24 | 25 | random_seed = None 26 | # np.random.seed(random_seed) 27 | data_dir = 'Data/processed_data' 28 | train_dir = 'within_block_runs' 29 | # model_name = 'model.h5' 30 | model_name = 'model.h5' 31 | batch_size = 64 32 | epoches = 1000 33 | 34 | data_list = ['MI4C'] 35 | s_num = 9 36 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 37 | model_list = ['EEGNet'] 38 | k_fold = 5 39 | 40 | for data_name in data_list: 41 | for model_used in model_list: 42 | for s_id in range(s_num): 43 | # Build pathes 44 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 45 | # Load dataset 46 | data = loadmat(data_path) 47 | x = data['x'] 48 | y = np.squeeze(data['y']) 49 | kfold = KFold(n_splits=k_fold, shuffle=False) 50 | kf = 0 51 | for train_index, test_index in kfold.split(x, y): 52 | # Build checkpoint pathes 53 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 54 | '{}'.format(s_id), '{}'.format(kf)) 55 | model_path = os.path.join(checkpoint_path, model_name) 56 | 57 | if not os.path.exists(checkpoint_path): 58 | os.makedirs(checkpoint_path) 59 | print(checkpoint_path) 60 | 61 | x_train = x[train_index] 62 | y_train = y[train_index] 63 | x_test = x[test_index] 64 | y_test = y[test_index] 65 | 66 | if 'EPFL' in data_name: 67 | # downsampling 68 | data_size = y_train.shape[0] 69 | shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 70 | # shuffle_index = utils.shuffle_data(data_size) 71 | x_train = x_train[shuffle_index] 72 | y_train = y_train[shuffle_index] 73 | 74 | y0_index = np.argwhere(y_train==0) 75 | y1_index = np.argwhere(y_train==1) 76 | length = min(len(y0_index), len(y1_index)) 77 | y0_index = y0_index[0:length] 78 | y1_index = y1_index[0:length] 79 | y_index = np.squeeze(np.concatenate((y0_index, y1_index))) 80 | 81 | y_train = y_train[y_index] 82 | x_train = x_train[y_index] 83 | elif 'ERN' in data_name: 84 | y0_rate = np.mean(np.where(y_train==0, 1, 0)) 85 | y1_rate = np.mean(np.where(y_train==1, 1, 0)) 86 | class_weights = {0: y1_rate, 1: y0_rate} 87 | 88 | data_size = y_train.shape[0] 89 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 90 | shuffle_index = utils.shuffle_data(data_size) 91 | x_train = x_train[shuffle_index] 92 | y_train = y_train[shuffle_index] 93 | 94 | print(x_train.shape) 95 | nb_classes = len(np.unique(y_train)) 96 | samples = x_train.shape[3] 97 | channels = x_train.shape[2] 98 | 99 | # Build Model 100 | if model_used == 'EEGNet': 101 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 102 | elif model_used == 'DeepConvNet': 103 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 104 | elif model_used == 'ShallowConvNet': 105 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 106 | else: 107 | raise Exception('No such model:{}'.format(model_used)) 108 | 109 | model.summary() 110 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 111 | early_stop = EarlyStopping(monitor='val_loss', mode='min', patience=160) 112 | model_checkpoint = ModelCheckpoint(filepath=model_path, monitor='val_loss', mode='min', save_best_only=True) 113 | 114 | # Train Model 115 | his = model.fit( 116 | x_train, y_train, 117 | batch_size=batch_size, 118 | validation_split=0.25, 119 | shuffle=False, 120 | epochs=epoches, 121 | callbacks=[early_stop, model_checkpoint], 122 | ) 123 | 124 | # Test Model 125 | # y_pred = np.argmax(model.predict(x_test), axis=1) 126 | # y_test = np.squeeze(y_test) 127 | # bca = utils.bca(y_test, y_pred) 128 | # acc = np.sum(y_pred==y_test).astype(np.float32)/len(y_pred) 129 | # print('{}_{}:bca-{} acc-{}'.format(data_name, model_used, bca, acc)) 130 | K.clear_session() 131 | 132 | kf += 1 133 | 134 | -------------------------------------------------------------------------------- /train_within_block_subject1.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | from keras.callbacks import EarlyStopping, ModelCheckpoint 3 | import keras.backend as K 4 | import os 5 | import utils 6 | import numpy as np 7 | from scipy.io import loadmat 8 | import tensorflow as tf 9 | from sklearn.model_selection import KFold 10 | 11 | K.set_image_data_format('channels_first') 12 | 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '0' 15 | 16 | 17 | gpuConfig = tf.ConfigProto(allow_soft_placement=True) 18 | gpuConfig.gpu_options.allow_growth = True 19 | 20 | config = tf.ConfigProto() 21 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 22 | config.gpu_options.per_process_gpu_memory_fraction = 0.32 23 | config.gpu_options.allow_growth = True 24 | K.set_session(tf.Session(config=config)) 25 | 26 | random_seed = None 27 | # np.random.seed(random_seed) 28 | data_dir = 'Data/processed_data' 29 | train_dir = 'within_block_runs' 30 | # model_name = 'model.h5' 31 | model_name = 'model.h5' 32 | batch_size = 64 33 | epoches = 1000 34 | 35 | data_list = ['EPFL'] 36 | s_num = 8 37 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 38 | model_list = ['EEGNet'] 39 | k_fold = 5 40 | 41 | for data_name in data_list: 42 | for model_used in model_list: 43 | for s_id in range(s_num): 44 | # Build pathes 45 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 46 | # Load dataset 47 | data = loadmat(data_path) 48 | x = data['x'] 49 | y = np.squeeze(data['y']) 50 | kfold = KFold(n_splits=k_fold, shuffle=False) 51 | kf = 0 52 | for train_index, test_index in kfold.split(x, y): 53 | # Build checkpoint pathes 54 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 55 | '{}'.format(s_id), '{}'.format(kf)) 56 | model_path = os.path.join(checkpoint_path, model_name) 57 | 58 | if not os.path.exists(checkpoint_path): 59 | os.makedirs(checkpoint_path) 60 | print(checkpoint_path) 61 | 62 | x_train = x[train_index] 63 | y_train = y[train_index] 64 | x_test = x[test_index] 65 | y_test = y[test_index] 66 | 67 | if 'EPFL' in data_name: 68 | # downsampling 69 | # data_size = y_train.shape[0] 70 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 71 | # # shuffle_index = utils.shuffle_data(data_size) 72 | # x_train = x_train[shuffle_index] 73 | # y_train = y_train[shuffle_index] 74 | # 75 | # y0_index = np.argwhere(y_train==0) 76 | # y1_index = np.argwhere(y_train==1) 77 | # length = min(len(y0_index), len(y1_index)) 78 | # y0_index = y0_index[0:length] 79 | # y1_index = y1_index[0:length] 80 | # y_index = np.squeeze(np.concatenate((y0_index, y1_index))) 81 | # 82 | # y_train = y_train[y_index] 83 | # x_train = x_train[y_index] 84 | # elif 'ERN' in data_name: 85 | y0_rate = np.mean(np.where(y_train==0, 1, 0)) 86 | y1_rate = np.mean(np.where(y_train==1, 1, 0)) 87 | class_weights = {0: y1_rate, 1: y0_rate} 88 | 89 | data_size = y_train.shape[0] 90 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 91 | shuffle_index = utils.shuffle_data(data_size) 92 | x_train = x_train[shuffle_index] 93 | y_train = y_train[shuffle_index] 94 | 95 | print(x_train.shape) 96 | nb_classes = len(np.unique(y_train)) 97 | samples = x_train.shape[3] 98 | channels = x_train.shape[2] 99 | 100 | # Build Model 101 | if model_used == 'EEGNet': 102 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 103 | elif model_used == 'DeepConvNet': 104 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 105 | elif model_used == 'ShallowConvNet': 106 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 107 | else: 108 | raise Exception('No such model:{}'.format(model_used)) 109 | 110 | model.summary() 111 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 112 | early_stop = EarlyStopping(monitor='val_loss', mode='min', patience=30) 113 | model_checkpoint = ModelCheckpoint(filepath=model_path, monitor='val_loss', mode='min', save_best_only=True) 114 | 115 | # Train Model 116 | his = model.fit( 117 | x_train, y_train, 118 | batch_size=batch_size, 119 | validation_split=0.25, 120 | shuffle=False, 121 | epochs=epoches, 122 | callbacks=[early_stop, model_checkpoint], 123 | class_weight=class_weights 124 | ) 125 | 126 | # Test Model 127 | # y_pred = np.argmax(model.predict(x_test), axis=1) 128 | # y_test = np.squeeze(y_test) 129 | # bca = utils.bca(y_test, y_pred) 130 | # acc = np.sum(y_pred==y_test).astype(np.float32)/len(y_pred) 131 | # print('{}_{}:bca-{} acc-{}'.format(data_name, model_used, bca, acc)) 132 | K.clear_session() 133 | 134 | kf += 1 135 | 136 | -------------------------------------------------------------------------------- /train_within_block_subject2.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | from keras.callbacks import EarlyStopping, ModelCheckpoint 3 | import keras.backend as K 4 | import os 5 | import utils 6 | import numpy as np 7 | from scipy.io import loadmat 8 | import tensorflow as tf 9 | from sklearn.model_selection import KFold 10 | 11 | K.set_image_data_format('channels_first') 12 | 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '0' 15 | 16 | config = tf.ConfigProto() 17 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 18 | config.gpu_options.per_process_gpu_memory_fraction = 0.32 19 | config.gpu_options.allow_growth = True 20 | K.set_session(tf.Session(config=config)) 21 | 22 | gpuConfig = tf.ConfigProto(allow_soft_placement=True) 23 | gpuConfig.gpu_options.allow_growth = True 24 | 25 | random_seed = None 26 | # np.random.seed(random_seed) 27 | data_dir = 'Data/processed_data' 28 | train_dir = 'within_block_runs' 29 | # model_name = 'model.h5' 30 | model_name = 'model.h5' 31 | batch_size = 64 32 | epoches = 1000 33 | 34 | data_list = ['ERN'] 35 | s_num = 16 36 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 37 | model_list = ['EEGNet'] 38 | k_fold = 5 39 | 40 | for data_name in data_list: 41 | for model_used in model_list: 42 | for s_id in range(s_num): 43 | # Build pathes 44 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 45 | # Load dataset 46 | data = loadmat(data_path) 47 | x = data['x'] 48 | y = np.squeeze(data['y']) 49 | kfold = KFold(n_splits=k_fold, shuffle=False) 50 | kf = 0 51 | # acc_kfold = 0. 52 | # bca_kfold = 0. 53 | for train_index, test_index in kfold.split(x, y): 54 | # Build checkpoint pathes 55 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 56 | '{}'.format(s_id), '{}'.format(kf)) 57 | model_path = os.path.join(checkpoint_path, model_name) 58 | 59 | if not os.path.exists(checkpoint_path): 60 | os.makedirs(checkpoint_path) 61 | print(checkpoint_path) 62 | 63 | x_train = x[train_index] 64 | y_train = y[train_index] 65 | x_test = x[test_index] 66 | y_test = y[test_index] 67 | 68 | if 'EPFL' in data_name: 69 | # downsampling 70 | data_size = y_train.shape[0] 71 | shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 72 | # shuffle_index = utils.shuffle_data(data_size) 73 | x_train = x_train[shuffle_index] 74 | y_train = y_train[shuffle_index] 75 | 76 | y0_index = np.argwhere(y_train==0) 77 | y1_index = np.argwhere(y_train==1) 78 | length = min(len(y0_index), len(y1_index)) 79 | y0_index = y0_index[0:length] 80 | y1_index = y1_index[0:length] 81 | y_index = np.squeeze(np.concatenate((y0_index, y1_index))) 82 | 83 | y_train = y_train[y_index] 84 | x_train = x_train[y_index] 85 | elif 'ERN' in data_name: 86 | y0_rate = np.mean(np.where(y_train==0, 1, 0)) 87 | y1_rate = np.mean(np.where(y_train==1, 1, 0)) 88 | class_weights = {0: y1_rate, 1: y0_rate} 89 | 90 | data_size = y_train.shape[0] 91 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 92 | shuffle_index = utils.shuffle_data(data_size) 93 | x_train = x_train[shuffle_index] 94 | y_train = y_train[shuffle_index] 95 | 96 | print(x_train.shape) 97 | nb_classes = len(np.unique(y_train)) 98 | samples = x_train.shape[3] 99 | channels = x_train.shape[2] 100 | 101 | # Build Model 102 | if model_used == 'EEGNet': 103 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 104 | elif model_used == 'DeepConvNet': 105 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 106 | elif model_used == 'ShallowConvNet': 107 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 108 | else: 109 | raise Exception('No such model:{}'.format(model_used)) 110 | 111 | model.summary() 112 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 113 | early_stop = EarlyStopping(monitor='val_loss', mode='min', patience=30) 114 | model_checkpoint = ModelCheckpoint(filepath=model_path, monitor='val_loss', mode='min', save_best_only=True) 115 | 116 | # Train Model 117 | his = model.fit( 118 | x_train, y_train, 119 | batch_size=batch_size, 120 | validation_split=0.25, 121 | shuffle=False, 122 | epochs=epoches, 123 | callbacks=[early_stop, model_checkpoint], 124 | class_weight=class_weights 125 | ) 126 | 127 | # Test Model 128 | # y_pred = np.argmax(model.predict(x_test), axis=1) 129 | # y_test = np.squeeze(y_test) 130 | # bca = utils.bca(y_test, y_pred) 131 | # acc = np.sum(y_pred==y_test).astype(np.float32)/len(y_pred) 132 | # print('{}_{}:bca-{} acc-{}'.format(data_name, model_used, bca, acc)) 133 | K.clear_session() 134 | 135 | kf += 1 136 | 137 | -------------------------------------------------------------------------------- /tlm_uap_nontarget_cross.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | 7 | 8 | 9 | if __name__ == '__main__': 10 | os.environ["CUDA_VISIBLE_DEVICES"] = '4' 11 | K.set_image_data_format('channels_first') 12 | K.set_learning_phase(0) #set learning phase 13 | 14 | # data_names = ['EPFL', 'ERN', 'MI4C'] 15 | data_names = ['MI4C'] 16 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 17 | model_list = ['ShallowConvNet'] 18 | 19 | a = 0.2 # noisy 20 | # epsilon = 0.1 21 | attack_type = 'nontarget' # 'target' or 'nontarget' 22 | 23 | for data_name in data_names: 24 | # Load dataset 25 | data_dir = 'Data/processed_data' 26 | train_dir = 'runs' 27 | checkpoint = 'checkpoint' 28 | model_name = 'model.h5' 29 | batch_size = 64 30 | epoches = 1600 31 | reg = 'l1' 32 | 33 | # Build pathes 34 | data_path = os.path.join(data_dir, '{}.npz'.format(data_name)) 35 | 36 | # Load dataset 37 | data = np.load(data_path) 38 | print(data.keys()) 39 | x = data['x'] 40 | y = data['y'] 41 | s = data['s'] 42 | # seed = 2019 43 | 44 | # x_train, x_test, y_train, y_test = train_test_split(x, y, shuffle=True, test_size=0.3, random_state=seed) 45 | 46 | # num_classes = 4 47 | print(x.shape,y.shape) 48 | raw_accs = [] 49 | adv_accs = [] 50 | rand_accs = [] 51 | rand_bcas = [] 52 | raw_bcas = [] 53 | adv_bcas = [] 54 | 55 | datasets_wrt_s = utils.list_leave_one_subject(x, y, s, shuffle=True) 56 | for dataset_wrt_s in datasets_wrt_s: 57 | x_train, y_train = dataset_wrt_s[0] 58 | x_test, y_test = dataset_wrt_s[1] 59 | subject = dataset_wrt_s[2] 60 | 61 | nb_classes = len(np.unique(y_test)) 62 | samples = x_test.shape[3] 63 | channels = x_test.shape[2] 64 | 65 | print(x_train.shape, x_test.shape, nb_classes) 66 | 67 | for model_used in model_list: 68 | 69 | 70 | # Build pathes 71 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 72 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 73 | # print(checkpoint_path) 74 | # checkpoint_path = os.path.join('/mnt/disk2/zhangxiao/AdversarialExamplesOnEEG_cross_subject/old_runs', 75 | # '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 76 | checkpoint_path = os.path.join('runs', '{}/{}'.format(data_name, model_used), '{}'.format(int(subject))) 77 | print(checkpoint_path) 78 | model_path = os.path.join(checkpoint_path, model_name) 79 | 80 | 81 | # Build Model 82 | if model_used == 'EEGNet': 83 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 84 | elif model_used == 'DeepConvNet': 85 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 86 | elif model_used == 'ShallowConvNet': 87 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 88 | else: 89 | raise Exception('No such model:{}'.format(model_used)) 90 | 91 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 92 | # model.load_weights(model_path) 93 | 94 | 95 | save_path = os.path.join(checkpoint_path, 'adv_v_nontarget_pre_{}_test.npz'.format(reg)) 96 | 97 | 98 | 99 | # v = utils.UAP_target(x_train, y_train, model=model, model_used=model_used, model_path=model_path, save_path=save_path, 100 | # noise_limit=a, attack_type=attack_type, batch_size=batch_size, nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 101 | v = utils.UAP_target_pre(x_train, model=model, model_used=model_used, model_path=model_path, 102 | save_path=save_path, 103 | noise_limit=a, attack_type=attack_type, batch_size=batch_size, 104 | nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 105 | 106 | v = np.load(save_path)['v'] 107 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 108 | v = np.expand_dims(v, axis=0) 109 | # print(v) 110 | 111 | 112 | model.load_weights(model_path) 113 | 114 | y_test = y_test.astype('int32').squeeze() 115 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 116 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 117 | 118 | # np.random.seed(2009) 119 | shape = x_test.shape 120 | # random_v = a * np.random.rand(1, 1, channels, samples) 121 | random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 122 | random_x = x_test + random_v 123 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 124 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 125 | 126 | adv_x = x_test + v 127 | # print(v.shape) 128 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 129 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 130 | 131 | raw_accs.append(raw_acc) 132 | rand_accs.append(rand_acc) 133 | adv_accs.append(adv_acc) 134 | 135 | raw_bca = utils.bca(y_test, y_test_pre) 136 | rand_bca = utils.bca(y_test, y_rand_pre) 137 | adv_bca = utils.bca(y_test, y_adv_pre) 138 | 139 | raw_bcas.append(raw_bca) 140 | rand_bcas.append(rand_bca) 141 | adv_bcas.append(adv_bca) 142 | K.clear_session() 143 | # exit() 144 | print(raw_accs) 145 | print(rand_accs) 146 | print(adv_accs) 147 | print('\n') 148 | 149 | 150 | print(np.mean(raw_accs), np.mean(raw_bcas), np.mean(rand_accs), np.mean(rand_bcas), np.mean(adv_accs), 151 | np.mean(adv_bcas),'\n') -------------------------------------------------------------------------------- /tlm_uap_target_within.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | 8 | 9 | if __name__ == '__main__': 10 | K.set_image_data_format('channels_first') 11 | K.set_learning_phase(0) # set learning phase 12 | 13 | os.environ["CUDA_VISIBLE_DEVICES"] = '3' 14 | 15 | random_seed = None 16 | # np.random.seed(random_seed) 17 | data_dir = 'Data/processed_data' 18 | train_dir = 'within_runs' 19 | model_name = 'model.h5' 20 | batch_size = 64 21 | epoches = 1600 22 | 23 | # data_list = ['EPFL', 'ERN', 'MI4C'] 24 | data_list = ['ERN'] 25 | 26 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 27 | model_list = ['ShallowConvNet'] 28 | 29 | a = 0.2 # noisy 30 | # target_classes = [0, 1, 2, 3] 31 | 32 | attack_type = 'target' # 'target' or 'nontarget' 33 | 34 | for data_name in data_list: 35 | if data_name == 'EPFL': 36 | s_num = 8 37 | target_classes = [0, 1] 38 | elif data_name == 'ERN': 39 | s_num = 16 40 | target_classes = [0, 1] 41 | elif data_name == 'MI4C': 42 | s_num = 9 43 | target_classes = [0, 1, 2, 3] 44 | else: 45 | raise Exception('No such dataset:{}'.format(data_name)) 46 | 47 | tr_list = [] 48 | for target_class in target_classes: 49 | raw_accs = [] 50 | adv_accs = [] 51 | rand_accs = [] 52 | rand_bcas = [] 53 | raw_bcas = [] 54 | adv_bcas = [] 55 | raw_trs = [] 56 | rand_trs = [] 57 | adv_trs = [] 58 | for model_used in model_list: 59 | for s_id in range(s_num): 60 | # Build pathes 61 | data_path = os.path.join(data_dir, data_name, 's{}.mat'.format(s_id)) 62 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), '{}'.format(s_id)) 63 | model_path = os.path.join(checkpoint_path, model_name) 64 | 65 | if not os.path.exists(checkpoint_path): 66 | os.makedirs(checkpoint_path) 67 | 68 | print(checkpoint_path) 69 | # Load dataset 70 | data = loadmat(data_path) 71 | x_train = data['x_train'] 72 | y_train = np.squeeze(data['y_train']) 73 | x_test = data['x_test'] 74 | y_test = np.squeeze(data['y_test']) 75 | 76 | data_size = y_train.shape[0] 77 | print(x_train.shape) 78 | print(y_train.shape) 79 | 80 | nb_classes = len(np.unique(y_train)) 81 | samples = x_train.shape[3] 82 | channels = x_train.shape[2] 83 | 84 | # Build Model 85 | if model_used == 'EEGNet': 86 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 87 | elif model_used == 'DeepConvNet': 88 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 89 | elif model_used == 'ShallowConvNet': 90 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 91 | else: 92 | raise Exception('No such model:{}'.format(model_used)) 93 | 94 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 95 | # model.load_weights(model_path) 96 | 97 | 98 | save_path = os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)) 99 | 100 | 101 | 102 | v = utils.UAP_target(x_train, y_train, model_used=model_used, model_path=model_path, save_path=save_path, noise_limit=a) 103 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 104 | v = np.expand_dims(v, axis=0) 105 | # print(v) 106 | 107 | 108 | model.load_weights(model_path) 109 | y_test = y_test.astype('int32').squeeze() 110 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 111 | 112 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 113 | 114 | # np.random.seed(2009) 115 | shape = x_test.shape 116 | # random_v = a * np.random.rand(1, 1, channels, samples) 117 | random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 118 | random_x = x_test + random_v 119 | 120 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 121 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 122 | 123 | adv_x = x_test + v 124 | # print(v.shape) 125 | 126 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 127 | 128 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 129 | 130 | raw_accs.append(raw_acc) 131 | rand_accs.append(rand_acc) 132 | adv_accs.append(adv_acc) 133 | 134 | raw_bca = utils.bca(y_test, y_test_pre) 135 | rand_bca = utils.bca(y_test, y_rand_pre) 136 | adv_bca = utils.bca(y_test, y_adv_pre) 137 | 138 | raw_bcas.append(raw_bca) 139 | rand_bcas.append(rand_bca) 140 | adv_bcas.append(adv_bca) 141 | 142 | raw_tr = np.sum(y_test_pre == target_class) / len(y_test) 143 | rand_tr = np.sum(y_rand_pre == target_class) / len(y_test) 144 | adv_tr = np.sum(y_adv_pre == target_class) / len(y_test) 145 | 146 | raw_trs.append(raw_tr) 147 | rand_trs.append(rand_tr) 148 | adv_trs.append(adv_tr) 149 | 150 | print('raw target rate: ', raw_tr) 151 | print('rand target rate: ', rand_tr) 152 | print('adv target rate: ', adv_tr) 153 | K.clear_session() 154 | # exit() 155 | print(raw_trs) 156 | print(rand_trs) 157 | print(adv_trs) 158 | print('\n') 159 | print(np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)) 160 | tr_list.append([np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)]) 161 | 162 | for tr in tr_list: 163 | print(tr) -------------------------------------------------------------------------------- /tlm_uap_nontarget_within.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | 8 | 9 | 10 | if __name__ == '__main__': 11 | K.set_image_data_format('channels_first') 12 | K.set_learning_phase(0) # set learning phase 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '3' 15 | 16 | random_seed = None 17 | # np.random.seed(random_seed) 18 | data_dir = 'Data/processed_data' 19 | train_dir = 'within_runs' 20 | model_name = 'model.h5' 21 | batch_size = 64 22 | epoches = 1600 23 | 24 | # data_list = ['EPFL', 'ERN', 'MI4C'] 25 | data_list = ['MI4C'] 26 | 27 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 28 | model_list = ['ShallowConvNet'] 29 | 30 | a = 0.2 # noisy 31 | reg = 'l2' 32 | attack_type = 'nontarget' # 'target' or 'nontarget' 33 | 34 | for data_name in data_list: 35 | if data_name == 'EPFL': 36 | s_num = 8 37 | target_classes = [0, 1] 38 | elif data_name == 'ERN': 39 | s_num = 16 40 | target_classes = [0, 1] 41 | elif data_name == 'MI4C': 42 | s_num = 9 43 | target_classes = [0, 1, 2, 3] 44 | else: 45 | raise Exception('No such dataset:{}'.format(data_name)) 46 | 47 | raw_accs = [] 48 | adv_accs = [] 49 | rand_accs = [] 50 | rand_bcas = [] 51 | raw_bcas = [] 52 | adv_bcas = [] 53 | 54 | for model_used in model_list: 55 | for s_id in range(s_num): 56 | # Build pathes 57 | data_path = os.path.join(data_dir, data_name, 's{}.mat'.format(s_id)) 58 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), '{}'.format(s_id)) 59 | model_path = os.path.join(checkpoint_path, model_name) 60 | 61 | if not os.path.exists(checkpoint_path): 62 | os.makedirs(checkpoint_path) 63 | 64 | print(checkpoint_path) 65 | # Load dataset 66 | data = loadmat(data_path) 67 | x_train = data['x_train'] 68 | y_train = np.squeeze(data['y_train']) 69 | x_test = data['x_test'] 70 | y_test = np.squeeze(data['y_test']) 71 | 72 | data_size = y_train.shape[0] 73 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 74 | # shuffle_index = utils.shuffle_data(data_size) 75 | # x_train = x_train[shuffle_index] 76 | # y_train = y_train[shuffle_index] 77 | 78 | print(x_train.shape) 79 | print(y_train.shape) 80 | 81 | nb_classes = len(np.unique(y_train)) 82 | samples = x_train.shape[3] 83 | channels = x_train.shape[2] 84 | 85 | # Build Model 86 | if model_used == 'EEGNet': 87 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 88 | elif model_used == 'DeepConvNet': 89 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 90 | elif model_used == 'ShallowConvNet': 91 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 92 | else: 93 | raise Exception('No such model:{}'.format(model_used)) 94 | 95 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 96 | # model.load_weights(model_path) 97 | 98 | 99 | save_path = os.path.join(checkpoint_path, 'adv_v_nontarget.npz') 100 | 101 | 102 | 103 | # v = UAP_target(x_train, y_train, model_used=model_used, model_path=model_path, save_path=save_path, 104 | # noise_limit=a, attack_type=attack_type) 105 | v = utils.UAP_target_pre(x_train, model=model, model_used=model_used, model_path=model_path, 106 | save_path=save_path, 107 | noise_limit=a, attack_type=attack_type, batch_size=batch_size, 108 | nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 109 | 110 | v = np.load(save_path)['v'] 111 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 112 | v = np.expand_dims(v, axis=0) 113 | # print(v) 114 | 115 | 116 | model.load_weights(model_path) 117 | 118 | y_test = y_test.astype('int32').squeeze() 119 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 120 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 121 | 122 | # np.random.seed(2009) 123 | shape = x_test.shape 124 | # random_v = a * np.random.rand(1, 1, channels, samples) 125 | random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 126 | random_x = x_test + random_v 127 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 128 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 129 | 130 | adv_x = x_test + v 131 | # print(v.shape) 132 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 133 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 134 | 135 | raw_accs.append(raw_acc) 136 | rand_accs.append(rand_acc) 137 | adv_accs.append(adv_acc) 138 | 139 | raw_bca = utils.bca(y_test, y_test_pre) 140 | rand_bca = utils.bca(y_test, y_rand_pre) 141 | adv_bca = utils.bca(y_test, y_adv_pre) 142 | 143 | raw_bcas.append(raw_bca) 144 | rand_bcas.append(rand_bca) 145 | adv_bcas.append(adv_bca) 146 | print('raw acc: ', raw_acc) 147 | print('rand_acc: ', rand_acc) 148 | print('adv_acc: ', adv_acc) 149 | 150 | K.clear_session() 151 | print(raw_accs) 152 | print(rand_accs) 153 | print(adv_accs) 154 | print('\n') 155 | print(raw_bcas) 156 | print(rand_bcas) 157 | print(adv_bcas) 158 | print('\n') 159 | 160 | # print(np.mean(raw_accs), np.mean(rand_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(rand_bcas), 161 | # np.mean(adv_bcas),'\n') 162 | 163 | print(np.mean(raw_accs), np.mean(raw_bcas), np.mean(rand_accs), np.mean(rand_bcas), np.mean(adv_accs), 164 | np.mean(adv_bcas),'\n') 165 | -------------------------------------------------------------------------------- /tlm_uap_target_cross.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | 7 | 8 | if __name__ == '__main__': 9 | os.environ["CUDA_VISIBLE_DEVICES"] = '3' 10 | K.set_image_data_format('channels_first') 11 | K.set_learning_phase(0) #set learning phase 12 | 13 | # data_names = ['EPFL', 'ERN', 'MI4C'] 14 | data_names = ['ERN'] 15 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 16 | model_list = ['ShallowConvNet'] 17 | 18 | a = 0.2 # noisy 19 | attack_type = 'target' # 'target' or 'nontarget' 20 | reg = 'l2' 21 | 22 | for data_name in data_names: 23 | if data_name == 'EPFL': 24 | target_classes = [0, 1] 25 | elif data_name == 'ERN': 26 | target_classes = [0, 1] 27 | elif data_name == 'MI4C': 28 | target_classes = [0, 1, 2, 3] 29 | else: 30 | raise Exception('No such dataset:{}'.format(data_name)) 31 | 32 | # Load dataset 33 | data_dir = 'Data/processed_data' 34 | train_dir = 'runs' 35 | checkpoint = 'checkpoint' 36 | model_name = 'model.h5' 37 | batch_size = 256 38 | epoches = 1000 39 | 40 | # Build pathes 41 | data_path = os.path.join(data_dir, '{}.npz'.format(data_name)) 42 | 43 | # Load dataset 44 | data = np.load(data_path) 45 | print(data.keys()) 46 | x = data['x'] 47 | y = data['y'] 48 | s = data['s'] 49 | # seed = 2019 50 | 51 | # x_train, x_test, y_train, y_test = train_test_split(x, y, shuffle=True, test_size=0.3, random_state=seed) 52 | 53 | # num_classes = 4 54 | print(x.shape,y.shape) 55 | 56 | tr_list = [] 57 | for target_class in target_classes: 58 | raw_accs = [] 59 | adv_accs = [] 60 | rand_accs = [] 61 | rand_bcas = [] 62 | raw_bcas = [] 63 | adv_bcas = [] 64 | raw_trs = [] 65 | rand_trs = [] 66 | adv_trs = [] 67 | datasets_wrt_s = utils.list_leave_one_subject(x, y, s, shuffle=True) 68 | for dataset_wrt_s in datasets_wrt_s: 69 | x_train, y_train = dataset_wrt_s[0] 70 | x_test, y_test = dataset_wrt_s[1] 71 | subject = dataset_wrt_s[2] 72 | 73 | nb_classes = len(np.unique(y_test)) 74 | samples = x_test.shape[3] 75 | channels = x_test.shape[2] 76 | 77 | print(x_train.shape, x_test.shape, nb_classes) 78 | 79 | for model_used in model_list: 80 | 81 | # Build pathes 82 | checkpoint_path = os.path.join('runs', '{}/{}'.format(data_name, model_used), 83 | '{}'.format(int(subject))) 84 | print(checkpoint_path) 85 | model_path = os.path.join(checkpoint_path, model_name) 86 | 87 | # Build Model 88 | if model_used == 'EEGNet': 89 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 90 | elif model_used == 'DeepConvNet': 91 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 92 | elif model_used == 'ShallowConvNet': 93 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 94 | else: 95 | raise Exception('No such model:{}'.format(model_used)) 96 | 97 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 98 | # model.load_weights(model_path) 99 | 100 | 101 | save_path = os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)) 102 | 103 | v = utils.UAP_target(x_train, y_train, model=model, model_used=model_used, model_path=model_path, 104 | save_path=save_path, 105 | noise_limit=a, attack_type=attack_type, batch_size=batch_size, 106 | nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 107 | 108 | v = np.expand_dims(v, axis=0) 109 | 110 | 111 | model.load_weights(model_path) 112 | y_test = y_test.astype('int32').squeeze() 113 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 114 | 115 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 116 | # np.random.seed(2009) 117 | shape = x_test.shape 118 | # random_v = a * np.random.rand(1, 1, channels, samples) 119 | random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 120 | random_x = x_test + random_v 121 | 122 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 123 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 124 | 125 | adv_x = x_test + v 126 | # print(v.shape) 127 | 128 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 129 | 130 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 131 | raw_accs.append(raw_acc) 132 | rand_accs.append(rand_acc) 133 | adv_accs.append(adv_acc) 134 | 135 | raw_bca = utils.bca(y_test, y_test_pre) 136 | rand_bca = utils.bca(y_test, y_rand_pre) 137 | adv_bca = utils.bca(y_test, y_adv_pre) 138 | 139 | raw_bcas.append(raw_bca) 140 | rand_bcas.append(rand_bca) 141 | adv_bcas.append(adv_bca) 142 | 143 | raw_tr = np.sum(y_test_pre == target_class) / len(y_test) 144 | rand_tr = np.sum(y_rand_pre == target_class) / len(y_test) 145 | adv_tr = np.sum(y_adv_pre == target_class) / len(y_test) 146 | 147 | raw_trs.append(raw_tr) 148 | rand_trs.append(rand_tr) 149 | adv_trs.append(adv_tr) 150 | 151 | print('raw target rate: ', raw_tr) 152 | print('rand target rate: ', rand_tr) 153 | print('adv target rate: ', adv_tr) 154 | 155 | K.clear_session() 156 | 157 | print(raw_trs) 158 | print(rand_trs) 159 | print(adv_trs) 160 | print('\n') 161 | # print(np.mean(raw_accs), np.mean(rand_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(rand_bcas), 162 | # np.mean(adv_bcas),'\n') 163 | print(np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)) 164 | tr_list.append([np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)]) 165 | 166 | for tr in tr_list: 167 | print(tr) -------------------------------------------------------------------------------- /tlm_uap_target_within_block.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | from sklearn.model_selection import KFold 8 | 9 | 10 | if __name__ == '__main__': 11 | K.set_image_data_format('channels_first') 12 | K.set_learning_phase(0) # set learning phase 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '3' 15 | 16 | random_seed = None 17 | # np.random.seed(random_seed) 18 | data_dir = 'Data/processed_data' 19 | train_dir = 'within_block_runs' 20 | model_name = 'model.h5' 21 | batch_size = 64 22 | epoches = 1600 23 | 24 | # data_list = ['EPFL', 'ERN', 'MI4C'] 25 | data_list = ['ERN'] 26 | 27 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 28 | model_list = ['ShallowConvNet'] 29 | 30 | a = 0.2 # noisy 31 | # target_classes = [0, 1, 2, 3] 32 | k_fold = 5 33 | 34 | attack_type = 'target' # 'target' or 'nontarget' 35 | 36 | for data_name in data_list: 37 | if data_name == 'EPFL': 38 | s_num = 8 39 | target_classes = [0, 1] 40 | elif data_name == 'ERN': 41 | s_num = 16 42 | target_classes = [0, 1] 43 | elif data_name == 'MI4C': 44 | s_num = 9 45 | target_classes = [0, 1, 2, 3] 46 | else: 47 | raise Exception('No such dataset:{}'.format(data_name)) 48 | 49 | tr_list = [] 50 | for target_class in target_classes: 51 | 52 | for model_used in model_list: 53 | raw_trs = np.zeros((s_num, k_fold)) 54 | rand_trs = np.zeros((s_num, k_fold)) 55 | adv_trs = np.zeros((s_num, k_fold)) 56 | for s_id in range(s_num): 57 | # Build pathes 58 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 59 | # Load dataset 60 | data = loadmat(data_path) 61 | x = data['x'] 62 | y = np.squeeze(data['y']) 63 | kfold = KFold(n_splits=k_fold, shuffle=False) 64 | kf = 0 65 | for train_index, test_index in kfold.split(x, y): 66 | # Build checkpoint pathes 67 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), '{}'.format(s_id), '{}'.format(kf)) 68 | model_path = os.path.join(checkpoint_path, model_name) 69 | 70 | if not os.path.exists(checkpoint_path): 71 | os.makedirs(checkpoint_path) 72 | print(checkpoint_path) 73 | 74 | x_train = x[train_index] 75 | y_train = y[train_index] 76 | x_test = x[test_index] 77 | y_test = y[test_index] 78 | 79 | data_size = y_train.shape[0] 80 | print(x_train.shape) 81 | print(y_train.shape) 82 | 83 | nb_classes = len(np.unique(y_train)) 84 | samples = x_train.shape[3] 85 | channels = x_train.shape[2] 86 | 87 | # Build Model 88 | if model_used == 'EEGNet': 89 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 90 | elif model_used == 'DeepConvNet': 91 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 92 | elif model_used == 'ShallowConvNet': 93 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 94 | else: 95 | raise Exception('No such model:{}'.format(model_used)) 96 | 97 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 98 | # model.load_weights(model_path) 99 | 100 | 101 | save_path = os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)) 102 | 103 | 104 | 105 | v = utils.UAP_target(x_train, y_train, model_used=model_used, model_path=model_path, save_path=save_path, noise_limit=a) 106 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 107 | v = np.expand_dims(v, axis=0) 108 | # print(v) 109 | 110 | 111 | model.load_weights(model_path) 112 | y_test = y_test.astype('int32').squeeze() 113 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 114 | 115 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 116 | 117 | # np.random.seed(2009) 118 | shape = x_test.shape 119 | # random_v = a * np.random.rand(1, 1, channels, samples) 120 | # random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 121 | random_v = a * np.random.randn(1, 1, channels, samples) 122 | random_x = x_test + random_v 123 | 124 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 125 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 126 | 127 | adv_x = x_test + v 128 | # print(v.shape) 129 | 130 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 131 | 132 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 133 | 134 | raw_tr = np.sum(y_test_pre == target_class) / len(y_test) 135 | rand_tr = np.sum(y_rand_pre == target_class) / len(y_test) 136 | adv_tr = np.sum(y_adv_pre == target_class) / len(y_test) 137 | 138 | print('raw target rate: ', raw_tr) 139 | print('rand target rate: ', rand_tr) 140 | print('adv target rate: ', adv_tr) 141 | 142 | raw_trs[s_id, kf] = raw_tr 143 | rand_trs[s_id, kf] = rand_tr 144 | adv_trs[s_id, kf] = adv_tr 145 | 146 | K.clear_session() 147 | 148 | kf += 1 149 | # exit() 150 | print('subject {}/{}, target rate:'.format(s_id, s_num), [list(raw_trs[s_id]), list(rand_trs[s_id]), list(adv_trs[s_id])]) 151 | print(np.mean(raw_trs, axis=1)) 152 | print(np.mean(rand_trs, axis=1)) 153 | print(np.mean(adv_trs, axis=1)) 154 | print('\n') 155 | tr_list.append([np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)]) 156 | print(tr_list[-1]) 157 | 158 | 159 | for tr in tr_list: 160 | print(tr) -------------------------------------------------------------------------------- /df_uap_within.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | from keras.callbacks import EarlyStopping, ModelCheckpoint 3 | import keras.backend as K 4 | import os 5 | import utils 6 | import numpy as np 7 | from scipy.io import loadmat 8 | from cleverhans.attacks import DeepFool 9 | from cleverhans.utils_keras import KerasModelWrapper 10 | from tqdm import tqdm 11 | 12 | 13 | def proj_lp(v, xi, p): 14 | if p == 2: 15 | v = v * min(1, xi / np.linalg.norm(v.flatten(1))) 16 | # v = v / np.linalg.norm(v.flatten(1)) * xi 17 | elif p == np.inf: 18 | v = np.sign(v) * np.minimum(abs(v), xi) 19 | else: 20 | raise ValueError('Values of p different from 2 and Inf are currently not supported...') 21 | 22 | return v 23 | 24 | 25 | def universal_perturbation(model, deepfool, x, delta=0.8, max_iter_uni=10, xi=0.5, p=np.inf, num_classes=4, overshoot=0.02, 26 | max_iter_df=10): 27 | v = 0 28 | fooling_rate = 0.0 29 | fool_list = [] 30 | itr = 0 31 | df_params = {'overshoot': overshoot, 32 | 'max_iter': 50, 33 | 'clip_max': np.amax(x), 34 | 'clip_min': np.amin(x), 35 | 'nb_candidate': num_classes} 36 | 37 | 38 | data = x 39 | shape = x.shape 40 | v_list = [] 41 | while fooling_rate < delta and itr < max_iter_uni-1: 42 | np.random.shuffle(data) 43 | for cur_x in tqdm(data): 44 | cur_x = cur_x.reshape(1, shape[1], shape[2], shape[3]) 45 | if int(np.argmax(model.predict(cur_x))) == int( 46 | np.argmax(model.predict(cur_x + v))): 47 | adv_x = deepfool.generate_np(cur_x, **df_params) 48 | dr = adv_x - cur_x 49 | v = v + dr 50 | # Project on l_p ball 51 | v = proj_lp(v, xi, p) 52 | # print(v) 53 | # print(cur_x) 54 | 55 | v_list.append(v) 56 | itr = itr + 1 57 | data_adv = data + v 58 | num_images = len(data) 59 | est_labels_orig = np.zeros((num_images)) 60 | est_labels_pert = np.zeros((num_images)) 61 | 62 | batch_size = 100 63 | num_batches = np.int(np.ceil(np.float(num_images) / np.float(batch_size))) 64 | 65 | # Compute the estimated labels in batches 66 | for ii in range(0, num_batches): 67 | m = (ii * batch_size) 68 | M = min((ii + 1) * batch_size, num_images) 69 | est_labels_orig[m:M] = np.argmax(model.predict(data[m:M, :, :, :]), axis=1).flatten() 70 | est_labels_pert[m:M] = np.argmax(model.predict(data_adv[m:M, :, :, :]), axis=1).flatten() 71 | 72 | # Compute the fooling rate 73 | fooling_rate = float(np.sum(est_labels_pert != est_labels_orig) / float(num_images)) 74 | print('FOOLING RATE = ', fooling_rate) 75 | fool_list.append(fooling_rate) 76 | max_index = fool_list.index(max(fool_list)) 77 | print(max_index) 78 | v = v_list[max_index] 79 | return v, fool_list 80 | 81 | 82 | 83 | 84 | if __name__ == '__main__': 85 | K.set_image_data_format('channels_first') 86 | 87 | 88 | os.environ["CUDA_VISIBLE_DEVICES"] = '6' 89 | 90 | random_seed = None 91 | # np.random.seed(random_seed) 92 | data_dir = 'Data/processed_data' 93 | train_dir = 'within_runs' 94 | model_name = 'model.h5' 95 | batch_size = 64 96 | epoches = 1600 97 | 98 | # data_list = ['EPFL', 'ERN', 'MI4C'] 99 | data_list = ['MI4C'] 100 | 101 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 102 | model_list = ['ShallowConvNet'] 103 | 104 | a = 0.2 # noisy 105 | 106 | 107 | for data_name in data_list: 108 | if data_name == 'EPFL': 109 | s_num = 8 110 | elif data_name == 'ERN': 111 | s_num = 16 112 | elif data_name == 'MI4C': 113 | s_num = 9 114 | 115 | raw_accs = [] 116 | adv_accs = [] 117 | rand_accs = [] 118 | rand_bcas = [] 119 | raw_bcas = [] 120 | adv_bcas = [] 121 | for model_used in model_list: 122 | for s_id in range(s_num): 123 | # Build pathes 124 | data_path = os.path.join(data_dir, data_name, 's{}.mat'.format(s_id)) 125 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), '{}'.format(s_id)) 126 | model_path = os.path.join(checkpoint_path, model_name) 127 | 128 | if not os.path.exists(checkpoint_path): 129 | os.makedirs(checkpoint_path) 130 | 131 | print(checkpoint_path) 132 | # Load dataset 133 | data = loadmat(data_path) 134 | x_train = data['x_train'] 135 | y_train = np.squeeze(data['y_train']) 136 | x_test = data['x_test'] 137 | y_test = np.squeeze(data['y_test']) 138 | 139 | data_size = y_train.shape[0] 140 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 141 | shuffle_index = utils.shuffle_data(data_size) 142 | x_train = x_train[shuffle_index] 143 | y_train = y_train[shuffle_index] 144 | 145 | print(x_train.shape) 146 | 147 | nb_classes = len(np.unique(y_train)) 148 | samples = x_train.shape[3] 149 | channels = x_train.shape[2] 150 | 151 | # Build Model 152 | if model_used == 'EEGNet': 153 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 154 | elif model_used == 'DeepConvNet': 155 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 156 | elif model_used == 'ShallowConvNet': 157 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 158 | else: 159 | raise Exception('No such model:{}'.format(model_used)) 160 | 161 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 162 | model.load_weights(model_path) 163 | 164 | 165 | y_test = y_test.astype('int32').flatten() 166 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 167 | 168 | ch_model = KerasModelWrapper(model) 169 | deepfool = DeepFool(ch_model, back='tf', sess=K.get_session()) 170 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 171 | 172 | 173 | # np.random.seed(2009) 174 | shape = x_test.shape 175 | # random_v = a * np.random.rand(1, 1, channels, samples) 176 | random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 177 | random_x = x_test + random_v 178 | 179 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 180 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 181 | 182 | 183 | v, fool_list = universal_perturbation(model, deepfool, x_train, num_classes=nb_classes, xi=a) 184 | # print(v, '\n', fool_list) 185 | # f_v = np.load(os.path.join(checkpoint_path, 'adv_v.npz')) 186 | # v = f_v['v'] 187 | adv_x = x_test + v 188 | # print(v.shape) 189 | 190 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 191 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 192 | print('raw acc: ', raw_acc) 193 | print('rand_acc: ', rand_acc) 194 | print('adv_acc: ', adv_acc) 195 | 196 | # print(y_adv_pre) 197 | # print(y_test) 198 | # exit() 199 | raw_accs.append(raw_acc) 200 | rand_accs.append(rand_acc) 201 | adv_accs.append(adv_acc) 202 | 203 | raw_bca = utils.bca(y_test, y_test_pre) 204 | rand_bca = utils.bca(y_test, y_rand_pre) 205 | adv_bca = utils.bca(y_test, y_adv_pre) 206 | 207 | raw_bcas.append(raw_bca) 208 | rand_bcas.append(rand_bca) 209 | adv_bcas.append(adv_bca) 210 | 211 | np.savez(os.path.join(checkpoint_path, 'adv_v.npz'), v=v) 212 | K.clear_session() 213 | print(raw_accs) 214 | print(rand_accs) 215 | print(adv_accs) 216 | print('\n') 217 | print(raw_bcas) 218 | print(rand_bcas) 219 | print(adv_bcas) 220 | print('\n') 221 | print(np.mean(raw_accs), np.mean(rand_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(rand_bcas), 222 | np.mean(adv_bcas)) -------------------------------------------------------------------------------- /tlm_uap_nontarget_within_block.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | from sklearn.model_selection import KFold 8 | import tensorflow as tf 9 | 10 | 11 | 12 | if __name__ == '__main__': 13 | K.set_image_data_format('channels_first') 14 | K.set_learning_phase(0) # set learning phase 15 | 16 | os.environ["CUDA_VISIBLE_DEVICES"] = '2' 17 | 18 | config = tf.ConfigProto() 19 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 20 | config.gpu_options.per_process_gpu_memory_fraction = 0.32 21 | config.gpu_options.allow_growth = True 22 | K.set_session(tf.Session(config=config)) 23 | 24 | random_seed = None 25 | # np.random.seed(random_seed) 26 | data_dir = 'Data/processed_data' 27 | train_dir = 'within_block_runs' 28 | model_name = 'model.h5' 29 | batch_size = 64 30 | epoches = 1600 31 | 32 | # data_list = ['EPFL', 'ERN', 'MI4C'] 33 | data_list = ['MI4C'] 34 | 35 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 36 | model_list = ['ShallowConvNet'] 37 | 38 | a = 0.2 # noisy 39 | reg = None 40 | attack_type = 'nontarget' # 'target' or 'nontarget' 41 | k_fold = 5 42 | 43 | for data_name in data_list: 44 | if data_name == 'EPFL': 45 | s_num = 8 46 | target_classes = [0, 1] 47 | elif data_name == 'ERN': 48 | s_num = 26 49 | # s_num = 10 50 | target_classes = [0, 1] 51 | elif data_name == 'MI4C': 52 | s_num = 9 53 | target_classes = [0, 1, 2, 3] 54 | else: 55 | raise Exception('No such dataset:{}'.format(data_name)) 56 | 57 | 58 | for model_used in model_list: 59 | adv_acc_stats = [] 60 | adv_bca_stats = [] 61 | raw_accs = np.zeros((s_num, k_fold)) 62 | rand_accs = np.zeros((s_num, k_fold)) 63 | adv_accs = np.zeros((s_num, k_fold)) 64 | raw_bcas = np.zeros((s_num, k_fold)) 65 | rand_bcas = np.zeros((s_num, k_fold)) 66 | adv_bcas = np.zeros((s_num, k_fold)) 67 | for s_id in range(s_num): 68 | # Build pathes 69 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 70 | # Load dataset 71 | data = loadmat(data_path) 72 | x = data['x'] 73 | y = np.squeeze(data['y']) 74 | kfold = KFold(n_splits=k_fold, shuffle=False) 75 | kf = 0 76 | for train_index, test_index in kfold.split(x, y): 77 | # Build checkpoint pathes 78 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 79 | '{}'.format(s_id), '{}'.format(kf)) 80 | model_path = os.path.join(checkpoint_path, model_name) 81 | 82 | if not os.path.exists(checkpoint_path): 83 | os.makedirs(checkpoint_path) 84 | print(checkpoint_path) 85 | 86 | x_train = x[train_index] 87 | y_train = y[train_index] 88 | x_test = x[test_index] 89 | y_test = y[test_index] 90 | 91 | data_size = y_train.shape[0] 92 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 93 | # shuffle_index = utils.shuffle_data(data_size) 94 | # x_train = x_train[shuffle_index] 95 | # y_train = y_train[shuffle_index] 96 | 97 | print(x_train.shape) 98 | print(y_train.shape) 99 | 100 | nb_classes = len(np.unique(y_train)) 101 | samples = x_train.shape[3] 102 | channels = x_train.shape[2] 103 | 104 | # Build Model 105 | if model_used == 'EEGNet': 106 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 107 | elif model_used == 'DeepConvNet': 108 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 109 | elif model_used == 'ShallowConvNet': 110 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 111 | else: 112 | raise Exception('No such model:{}'.format(model_used)) 113 | 114 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 115 | # model.load_weights(model_path) 116 | 117 | 118 | 119 | save_path = os.path.join(checkpoint_path, 'adv_v_nontarget_None.npz') 120 | 121 | 122 | 123 | # v = UAP_target(x_train, y_train, model_used=model_used, model_path=model_path, save_path=save_path, 124 | # noise_limit=a, attack_type=attack_type) 125 | # v = utils.UAP_target_pre(x_train, model=model, model_used=model_used, model_path=model_path, 126 | # save_path=save_path, 127 | # noise_limit=a, attack_type=attack_type, batch_size=batch_size, 128 | # nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 129 | 130 | v = np.load(save_path)['v'] 131 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 132 | v = np.expand_dims(v, axis=0) 133 | # print(v) 134 | 135 | 136 | model.load_weights(model_path) 137 | 138 | y_test = y_test.astype('int32').squeeze() 139 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 140 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 141 | 142 | # np.random.seed(2009) 143 | shape = x_test.shape 144 | # random_v = a * np.random.rand(1, 1, channels, samples) 145 | # random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 146 | random_v = a * np.random.randn(1, 1, channels, samples) 147 | random_x = x_test + random_v 148 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 149 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 150 | 151 | adv_x = x_test + v 152 | # print(v.shape) 153 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 154 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 155 | 156 | 157 | 158 | raw_accs[s_id, kf] = raw_acc 159 | rand_accs[s_id, kf] = rand_acc 160 | adv_accs[s_id, kf] = adv_acc 161 | 162 | 163 | raw_bca = utils.bca(y_test, y_test_pre) 164 | rand_bca = utils.bca(y_test, y_rand_pre) 165 | adv_bca = utils.bca(y_test, y_adv_pre) 166 | 167 | raw_bcas[s_id, kf] = raw_bca 168 | rand_bcas[s_id, kf] = rand_bca 169 | adv_bcas[s_id, kf] = adv_bca 170 | 171 | print('raw acc: ', raw_acc) 172 | print('rand_acc: ', rand_acc) 173 | print('adv_acc: ', adv_acc) 174 | 175 | adv_acc_stats.append(adv_acc) 176 | adv_bca_stats.append(adv_bca) 177 | K.clear_session() 178 | kf += 1 179 | # exit() 180 | 181 | print(np.mean(raw_accs[s_id])) 182 | print(np.mean(rand_accs[s_id])) 183 | print(np.mean(adv_accs[s_id])) 184 | print('\n') 185 | print(np.mean(raw_bcas[s_id])) 186 | print(np.mean(rand_bcas[s_id])) 187 | print(np.mean(adv_bcas[s_id])) 188 | print('\n') 189 | # exit() 190 | 191 | 192 | # print(np.mean(raw_accs), np.mean(rand_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(rand_bcas), 193 | # np.mean(adv_bcas),'\n') 194 | 195 | print(np.mean(raw_accs), np.mean(raw_bcas), np.mean(rand_accs), np.mean(rand_bcas), np.mean(adv_accs), 196 | np.mean(adv_bcas),'\n') 197 | stat_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 'results.npz') 198 | np.savez(stat_path, acc=adv_acc_stats, bca=adv_acc_stats) 199 | -------------------------------------------------------------------------------- /adv_patch_target_cross_train.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | import tensorflow as tf 8 | 9 | 10 | if __name__ == '__main__': 11 | K.set_image_data_format('channels_first') 12 | K.set_learning_phase(0) #set learning phase 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '7' 15 | gpuConfig = tf.ConfigProto(allow_soft_placement=True) 16 | gpuConfig.gpu_options.allow_growth = True 17 | 18 | config = tf.ConfigProto() 19 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 20 | config.gpu_options.per_process_gpu_memory_fraction = 0.32 21 | config.gpu_options.allow_growth = True 22 | K.set_session(tf.Session(config=config)) 23 | 24 | # data_names = ['EPFL', 'ERN', 'MI4C'] 25 | data_names = ['EPFL'] 26 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 27 | model_list = ['ShallowConvNet'] 28 | 29 | a = 0.2 # noisy 30 | attack_type = 'target' # 'target' or 'nontarget' 31 | reg = None 32 | patch_size = (32, 50) 33 | 34 | model_tr = [] 35 | for model_used in model_list: 36 | for data_name in data_names: 37 | if data_name == 'EPFL': 38 | target_classes = [0, 1] 39 | elif data_name == 'ERN': 40 | target_classes = [0, 1] 41 | elif data_name == 'MI4C': 42 | target_classes = [0, 1, 2, 3] 43 | else: 44 | raise Exception('No such dataset:{}'.format(data_name)) 45 | 46 | # Load dataset 47 | data_dir = 'Data/processed_data' 48 | train_dir = 'runs' 49 | checkpoint = 'checkpoint' 50 | model_name = 'model.h5' 51 | batch_size = 256 52 | epoches = 1000 53 | 54 | # Build pathes 55 | data_path = os.path.join(data_dir, '{}.npz'.format(data_name)) 56 | 57 | # Load dataset 58 | data = np.load(data_path) 59 | # print(data.keys()) 60 | x = data['x'] 61 | y = data['y'] 62 | s = data['s'] 63 | # seed = 2019 64 | 65 | # x_train, x_test, y_train, y_test = train_test_split(x, y, shuffle=True, test_size=0.3, random_state=seed) 66 | 67 | # num_classes = 4 68 | print(x.shape,y.shape) 69 | 70 | tr_list = [] 71 | for target_class in target_classes: 72 | raw_accs = [] 73 | adv_accs = [] 74 | rand_accs = [] 75 | rand_bcas = [] 76 | raw_bcas = [] 77 | adv_bcas = [] 78 | raw_trs = [] 79 | rand_trs = [] 80 | adv_trs = [] 81 | datasets_wrt_s = utils.list_leave_one_subject(x, y, s, shuffle=True) 82 | for dataset_wrt_s in datasets_wrt_s: 83 | x_train, y_train = dataset_wrt_s[0] 84 | x_test, y_test = dataset_wrt_s[1] 85 | subject = dataset_wrt_s[2] 86 | 87 | nb_classes = len(np.unique(y_test)) 88 | samples = x_test.shape[3] 89 | channels = x_test.shape[2] 90 | 91 | print(x_train.shape, x_test.shape, nb_classes) 92 | 93 | 94 | 95 | # Build pathes 96 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 97 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 98 | # print(checkpoint_path) 99 | # checkpoint_path = os.path.join('/mnt/disk2/zhangxiao/AdversarialExamplesOnEEG_cross_subject/old_runs', 100 | # '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 101 | checkpoint_path = os.path.join('runs', '{}/{}'.format(data_name, model_used), 102 | '{}'.format(int(subject))) 103 | print(checkpoint_path) 104 | model_path = os.path.join(checkpoint_path, model_name) 105 | 106 | # Build Model 107 | if model_used == 'EEGNet': 108 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 109 | elif model_used == 'DeepConvNet': 110 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 111 | elif model_used == 'ShallowConvNet': 112 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 113 | else: 114 | raise Exception('No such model:{}'.format(model_used)) 115 | 116 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 117 | # model.load_weights(model_path) 118 | 119 | save_path = os.path.join(checkpoint_path, 'adv_patch_v_target{}_size{}_{}.npz'.format(target_class, patch_size[0], patch_size[1])) 120 | patch_save_path = os.path.join(checkpoint_path, 'origin_adv_patch_v_target{}_size{}_{}.npz'.format(target_class, patch_size[0], patch_size[1])) 121 | 122 | 123 | v = utils.Adv_patch_target(x_train, model=model, model_used=model_used, model_path=model_path, 124 | save_path=save_path, patch_size=patch_size, patch_scale=None, noise_limit=a, patch_save_path=patch_save_path, 125 | attack_type=attack_type, target_class=target_class, batch_size=64, 126 | nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 127 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 128 | v = np.expand_dims(v, axis=0) 129 | # print(v) 130 | 131 | 132 | model.load_weights(model_path) 133 | y_test = y_test.astype('int32').squeeze() 134 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 135 | 136 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 137 | 138 | # np.random.seed(2009) 139 | shape = x_test.shape 140 | # random_v = a * np.random.rand(1, 1, channels, samples) 141 | # random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 142 | random_v = a * np.clip(np.random.randn(1, 1, channels, samples), -0.2, 0.2) 143 | random_x = x_test + random_v 144 | 145 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 146 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 147 | 148 | adv_x = x_test + v 149 | # print(v.shape) 150 | 151 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 152 | 153 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 154 | 155 | raw_accs.append(raw_acc) 156 | rand_accs.append(rand_acc) 157 | adv_accs.append(adv_acc) 158 | 159 | raw_bca = utils.bca(y_test, y_test_pre) 160 | rand_bca = utils.bca(y_test, y_rand_pre) 161 | adv_bca = utils.bca(y_test, y_adv_pre) 162 | 163 | raw_bcas.append(raw_bca) 164 | rand_bcas.append(rand_bca) 165 | adv_bcas.append(adv_bca) 166 | 167 | raw_tr = np.sum(y_test_pre == target_class) / len(y_test) 168 | rand_tr = np.sum(y_rand_pre == target_class) / len(y_test) 169 | adv_tr = np.sum(y_adv_pre == target_class) / len(y_test) 170 | 171 | raw_trs.append(raw_tr) 172 | rand_trs.append(rand_tr) 173 | adv_trs.append(adv_tr) 174 | 175 | print('raw target rate: ', raw_tr) 176 | print('rand target rate: ', rand_tr) 177 | print('adv target rate: ', adv_tr) 178 | K.clear_session() 179 | # exit() 180 | print(raw_trs) 181 | print(rand_trs) 182 | print(adv_trs) 183 | print('\n') 184 | print(np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)) 185 | tr_list.append([np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)]) 186 | 187 | for tr in tr_list: 188 | print(tr) 189 | model_tr.append(tr_list) 190 | for m_tr in model_tr: 191 | print(m_tr) 192 | -------------------------------------------------------------------------------- /df_uap_cross.py: -------------------------------------------------------------------------------- 1 | import models 2 | # import old_models 3 | import os 4 | import numpy as np 5 | import tensorflow.keras.backend as K 6 | import utils 7 | from sklearn.metrics import confusion_matrix 8 | from sklearn.model_selection import train_test_split 9 | from cleverhans.attacks import DeepFool 10 | from cleverhans.utils_keras import KerasModelWrapper 11 | from tqdm import tqdm 12 | # import logging 13 | import matplotlib.pyplot as plt 14 | # logging.getLogger("requests").setLevel(logging.WARNING) 15 | # logging.getLogger("urllib3").setLevel(logging.WARNING) 16 | 17 | 18 | def proj_lp(v, xi, p): 19 | # Project on the lp ball centered at 0 and of radius xi 20 | 21 | # SUPPORTS only p = 2 and p = Inf for now 22 | if p == 2: 23 | v = v * min(1, xi / np.linalg.norm(v.flatten(1))) 24 | # v = v / np.linalg.norm(v.flatten(1)) * xi 25 | elif p == np.inf: 26 | v = np.sign(v) * np.minimum(abs(v), xi) 27 | else: 28 | raise ValueError('Values of p different from 2 and Inf are currently not supported...') 29 | 30 | return v 31 | 32 | 33 | def universal_perturbation(model, deepfool, x, delta=0.8, max_iter_uni=5, xi=1, p=np.inf, num_classes=10, overshoot=0.02, 34 | max_iter_df=10): 35 | v = 0 36 | fooling_rate = 0.0 37 | fool_list = [] 38 | itr = 0 39 | df_params = {'max_iter': 50, 'nb_candidate': 3, 40 | 'clip_min': -1., 'clip_max': 1.} 41 | 42 | # np.random.shuffle(x) 43 | # end = int(0.2 * len(x)) 44 | # data = x[0:end] 45 | data = x 46 | v_list = [] 47 | while fooling_rate < delta and itr < max_iter_uni-1: 48 | np.random.shuffle(data) 49 | for cur_x in tqdm(data): 50 | # df_params = {'over_shoot': 0.09, 51 | # 'max_iter': 10, 52 | # 'clip_max': 1, 53 | # 'clip_min': 0, 54 | # 'nb_candidate': 2} 55 | 56 | cur_x = cur_x.reshape(1, 1, 22, 256) 57 | if int(np.argmax(np.array(model.predict(cur_x)).flatten())) == int( 58 | np.argmax(np.array(model.predict(cur_x + v)).flatten())): 59 | adv_x = deepfool.generate_np(cur_x, **df_params) 60 | dr = adv_x - cur_x 61 | v = v + dr 62 | # Project on l_p ball 63 | v = proj_lp(v, xi, p) 64 | # print(v) 65 | # print(cur_x) 66 | 67 | v_list.append(v) 68 | itr = itr + 1 69 | data_adv = data + v 70 | num_images = len(data) 71 | est_labels_orig = np.zeros((num_images)) 72 | est_labels_pert = np.zeros((num_images)) 73 | 74 | batch_size = 100 75 | num_batches = np.int(np.ceil(np.float(num_images) / np.float(batch_size))) 76 | 77 | # Compute the estimated labels in batches 78 | for ii in range(0, num_batches): 79 | m = (ii * batch_size) 80 | M = min((ii + 1) * batch_size, num_images) 81 | est_labels_orig[m:M] = np.argmax(model.predict(data[m:M, :, :, :]), axis=1).flatten() 82 | est_labels_pert[m:M] = np.argmax(model.predict(data_adv[m:M, :, :, :]), axis=1).flatten() 83 | 84 | # Compute the fooling rate 85 | fooling_rate = float(np.sum(est_labels_pert != est_labels_orig) / float(num_images)) 86 | print('FOOLING RATE = ', fooling_rate) 87 | fool_list.append(fooling_rate) 88 | max_index = fool_list.index(max(fool_list)) 89 | print(max_index) 90 | v = v_list[max_index] 91 | return v, fool_list 92 | 93 | if __name__ == '__main__': 94 | os.environ["CUDA_VISIBLE_DEVICES"] = '4' 95 | K.set_image_data_format('channels_first') 96 | K.set_learning_phase(0) #set learning phase 97 | 98 | # data_names = ['EPFL', 'ERN', 'MI4C'] 99 | data_names = ['MI4C'] 100 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 101 | model_list = ['DeepConvNet'] 102 | 103 | epsilon = 0.1 104 | 105 | for data_name in data_names: 106 | # Load dataset 107 | data_dir = 'EEG_data/process_data' 108 | train_dir = 'runs' 109 | checkpoint = 'checkpoint' 110 | model_name = 'model.h5' 111 | batch_size = 256 112 | epoches = 1000 113 | 114 | # Build pathes 115 | data_path = os.path.join(data_dir, '{}.npz'.format(data_name)) 116 | 117 | # Load dataset 118 | data = np.load(data_path) 119 | print(data.keys()) 120 | x = data['x'] 121 | y = data['y'] 122 | s = data['s'] 123 | # seed = 2019 124 | 125 | # x_train, x_test, y_train, y_test = train_test_split(x, y, shuffle=True, test_size=0.3, random_state=seed) 126 | 127 | # num_classes = 4 128 | print(x.shape,y.shape) 129 | raw_accs = [] 130 | adv_accs = [] 131 | raw_bcas = [] 132 | adv_bcas = [] 133 | subject = 4 134 | datasets_wrt_s = utils.list_leave_one_subject(x, y, s, shuffle=True) 135 | for dataset_wrt_s in datasets_wrt_s: 136 | print(subject) 137 | x_train, y_train = dataset_wrt_s[0] 138 | x_test, y_test = dataset_wrt_s[1] 139 | subject = dataset_wrt_s[2] 140 | 141 | nb_classes = len(np.unique(y_test)) 142 | samples = x_test.shape[3] 143 | channels = x_test.shape[2] 144 | 145 | print(x_train.shape, x_test.shape) 146 | 147 | # for model_used in model_list: 148 | model_used = 'EEGNet' 149 | 150 | # Build pathes 151 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 152 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 153 | # print(checkpoint_path) 154 | checkpoint_path = os.path.join('/mnt/disk2/zhangxiao/AdversarialExamplesOnEEG_cross_subject/runs', 155 | data_name, model_used, '{}'.format(int(subject))) 156 | # checkpoint_path = os.path.join('/mnt/disk2/zhangxiao/AdversarialExamplesOnEEG_cross_subject/runs', '{}/{}'.format(data_name, model_used), '{}'.format(int(subject))) 157 | print(checkpoint_path) 158 | model_path = os.path.join(checkpoint_path, 'model.h5') 159 | 160 | # checkpoint_path = 'model' 161 | # model_path = os.path.join(checkpoint_path, 'model.h5') 162 | 163 | # Build Model 164 | if model_used == 'EEGNet': 165 | model = models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 166 | elif model_used == 'DeepConvNet': 167 | model = models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 168 | elif model_used == 'ShallowConvNet': 169 | model = models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 170 | else: 171 | raise Exception('No such model:{}'.format(model_used)) 172 | 173 | 174 | # target = K.placeholder( 175 | # ndim=len(model.outputs), 176 | # name='my_target', 177 | # sparse=K.is_sparse(model.outputs[0]), 178 | # dtype=K.dtype(model.outputs[0]) 179 | # ) 180 | 181 | # model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc'], target=[target]) 182 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 183 | model.load_weights(model_path) 184 | # ------------ Unsupervised Attacking ------------- 185 | y_test = y_test.flatten() 186 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 187 | 188 | 189 | ch_model = KerasModelWrapper(model) 190 | deepfool = DeepFool(ch_model, back='tf', sess=K.get_session()) 191 | 192 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 193 | # print(np.sum(y_test_pre == y_test), y_test_pre.shape, y_test.shape) 194 | print(raw_acc) 195 | v, fool_list= universal_perturbation(model, deepfool, x_train) 196 | print(v, '\n', fool_list) 197 | adv_x = x_test + v 198 | print(v.shape) 199 | # np.savez('adv_x_test.npz', x=adv_x) 200 | 201 | # df_params = {'max_iter': 50, 'nb_candidate': 3, 202 | # 'clip_min': -1., 'clip_max': 1.} 203 | # adv_x = deepfool.generate_np(x_test, **df_params) 204 | # v = adv_x - x_test 205 | 206 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 207 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 208 | print(raw_acc) 209 | print(adv_acc) 210 | raw_accs.append(raw_acc) 211 | adv_accs.append(adv_acc) 212 | raw_bca = utils.bca(y_test, y_test_pre) 213 | adv_bca = utils.bca(y_test, y_adv_pre) 214 | raw_bcas.append(raw_bca) 215 | adv_bcas.append(adv_bca) 216 | subject += 1 217 | print(raw_bca) 218 | print(adv_bca) 219 | 220 | 221 | utils.plot_data(x_test, v) 222 | utils.plot_data(x_test,adv_x) 223 | exit() 224 | print(raw_accs,'\n',adv_accs,'\n', 225 | raw_bcas,'\n',adv_bcas,'\n') 226 | print(np.mean(raw_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(adv_bcas)) 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | 237 | 238 | -------------------------------------------------------------------------------- /adv_patch_target_cross_test.py: -------------------------------------------------------------------------------- 1 | import old_models 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | import tensorflow as tf 8 | import random 9 | 10 | if __name__ == '__main__': 11 | K.set_image_data_format('channels_first') 12 | K.set_learning_phase(0) #set learning phase 13 | 14 | os.environ["CUDA_VISIBLE_DEVICES"] = '6' 15 | gpuConfig = tf.ConfigProto(allow_soft_placement=True) 16 | gpuConfig.gpu_options.allow_growth = True 17 | 18 | config = tf.ConfigProto() 19 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 20 | config.gpu_options.per_process_gpu_memory_fraction = 1 21 | config.gpu_options.allow_growth = True 22 | K.set_session(tf.Session(config=config)) 23 | 24 | # data_names = ['EPFL', 'ERN', 'MI4C'] 25 | data_names = ['MI4C'] 26 | model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 27 | # model_list = ['ShallowConvNet'] 28 | 29 | a = 0.2 # noisy 30 | attack_type = 'target' # 'target' or 'nontarget' 31 | reg = None 32 | patch_size = (22, 50) 33 | 34 | model_tr = [] 35 | for model_used in model_list: 36 | for data_name in data_names: 37 | if data_name == 'EPFL': 38 | target_classes = [0, 1] 39 | elif data_name == 'ERN': 40 | target_classes = [0, 1] 41 | elif data_name == 'MI4C': 42 | target_classes = [0, 1, 2, 3] 43 | else: 44 | raise Exception('No such dataset:{}'.format(data_name)) 45 | 46 | # Load dataset 47 | data_dir = 'Data/processed_data' 48 | train_dir = 'runs' 49 | checkpoint = 'checkpoint' 50 | model_name = 'model.h5' 51 | batch_size = 256 52 | epoches = 1000 53 | 54 | # Build pathes 55 | data_path = os.path.join(data_dir, '{}.npz'.format(data_name)) 56 | 57 | # Load dataset 58 | data = np.load(data_path) 59 | # print(data.keys()) 60 | x = data['x'] 61 | y = data['y'] 62 | s = data['s'] 63 | # seed = 2019 64 | 65 | # x_train, x_test, y_train, y_test = train_test_split(x, y, shuffle=True, test_size=0.3, random_state=seed) 66 | 67 | # num_classes = 4 68 | print(x.shape,y.shape) 69 | 70 | tr_list = [] 71 | for target_class in target_classes: 72 | raw_accs = [] 73 | adv_accs = [] 74 | rand_accs = [] 75 | rand_bcas = [] 76 | raw_bcas = [] 77 | adv_bcas = [] 78 | raw_trs = [] 79 | rand_trs = [] 80 | adv_trs = [] 81 | datasets_wrt_s = utils.list_leave_one_subject(x, y, s, shuffle=True) 82 | for dataset_wrt_s in datasets_wrt_s: 83 | x_train, y_train = dataset_wrt_s[0] 84 | x_test, y_test = dataset_wrt_s[1] 85 | subject = dataset_wrt_s[2] 86 | 87 | nb_classes = len(np.unique(y_test)) 88 | samples = x_test.shape[3] 89 | channels = x_test.shape[2] 90 | 91 | print(x_train.shape, x_test.shape, nb_classes) 92 | 93 | 94 | 95 | # Build pathes 96 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 97 | # checkpoint_path = os.path.join('runs', '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 98 | # print(checkpoint_path) 99 | # checkpoint_path = os.path.join('/mnt/disk2/zhangxiao/AdversarialExamplesOnEEG_cross_subject/old_runs', 100 | # '{}_{}'.format(data_name, model_used), '{}'.format(int(subject)), 'checkpoint') 101 | checkpoint_path = os.path.join('runs', '{}/{}'.format(data_name, model_used), 102 | '{}'.format(int(subject))) 103 | print(checkpoint_path) 104 | model_path = os.path.join(checkpoint_path, model_name) 105 | 106 | # Build Model 107 | if model_used == 'EEGNet': 108 | model = old_models.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 109 | elif model_used == 'DeepConvNet': 110 | model = old_models.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 111 | elif model_used == 'ShallowConvNet': 112 | model = old_models.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 113 | else: 114 | raise Exception('No such model:{}'.format(model_used)) 115 | 116 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 117 | # model.load_weights(model_path) 118 | 119 | # save_path = os.path.join(checkpoint_path, 'adv_patch_v_target{}_size{}_{}.npz'.format(target_class, patch_size[0], patch_size[1])) 120 | patch_save_path = os.path.join(checkpoint_path, 'origin_adv_patch_v_target{}_size{}_{}.npz'.format(target_class, patch_size[0], patch_size[1])) 121 | 122 | 123 | # v = utils.Adv_patch_target(x_train, model=model, model_used=model_used, model_path=model_path, 124 | # save_path=save_path, patch_size=patch_size, patch_scale=None, noise_limit=a, patch_save_path=patch_save_path, 125 | # attack_type=attack_type, target_class=target_class, batch_size=64, 126 | # nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 127 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 128 | patch_v = np.load(patch_save_path)['patch_v'] 129 | print(patch_v.shape) 130 | # patch_scale = (1.0, 0.5) 131 | # v_size = patch_size 132 | width = x_train[0].shape[1] 133 | height = x_train[0].shape[2] 134 | patch_w = patch_size[0] 135 | patch_h = patch_size[1] 136 | patch_shape = (1, patch_w, patch_h) 137 | 138 | 139 | model.load_weights(model_path) 140 | y_test = y_test.astype('int32').squeeze() 141 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 142 | 143 | # raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 144 | 145 | # np.random.seed(2009) 146 | shape = x_test.shape 147 | # random_v = a * np.random.rand(1, 1, channels, samples) 148 | # random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 149 | random_v = np.clip(a * np.random.randn(1, 1, channels, samples), -0.2, 0.2) 150 | random_x = x_test + random_v 151 | 152 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 153 | # rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 154 | adv_tr_lists = [] 155 | test_num = 30 156 | for i in range(test_num): 157 | if patch_size[0] == width: 158 | random_h = random.randint(0, height - patch_h) 159 | v = np.pad(patch_v, ((0, 0), (0, 0), (random_h, height - random_h - patch_h)), 'constant') 160 | else: 161 | random_w = random.randint(0, width - patch_w) 162 | random_h = random.randint(0, height - patch_h) 163 | v = np.pad(patch_v, ((0, 0), (random_w, width - random_w - patch_w), (random_h, height - random_h - patch_h)), 'constant') 164 | # print(v.shape) 165 | v = np.expand_dims(v, axis=0) 166 | # print(v.shape) 167 | 168 | adv_x = x_test + v 169 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 170 | adv_tr = np.sum(y_adv_pre == target_class) / len(y_test) 171 | # adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 172 | adv_tr_lists.append(adv_tr) 173 | print('ex:{}/{}, target rate:{}'.format(i, test_num, adv_tr)) 174 | # print(adv_tr_lists) 175 | print('{} experiments target rate mean result: {}'.format(test_num, np.mean(adv_tr_lists))) 176 | 177 | 178 | raw_tr = np.sum(y_test_pre == target_class) / len(y_test) 179 | rand_tr = np.sum(y_rand_pre == target_class) / len(y_test) 180 | adv_tr = np.mean(adv_tr_lists) 181 | 182 | raw_trs.append(raw_tr) 183 | rand_trs.append(rand_tr) 184 | adv_trs.append(adv_tr) 185 | 186 | print('raw target rate: ', raw_tr) 187 | print('rand target rate: ', rand_tr) 188 | print('adv target rate: ', adv_tr) 189 | K.clear_session() 190 | # exit() 191 | print(raw_trs) 192 | print(rand_trs) 193 | print(adv_trs) 194 | print('\n') 195 | print(np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)) 196 | tr_list.append([np.mean(raw_trs), np.mean(rand_trs), np.mean(adv_trs)]) 197 | 198 | for tr in tr_list: 199 | print(tr) 200 | model_tr.append(tr_list) 201 | for m_tr in model_tr: 202 | print(m_tr) 203 | -------------------------------------------------------------------------------- /df_uap_within_block.py: -------------------------------------------------------------------------------- 1 | import old_models1 2 | import keras.backend as K 3 | import os 4 | import utils 5 | import numpy as np 6 | from scipy.io import loadmat 7 | from sklearn.model_selection import KFold 8 | import tensorflow as tf 9 | from cleverhans.attacks import DeepFool 10 | from cleverhans.utils_keras import KerasModelWrapper 11 | from tqdm import tqdm 12 | 13 | def proj_lp(v, xi, p): 14 | if p == 2: 15 | v = v * min(1, xi / np.linalg.norm(v.flatten(1))) 16 | # v = v / np.linalg.norm(v.flatten(1)) * xi 17 | elif p == np.inf: 18 | v = np.sign(v) * np.minimum(abs(v), xi) 19 | else: 20 | raise ValueError('Values of p different from 2 and Inf are currently not supported...') 21 | 22 | return v 23 | 24 | 25 | def universal_perturbation(model, deepfool, x, delta=0.8, max_iter_uni=10, xi=0.5, p=np.inf, num_classes=4, overshoot=0.02, 26 | max_iter_df=10): 27 | v = 0 28 | fooling_rate = 0.0 29 | fool_list = [] 30 | itr = 0 31 | df_params = {'overshoot': overshoot, 32 | 'max_iter': 50, 33 | 'clip_max': np.amax(x), 34 | 'clip_min': np.amin(x), 35 | 'nb_candidate': num_classes} 36 | 37 | 38 | data = x 39 | shape = x.shape 40 | v_list = [] 41 | while fooling_rate < delta and itr < max_iter_uni-1: 42 | np.random.shuffle(data) 43 | for cur_x in tqdm(data): 44 | cur_x = cur_x.reshape(1, shape[1], shape[2], shape[3]) 45 | if int(np.argmax(model.predict(cur_x))) == int( 46 | np.argmax(model.predict(cur_x + v))): 47 | adv_x = deepfool.generate_np(cur_x, **df_params) 48 | dr = adv_x - cur_x 49 | v = v + dr 50 | # Project on l_p ball 51 | v = proj_lp(v, xi, p) 52 | # print(v) 53 | # print(cur_x) 54 | 55 | v_list.append(v) 56 | itr = itr + 1 57 | data_adv = data + v 58 | num_images = len(data) 59 | est_labels_orig = np.zeros((num_images)) 60 | est_labels_pert = np.zeros((num_images)) 61 | 62 | batch_size = 100 63 | num_batches = np.int(np.ceil(np.float(num_images) / np.float(batch_size))) 64 | 65 | # Compute the estimated labels in batches 66 | for ii in range(0, num_batches): 67 | m = (ii * batch_size) 68 | M = min((ii + 1) * batch_size, num_images) 69 | est_labels_orig[m:M] = np.argmax(model.predict(data[m:M, :, :, :]), axis=1).flatten() 70 | est_labels_pert[m:M] = np.argmax(model.predict(data_adv[m:M, :, :, :]), axis=1).flatten() 71 | 72 | # Compute the fooling rate 73 | fooling_rate = float(np.sum(est_labels_pert != est_labels_orig) / float(num_images)) 74 | print('FOOLING RATE = ', fooling_rate) 75 | fool_list.append(fooling_rate) 76 | max_index = fool_list.index(max(fool_list)) 77 | print(max_index) 78 | v = v_list[max_index] 79 | return v, fool_list 80 | 81 | if __name__ == '__main__': 82 | K.set_image_data_format('channels_first') 83 | K.set_learning_phase(0) # set learning phase 84 | 85 | os.environ["CUDA_VISIBLE_DEVICES"] = '2' 86 | 87 | config = tf.ConfigProto() 88 | config.gpu_options.allocator_type = 'BFC' # A "Best-fit with coalescing" algorithm, simplified from a version of dlmalloc. 89 | config.gpu_options.per_process_gpu_memory_fraction = 1 90 | config.gpu_options.allow_growth = True 91 | K.set_session(tf.Session(config=config)) 92 | 93 | random_seed = None 94 | # np.random.seed(random_seed) 95 | data_dir = 'Data/processed_data' 96 | train_dir = 'within_block_runs' 97 | model_name = 'model.h5' 98 | batch_size = 64 99 | epoches = 1600 100 | 101 | # data_list = ['EPFL', 'ERN', 'MI4C'] 102 | data_list = ['MI4C'] 103 | 104 | # model_list = ['EEGNet', 'DeepConvNet', 'ShallowConvNet'] 105 | model_list = ['ShallowConvNet'] 106 | 107 | a = 0.2 # noisy 108 | reg = None 109 | attack_type = 'nontarget' # 'target' or 'nontarget' 110 | k_fold = 5 111 | 112 | for data_name in data_list: 113 | if data_name == 'EPFL': 114 | s_num = 8 115 | target_classes = [0, 1] 116 | elif data_name == 'ERN': 117 | s_num = 26 118 | target_classes = [0, 1] 119 | elif data_name == 'MI4C': 120 | s_num = 9 121 | target_classes = [0, 1, 2, 3] 122 | else: 123 | raise Exception('No such dataset:{}'.format(data_name)) 124 | 125 | 126 | for model_used in model_list: 127 | adv_acc_stats = [] 128 | adv_bca_stats = [] 129 | raw_accs = np.zeros((s_num, k_fold)) 130 | rand_accs = np.zeros((s_num, k_fold)) 131 | adv_accs = np.zeros((s_num, k_fold)) 132 | raw_bcas = np.zeros((s_num, k_fold)) 133 | rand_bcas = np.zeros((s_num, k_fold)) 134 | adv_bcas = np.zeros((s_num, k_fold)) 135 | for s_id in range(s_num): 136 | # Build pathes 137 | data_path = os.path.join(data_dir, data_name, 'block', 's{}.mat'.format(s_id)) 138 | # Load dataset 139 | data = loadmat(data_path) 140 | x = data['x'] 141 | y = np.squeeze(data['y']) 142 | kfold = KFold(n_splits=k_fold, shuffle=False) 143 | kf = 0 144 | for train_index, test_index in kfold.split(x, y): 145 | # Build checkpoint pathes 146 | checkpoint_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 147 | '{}'.format(s_id), '{}'.format(kf)) 148 | model_path = os.path.join(checkpoint_path, model_name) 149 | 150 | if not os.path.exists(checkpoint_path): 151 | os.makedirs(checkpoint_path) 152 | print(checkpoint_path) 153 | 154 | x_train = x[train_index] 155 | y_train = y[train_index] 156 | x_test = x[test_index] 157 | y_test = y[test_index] 158 | 159 | data_size = y_train.shape[0] 160 | # shuffle_index = utils.shuffle_data(data_size, random_seed=random_seed) 161 | # shuffle_index = utils.shuffle_data(data_size) 162 | # x_train = x_train[shuffle_index] 163 | # y_train = y_train[shuffle_index] 164 | 165 | print(x_train.shape) 166 | print(y_train.shape) 167 | 168 | nb_classes = len(np.unique(y_train)) 169 | samples = x_train.shape[3] 170 | channels = x_train.shape[2] 171 | 172 | # Build Model 173 | if model_used == 'EEGNet': 174 | model = old_models1.EEGNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 175 | elif model_used == 'DeepConvNet': 176 | model = old_models1.DeepConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 177 | elif model_used == 'ShallowConvNet': 178 | model = old_models1.ShallowConvNet(nb_classes=nb_classes, Chans=channels, Samples=samples) 179 | else: 180 | raise Exception('No such model:{}'.format(model_used)) 181 | 182 | model.compile(optimizer='Adam', loss='sparse_categorical_crossentropy', metrics=['acc']) 183 | model.load_weights(model_path) 184 | 185 | 186 | save_path = os.path.join(checkpoint_path, 'df_uap.npz') 187 | 188 | # ch_model = KerasModelWrapper(model) 189 | # deepfool = DeepFool(ch_model, back='tf', sess=K.get_session()) 190 | # v, fool_list = universal_perturbation(model, deepfool, x_train, num_classes=nb_classes, xi=a) 191 | # np.savez(save_path, v=v) 192 | # f_v = np.load(save_path) 193 | # v = f_v['v'] 194 | 195 | # v = UAP_target(x_train, y_train, model_used=model_used, model_path=model_path, save_path=save_path, 196 | # noise_limit=a, attack_type=attack_type) 197 | # v = utils.UAP_target_pre(x_train, model=model, model_used=model_used, model_path=model_path, 198 | # save_path=save_path, 199 | # noise_limit=a, attack_type=attack_type, batch_size=batch_size, 200 | # nb_classes=nb_classes, channels=channels, samples=samples, regular=reg) 201 | 202 | v = np.load(save_path)['v'] 203 | # v = np.load(os.path.join(checkpoint_path, 'adv_v_target{}.npz'.format(target_class)))['v'] 204 | # v = np.expand_dims(v, axis=0) 205 | # print(v) 206 | 207 | 208 | y_test = y_test.astype('int32').squeeze() 209 | y_test_pre = np.argmax(model.predict(x_test), axis=1) 210 | raw_acc = np.sum(y_test_pre == y_test) / len(y_test_pre) 211 | 212 | # np.random.seed(2009) 213 | shape = x_test.shape 214 | # random_v = a * np.random.rand(1, 1, channels, samples) 215 | # random_v = a * np.random.uniform(-1, 1, (1, 1, channels, samples)) 216 | random_v = a * np.random.randn(1, 1, channels, samples) 217 | random_x = x_test + random_v 218 | y_rand_pre = np.argmax(model.predict(random_x), axis=1) 219 | rand_acc = np.sum(y_rand_pre == y_test) / len(y_rand_pre) 220 | 221 | adv_x = x_test + v 222 | # print(v.shape) 223 | y_adv_pre = np.argmax(model.predict(adv_x), axis=1) 224 | adv_acc = np.sum(y_adv_pre == y_test) / len(y_adv_pre) 225 | 226 | raw_accs[s_id, kf] = raw_acc 227 | rand_accs[s_id, kf] = rand_acc 228 | adv_accs[s_id, kf] = adv_acc 229 | 230 | 231 | raw_bca = utils.bca(y_test, y_test_pre) 232 | rand_bca = utils.bca(y_test, y_rand_pre) 233 | adv_bca = utils.bca(y_test, y_adv_pre) 234 | 235 | raw_bcas[s_id, kf] = raw_bca 236 | rand_bcas[s_id, kf] = rand_bca 237 | adv_bcas[s_id, kf] = adv_bca 238 | 239 | print('raw acc: ', raw_acc) 240 | print('rand_acc: ', rand_acc) 241 | print('adv_acc: ', adv_acc) 242 | 243 | adv_acc_stats.append(adv_acc) 244 | adv_bca_stats.append(adv_bca) 245 | # 246 | K.clear_session() 247 | kf += 1 248 | # exit() 249 | 250 | print(np.mean(raw_accs[s_id])) 251 | print(np.mean(rand_accs[s_id])) 252 | print(np.mean(adv_accs[s_id])) 253 | print('\n') 254 | print(np.mean(raw_bcas[s_id])) 255 | print(np.mean(rand_bcas[s_id])) 256 | print(np.mean(adv_bcas[s_id])) 257 | print('\n') 258 | # exit() 259 | 260 | 261 | # print(np.mean(raw_accs), np.mean(rand_accs), np.mean(adv_accs), np.mean(raw_bcas), np.mean(rand_bcas), 262 | # np.mean(adv_bcas),'\n') 263 | 264 | print(np.mean(raw_accs), np.mean(raw_bcas), np.mean(rand_accs), np.mean(rand_bcas), np.mean(adv_accs), 265 | np.mean(adv_bcas),'\n') 266 | stat_path = os.path.join(train_dir, data_name, 'gray_{}'.format(model_used), 'df_results.npz') 267 | np.savez(stat_path, acc=adv_acc_stats, bca=adv_acc_stats) 268 | -------------------------------------------------------------------------------- /old_models.py: -------------------------------------------------------------------------------- 1 | from keras.models import Model 2 | from keras.layers.core import Dense, Activation, Permute, Reshape 3 | from keras.layers.convolutional import Conv2D, AveragePooling2D 4 | from keras.layers.convolutional import SeparableConv2D 5 | from keras.layers.normalization import BatchNormalization 6 | from keras.layers import SpatialDropout2D, MaxPooling2D 7 | from keras.regularizers import l1_l2 8 | from keras.layers import Input, Flatten, Dropout 9 | from keras.layers import DepthwiseConv2D 10 | from keras import backend as K 11 | from keras.constraints import max_norm 12 | import numpy as np 13 | import utils 14 | 15 | def EEGNet(nb_classes, Chans=64, Samples=128, D=2, 16 | dropoutRate=0.5, kernLength=64, numFilters=8, norm_rate=0.25): 17 | """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 18 | 19 | Requires Tensorflow >= 1.5 and Keras >= 2.1.3 20 | 21 | Note that this implements the newest version of EEGNet and NOT the earlier 22 | version (version v1 and v2 on arxiv). We strongly recommend using this 23 | architecture as it performs much better and has nicer properties than 24 | our earlier version. 25 | 26 | Note that we use 'image_data_format' = 'channels_first' in there keras.json 27 | configuration file. 28 | 29 | Inputs: 30 | 31 | nb_classes: int, number of classes to classify 32 | Chans, Samples: number of channels and time points in the EEG data 33 | regRate: regularization parameter for L1 and L2 penalties 34 | dropoutRate: dropout fraction 35 | kernLength: length of temporal convolution in first layer 36 | numFilters: number of temporal-spatial filter pairs to learn 37 | D: number of spatial filters to learn within each temporal convolution. Default: D = 2 38 | 39 | Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 40 | across tasks. 41 | """ 42 | input1 = Input(shape=(1, Chans, Samples)) 43 | # input1 = Permute((2, 1))(input_original) 44 | # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 45 | layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 46 | input_shape=(1, Chans, Samples), 47 | use_bias=False, 48 | data_format='channels_first')(input1) 49 | layer1 = BatchNormalization(axis=1)(layer1) 50 | layer1 = DepthwiseConv2D((Chans, 1), 51 | depth_multiplier=D, 52 | depthwise_constraint=max_norm(1.), 53 | use_bias=False, 54 | data_format='channels_first')(layer1) 55 | layer1 = BatchNormalization(axis=1)(layer1) 56 | layer1 = Activation('elu')(layer1) 57 | layer1 = AveragePooling2D((1, 4), data_format='channels_first')(layer1) 58 | layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 59 | 60 | layer2 = SeparableConv2D(numFilters * D, (1, 16), 61 | use_bias=False, padding='same', 62 | data_format='channels_first')(layer1) 63 | layer2 = BatchNormalization(axis=1)(layer2) 64 | layer2 = Activation('elu')(layer2) 65 | layer2 = AveragePooling2D((1, 8), data_format='channels_first')(layer2) 66 | layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 67 | 68 | flatten = Flatten(name='flatten')(layer2) 69 | 70 | dense = Dense(nb_classes, name='dense',kernel_constraint = max_norm(norm_rate))(flatten) 71 | softmax = Activation('softmax', name='softmax')(dense) 72 | 73 | return Model(inputs=input1, outputs=softmax) 74 | 75 | def EEGNet_output(nb_classes, Chans=64, Samples=128, D=2, dropoutRate=0.5, 76 | kernLength=64, numFilters=8, norm_rate=0.25, x_input=None): 77 | """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 78 | 79 | Requires Tensorflow >= 1.5 and Keras >= 2.1.3 80 | 81 | Note that this implements the newest version of EEGNet and NOT the earlier 82 | version (version v1 and v2 on arxiv). We strongly recommend using this 83 | architecture as it performs much better and has nicer properties than 84 | our earlier version. 85 | 86 | Note that we use 'image_data_format' = 'channels_first' in there keras.json 87 | configuration file. 88 | 89 | Inputs: 90 | 91 | nb_classes: int, number of classes to classify 92 | Chans, Samples: number of channels and time points in the EEG data 93 | regRate: regularization parameter for L1 and L2 penalties 94 | dropoutRate: dropout fraction 95 | kernLength: length of temporal convolution in first layer 96 | numFilters: number of temporal-spatial filter pairs to learn 97 | D: number of spatial filters to learn within each temporal convolution. Default: D = 2 98 | 99 | Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 100 | across tasks. 101 | """ 102 | input1 = x_input 103 | # input1 = Input(shape=(1, Chans, Samples)) 104 | # input1 = Permute((2, 1))(input_original) 105 | # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 106 | layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 107 | input_shape=(1, Chans, Samples), 108 | use_bias=False, 109 | data_format='channels_first')(input1) 110 | layer1 = BatchNormalization(axis=1)(layer1) 111 | layer1 = DepthwiseConv2D((Chans, 1), 112 | depth_multiplier=D, 113 | depthwise_constraint=max_norm(1.), 114 | use_bias=False, 115 | data_format='channels_first')(layer1) 116 | layer1 = BatchNormalization(axis=1)(layer1) 117 | layer1 = Activation('elu')(layer1) 118 | layer1 = AveragePooling2D((1, 4), data_format='channels_first')(layer1) 119 | layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 120 | 121 | layer2 = SeparableConv2D(numFilters * D, (1, 16), 122 | use_bias=False, padding='same', 123 | data_format='channels_first')(layer1) 124 | layer2 = BatchNormalization(axis=1)(layer2) 125 | layer2 = Activation('elu')(layer2) 126 | layer2 = AveragePooling2D((1, 8), data_format='channels_first')(layer2) 127 | layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 128 | 129 | flatten = Flatten(name='flatten')(layer2) 130 | 131 | dense = Dense(nb_classes, name='dense',kernel_constraint = max_norm(norm_rate))(flatten) 132 | softmax = Activation('softmax', name='softmax')(dense) 133 | 134 | return softmax 135 | 136 | 137 | def EEGNet_old(nb_classes, Chans=64, Samples=128, regRate=0.0001, 138 | dropoutRate=0.25, kernLength=64, numFilters=8): 139 | """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 140 | 141 | Requires Tensorflow >= 1.5 and Keras >= 2.1.3 142 | 143 | Note that this implements the newest version of EEGNet and NOT the earlier 144 | version (version v1 and v2 on arxiv). We strongly recommend using this 145 | architecture as it performs much better and has nicer properties than 146 | our earlier version. 147 | 148 | Note that we use 'image_data_format' = 'channels_first' in there keras.json 149 | configuration file. 150 | 151 | Inputs: 152 | 153 | nb_classes: int, number of classes to classify 154 | Chans, Samples: number of channels and time points in the EEG data 155 | regRate: regularization parameter for L1 and L2 penalties 156 | dropoutRate: dropout fraction 157 | kernLength: length of temporal convolution in first layer 158 | numFilters: number of temporal-spatial filter pairs to learn 159 | 160 | Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 161 | across tasks. 162 | """ 163 | input1 = Input(shape=(1, Chans, Samples)) 164 | # input1 = Permute((2, 1))(input_original) 165 | # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 166 | layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 167 | kernel_regularizer=l1_l2(l1=0.0, l2=0.0), 168 | input_shape=(1, Chans, Samples), 169 | use_bias=False, 170 | data_format='channels_first')(input1) 171 | layer1 = BatchNormalization(axis=1)(layer1) 172 | layer1 = DepthwiseConv2D((Chans, 1), 173 | depthwise_regularizer=l1_l2(l1=regRate, l2=regRate), 174 | use_bias=False, 175 | data_format='channels_first')(layer1) 176 | layer1 = BatchNormalization(axis=1)(layer1) 177 | layer1 = Activation('elu')(layer1) 178 | layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 179 | 180 | layer2 = SeparableConv2D(numFilters, (1, 8), 181 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 182 | use_bias=False, padding='same', 183 | data_format='channels_first')(layer1) 184 | layer2 = BatchNormalization(axis=1)(layer2) 185 | layer2 = Activation('elu')(layer2) 186 | layer2 = AveragePooling2D((1, 4), data_format='channels_first')(layer2) 187 | layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 188 | 189 | layer3 = SeparableConv2D(numFilters * 2, (1, 8), depth_multiplier=2, 190 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 191 | use_bias=False, padding='same', 192 | data_format='channels_first')(layer2) 193 | layer3 = BatchNormalization(axis=1)(layer3) 194 | layer3 = Activation('elu')(layer3) 195 | layer3 = AveragePooling2D((1, 4), data_format='channels_first')(layer3) 196 | layer3 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer3) 197 | 198 | flatten = Flatten(name='flatten')(layer3) 199 | 200 | dense = Dense(nb_classes, name='dense')(flatten) 201 | softmax = Activation('softmax', name='softmax')(dense) 202 | 203 | return Model(inputs=input1, outputs=softmax) 204 | 205 | def EEGNet_wide(nb_classes, Chans=64, Samples=128, regRate=0.0001, 206 | dropoutRate=0.25, kernLength=64, numFilters=32): 207 | """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 208 | 209 | Requires Tensorflow >= 1.5 and Keras >= 2.1.3 210 | 211 | Note that this implements the newest version of EEGNet and NOT the earlier 212 | version (version v1 and v2 on arxiv). We strongly recommend using this 213 | architecture as it performs much better and has nicer properties than 214 | our earlier version. 215 | 216 | Note that we use 'image_data_format' = 'channels_first' in there keras.json 217 | configuration file. 218 | 219 | Inputs: 220 | 221 | nb_classes: int, number of classes to classify 222 | Chans, Samples: number of channels and time points in the EEG data 223 | regRate: regularization parameter for L1 and L2 penalties 224 | dropoutRate: dropout fraction 225 | kernLength: length of temporal convolution in first layer 226 | numFilters: number of temporal-spatial filter pairs to learn 227 | 228 | Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 229 | across tasks. 230 | """ 231 | input1 = Input(shape=(1, Chans, Samples)) 232 | # input1 = Permute((2, 1))(input_original) 233 | # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 234 | layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 235 | kernel_regularizer=l1_l2(l1=0.0, l2=0.0), 236 | input_shape=(1, Chans, Samples), 237 | use_bias=False, 238 | data_format='channels_first')(input1) 239 | layer1 = BatchNormalization(axis=1)(layer1) 240 | layer1 = DepthwiseConv2D((Chans, 1), 241 | depthwise_regularizer=l1_l2(l1=regRate, l2=regRate), 242 | use_bias=False, 243 | data_format='channels_first')(layer1) 244 | layer1 = BatchNormalization(axis=1)(layer1) 245 | layer1 = Activation('elu')(layer1) 246 | layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 247 | 248 | layer2 = SeparableConv2D(numFilters, (1, 8), 249 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 250 | use_bias=False, padding='same', 251 | data_format='channels_first')(layer1) 252 | layer2 = BatchNormalization(axis=1)(layer2) 253 | layer2 = Activation('elu')(layer2) 254 | layer2 = AveragePooling2D((1, 4), data_format='channels_first')(layer2) 255 | layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 256 | 257 | layer3 = SeparableConv2D(numFilters * 2, (1, 8), depth_multiplier=2, 258 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 259 | use_bias=False, padding='same', 260 | data_format='channels_first')(layer2) 261 | layer3 = BatchNormalization(axis=1)(layer3) 262 | layer3 = Activation('elu')(layer3) 263 | layer3 = AveragePooling2D((1, 4), data_format='channels_first')(layer3) 264 | layer3 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer3) 265 | 266 | flatten = Flatten(name='flatten')(layer3) 267 | 268 | dense = Dense(nb_classes, name='dense')(flatten) 269 | softmax = Activation('softmax', name='softmax')(dense) 270 | 271 | return Model(inputs=input1, outputs=softmax) 272 | 273 | # def EEGNet_output(nb_classes, Chans=64, Samples=128, regRate=0.0001, 274 | # dropoutRate=0.25, kernLength=64, numFilters=8, x_input=None): 275 | # """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 276 | # 277 | # Requires Tensorflow >= 1.5 and Keras >= 2.1.3 278 | # 279 | # Note that this implements the newest version of EEGNet and NOT the earlier 280 | # version (version v1 and v2 on arxiv). We strongly recommend using this 281 | # architecture as it performs much better and has nicer properties than 282 | # our earlier version. 283 | # 284 | # Note that we use 'image_data_format' = 'channels_first' in there keras.json 285 | # configuration file. 286 | # 287 | # Inputs: 288 | # 289 | # nb_classes: int, number of classes to classify 290 | # Chans, Samples: number of channels and time points in the EEG data 291 | # regRate: regularization parameter for L1 and L2 penalties 292 | # dropoutRate: dropout fraction 293 | # kernLength: length of temporal convolution in first layer 294 | # numFilters: number of temporal-spatial filter pairs to learn 295 | # 296 | # Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 297 | # across tasks. 298 | # """ 299 | # input1 = x_input 300 | # # input1 = Input(shape=(1, Chans, Samples)) 301 | # # input1 = Permute((2, 1))(input_original) 302 | # # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 303 | # layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 304 | # kernel_regularizer=l1_l2(l1=0.0, l2=0.0), 305 | # input_shape=(1, Chans, Samples), 306 | # use_bias=False, 307 | # data_format='channels_first')(input1) 308 | # layer1 = BatchNormalization(axis=1)(layer1) 309 | # layer1 = DepthwiseConv2D((Chans, 1), 310 | # depthwise_regularizer=l1_l2(l1=regRate, l2=regRate), 311 | # use_bias=False, 312 | # data_format='channels_first')(layer1) 313 | # layer1 = BatchNormalization(axis=1)(layer1) 314 | # layer1 = Activation('elu')(layer1) 315 | # layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 316 | # 317 | # layer2 = SeparableConv2D(numFilters, (1, 8), 318 | # depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 319 | # use_bias=False, padding='same', 320 | # data_format='channels_first')(layer1) 321 | # layer2 = BatchNormalization(axis=1)(layer2) 322 | # layer2 = Activation('elu')(layer2) 323 | # layer2 = AveragePooling2D((1, 4), data_format='channels_first')(layer2) 324 | # layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 325 | # 326 | # layer3 = SeparableConv2D(numFilters * 2, (1, 8), depth_multiplier=2, 327 | # depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 328 | # use_bias=False, padding='same', 329 | # data_format='channels_first')(layer2) 330 | # layer3 = BatchNormalization(axis=1)(layer3) 331 | # layer3 = Activation('elu')(layer3) 332 | # layer3 = AveragePooling2D((1, 4), data_format='channels_first')(layer3) 333 | # layer3 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer3) 334 | # 335 | # flatten = Flatten(name='flatten')(layer3) 336 | # 337 | # dense = Dense(nb_classes, name='dense')(flatten) 338 | # softmax = Activation('softmax', name='softmax')(dense) 339 | # 340 | # return softmax 341 | 342 | 343 | def EEGNet_binary(nb_classes, Chans=64, Samples=128, regRate=0.0001, 344 | dropoutRate=0.25, kernLength=64, numFilters=8): 345 | """ Keras Implementation of EEGNet (https://arxiv.org/abs/1611.08024v3) 346 | 347 | Requires Tensorflow >= 1.5 and Keras >= 2.1.3 348 | 349 | Note that this implements the newest version of EEGNet and NOT the earlier 350 | version (version v1 and v2 on arxiv). We strongly recommend using this 351 | architecture as it performs much better and has nicer properties than 352 | our earlier version. 353 | 354 | Note that we use 'image_data_format' = 'channels_first' in there keras.json 355 | configuration file. 356 | 357 | Inputs: 358 | 359 | nb_classes: int, number of classes to classify 360 | Chans, Samples: number of channels and time points in the EEG data 361 | regRate: regularization parameter for L1 and L2 penalties 362 | dropoutRate: dropout fraction 363 | kernLength: length of temporal convolution in first layer 364 | numFilters: number of temporal-spatial filter pairs to learn 365 | 366 | Depending on the task, using numFilters = 4 or 8 seemed to do pretty well 367 | across tasks. 368 | """ 369 | input1 = Input(shape=(1, Chans, Samples)) 370 | # input1 = Permute((2, 1))(input_original) 371 | # input1 = Reshape(target_shape=(1, Chans, Samples))(input_original) 372 | layer1 = Conv2D(numFilters, (1, kernLength), padding='same', 373 | kernel_regularizer=l1_l2(l1=0.0, l2=0.0), 374 | input_shape=(1, Chans, Samples), 375 | use_bias=False, 376 | data_format='channels_first')(input1) 377 | layer1 = BatchNormalization(axis=1)(layer1) 378 | layer1 = DepthwiseConv2D((Chans, 1), 379 | depthwise_regularizer=l1_l2(l1=regRate, l2=regRate), 380 | use_bias=False, 381 | data_format='channels_first')(layer1) 382 | layer1 = BatchNormalization(axis=1)(layer1) 383 | layer1 = Activation('elu')(layer1) 384 | layer1 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer1) 385 | 386 | layer2 = SeparableConv2D(numFilters, (1, 8), 387 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 388 | use_bias=False, padding='same', 389 | data_format='channels_first')(layer1) 390 | layer2 = BatchNormalization(axis=1)(layer2) 391 | layer2 = Activation('elu')(layer2) 392 | layer2 = AveragePooling2D((1, 4), data_format='channels_first')(layer2) 393 | layer2 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer2) 394 | 395 | layer3 = SeparableConv2D(numFilters * 2, (1, 8), depth_multiplier=2, 396 | depthwise_regularizer=l1_l2(l1=0.0, l2=regRate), 397 | use_bias=False, padding='same', 398 | data_format='channels_first')(layer2) 399 | layer3 = BatchNormalization(axis=1)(layer3) 400 | layer3 = Activation('elu')(layer3) 401 | layer3 = AveragePooling2D((1, 4), data_format='channels_first')(layer3) 402 | layer3 = SpatialDropout2D(dropoutRate, data_format='channels_first')(layer3) 403 | 404 | flatten = Flatten(name='flatten')(layer3) 405 | 406 | dense = Dense(1, name='dense')(flatten) 407 | tanh = Activation('tanh', name='tanh')(dense) 408 | 409 | return Model(inputs=input1, outputs=tanh) 410 | 411 | 412 | # def EEGNet_old(nb_classes, Chans=64, Samples=128, regRate=0.0001, 413 | # dropoutRate=0.25, kernels=[(2, 32), (8, 4)], strides=(2, 4)): 414 | # """ Keras Implementation of EEGNet_v1 (https://arxiv.org/abs/1611.08024v2) 415 | # 416 | # This model is the original EEGNet model proposed on arxiv 417 | # https://arxiv.org/abs/1611.08024v2 418 | # 419 | # with a few modifications: we use striding instead of max-pooling as this 420 | # helped slightly in classification performance while also providing a 421 | # computational speed-up. 422 | # 423 | # Note that we no longer recommend the use of this architecture, as the new 424 | # version of EEGNet performs much better overall and has nicer properties. 425 | # 426 | # Inputs: 427 | # 428 | # nb_classes : total number of final categories 429 | # Chans, Samples : number of EEG channels and samples, respectively 430 | # regRate : regularization rate for L1 and L2 regularizations 431 | # dropoutRate : dropout fraction 432 | # kernels : the 2nd and 3rd layer kernel dimensions (default is 433 | # the [2, 32] x [8, 4] configuration) 434 | # strides : the stride size (note that this replaces the max-pool 435 | # used in the original paper) 436 | # 437 | # """ 438 | # 439 | # # start the model 440 | # input_main = Input((1, Chans, Samples)) 441 | # layer1 = Conv2D(16, (Chans, 1), input_shape=(1, Chans, Samples), 442 | # kernel_regularizer=l1_l2(l1=regRate, l2=regRate))(input_main) 443 | # layer1 = BatchNormalization(axis=1)(layer1) 444 | # layer1 = Activation('elu')(layer1) 445 | # layer1 = Dropout(dropoutRate)(layer1) 446 | # 447 | # permute_dims = 2, 1, 3 448 | # permute1 = Permute(permute_dims)(layer1) 449 | # 450 | # layer2 = Conv2D(4, kernels[0], padding='same', 451 | # kernel_regularizer=l1_l2(l1=0.0, l2=regRate), 452 | # strides=strides)(permute1) 453 | # layer2 = BatchNormalization(axis=1)(layer2) 454 | # layer2 = Activation('elu')(layer2) 455 | # layer2 = Dropout(dropoutRate)(layer2) 456 | # 457 | # layer3 = Conv2D(4, kernels[1], padding='same', 458 | # kernel_regularizer=l1_l2(l1=0.0, l2=regRate), 459 | # strides=strides)(layer2) 460 | # layer3 = BatchNormalization(axis=1)(layer3) 461 | # layer3 = Activation('elu')(layer3) 462 | # layer3 = Dropout(dropoutRate)(layer3) 463 | # 464 | # flatten = Flatten(name='flatten')(layer3) 465 | # 466 | # dense = Dense(nb_classes, name='dense')(flatten) 467 | # softmax = Activation('softmax', name='softmax')(dense) 468 | # 469 | # return Model(inputs=input_main, outputs=softmax) 470 | 471 | def EEGNet_old(nb_classes, Chans=64, Samples=128, regRate=0.0001, 472 | dropoutRate=0.25, kernels=[(2, 32), (8, 4)], strides=(2, 4)): 473 | """ Keras Implementation of EEGNet_v1 (https://arxiv.org/abs/1611.08024v2) 474 | 475 | This model is the original EEGNet model proposed on arxiv 476 | https://arxiv.org/abs/1611.08024v2 477 | 478 | with a few modifications: we use striding instead of max-pooling as this 479 | helped slightly in classification performance while also providing a 480 | computational speed-up. 481 | 482 | Note that we no longer recommend the use of this architecture, as the new 483 | version of EEGNet performs much better overall and has nicer properties. 484 | 485 | Inputs: 486 | 487 | nb_classes : total number of final categories 488 | Chans, Samples : number of EEG channels and samples, respectively 489 | regRate : regularization rate for L1 and L2 regularizations 490 | dropoutRate : dropout fraction 491 | kernels : the 2nd and 3rd layer kernel dimensions (default is 492 | the [2, 32] x [8, 4] configuration) 493 | strides : the stride size (note that this replaces the max-pool 494 | used in the original paper) 495 | 496 | """ 497 | 498 | # start the model 499 | input_main = Input((1, Chans, Samples)) 500 | layer1 = Conv2D(16, (Chans, 1), input_shape=(1, Chans, Samples), 501 | kernel_regularizer=l1_l2(l1=regRate, l2=regRate))(input_main) 502 | layer1 = BatchNormalization(axis=1)(layer1) 503 | layer1 = Activation('elu')(layer1) 504 | layer1 = Dropout(dropoutRate)(layer1) 505 | 506 | permute_dims = 2, 1, 3 507 | permute1 = Permute(permute_dims)(layer1) 508 | 509 | layer2 = Conv2D(4, kernels[0], padding='same', 510 | kernel_regularizer=l1_l2(l1=0.0, l2=regRate), 511 | strides=strides)(permute1) 512 | layer2 = BatchNormalization(axis=1)(layer2) 513 | layer2 = Activation('elu')(layer2) 514 | layer2 = Dropout(dropoutRate)(layer2) 515 | 516 | layer3 = Conv2D(4, kernels[1], padding='same', 517 | kernel_regularizer=l1_l2(l1=0.0, l2=regRate), 518 | strides=strides)(layer2) 519 | layer3 = BatchNormalization(axis=1)(layer3) 520 | layer3 = Activation('elu')(layer3) 521 | layer3 = Dropout(dropoutRate)(layer3) 522 | 523 | flatten = Flatten(name='flatten')(layer3) 524 | 525 | dense = Dense(nb_classes, name='dense')(flatten) 526 | softmax = Activation('softmax', name='softmax')(dense) 527 | 528 | return Model(inputs=input_main, outputs=softmax) 529 | 530 | 531 | 532 | # def DeepConvNet(nb_classes, Chans=64, Samples=128, filter_num1=25, 533 | # filter_num2=50, filter_num3=100, filter_num4=200, sample_kernel=10): 534 | # input_original = Input(shape=(Samples, Chans)) 535 | # input1 = Reshape(target_shape=(Samples, Chans, 1))(input_original) 536 | # 537 | # # Conv Pool Block1 538 | # conv1 = Conv2D(filters=filter_num1, kernel_size=(sample_kernel, 1), 539 | # strides=(1, 1), padding='valid', 540 | # activation='linear', use_bias=True)(input1) # (Samples, Chans, filters) 541 | # conv1_spatial = Conv2D(filters=filter_num1, kernel_size=(1, Chans), 542 | # strides=(1, 1), padding='valid', activation='elu', 543 | # use_bias=True)(conv1) # (Samples, 1, filters) 544 | # layer1_perm = Permute((3, 1, 2))(conv1_spatial) # (filters, Samples, 1) 545 | # pool1 = MaxPooling2D(pool_size=(1, 3), strides=(1, 3), padding='same')(layer1_perm) # (filters, Samples, 1) 546 | # 547 | # # Conv Pool Block2 548 | # conv2 = Conv2D(filters=filter_num2, kernel_size=(filter_num1, sample_kernel), strides=(1, 1), 549 | # padding='valid', activation='elu', 550 | # use_bias=True)(pool1) # (1, Samples, filters) 551 | # layer2_perm = Permute((3, 2, 1))(conv2) # (filters, Samples, 1) 552 | # pool2 = MaxPooling2D(pool_size=(1, 3), strides=(1, 3), padding='same')(layer2_perm) 553 | # 554 | # # Conv Pool Block3 555 | # conv3 = Conv2D(filters=filter_num3, kernel_size=(filter_num2, sample_kernel), strides=(1, 1), 556 | # padding='valid', activation='elu', 557 | # use_bias=True)(pool2) # (1, Samples, filters) 558 | # layer3_perm = Permute((3, 2, 1))(conv3) # (filters, Samples, 1) 559 | # pool3 = MaxPooling2D(pool_size=(1, 3), strides=(1, 3), padding='same')(layer3_perm) 560 | # 561 | # # # Conv Pool Block4 562 | # # conv4 = Conv2D(filters=filter_num4, kernel_size=(filter_num3, sample_kernel), strides=(1, 1), 563 | # # padding='valid', activation='elu', 564 | # # use_bias=True)(pool3) # (1, Samples, filters) 565 | # # layer4_perm = Permute((3, 2, 1))(conv4) # (filters, Samples, 1) 566 | # # pool4 = MaxPooling2D(pool_size=(1, 3), strides=(1, 3), padding='same')(layer4_perm) 567 | # 568 | # # Dense 569 | # flatten = Flatten()(pool3) 570 | # 571 | # dense = Dense(nb_classes, activation='softmax', name='dense')(flatten) 572 | # softmax = Activation('softmax', name='softmax')(dense) 573 | # 574 | # return Model(inputs=input_original, outputs=softmax) 575 | 576 | def DeepConvNet(nb_classes, Chans=64, Samples=256, 577 | dropoutRate=0.5): 578 | """ Keras implementation of the Deep Convolutional Network as described in 579 | Schirrmeister et. al. (2017), Human Brain Mapping. 580 | 581 | This implementation assumes the input is a 2-second EEG signal sampled at 582 | 128Hz, as opposed to signals sampled at 250Hz as described in the original 583 | paper. We also perform temporal convolutions of length (1, 5) as opposed 584 | to (1, 10) due to this sampling rate difference. 585 | 586 | Note that we use the max_norm constraint on all convolutional layers, as 587 | well as the classification layer. We also change the defaults for the 588 | BatchNormalization layer. We used this based on a personal communication 589 | with the original authors. 590 | 591 | ours original paper 592 | pool_size 1, 2 1, 3 593 | strides 1, 2 1, 3 594 | conv filters 1, 5 1, 10 595 | 596 | Note that this implementation has not been verified by the original 597 | authors. 598 | 599 | """ 600 | 601 | # start the model 602 | input_main = Input((1, Chans, Samples)) 603 | block1 = Conv2D(25, (1, 5), 604 | input_shape=(1, Chans, Samples), 605 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 606 | block1 = Conv2D(25, (Chans, 1), 607 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 608 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 609 | block1 = Activation('elu')(block1) 610 | block1 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block1) 611 | block1 = Dropout(dropoutRate)(block1) 612 | 613 | block2 = Conv2D(50, (1, 5), 614 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 615 | block2 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block2) 616 | block2 = Activation('elu')(block2) 617 | block2 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block2) 618 | block2 = Dropout(dropoutRate)(block2) 619 | 620 | block3 = Conv2D(100, (1, 5), 621 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block2) 622 | block3 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block3) 623 | block3 = Activation('elu')(block3) 624 | block3 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block3) 625 | block3 = Dropout(dropoutRate)(block3) 626 | 627 | block4 = Conv2D(200, (1, 5), 628 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block3) 629 | block4 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block4) 630 | block4 = Activation('elu')(block4) 631 | block4 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block4) 632 | block4 = Dropout(dropoutRate)(block4) 633 | 634 | flatten = Flatten()(block4) 635 | 636 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 637 | softmax = Activation('softmax')(dense) 638 | 639 | return Model(inputs=input_main, outputs=softmax) 640 | 641 | 642 | def DeepConvNet_wide(nb_classes, Chans=64, Samples=256, 643 | dropoutRate=0.5): 644 | """ Keras implementation of the Deep Convolutional Network as described in 645 | Schirrmeister et. al. (2017), Human Brain Mapping. 646 | 647 | This implementation assumes the input is a 2-second EEG signal sampled at 648 | 128Hz, as opposed to signals sampled at 250Hz as described in the original 649 | paper. We also perform temporal convolutions of length (1, 5) as opposed 650 | to (1, 10) due to this sampling rate difference. 651 | 652 | Note that we use the max_norm constraint on all convolutional layers, as 653 | well as the classification layer. We also change the defaults for the 654 | BatchNormalization layer. We used this based on a personal communication 655 | with the original authors. 656 | 657 | ours original paper 658 | pool_size 1, 2 1, 3 659 | strides 1, 2 1, 3 660 | conv filters 1, 5 1, 10 661 | 662 | Note that this implementation has not been verified by the original 663 | authors. 664 | 665 | """ 666 | 667 | # start the model 668 | input_main = Input((1, Chans, Samples)) 669 | block1 = Conv2D(50, (1, 5), 670 | input_shape=(1, Chans, Samples), 671 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 672 | block1 = Conv2D(50, (Chans, 1), 673 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 674 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 675 | block1 = Activation('elu')(block1) 676 | block1 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block1) 677 | block1 = Dropout(dropoutRate)(block1) 678 | 679 | block2 = Conv2D(100, (1, 5), 680 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 681 | block2 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block2) 682 | block2 = Activation('elu')(block2) 683 | block2 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block2) 684 | block2 = Dropout(dropoutRate)(block2) 685 | 686 | block3 = Conv2D(200, (1, 5), 687 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block2) 688 | block3 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block3) 689 | block3 = Activation('elu')(block3) 690 | block3 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block3) 691 | block3 = Dropout(dropoutRate)(block3) 692 | 693 | block4 = Conv2D(400, (1, 5), 694 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block3) 695 | block4 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block4) 696 | block4 = Activation('elu')(block4) 697 | block4 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block4) 698 | block4 = Dropout(dropoutRate)(block4) 699 | 700 | flatten = Flatten()(block4) 701 | 702 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 703 | softmax = Activation('softmax')(dense) 704 | 705 | return Model(inputs=input_main, outputs=softmax) 706 | 707 | def DeepConvNet_output(nb_classes, Chans=64, Samples=256, dropoutRate=0.5, x_input=None): 708 | """ Keras implementation of the Deep Convolutional Network as described in 709 | Schirrmeister et. al. (2017), Human Brain Mapping. 710 | 711 | This implementation assumes the input is a 2-second EEG signal sampled at 712 | 128Hz, as opposed to signals sampled at 250Hz as described in the original 713 | paper. We also perform temporal convolutions of length (1, 5) as opposed 714 | to (1, 10) due to this sampling rate difference. 715 | 716 | Note that we use the max_norm constraint on all convolutional layers, as 717 | well as the classification layer. We also change the defaults for the 718 | BatchNormalization layer. We used this based on a personal communication 719 | with the original authors. 720 | 721 | ours original paper 722 | pool_size 1, 2 1, 3 723 | strides 1, 2 1, 3 724 | conv filters 1, 5 1, 10 725 | 726 | Note that this implementation has not been verified by the original 727 | authors. 728 | 729 | """ 730 | 731 | # start the model 732 | input_main = x_input 733 | # input_main = Input((1, Chans, Samples)) 734 | block1 = Conv2D(25, (1, 5), 735 | input_shape=(1, Chans, Samples), 736 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 737 | block1 = Conv2D(25, (Chans, 1), 738 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 739 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 740 | block1 = Activation('elu')(block1) 741 | block1 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block1) 742 | block1 = Dropout(dropoutRate)(block1) 743 | 744 | block2 = Conv2D(50, (1, 5), 745 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 746 | block2 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block2) 747 | block2 = Activation('elu')(block2) 748 | block2 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block2) 749 | block2 = Dropout(dropoutRate)(block2) 750 | 751 | block3 = Conv2D(100, (1, 5), 752 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block2) 753 | block3 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block3) 754 | block3 = Activation('elu')(block3) 755 | block3 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block3) 756 | block3 = Dropout(dropoutRate)(block3) 757 | 758 | block4 = Conv2D(200, (1, 5), 759 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block3) 760 | block4 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block4) 761 | block4 = Activation('elu')(block4) 762 | block4 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block4) 763 | block4 = Dropout(dropoutRate)(block4) 764 | 765 | flatten = Flatten()(block4) 766 | 767 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 768 | softmax = Activation('softmax')(dense) 769 | 770 | return softmax 771 | 772 | 773 | def DeepConvNet_output_wide(nb_classes, Chans=64, Samples=256, dropoutRate=0.5, x_input=None): 774 | """ Keras implementation of the Deep Convolutional Network as described in 775 | Schirrmeister et. al. (2017), Human Brain Mapping. 776 | 777 | This implementation assumes the input is a 2-second EEG signal sampled at 778 | 128Hz, as opposed to signals sampled at 250Hz as described in the original 779 | paper. We also perform temporal convolutions of length (1, 5) as opposed 780 | to (1, 10) due to this sampling rate difference. 781 | 782 | Note that we use the max_norm constraint on all convolutional layers, as 783 | well as the classification layer. We also change the defaults for the 784 | BatchNormalization layer. We used this based on a personal communication 785 | with the original authors. 786 | 787 | ours original paper 788 | pool_size 1, 2 1, 3 789 | strides 1, 2 1, 3 790 | conv filters 1, 5 1, 10 791 | 792 | Note that this implementation has not been verified by the original 793 | authors. 794 | 795 | """ 796 | 797 | # start the model 798 | input_main = x_input 799 | # input_main = Input((1, Chans, Samples)) 800 | block1 = Conv2D(50, (1, 5), 801 | input_shape=(1, Chans, Samples), 802 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 803 | block1 = Conv2D(50, (Chans, 1), 804 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 805 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 806 | block1 = Activation('elu')(block1) 807 | block1 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block1) 808 | block1 = Dropout(dropoutRate)(block1) 809 | 810 | block2 = Conv2D(100, (1, 5), 811 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 812 | block2 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block2) 813 | block2 = Activation('elu')(block2) 814 | block2 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block2) 815 | block2 = Dropout(dropoutRate)(block2) 816 | 817 | block3 = Conv2D(200, (1, 5), 818 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block2) 819 | block3 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block3) 820 | block3 = Activation('elu')(block3) 821 | block3 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block3) 822 | block3 = Dropout(dropoutRate)(block3) 823 | 824 | block4 = Conv2D(400, (1, 5), 825 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block3) 826 | block4 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block4) 827 | block4 = Activation('elu')(block4) 828 | block4 = MaxPooling2D(pool_size=(1, 2), strides=(1, 2))(block4) 829 | block4 = Dropout(dropoutRate)(block4) 830 | 831 | flatten = Flatten()(block4) 832 | 833 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 834 | softmax = Activation('softmax')(dense) 835 | 836 | return softmax 837 | 838 | # def ShallowConvNet(nb_classes, Chans=64, Samples=128, filter_num1=25): 839 | # input_original = Input(shape=(Samples, Chans)) 840 | # input1 = Reshape(target_shape=(Samples, Chans, 1))(input_original) 841 | # 842 | # # Conv Pool Block 843 | # conv = Conv2D(filters=filter_num1, kernel_size=(25, 1), 844 | # strides=(1, 1), padding='valid', 845 | # activation='linear', use_bias=True)(input1) # (Samples, Chans, filters) 846 | # conv_spatial = Conv2D(filters=filter_num1, kernel_size=(1, Chans), 847 | # strides=(1, 1), padding='valid', activation='linear', 848 | # use_bias=True)(conv) # (Samples, 1, filters) 849 | # # TODO: Square 850 | # 851 | # layer_perm = Permute((3, 1, 2))(conv_spatial) # (filters, Samples, 1) 852 | # pool = AveragePooling2D(pool_size=(1, 75), strides=(1, 75))(layer_perm) # (filters, Samples, 1) 853 | # 854 | # # Dense 855 | # flatten = Flatten()(pool) 856 | # dense = Dense(nb_classes, name='dense')(flatten) 857 | # softmax = Activation('softmax', name='softmax')(dense) 858 | # 859 | # return Model(inputs=input_original, outputs=softmax) 860 | 861 | # need these for ShallowConvNet 862 | def square(x): 863 | return K.square(x) 864 | 865 | 866 | def log(x): 867 | return K.log(K.clip(x, min_value=1e-7, max_value=10000)) 868 | 869 | 870 | def ShallowConvNet(nb_classes, Chans=64, Samples=128, dropoutRate=0.5): 871 | """ Keras implementation of the Shallow Convolutional Network as described 872 | in Schirrmeister et. al. (2017), Human Brain Mapping. 873 | 874 | Assumes the input is a 2-second EEG signal sampled at 128Hz. Note that in 875 | the original paper, they do temporal convolutions of length 25 for EEG 876 | data sampled at 250Hz. We instead use length 13 since the sampling rate is 877 | roughly half of the 250Hz which the paper used. The pool_size and stride 878 | in later layers is also approximately half of what is used in the paper. 879 | 880 | Note that we use the max_norm constraint on all convolutional layers, as 881 | well as the classification layer. We also change the defaults for the 882 | BatchNormalization layer. We used this based on a personal communication 883 | with the original authors. 884 | 885 | ours original paper 886 | pool_size 1, 35 1, 75 887 | strides 1, 7 1, 15 888 | conv filters 1, 13 1, 25 889 | 890 | Note that this implementation has not been verified by the original 891 | authors. We do note that this implementation reproduces the results in the 892 | original paper with minor deviations. 893 | """ 894 | 895 | # start the model 896 | input_main = Input((1, Chans, Samples)) 897 | block1 = Conv2D(40, (1, 13), 898 | input_shape=(1, Chans, Samples), 899 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 900 | block1 = Conv2D(40, (Chans, 1), use_bias=False, 901 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 902 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 903 | block1 = Activation(square)(block1) 904 | block1 = AveragePooling2D(pool_size=(1, 35), strides=(1, 7))(block1) 905 | block1 = Activation(log)(block1) 906 | block1 = Dropout(dropoutRate)(block1) 907 | flatten = Flatten()(block1) 908 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 909 | softmax = Activation('softmax')(dense) 910 | 911 | return Model(inputs=input_main, outputs=softmax) 912 | 913 | 914 | def ShallowConvNet_wide(nb_classes, Chans=64, Samples=128, dropoutRate=0.5, numFilters=80): 915 | """ Keras implementation of the Shallow Convolutional Network as described 916 | in Schirrmeister et. al. (2017), Human Brain Mapping. 917 | 918 | Assumes the input is a 2-second EEG signal sampled at 128Hz. Note that in 919 | the original paper, they do temporal convolutions of length 25 for EEG 920 | data sampled at 250Hz. We instead use length 13 since the sampling rate is 921 | roughly half of the 250Hz which the paper used. The pool_size and stride 922 | in later layers is also approximately half of what is used in the paper. 923 | 924 | Note that we use the max_norm constraint on all convolutional layers, as 925 | well as the classification layer. We also change the defaults for the 926 | BatchNormalization layer. We used this based on a personal communication 927 | with the original authors. 928 | 929 | ours original paper 930 | pool_size 1, 35 1, 75 931 | strides 1, 7 1, 15 932 | conv filters 1, 13 1, 25 933 | 934 | Note that this implementation has not been verified by the original 935 | authors. We do note that this implementation reproduces the results in the 936 | original paper with minor deviations. 937 | """ 938 | 939 | # start the model 940 | input_main = Input((1, Chans, Samples)) 941 | block1 = Conv2D(numFilters, (1, 13), 942 | input_shape=(1, Chans, Samples), 943 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 944 | block1 = Conv2D(numFilters, (Chans, 1), use_bias=False, 945 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 946 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 947 | block1 = Activation(square)(block1) 948 | block1 = AveragePooling2D(pool_size=(1, 35), strides=(1, 7))(block1) 949 | block1 = Activation(log)(block1) 950 | block1 = Dropout(dropoutRate)(block1) 951 | flatten = Flatten()(block1) 952 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 953 | softmax = Activation('softmax')(dense) 954 | 955 | return Model(inputs=input_main, outputs=softmax) 956 | 957 | 958 | def ShallowConvNet_output(nb_classes, Chans=64, Samples=128, dropoutRate=0.5, x_input=None): 959 | """ Keras implementation of the Shallow Convolutional Network as described 960 | in Schirrmeister et. al. (2017), Human Brain Mapping. 961 | 962 | Assumes the input is a 2-second EEG signal sampled at 128Hz. Note that in 963 | the original paper, they do temporal convolutions of length 25 for EEG 964 | data sampled at 250Hz. We instead use length 13 since the sampling rate is 965 | roughly half of the 250Hz which the paper used. The pool_size and stride 966 | in later layers is also approximately half of what is used in the paper. 967 | 968 | Note that we use the max_norm constraint on all convolutional layers, as 969 | well as the classification layer. We also change the defaults for the 970 | BatchNormalization layer. We used this based on a personal communication 971 | with the original authors. 972 | 973 | ours original paper 974 | pool_size 1, 35 1, 75 975 | strides 1, 7 1, 15 976 | conv filters 1, 13 1, 25 977 | 978 | Note that this implementation has not been verified by the original 979 | authors. We do note that this implementation reproduces the results in the 980 | original paper with minor deviations. 981 | """ 982 | 983 | # start the model 984 | # input_main = Input((1, Chans, Samples)) 985 | input_main = x_input 986 | block1 = Conv2D(40, (1, 13), 987 | input_shape=(1, Chans, Samples), 988 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 989 | block1 = Conv2D(40, (Chans, 1), use_bias=False, 990 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 991 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 992 | block1 = Activation(square)(block1) 993 | block1 = AveragePooling2D(pool_size=(1, 35), strides=(1, 7))(block1) 994 | block1 = Activation(log)(block1) 995 | block1 = Dropout(dropoutRate)(block1) 996 | flatten = Flatten()(block1) 997 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 998 | softmax = Activation('softmax')(dense) 999 | 1000 | return softmax 1001 | 1002 | def ShallowConvNet_output_wide(nb_classes, Chans=64, Samples=128, dropoutRate=0.5, x_input=None): 1003 | """ Keras implementation of the Shallow Convolutional Network as described 1004 | in Schirrmeister et. al. (2017), Human Brain Mapping. 1005 | 1006 | Assumes the input is a 2-second EEG signal sampled at 128Hz. Note that in 1007 | the original paper, they do temporal convolutions of length 25 for EEG 1008 | data sampled at 250Hz. We instead use length 13 since the sampling rate is 1009 | roughly half of the 250Hz which the paper used. The pool_size and stride 1010 | in later layers is also approximately half of what is used in the paper. 1011 | 1012 | Note that we use the max_norm constraint on all convolutional layers, as 1013 | well as the classification layer. We also change the defaults for the 1014 | BatchNormalization layer. We used this based on a personal communication 1015 | with the original authors. 1016 | 1017 | ours original paper 1018 | pool_size 1, 35 1, 75 1019 | strides 1, 7 1, 15 1020 | conv filters 1, 13 1, 25 1021 | 1022 | Note that this implementation has not been verified by the original 1023 | authors. We do note that this implementation reproduces the results in the 1024 | original paper with minor deviations. 1025 | """ 1026 | 1027 | # start the model 1028 | # input_main = Input((1, Chans, Samples)) 1029 | input_main = x_input 1030 | block1 = Conv2D(80, (1, 13), 1031 | input_shape=(1, Chans, Samples), 1032 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(input_main) 1033 | block1 = Conv2D(80, (Chans, 1), use_bias=False, 1034 | kernel_constraint=max_norm(2., axis=(0, 1, 2)))(block1) 1035 | block1 = BatchNormalization(axis=1, epsilon=1e-05, momentum=0.1)(block1) 1036 | block1 = Activation(square)(block1) 1037 | block1 = AveragePooling2D(pool_size=(1, 35), strides=(1, 7))(block1) 1038 | block1 = Activation(log)(block1) 1039 | block1 = Dropout(dropoutRate)(block1) 1040 | flatten = Flatten()(block1) 1041 | dense = Dense(nb_classes, kernel_constraint=max_norm(0.5))(flatten) 1042 | softmax = Activation('softmax')(dense) 1043 | 1044 | return softmax 1045 | 1046 | 1047 | def eval(model, x, y): 1048 | y_pred = np.argmax(model.predict(x), axis=1) 1049 | y_test = np.squeeze(y) 1050 | bca = utils.bca(y_test, y_pred) 1051 | acc = np.sum(y_pred == y_test).astype(np.float32) / len(y_pred) 1052 | 1053 | return acc, bca -------------------------------------------------------------------------------- /utils.py: -------------------------------------------------------------------------------- 1 | import numpy as np 2 | from sklearn.metrics import confusion_matrix 3 | import matplotlib.pyplot as plt 4 | import tensorflow as tf 5 | import keras.backend as K 6 | from keras import Model 7 | from keras.layers import Lambda, Input 8 | from sklearn.model_selection import train_test_split 9 | from sklearn.utils import shuffle 10 | import old_models 11 | import random 12 | 13 | def standard_normalize(x, clip_range=None): 14 | x = (x-np.mean(x))/np.std(x) 15 | if clip_range is not None: 16 | x = np.clip(x, a_min=clip_range[0], a_max=clip_range[1]) 17 | return x 18 | 19 | 20 | def split_data(data_size, split=0.8, random_seed=1000, shuffle=True): 21 | np.random.seed(random_seed) 22 | split_index = int(data_size * split) 23 | indices = np.arange(data_size) 24 | if shuffle: 25 | indices = np.random.permutation(indices) 26 | return indices[:split_index], indices[split_index:] 27 | 28 | 29 | def shuffle_data(data_size, random_seed=None): 30 | if random_seed: 31 | np.random.seed(random_seed) 32 | indices = np.arange(data_size).squeeze() 33 | return np.random.permutation(indices).squeeze() 34 | 35 | 36 | def bca(y_true, y_pred): 37 | m = confusion_matrix(y_true, y_pred) 38 | numb = m.shape[0] 39 | acc_each_label = 0 40 | for i in range(numb): 41 | all = np.sum(m[i, :], keepdims=False).astype(np.float32) 42 | acc = m[i, i]/all 43 | acc_each_label += acc 44 | return acc_each_label/numb 45 | 46 | 47 | def list_leave_one_subject(x, y, s, shuffle=True): 48 | subjects = np.unique(s) 49 | for subject in subjects: 50 | test_indics = np.argwhere(s == subject).squeeze() 51 | test_x = x[test_indics] 52 | test_y = y[test_indics] 53 | 54 | train_indics = np.argwhere(s != subject).squeeze() 55 | train_x = x[train_indics] 56 | train_y = y[train_indics] 57 | 58 | if shuffle: 59 | indices = shuffle_data(len(train_y)) 60 | train_x = train_x[indices] 61 | train_y = train_y[indices] 62 | 63 | yield (train_x, train_y), (test_x, test_y), subject 64 | 65 | 66 | 67 | def list_cross_subject(x, y, s, shuffle=True): 68 | subjects = np.unique(s) 69 | subject = 0 70 | test_indics = np.argwhere(s == subject).squeeze() 71 | test_x = x[test_indics] 72 | test_y = y[test_indics] 73 | 74 | train_indics = np.argwhere(s != subject).squeeze() 75 | train_x = x[train_indics] 76 | train_y = y[train_indics] 77 | 78 | if shuffle: 79 | indices = shuffle_data(len(train_y)) 80 | train_x = train_x[indices] 81 | train_y = train_y[indices] 82 | 83 | return (train_x, train_y), (test_x, test_y), subject 84 | 85 | 86 | 87 | def plot_data(test_x, adv_x, data='MI'): 88 | if data == 'EPFL': 89 | t = np.arange(test_x.shape[3]) * 1. / 250. 90 | if data == 'MI4C': 91 | t = np.arange(test_x.shape[3]) * 1. / 128. 92 | if data == 'ERN': 93 | t = np.arange(test_x.shape[3]) * 1. / 200. 94 | i = 0 95 | channels = 10 96 | for j in range(channels): 97 | if j == 0: 98 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 99 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Original Example', linewidth=1) 100 | else: 101 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', linewidth=1) 102 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', linewidth=1) 103 | plt.xlabel('Time (s)', fontsize=14) 104 | plt.ylim([-4, 46]) 105 | temp_y = np.arange(channels) * 4 106 | y_names = ['channel {}'.format(int(y_id/4)) for y_id in temp_y] 107 | plt.yticks(temp_y, y_names, fontsize=12) 108 | plt.legend(loc='upper center', fontsize=12, ncol=2) 109 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 110 | plt.tight_layout() 111 | plt.show() 112 | 113 | def plot_data_choose_channel(test_x, adv_x, data='MI', choose_channel=20): 114 | if data == 'EPFL': 115 | t = np.arange(test_x.shape[3]) * 1. / 250. 116 | if data == 'MI4C': 117 | t = np.arange(test_x.shape[3]) * 1. / 128. 118 | if data == 'ERN': 119 | t = np.arange(test_x.shape[3]) * 1. / 200. 120 | i = 0 121 | channels = 10 122 | for m in range(choose_channel-10, choose_channel, 1): 123 | j = m % 10 124 | if j == 0: 125 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 126 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Original Example', linewidth=1) 127 | else: 128 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', linewidth=1) 129 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', linewidth=1) 130 | plt.xlabel('Time (s)', fontsize=14) 131 | plt.ylim([-4, 46]) 132 | temp_y = np.arange(channels) * 4 133 | y_names = ['channel {}'.format(int(y_id/4)) for y_id in temp_y] 134 | plt.yticks(temp_y, y_names, fontsize=12) 135 | plt.legend(loc='upper center', fontsize=12, ncol=2) 136 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 137 | plt.tight_layout() 138 | plt.show() 139 | 140 | def plot_data_new(test_x, adv_x, data='MI'): 141 | if data == 'EPFL': 142 | t = np.arange(test_x.shape[3]) * 1. / 250. 143 | if data == 'MI4C': 144 | t = np.arange(test_x.shape[3]) * 1. / 128. 145 | if data == 'ERN': 146 | t = np.arange(test_x.shape[3]) * 1. / 200. 147 | i = 0 148 | channels = [0, 7, 9, 11, 19] 149 | for j in range(len(channels)): 150 | if j == 0: 151 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 152 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Benign Example', linewidth=1) 153 | else: 154 | plt.plot(t, adv_x[i, 0, channels[j], :]+j*4, 'r', linewidth=1) 155 | plt.plot(t, test_x[i, 0, channels[j], :]+j*4, 'g', linewidth=1) 156 | plt.xlabel('Time (s)', fontsize=14) 157 | plt.ylabel('Channel', fontsize=14) 158 | plt.ylim([-4, 23]) 159 | temp_y = np.arange(len(channels)) * 4 160 | y_names = ['$Fz$', '$C3$', '$Cz$', '$C4$', '$Pz$'] 161 | plt.yticks(temp_y, y_names, fontsize=12) 162 | plt.xticks(fontsize=12) 163 | plt.legend(loc='upper center', fontsize=12, ncol=2) 164 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 165 | plt.tight_layout() 166 | plt.show() 167 | 168 | 169 | def plot_regular(adv_x, adv_x_l1, adv_x_l2, adv_x_l3, data='MI'): 170 | if data == 'EPFL': 171 | t = np.arange(adv_x.shape[3]) * 1. / 250. 172 | if data == 'MI4C': 173 | t = np.arange(adv_x.shape[3]) * 1. / 128. 174 | if data == 'ERN': 175 | t = np.arange(adv_x.shape[3]) * 1. / 200. 176 | i = 0 177 | channels = 2 178 | for j in [2]: 179 | j=2 180 | if j == 2: 181 | plt.plot(t, adv_x[i, 0, j, :], 'r', label='No', linewidth=1.5) 182 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', label='L1', linewidth=1.5) 183 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', label='L2', linewidth=1.5) 184 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 185 | plt.plot(t, [0]*len(t), 'black',linestyle='--', linewidth=0.5) 186 | else: 187 | plt.plot(t, adv_x[i, 0, j, :], 'r', linewidth=1.5) 188 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', linewidth=1.5) 189 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', linewidth=1.5) 190 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 191 | plt.xlabel('time (s)', fontsize=12) 192 | plt.ylim([-0.5,0.5]) 193 | plt.xlim([0,0.3]) 194 | temp_y = np.arange(channels) * 0.5 195 | # y_names = ['channel {}'.format(int(y_id/0.5)) for y_id in temp_y] 196 | y_names = ['channel {}'.format(channels)] 197 | plt.yticks(temp_y, y_names, fontsize=10) 198 | plt.legend(loc='upper right', fontsize=10) 199 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 200 | plt.tight_layout() 201 | plt.show() 202 | 203 | 204 | 205 | def plot_regular_0(adv_x, adv_x_l1, adv_x_l2, adv_x_l3, data='MI'): 206 | if data == 'EPFL': 207 | t = np.arange(adv_x.shape[3]) * 1. / 250. 208 | if data == 'MI4C': 209 | t = np.arange(adv_x.shape[3]) * 1. / 128. 210 | if data == 'ERN': 211 | t = np.arange(adv_x.shape[3]) * 1. / 200. 212 | i = 0 213 | channels = 1 214 | for j in range(channels): 215 | if j == 0: 216 | plt.plot(t, adv_x[i, 0, j, :], 'r', label='No', linewidth=1.5) 217 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', label='L1', linewidth=1.5) 218 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', label='L2', linewidth=1.5) 219 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 220 | plt.plot(t, [0]*len(t), 'black',linestyle='--', linewidth=0.5) 221 | else: 222 | plt.plot(t, adv_x[i, 0, j, :], 'r', linewidth=1.5) 223 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', linewidth=1.5) 224 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', linewidth=1.5) 225 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 226 | plt.xlabel('time (s)', fontsize=12) 227 | plt.xlim([0, 0.3]) 228 | plt.ylim([-0.5,0.5]) 229 | temp_y = np.arange(channels) * 0.5 230 | y_names = ['channel {}'.format(int(y_id/0.5)) for y_id in temp_y] 231 | # y_names = ['channel {}'.format(channels)] 232 | plt.yticks(temp_y, y_names, fontsize=10) 233 | plt.legend(loc='upper right', fontsize=10) 234 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 235 | plt.tight_layout() 236 | plt.show() 237 | 238 | 239 | def plot_regular_fz(adv_x, adv_x_l1, adv_x_l2, adv_x_l3, data='MI'): 240 | if data == 'EPFL': 241 | t = np.arange(adv_x.shape[3]) * 1. / 250. 242 | if data == 'MI4C': 243 | t = np.arange(adv_x.shape[3]) * 1. / 128. 244 | if data == 'ERN': 245 | t = np.arange(adv_x.shape[3]) * 1. / 200. 246 | i = 0 247 | channels = 1 248 | for j in range(channels): 249 | if j == 0: 250 | plt.plot(t, adv_x[i, 0, j, :], 'r', label='No', linewidth=1.5) 251 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', label='L1', linewidth=1.5) 252 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', label='L2', linewidth=1.5) 253 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 254 | plt.plot(t, [0]*len(t), 'black',linestyle='--', linewidth=0.5) 255 | else: 256 | plt.plot(t, adv_x[i, 0, j, :], 'r', linewidth=1.5) 257 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', linewidth=1.5) 258 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', linewidth=1.5) 259 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 260 | plt.xlabel('time (s)', fontsize=12) 261 | plt.xlim([0, 0.3]) 262 | plt.ylim([-0.5,0.5]) 263 | temp_y = np.arange(channels) * 0.5 264 | y_names = ['Channel $Fz$ '.format(int(y_id/0.5)) for y_id in temp_y] 265 | # y_names = ['channel {}'.format(channels)] 266 | plt.yticks(temp_y, y_names, fontsize=10) 267 | plt.legend(loc='upper right', fontsize=10) 268 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 269 | plt.tight_layout() 270 | plt.show() 271 | 272 | def plot_regular_mutil(adv_x, adv_x_l1, adv_x_l2, adv_x_l3, data='MI'): 273 | if data == 'EPFL': 274 | t = np.arange(adv_x.shape[3]) * 1. / 250. 275 | if data == 'MI4C': 276 | t = np.arange(adv_x.shape[3]) * 1. / 128. 277 | if data == 'ERN': 278 | t = np.arange(adv_x.shape[3]) * 1. / 200. 279 | i = 0 280 | channels = 20 281 | for j in range(channels): 282 | if j == 0: 283 | plt.plot(t, adv_x[i, 0, j, :], 'r', label='No', linewidth=1.5) 284 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', label='L1', linewidth=1.5) 285 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', label='L2', linewidth=1.5) 286 | plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 287 | plt.plot(t, [0]*len(t), 'black',linestyle='--', linewidth=0.5) 288 | if j == 9: 289 | plt.plot(t, adv_x[i, 0, j, :]+0.8, 'r', linewidth=1.5) 290 | plt.plot(t, adv_x_l1[i, 0, j, :]+0.8, 'g', linewidth=1.5) 291 | plt.plot(t, adv_x_l2[i, 0, j, :]+0.8, 'b', linewidth=1.5) 292 | plt.plot(t, adv_x_l3[i, 0, j, :]+0.8, 'm', linewidth=1.5) 293 | plt.plot(t, [0.8] * len(t), 'black', linestyle='--', linewidth=0.5) 294 | if j == 19: 295 | plt.plot(t, adv_x[i, 0, j, :]+2*0.8, 'r', linewidth=1.5) 296 | plt.plot(t, adv_x_l1[i, 0, j, :]+2*0.8, 'g', linewidth=1.5) 297 | plt.plot(t, adv_x_l2[i, 0, j, :]+2*0.8, 'b', linewidth=1.5) 298 | plt.plot(t, adv_x_l3[i, 0, j, :]+2*0.8, 'm', linewidth=1.5) 299 | plt.plot(t, [1.6] * len(t), 'black', linestyle='--', linewidth=0.5) 300 | plt.xlabel('Time (s)', fontsize=14) 301 | plt.ylabel('Channel', fontsize=14) 302 | plt.xlim([0, 0.3]) 303 | plt.ylim([-0.5,2.3]) 304 | temp_y = [0,0.8,1.6] 305 | y_names = ['$Fz$', '$Cz$', '$Pz$'] 306 | # y_names = ['channel {}'.format(channels)] 307 | plt.yticks(temp_y, y_names, fontsize=12) 308 | plt.xticks(fontsize=12) 309 | plt.legend(loc='upper center', fontsize=12, ncol=4) 310 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 311 | plt.tight_layout() 312 | plt.show() 313 | 314 | def plot_regular_3(adv_x, adv_x_l1, adv_x_l2, data='MI'): 315 | if data == 'EPFL': 316 | t = np.arange(adv_x.shape[3]) * 1. / 250. 317 | if data == 'MI4C': 318 | t = np.arange(adv_x.shape[3]) * 1. / 128. 319 | if data == 'ERN': 320 | t = np.arange(adv_x.shape[3]) * 1. / 200. 321 | i = 0 322 | channels = 20 323 | for j in range(channels): 324 | if j == 0: 325 | plt.plot(t, adv_x[i, 0, j, :], 'r', label='No', linewidth=1.5) 326 | plt.plot(t, adv_x_l1[i, 0, j, :], 'g', label='L1', linewidth=1.5) 327 | plt.plot(t, adv_x_l2[i, 0, j, :], 'b', label='L2', linewidth=1.5) 328 | # plt.plot(t, adv_x_l3[i, 0, j, :], 'm', label='L1+L2', linewidth=1.5) 329 | plt.plot(t, [0]*len(t), 'black',linestyle='--', linewidth=0.5) 330 | if j == 9: 331 | plt.plot(t, adv_x[i, 0, j, :]+0.8, 'r', linewidth=1.5) 332 | plt.plot(t, adv_x_l1[i, 0, j, :]+0.8, 'g', linewidth=1.5) 333 | plt.plot(t, adv_x_l2[i, 0, j, :]+0.8, 'b', linewidth=1.5) 334 | # plt.plot(t, adv_x_l3[i, 0, j, :]+0.8, 'm', linewidth=1.5) 335 | plt.plot(t, [0.8] * len(t), 'black', linestyle='--', linewidth=0.5) 336 | if j == 19: 337 | plt.plot(t, adv_x[i, 0, j, :]+2*0.8, 'r', linewidth=1.5) 338 | plt.plot(t, adv_x_l1[i, 0, j, :]+2*0.8, 'g', linewidth=1.5) 339 | plt.plot(t, adv_x_l2[i, 0, j, :]+2*0.8, 'b', linewidth=1.5) 340 | # plt.plot(t, adv_x_l3[i, 0, j, :]+2*0.8, 'm', linewidth=1.5) 341 | plt.plot(t, [1.6] * len(t), 'black', linestyle='--', linewidth=0.5) 342 | plt.xlabel('Time (s)', fontsize=14) 343 | plt.ylabel('Channel', fontsize=14) 344 | plt.xlim([0, 0.3]) 345 | plt.ylim([-0.5,2.3]) 346 | temp_y = [0,0.8,1.6] 347 | y_names = ['$Fz$', '$Cz$', '$Pz$'] 348 | # y_names = ['channel {}'.format(channels)] 349 | plt.yticks(temp_y, y_names, fontsize=12) 350 | plt.xticks(fontsize=12) 351 | plt.legend(loc='upper center', fontsize=12, ncol=4) 352 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 353 | plt.tight_layout() 354 | plt.show() 355 | 356 | 357 | def plot_v_diversity(test_x, adv_x): 358 | t = np.arange(test_x.shape[3]) * 1. / 250. 359 | v = adv_x-test_x 360 | i = 0 361 | channels = 3 362 | for j in range(channels): 363 | if j == 0: 364 | plt.plot(t, v[i, 0, j, :]+j*2, 'r', label='UAP', linewidth=2) 365 | # plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Original Example', linewidth=1) 366 | else: 367 | plt.plot(t, v[i, 0, j, :]+j*2, 'r', linewidth=2) 368 | # plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', linewidth=1) 369 | plt.xlabel('time (s)', fontsize=26) 370 | plt.xticks(fontsize=24) 371 | plt.ylim([-1, 6.6]) 372 | temp_y = np.arange(channels) * 2 373 | y_names = ['ch {}'.format(int(y_id/2)) for y_id in temp_y] 374 | plt.yticks(temp_y, y_names, fontsize=26) 375 | plt.legend(loc='upper right', fontsize=26) 376 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 377 | plt.show() 378 | 379 | def plot_alone(x0, x1, title): 380 | t = np.arange(x0.shape[3]) * 1. / 250. 381 | i = 0 382 | channels = 10 383 | for j in range(channels): 384 | if j == 0: 385 | plt.plot(t, x0[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 386 | plt.plot(t, x1[i, 0, j, :]+j*4, 'g', label='Original Example', linewidth=1) 387 | else: 388 | plt.plot(t, x0[i, 0, j, :]+j*4, 'r', linewidth=1) 389 | plt.plot(t, x1[i, 0, j, :]+j*4, 'g', linewidth=1) 390 | plt.xlabel('time (s)', fontsize=12) 391 | plt.ylim([-4, 46]) 392 | temp_y = np.arange(channels) * 4 393 | y_names = ['channel {}'.format(int(y_id/4)) for y_id in temp_y] 394 | plt.yticks(temp_y, y_names, fontsize=10) 395 | plt.legend(loc='upper right', fontsize=10) 396 | plt.title(title, fontsize=15) 397 | plt.show() 398 | 399 | 400 | def plot_one_channel(x0, x1, title): 401 | t = np.arange(x0.shape[3]) * 1. / 250. 402 | i = 0 403 | channels = 1 404 | for j in range(channels): 405 | if j == 0: 406 | plt.plot(t, x0[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 407 | plt.plot(t, x1[i, 0, j, :]+j*4, 'g', label='Original Example', linewidth=1) 408 | else: 409 | plt.plot(t, x0[i, 0, j, :]+j*4, 'r', linewidth=1) 410 | plt.plot(t, x1[i, 0, j, :]+j*4, 'g', linewidth=1) 411 | plt.xlabel('time (s)', fontsize=12) 412 | # plt.ylim([-4, 46]) 413 | temp_y = np.arange(channels) * 4 414 | y_names = ['channel {}'.format(int(y_id/4)) for y_id in temp_y] 415 | # plt.yticks(temp_y, y_names, fontsize=10) 416 | plt.legend(loc='upper right', fontsize=10) 417 | plt.title(title, fontsize=15) 418 | plt.show() 419 | 420 | def plot_data_one(test_x, adv_x, data='MI'): 421 | if data == 'EPFL': 422 | t = np.arange(test_x.shape[3]) * 1. / 250. 423 | if data == 'MI4C': 424 | t = np.arange(test_x.shape[3]) * 1. / 128. 425 | if data == 'ERN': 426 | t = np.arange(test_x.shape[3]) * 1. / 200. 427 | i = 0 428 | channels = [0, 7, 9, 11, 19] 429 | for j in range(len(channels)): 430 | if j == 0: 431 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 432 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'r', label='Original Example', linewidth=1) 433 | else: 434 | plt.plot(t, adv_x[i, 0, channels[j], :]+j*4, 'r', linewidth=1) 435 | plt.plot(t, test_x[i, 0, channels[j], :]+j*4, 'r', linewidth=1) 436 | plt.xlabel('Time (s)', fontsize=14) 437 | plt.ylabel('Channel', fontsize=14) 438 | plt.ylim([-4, 23]) 439 | temp_y = np.arange(len(channels)) * 4 440 | y_names = ['$Fz$', '$C3$', '$Cz$', '$C4$', '$Pz$'] 441 | plt.yticks(temp_y, y_names, fontsize=12) 442 | plt.xticks(fontsize=12) 443 | plt.legend(loc='upper center', fontsize=12, ncol=2) 444 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 445 | plt.tight_layout() 446 | plt.show() 447 | 448 | def plot_data_choose_channel_new(test_x, adv_x, data='MI', channels=None): 449 | if data == 'EPFL': 450 | t = np.arange(test_x.shape[3]) * 1. / 250. 451 | if data == 'MI4C': 452 | t = np.arange(test_x.shape[3]) * 1. / 128. 453 | if data == 'ERN': 454 | t = np.arange(test_x.shape[3]) * 1. / 200. 455 | i = 0 456 | channels = channels 457 | for j in range(len(channels)): 458 | if j == 0: 459 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Example', linewidth=1) 460 | plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Benign Example', linewidth=1) 461 | else: 462 | plt.plot(t, adv_x[i, 0, channels[j], :]+j*4, 'r', linewidth=1) 463 | plt.plot(t, test_x[i, 0, channels[j], :]+j*4, 'g', linewidth=1) 464 | plt.xlabel('Time (s)', fontsize=14) 465 | plt.ylabel('Channel', fontsize=14) 466 | plt.ylim([-4, 23]) 467 | # temp_y = np.arange(len(channels)) * 4 468 | # y_names = ['Ch {}'.format(i) for i in channels] 469 | # plt.yticks(temp_y, y_names, fontsize=12) 470 | temp_y = np.arange(len(channels)) * 4 471 | y_names = ['$Fz$', '$C3$', '$Cz$', '$C4$', '$Pz$'] 472 | plt.yticks(temp_y, y_names, fontsize=12) 473 | plt.xticks(fontsize=12) 474 | plt.legend(loc='upper center', fontsize=12, ncol=2) 475 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 476 | plt.tight_layout() 477 | plt.show() 478 | 479 | def plot_patch(adv_x, data='MI', channels=None): 480 | if data == 'EPFL': 481 | t = np.arange(adv_x.shape[3]) * 1. / 250. 482 | if data == 'MI4C': 483 | t = np.arange(adv_x.shape[3]) * 1. / 128. 484 | if data == 'ERN': 485 | t = np.arange(adv_x.shape[3]) * 1. / 200. 486 | i = 0 487 | channels = channels 488 | for j in range(len(channels)): 489 | if j == 0: 490 | plt.plot(t, adv_x[i, 0, j, :]+j*4, 'r', label='Adversarial Patch', linewidth=1) 491 | # plt.plot(t, test_x[i, 0, j, :]+j*4, 'g', label='Benign Example', linewidth=1) 492 | else: 493 | plt.plot(t, adv_x[i, 0, channels[j], :]+j*4, 'r', linewidth=1) 494 | # plt.plot(t, test_x[i, 0, channels[j], :]+j*4, 'g', linewidth=1) 495 | plt.xlabel('Time (s)', fontsize=14) 496 | plt.ylabel('Channel', fontsize=14) 497 | plt.ylim([-4, 23]) 498 | # temp_y = np.arange(len(channels)) * 4 499 | # y_names = ['Ch {}'.format(i) for i in channels] 500 | # plt.yticks(temp_y, y_names, fontsize=12) 501 | temp_y = np.arange(len(channels)) * 4 502 | y_names = ['$Fz$', '$C3$', '$Cz$', '$C4$', '$Pz$'] 503 | plt.yticks(temp_y, y_names, fontsize=12) 504 | plt.xticks(fontsize=12) 505 | plt.legend(loc='upper center', fontsize=12, ncol=2) 506 | # plt.title('Original EEG Signal and Adversarial EEG Signal', fontsize=15) 507 | plt.tight_layout() 508 | plt.show() 509 | 510 | 511 | def UAP_target(x, y, model, model_used, model_path, save_path, noise_limit=0.2, attack_type=None, target_class=None, 512 | batch_size=None, nb_classes=None, channels=None, samples=None, regular=None): 513 | x_train, x_val, y_train, y_val = train_test_split(x, y, shuffle=True, test_size=0.2) 514 | batch_size = min(batch_size, len(x_train)) 515 | 516 | universal_noise = tf.Variable(np.zeros((x_train[0].shape)), dtype=tf.float32) 517 | temp_universal_noise = tf.expand_dims(universal_noise, 0) 518 | # print(temp_universal_noise) 519 | x_input = Input(shape=(x_train.shape[1], x_train.shape[2], x_train.shape[3])) 520 | x = Lambda(lambda xx: xx + tf.clip_by_value(temp_universal_noise, -noise_limit, noise_limit))(x_input) 521 | 522 | # Model output 523 | if model_used == 'EEGNet': 524 | prediction = old_models.EEGNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 525 | elif model_used == 'DeepConvNet': 526 | prediction = old_models.DeepConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 527 | elif model_used == 'ShallowConvNet': 528 | prediction = old_models.ShallowConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 529 | else: 530 | raise Exception('No such model:{}'.format(model_used)) 531 | 532 | # print(prediction) 533 | u_model = Model(inputs=x_input, outputs=prediction) 534 | u_model.load_weights(model_path) 535 | model.load_weights(model_path) 536 | 537 | alpha = tf.placeholder(dtype=tf.float32) 538 | al = 100 539 | if regular == 'l1': 540 | loss = alpha * (tf.reduce_mean(tf.abs(universal_noise))) 541 | al = 10 542 | elif regular == 'l2': 543 | loss = alpha * (tf.reduce_mean(tf.square(universal_noise))) 544 | al = 100 545 | elif regular == 'l1+l2': 546 | loss = alpha * (tf.reduce_mean(10*tf.square(universal_noise) + tf.abs(universal_noise))) 547 | al = 10 548 | elif regular == None: 549 | loss = 0 550 | else: 551 | raise Exception('no such loss regularization!') 552 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.abs(universal_noise))) 553 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.square(universal_noise))) 554 | # print(loss) 555 | target = tf.placeholder(dtype=tf.int32, shape=[None, ]) 556 | if attack_type == 'nontarget': 557 | # loss += K.mean(K.sparse_categorical_crossentropy(target, 1-prediction, from_logits=False)) 558 | loss += -K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 559 | elif attack_type == 'target': 560 | loss += K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 561 | else: 562 | raise Exception('no such attack_type!') 563 | 564 | start_vars = set(x.name for x in tf.global_variables()) 565 | lr_ph = tf.placeholder(shape=[], dtype=tf.float32) 566 | 567 | optimizer = tf.train.AdamOptimizer(learning_rate=lr_ph) 568 | train = optimizer.minimize(loss, var_list=[universal_noise]) 569 | 570 | end_vars = tf.global_variables() 571 | new_vars = [x for x in end_vars if x.name not in start_vars] 572 | init = tf.variables_initializer(var_list=[universal_noise] + new_vars) 573 | 574 | sess = K.get_session() 575 | sess.run(init) 576 | 577 | nb_batch = len(x_train) // batch_size 578 | 579 | 580 | end = False 581 | 582 | epochs = 500 583 | lr = 1e-3 584 | v = np.zeros((x_train[0].shape)) 585 | 586 | patience = 0 587 | patience_threshold = 10 588 | 589 | idx_list = [m for m in range(len(x_train))] 590 | 591 | # target 592 | if attack_type == 'target': 593 | y_true = np.ones(y_val.shape) * target_class 594 | stop_condition = 1 595 | acc_best = 0. 596 | else: 597 | y_true = np.copy(y_val) 598 | stop_condition = -1 599 | acc_best = 1. 600 | # stop_condition = 1 601 | # fr_best = 0. 602 | 603 | for epoch in range(epochs): 604 | idx_list = shuffle(idx_list) 605 | for i in range(nb_batch): 606 | target_idx = idx_list[i * batch_size:min((i + 1) * batch_size, len(x_train))] 607 | x_batch, y_batch = x_train[target_idx], y_train[target_idx] 608 | 609 | if attack_type == 'target': 610 | y_batch = np.ones(y_batch.shape) * target_class 611 | 612 | _, losses = sess.run( 613 | [train, loss], 614 | { 615 | u_model.inputs[0]: x_batch, 616 | alpha: al, lr_ph: lr, 617 | target: y_batch, 618 | # K.learning_phase(): 0 619 | } 620 | ) 621 | 622 | if (i + epoch * nb_batch) % 100 == 0: 623 | # if i % 1 == 0: 624 | pred = np.argmax(u_model.predict(x_val), -1) 625 | y_pred = pred.squeeze() 626 | acc = np.sum(np.where(y_pred == y_true, 1, 0)).astype(np.float64) / len(y_pred) 627 | norm = np.mean(np.square(sess.run(universal_noise))) 628 | if attack_type == 'target': 629 | print('epoch:{}/{}, batch:{}/{}, acc:{}, norm:{}'.format(epoch + 1, epochs, i + 1, nb_batch, 630 | acc, norm)) 631 | else: 632 | raw_pred = np.argmax(model.predict(x_val), -1).squeeze() 633 | fooling_rate = np.sum(np.where(y_pred != raw_pred, 1, 0)).astype(np.float64) / len(y_pred) 634 | print('epoch:{}/{}, batch:{}/{}, acc:{}, fooling rate:{}, norm:{}, loss:{}'.format(epoch + 1, 635 | epochs, i + 1, nb_batch, acc, fooling_rate, norm, losses)) 636 | 637 | # if acc > threshold_acc and norm > threshold_norm: 638 | # a = 5e2 639 | if stop_condition * acc > stop_condition * acc_best: 640 | patience = 0 641 | acc_best = acc 642 | v = K.eval(universal_noise) 643 | if save_path == None: 644 | print('update v! but not save.') 645 | else: 646 | print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 647 | # np.savez(noise_filename, v=un_no) 648 | np.savez(save_path, v=v) 649 | else: 650 | patience += 1 651 | 652 | if patience == patience_threshold: 653 | end = True 654 | break 655 | 656 | if end: 657 | break 658 | return v 659 | 660 | def UAP_target_pre(x, model, model_used, model_path, save_path, noise_limit=0.2, attack_type=None, target_class=None, 661 | batch_size=None, nb_classes=None, channels=None, samples=None, regular=None): 662 | # x_train, x_val, y_train, y_val = train_test_split(x, y, shuffle=True, test_size=0.2) 663 | x_train, x_val = train_test_split(x, shuffle=True, test_size=0.2) 664 | batch_size = min(batch_size, len(x_train)) 665 | 666 | universal_noise = tf.Variable(np.zeros((x_train[0].shape)), dtype=tf.float32) 667 | temp_universal_noise = tf.expand_dims(universal_noise, 0) 668 | # print(temp_universal_noise) 669 | x_input = Input(shape=(x_train.shape[1], x_train.shape[2], x_train.shape[3])) 670 | x = Lambda(lambda xx: xx + tf.clip_by_value(temp_universal_noise, -noise_limit, noise_limit))(x_input) 671 | 672 | # Model output 673 | if model_used == 'EEGNet': 674 | prediction = old_models.EEGNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 675 | elif model_used == 'DeepConvNet': 676 | prediction = old_models.DeepConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 677 | elif model_used == 'ShallowConvNet': 678 | prediction = old_models.ShallowConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 679 | else: 680 | raise Exception('No such model:{}'.format(model_used)) 681 | 682 | # print(prediction) 683 | u_model = Model(inputs=x_input, outputs=prediction) 684 | u_model.load_weights(model_path) 685 | model.load_weights(model_path) 686 | 687 | y_train = np.argmax(model.predict(x_train, batch_size=batch_size), axis=1).flatten() 688 | y_val = np.argmax(model.predict(x_val, batch_size=batch_size), axis=1).flatten() 689 | 690 | 691 | alpha = tf.placeholder(dtype=tf.float32) 692 | al = 100 693 | if regular == 'l1': 694 | loss = alpha * (tf.reduce_mean(tf.abs(universal_noise))) 695 | al = 5 696 | elif regular == 'l2': 697 | loss = alpha * (tf.reduce_mean(tf.square(universal_noise))) 698 | al = 100 699 | elif regular == 'l1+l2': 700 | loss = alpha * (tf.reduce_mean(10*tf.square(universal_noise) + 0.1*tf.abs(universal_noise))) 701 | al = 10 702 | elif regular == None: 703 | loss = 0 704 | else: 705 | raise Exception('no such loss regularization!') 706 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.abs(universal_noise))) 707 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.square(universal_noise))) 708 | # print(loss) 709 | target = tf.placeholder(dtype=tf.int32, shape=[None, ]) 710 | if attack_type == 'nontarget': 711 | # loss += K.mean(K.sparse_categorical_crossentropy(target, 1-prediction, from_logits=False)) 712 | loss += -K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 713 | elif attack_type == 'target': 714 | loss += K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 715 | else: 716 | raise Exception('no such attack_type!') 717 | 718 | start_vars = set(x.name for x in tf.global_variables()) 719 | lr_ph = tf.placeholder(shape=[], dtype=tf.float32) 720 | 721 | optimizer = tf.train.AdamOptimizer(learning_rate=lr_ph) 722 | train = optimizer.minimize(loss, var_list=[universal_noise]) 723 | 724 | end_vars = tf.global_variables() 725 | new_vars = [x for x in end_vars if x.name not in start_vars] 726 | init = tf.variables_initializer(var_list=[universal_noise] + new_vars) 727 | 728 | sess = K.get_session() 729 | sess.run(init) 730 | 731 | nb_batch = len(x_train) // batch_size 732 | 733 | 734 | end = False 735 | 736 | epochs = 500 737 | lr = 1e-3 738 | v = np.zeros((x_train[0].shape)) 739 | 740 | patience = 0 741 | patience_threshold = 10 742 | 743 | idx_list = [m for m in range(len(x_train))] 744 | 745 | # target 746 | if attack_type == 'target': 747 | y_true = np.ones(y_val.shape) * target_class 748 | stop_condition = 1 749 | acc_best = 0. 750 | else: 751 | y_true = np.copy(y_val) 752 | stop_condition = -1 753 | acc_best = 1. 754 | # stop_condition = 1 755 | # fr_best = 0. 756 | 757 | for epoch in range(epochs): 758 | idx_list = shuffle(idx_list) 759 | for i in range(nb_batch): 760 | target_idx = idx_list[i * batch_size:min((i + 1) * batch_size, len(x_train))] 761 | x_batch, y_batch = x_train[target_idx], y_train[target_idx] 762 | 763 | if attack_type == 'target': 764 | y_batch = np.ones(y_batch.shape) * target_class 765 | 766 | _, losses = sess.run( 767 | [train, loss], 768 | { 769 | u_model.inputs[0]: x_batch, 770 | alpha: al, lr_ph: lr, 771 | target: y_batch, 772 | # K.learning_phase(): 0 773 | } 774 | ) 775 | 776 | if (i + epoch * nb_batch) % 100 == 0: 777 | # if i % 1 == 0: 778 | pred = np.argmax(u_model.predict(x_val), -1) 779 | y_pred = pred.squeeze() 780 | acc = np.sum(np.where(y_pred == y_true, 1, 0)).astype(np.float64) / len(y_pred) 781 | norm = np.mean(np.square(sess.run(universal_noise))) 782 | if attack_type == 'target': 783 | print('epoch:{}/{}, batch:{}/{}, acc:{}, norm:{}'.format(epoch + 1, epochs, i + 1, nb_batch, 784 | acc, norm)) 785 | else: 786 | raw_pred = np.argmax(model.predict(x_val), -1).squeeze() 787 | fooling_rate = np.sum(np.where(y_pred != raw_pred, 1, 0)).astype(np.float64) / len(y_pred) 788 | print('epoch:{}/{}, batch:{}/{}, acc:{}, fooling rate:{}, norm:{}, loss:{}'.format(epoch + 1, 789 | epochs, i + 1, nb_batch, acc, fooling_rate, norm, losses)) 790 | 791 | # if acc > threshold_acc and norm > threshold_norm: 792 | # a = 5e2 793 | if stop_condition * acc > stop_condition * acc_best: 794 | patience = 0 795 | acc_best = acc 796 | v = K.eval(universal_noise) 797 | if save_path == None: 798 | print('update v! but not save.') 799 | else: 800 | print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 801 | # np.savez(noise_filename, v=un_no) 802 | np.savez(save_path, v=v) 803 | else: 804 | patience += 1 805 | if acc == 1: 806 | print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 807 | np.savez(save_path, v=v) 808 | 809 | if patience == patience_threshold: 810 | end = True 811 | break 812 | 813 | if end: 814 | break 815 | return v 816 | 817 | 818 | 819 | def Adv_patch_target(x, model, model_used, model_path, save_path, patch_save_path, patch_size=None, patch_scale=(0.5, 0.5), noise_limit=0.2, attack_type=None, target_class=None, 820 | batch_size=None, nb_classes=None, channels=None, samples=None, regular=None, val_num=30): 821 | # x_train, x_val, y_train, y_val = train_test_split(x, y, shuffle=True, test_size=0.2) 822 | x_train, x_val = train_test_split(x, shuffle=True, test_size=0.2) 823 | batch_size = min(batch_size, len(x_train)) 824 | width = x_train[0].shape[1] 825 | height = x_train[0].shape[2] 826 | if patch_size == None: 827 | patch_w = int(width * patch_scale[0]) 828 | patch_h = int(height * patch_scale[1]) 829 | patch_shape = (1, patch_w, patch_h) 830 | patch_noise = tf.Variable(np.zeros(patch_shape), dtype=tf.float32) 831 | 832 | if patch_scale[0] == 1.0: 833 | random_h = tf.random.uniform(shape=(1,), maxval=height - patch_h, dtype=tf.int32) 834 | universal_noise = tf.pad(patch_noise, [[0,0], [0,0], tf.concat([random_h,tf.constant(height, dtype=tf.int32) - random_h - tf.constant(patch_h, dtype=tf.int32)],0)], "CONSTANT") 835 | else: 836 | random_w = tf.random.uniform(shape=(1,), maxval=width - patch_w, dtype=tf.int32) 837 | random_h = tf.random.uniform(shape=(1,), maxval=height - patch_h, dtype=tf.int32) 838 | # universal_noise = tf.pad(patch_noise, [[0, 0], [random_w, tf.constant(width, dtype=tf.int32) - random_w - tf.constant(patch_w, dtype=tf.int32)], 839 | # [random_h, tf.constant(height, dtype=tf.int32) - random_h - tf.constant(patch_h, dtype=tf.int32)]], "CONSTANT") 840 | universal_noise = tf.pad(patch_noise, [[0,0],tf.concat([random_w, tf.constant(width, dtype=tf.int32) - random_w - tf.constant(patch_w, dtype=tf.int32)],0), 841 | tf.concat([random_h,tf.constant(height, dtype=tf.int32) - random_h - tf.constant(patch_h, dtype=tf.int32)],0)], "CONSTANT") 842 | else: 843 | patch_w = int(patch_size[0]) 844 | patch_h = int(patch_size[1]) 845 | patch_shape = (1, patch_w, patch_h) 846 | patch_noise = tf.Variable(np.zeros(patch_shape), dtype=tf.float32) 847 | 848 | if patch_size[0] == width: 849 | random_h = tf.random.uniform(shape=(1,), maxval=height - patch_h, dtype=tf.int32) 850 | universal_noise = tf.pad(patch_noise, [[0, 0], [0, 0], tf.concat( 851 | [random_h, tf.constant(height, dtype=tf.int32) - random_h - tf.constant(patch_h, dtype=tf.int32)], 0)], 852 | "CONSTANT") 853 | else: 854 | random_w = tf.random.uniform(shape=(1,), maxval=width - patch_w, dtype=tf.int32) 855 | random_h = tf.random.uniform(shape=(1,), maxval=height - patch_h, dtype=tf.int32) 856 | # universal_noise = tf.pad(patch_noise, [[0, 0], [random_w, tf.constant(width, dtype=tf.int32) - random_w - tf.constant(patch_w, dtype=tf.int32)], 857 | # [random_h, tf.constant(height, dtype=tf.int32) - random_h - tf.constant(patch_h, dtype=tf.int32)]], "CONSTANT") 858 | universal_noise = tf.pad(patch_noise, [[0, 0], tf.concat( 859 | [random_w, tf.constant(width, dtype=tf.int32) - random_w - tf.constant(patch_w, dtype=tf.int32)], 0), 860 | tf.concat([random_h, tf.constant(height, 861 | dtype=tf.int32) - random_h - tf.constant( 862 | patch_h, dtype=tf.int32)], 0)], "CONSTANT") 863 | 864 | # print(universal_noise) 865 | # universal_noise = tf.Variable(np.zeros((x_train[0].shape)), dtype=tf.float32) 866 | temp_universal_noise = tf.expand_dims(universal_noise, 0) 867 | # print(temp_universal_noise) 868 | x_input = Input(shape=(x_train.shape[1], x_train.shape[2], x_train.shape[3])) 869 | if noise_limit == None: 870 | x = Lambda(lambda xx: xx + temp_universal_noise)(x_input) 871 | else: 872 | x = Lambda(lambda xx: xx + tf.clip_by_value(temp_universal_noise, -noise_limit, noise_limit))(x_input) 873 | # Model output 874 | if model_used == 'EEGNet': 875 | prediction = old_models.EEGNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 876 | elif model_used == 'DeepConvNet': 877 | prediction = old_models.DeepConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 878 | elif model_used == 'ShallowConvNet': 879 | prediction = old_models.ShallowConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 880 | else: 881 | raise Exception('No such model:{}'.format(model_used)) 882 | 883 | # print(prediction) 884 | u_model = Model(inputs=x_input, outputs=prediction) 885 | u_model.load_weights(model_path) 886 | model.load_weights(model_path) 887 | 888 | y_train = np.argmax(model.predict(x_train, batch_size=batch_size), axis=1).flatten() 889 | y_val = np.argmax(model.predict(x_val, batch_size=batch_size), axis=1).flatten() 890 | 891 | 892 | alpha = tf.placeholder(dtype=tf.float32) 893 | al = 100 894 | if regular == 'l1': 895 | loss = alpha * (tf.reduce_mean(tf.abs(patch_noise))) 896 | al = 5 897 | elif regular == 'l2': 898 | loss = alpha * (tf.reduce_mean(tf.square(patch_noise))) 899 | al = 100 900 | elif regular == 'l1+l2': 901 | loss = alpha * (tf.reduce_mean(10*tf.square(patch_noise) + 0.1*tf.abs(patch_noise))) 902 | al = 10 903 | elif regular == None: 904 | loss = 0 905 | else: 906 | raise Exception('no such loss regularization!') 907 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.abs(universal_noise))) 908 | # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.square(universal_noise))) 909 | # print(loss) 910 | target = tf.placeholder(dtype=tf.int32, shape=[None, ]) 911 | if attack_type == 'nontarget': 912 | # loss += K.mean(K.sparse_categorical_crossentropy(target, 1-prediction, from_logits=False)) 913 | loss += -K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 914 | elif attack_type == 'target': 915 | loss += K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 916 | else: 917 | raise Exception('no such attack_type!') 918 | 919 | start_vars = set(x.name for x in tf.global_variables()) 920 | lr_ph = tf.placeholder(shape=[], dtype=tf.float32) 921 | 922 | optimizer = tf.train.AdamOptimizer(learning_rate=lr_ph) 923 | train = optimizer.minimize(loss, var_list=[patch_noise]) 924 | 925 | end_vars = tf.global_variables() 926 | new_vars = [x for x in end_vars if x.name not in start_vars] 927 | init = tf.variables_initializer(var_list=[patch_noise] + new_vars) 928 | 929 | sess = K.get_session() 930 | sess.run(init) 931 | 932 | nb_batch = len(x_train) // batch_size 933 | 934 | 935 | end = False 936 | 937 | epochs = 1000 938 | lr = 1e-2 939 | v = np.zeros((x_train[0].shape)) 940 | 941 | patience = 0 942 | patience_threshold = 5 943 | 944 | idx_list = [m for m in range(len(x_train))] 945 | 946 | # target 947 | if attack_type == 'target': 948 | y_true = np.ones(y_val.shape) * target_class 949 | stop_condition = 1 950 | acc_best = 0. 951 | else: 952 | y_true = np.copy(y_val) 953 | stop_condition = -1 954 | acc_best = 1. 955 | # stop_condition = 1 956 | # fr_best = 0. 957 | 958 | for epoch in range(epochs): 959 | idx_list = shuffle(idx_list) 960 | for i in range(nb_batch): 961 | target_idx = idx_list[i * batch_size:min((i + 1) * batch_size, len(x_train))] 962 | x_batch, y_batch = x_train[target_idx], y_train[target_idx] 963 | 964 | if attack_type == 'target': 965 | y_batch = np.ones(y_batch.shape) * target_class 966 | 967 | _, losses = sess.run( 968 | [train, loss], 969 | { 970 | u_model.inputs[0]: x_batch, 971 | alpha: al, lr_ph: lr, 972 | target: y_batch, 973 | # K.learning_phase(): 0 974 | } 975 | ) 976 | 977 | if (i + epoch * nb_batch) % 100 == 0: 978 | # if i % 1 == 0: 979 | # pred = np.argmax(u_model.predict(x_val), -1) 980 | # y_pred = pred.squeeze() 981 | # acc = np.sum(np.where(y_pred == y_true, 1, 0)).astype(np.float64) / len(y_pred) 982 | # norm = np.mean(np.square(sess.run(universal_noise))) 983 | acc_list = [] 984 | for val_ite in range(val_num): 985 | pred = np.argmax(u_model.predict(x_val), -1) 986 | y_pred = pred.squeeze() 987 | acc_i = np.sum(np.where(y_pred == y_true, 1, 0)).astype(np.float64) / len(y_pred) 988 | acc_list.append(acc_i) 989 | acc = np.mean(acc_list) 990 | norm = np.mean(np.square(sess.run(universal_noise))) 991 | if attack_type == 'target': 992 | print('epoch:{}/{}, batch:{}/{}, target rate:{}, norm:{}'.format(epoch + 1, epochs, i + 1, nb_batch, 993 | acc, norm)) 994 | else: 995 | raw_pred = np.argmax(model.predict(x_val), -1).squeeze() 996 | fooling_rate = np.sum(np.where(y_pred != raw_pred, 1, 0)).astype(np.float64) / len(y_pred) 997 | print('epoch:{}/{}, batch:{}/{}, acc:{}, fooling rate:{}, norm:{}, loss:{}'.format(epoch + 1, 998 | epochs, i + 1, nb_batch, acc, fooling_rate, norm, losses)) 999 | 1000 | # if acc > threshold_acc and norm > threshold_norm: 1001 | # a = 5e2 1002 | if stop_condition * acc > stop_condition * acc_best: 1003 | patience = 0 1004 | acc_best = acc 1005 | v = K.eval(universal_noise) 1006 | patch_v = K.eval(patch_noise) 1007 | if save_path == None: 1008 | print('update v! but not save.') 1009 | else: 1010 | print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 1011 | # np.savez(noise_filename, v=un_no) 1012 | np.savez(save_path, v=v) 1013 | np.savez(patch_save_path, patch_v=patch_v) 1014 | else: 1015 | patience += 1 1016 | if acc == 1: 1017 | print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 1018 | np.savez(save_path, v=v) 1019 | np.savez(patch_save_path, patch_v=patch_v) 1020 | 1021 | if patience == patience_threshold: 1022 | end = True 1023 | break 1024 | 1025 | if end: 1026 | break 1027 | return v 1028 | 1029 | 1030 | 1031 | # def Adv_patch_target(x, model, model_used, model_path, save_path, patch_save_path, patch_scale=0.5, noise_limit=None, attack_type=None, target_class=None, 1032 | # batch_size=None, nb_classes=None, channels=None, samples=None, regular=None): 1033 | # # x_train, x_val, y_train, y_val = train_test_split(x, y, shuffle=True, test_size=0.2) 1034 | # x_train, x_val = train_test_split(x, shuffle=True, test_size=0.2) 1035 | # batch_size = min(batch_size, len(x_train)) 1036 | # width = x_train[0].shape[1] 1037 | # height = x_train[0].shape[2] 1038 | # patch_w = int(width * patch_scale) 1039 | # patch_h = int(height * patch_scale) 1040 | # patch_shape = (1, patch_w, patch_h) 1041 | # patch_noise = tf.Variable(np.zeros(patch_shape), dtype=tf.float32) 1042 | # 1043 | # random_w = tf.random.uniform(shape=(batch_size,), maxval=width - patch_w, dtype=tf.int32) 1044 | # random_h = tf.random.uniform(shape=(batch_size,), maxval=height - patch_h, dtype=tf.int32) 1045 | # universal_noise = tf.pad(patch_noise, [[0, 0], [random_w, width - random_w - patch_w], [random_h, height - random_h - patch_h]], "CONSTANT") 1046 | # # print(universal_noise) 1047 | # # universal_noise = tf.Variable(np.zeros((x_train[0].shape)), dtype=tf.float32) 1048 | # temp_universal_noise = tf.expand_dims(universal_noise, 0) 1049 | # # print(temp_universal_noise) 1050 | # x_input = Input(shape=(x_train.shape[1], x_train.shape[2], x_train.shape[3])) 1051 | # if noise_limit == None: 1052 | # x = Lambda(lambda xx: xx + temp_universal_noise)(x_input) 1053 | # else: 1054 | # x = Lambda(lambda xx: xx + tf.clip_by_value(temp_universal_noise, -noise_limit, noise_limit))(x_input) 1055 | # # Model output 1056 | # if model_used == 'EEGNet': 1057 | # prediction = old_models.EEGNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 1058 | # elif model_used == 'DeepConvNet': 1059 | # prediction = old_models.DeepConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 1060 | # elif model_used == 'ShallowConvNet': 1061 | # prediction = old_models.ShallowConvNet_output(nb_classes=nb_classes, Chans=channels, Samples=samples, x_input=x) 1062 | # else: 1063 | # raise Exception('No such model:{}'.format(model_used)) 1064 | # 1065 | # # print(prediction) 1066 | # u_model = Model(inputs=x_input, outputs=prediction) 1067 | # u_model.load_weights(model_path) 1068 | # model.load_weights(model_path) 1069 | # 1070 | # y_train = np.argmax(model.predict(x_train, batch_size=batch_size), axis=1).flatten() 1071 | # y_val = np.argmax(model.predict(x_val, batch_size=batch_size), axis=1).flatten() 1072 | # 1073 | # 1074 | # alpha = tf.placeholder(dtype=tf.float32) 1075 | # al = 100 1076 | # if regular == 'l1': 1077 | # loss = alpha * (tf.reduce_mean(tf.abs(patch_noise))) 1078 | # al = 5 1079 | # elif regular == 'l2': 1080 | # loss = alpha * (tf.reduce_mean(tf.square(patch_noise))) 1081 | # al = 100 1082 | # elif regular == 'l1+l2': 1083 | # loss = alpha * (tf.reduce_mean(10*tf.square(patch_noise) + 0.1*tf.abs(patch_noise))) 1084 | # al = 10 1085 | # elif regular == None: 1086 | # loss = 0 1087 | # else: 1088 | # raise Exception('no such loss regularization!') 1089 | # # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.abs(universal_noise))) 1090 | # # loss = alpha * (tf.reduce_mean(tf.square(universal_noise) + tf.square(universal_noise))) 1091 | # # print(loss) 1092 | # target = tf.placeholder(dtype=tf.int32, shape=[None, ]) 1093 | # if attack_type == 'nontarget': 1094 | # # loss += K.mean(K.sparse_categorical_crossentropy(target, 1-prediction, from_logits=False)) 1095 | # loss += -K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 1096 | # elif attack_type == 'target': 1097 | # loss += K.mean(K.sparse_categorical_crossentropy(target, prediction, from_logits=False)) 1098 | # else: 1099 | # raise Exception('no such attack_type!') 1100 | # 1101 | # start_vars = set(x.name for x in tf.global_variables()) 1102 | # lr_ph = tf.placeholder(shape=[], dtype=tf.float32) 1103 | # 1104 | # optimizer = tf.train.AdamOptimizer(learning_rate=lr_ph) 1105 | # train = optimizer.minimize(loss, var_list=[patch_noise]) 1106 | # 1107 | # end_vars = tf.global_variables() 1108 | # new_vars = [x for x in end_vars if x.name not in start_vars] 1109 | # init = tf.variables_initializer(var_list=[patch_noise] + new_vars) 1110 | # 1111 | # sess = K.get_session() 1112 | # sess.run(init) 1113 | # 1114 | # nb_batch = len(x_train) // batch_size 1115 | # 1116 | # 1117 | # end = False 1118 | # 1119 | # epochs = 500 1120 | # lr = 1e-1 1121 | # v = np.zeros((x_train[0].shape)) 1122 | # 1123 | # patience = 0 1124 | # patience_threshold = 10 1125 | # 1126 | # idx_list = [m for m in range(len(x_train))] 1127 | # 1128 | # # target 1129 | # if attack_type == 'target': 1130 | # y_true = np.ones(y_val.shape) * target_class 1131 | # stop_condition = 1 1132 | # acc_best = 0. 1133 | # else: 1134 | # y_true = np.copy(y_val) 1135 | # stop_condition = -1 1136 | # acc_best = 1. 1137 | # # stop_condition = 1 1138 | # # fr_best = 0. 1139 | # 1140 | # for epoch in range(epochs): 1141 | # idx_list = shuffle(idx_list) 1142 | # for i in range(nb_batch): 1143 | # target_idx = idx_list[i * batch_size:min((i + 1) * batch_size, len(x_train))] 1144 | # x_batch, y_batch = x_train[target_idx], y_train[target_idx] 1145 | # 1146 | # if attack_type == 'target': 1147 | # y_batch = np.ones(y_batch.shape) * target_class 1148 | # 1149 | # _, losses = sess.run( 1150 | # [train, loss], 1151 | # { 1152 | # u_model.inputs[0]: x_batch, 1153 | # alpha: al, lr_ph: lr, 1154 | # target: y_batch, 1155 | # # K.learning_phase(): 0 1156 | # } 1157 | # ) 1158 | # 1159 | # if (i + epoch * nb_batch) % 100 == 0: 1160 | # # if i % 1 == 0: 1161 | # pred = np.argmax(u_model.predict(x_val), -1) 1162 | # y_pred = pred.squeeze() 1163 | # acc = np.sum(np.where(y_pred == y_true, 1, 0)).astype(np.float64) / len(y_pred) 1164 | # norm = np.mean(np.square(sess.run(universal_noise))) 1165 | # if attack_type == 'target': 1166 | # print('epoch:{}/{}, batch:{}/{}, target rate:{}, norm:{}'.format(epoch + 1, epochs, i + 1, nb_batch, 1167 | # acc, norm)) 1168 | # else: 1169 | # raw_pred = np.argmax(model.predict(x_val), -1).squeeze() 1170 | # fooling_rate = np.sum(np.where(y_pred != raw_pred, 1, 0)).astype(np.float64) / len(y_pred) 1171 | # print('epoch:{}/{}, batch:{}/{}, acc:{}, fooling rate:{}, norm:{}, loss:{}'.format(epoch + 1, 1172 | # epochs, i + 1, nb_batch, acc, fooling_rate, norm, losses)) 1173 | # 1174 | # # if acc > threshold_acc and norm > threshold_norm: 1175 | # # a = 5e2 1176 | # if stop_condition * acc > stop_condition * acc_best: 1177 | # patience = 0 1178 | # acc_best = acc 1179 | # v = K.eval(universal_noise) 1180 | # patch_v = K.eval(patch_noise) 1181 | # if save_path == None: 1182 | # print('update v! but not save.') 1183 | # else: 1184 | # print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 1185 | # # np.savez(noise_filename, v=un_no) 1186 | # np.savez(save_path, v=v) 1187 | # np.savez(patch_save_path, patch_v=patch_v) 1188 | # else: 1189 | # patience += 1 1190 | # if acc == 1: 1191 | # print('best acc:{}, now saving adversarial patch to {}.'.format(acc_best, save_path)) 1192 | # np.savez(save_path, v=v) 1193 | # np.savez(patch_save_path, patch_v=patch_v) 1194 | # 1195 | # if patience == patience_threshold: 1196 | # end = True 1197 | # break 1198 | # 1199 | # if end: 1200 | # break 1201 | # return v 1202 | 1203 | 1204 | --------------------------------------------------------------------------------