├── LICENSE ├── README.md ├── attack_example.png ├── attack_example_no_dimred.png ├── genattack_tf2.py ├── imagenet_classes.txt ├── images └── 336.00049024.jpg ├── main.py ├── requirements.txt ├── setup_cifar.py ├── setup_inception.py ├── setup_mnist.py ├── train_models.py └── utils.py /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2018 UCLA Networked & Embedded Systems Laboratory 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # GenAttack: Practical Black-box Attacks with Gradient-Free Optimization. 2 | 3 | This repo has an implemntation for our paper [GenAttack: Practical Black-box Attacks with Gradient-Free Optimization](https://arxiv.org/abs/1805.11090) 4 | 5 | ## Instructions 6 | 7 | ### Setup 8 | 9 | Install the required libraries: 10 | ``` 11 | pip install -r requirements.txt 12 | ``` 13 | ### ImageNet Experiment 14 | Download `Inception-v3` model checkpoint 15 | 16 | ``` 17 | python setup_inception.py 18 | ``` 19 | 20 | You can download test images from [ImageNet test set](http://jaina.cs.ucdavis.edu/datasets/adv/imagenet/img.tar.gz). 21 | 22 | To run the attack without dimensionality reduction and adaptive parameter scaling 23 | ``` 24 | python main.py --input_dir=./images/ --test_size=1 \ 25 | --eps=0.05 --alpha=0.15 --mutation_rate=0.005 \ 26 | --max_steps=500000 --output_dir=attack_outputs \ 27 | --pop_size=6 --target=704 --adaptive=False 28 | ``` 29 | 30 | ![Attack example with no dimensionality reduction](attack_example_no_dimred.png) 31 | **Original class:** Squirrl, **Adversarial class**: Parking Meter, **Number of queries**=74,171 32 | 33 | 34 | **For more query efficiency** 35 | 36 | Run attack with dimensionality reduction and adaptive parameter scaling 37 | 38 | ``` 39 | python main.py --input_dir=./images/ --test_size=1 \ 40 | --eps=0.05 --alpha=0.15 --mutation_rate=0.10 \ 41 | --max_steps=100000 --output_dir=attack_outputs \ 42 | --pop_size=6 --target=704 --adaptive=True --resize_dim=96 43 | ``` 44 | 45 | ![Attack example](attack_example.png) 46 | **Original class:** Squirrl, **Adversarial class**: Parking Meter, **Number of queries**=11,696 47 | 48 | 49 | **More options**: 50 | * If you want to test on a single image, add the FLAG: `--test_example=xx`. 51 | * To specify a target class, instead of using a random target, add the flag `--target=xx`. 52 | 53 | --- 54 | ### MNIST and CIFAR-10 Experiments 55 | 56 | First, you need to train the classification models on MNIST and CIFAR-10 datasets. 57 | 58 | ``` 59 | python train_models.py 60 | ``` 61 | 62 | ### Attacking MNIST Model 63 | 64 | ``` 65 | python main.py --model=mnist --test_size=1000 --mutation_rate=0.30 --alpha=0.5 --adaptive=False --max_steps=10000 --eps=0.30 --output_dir=mnist_output --pop_size=4 --temp=0.1 66 | ``` 67 | 68 | ### Attacking CIFAR-10 Model: 69 | 70 | ``` 71 | python main.py --model=cifar10 --test_size=1000 --mutation_rate=0.05 --alpha=0.25 --adaptive=False --max_steps=10000 --eps=0.05 --output_dir=cifar10_output --pop_size=4 --temp=0.1 72 | ``` 73 | 74 | ## Maintainer: 75 | * This project is maintained by: Moustafa Alzantot [(malzantot)](https://github.com/malzantot) 76 | 77 | -------------------------------------------------------------------------------- /attack_example.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nesl/adversarial_genattack/2304cdc2a49d2c16b9f43821ad8a29d664f334d1/attack_example.png -------------------------------------------------------------------------------- /attack_example_no_dimred.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nesl/adversarial_genattack/2304cdc2a49d2c16b9f43821ad8a29d664f334d1/attack_example_no_dimred.png -------------------------------------------------------------------------------- /genattack_tf2.py: -------------------------------------------------------------------------------- 1 | """ 2 | Author: Moustafa Alzantot (malzantot@ucla.edu) 3 | """ 4 | import time 5 | import random 6 | import numpy as np 7 | import tensorflow as tf 8 | from setup_inception import ImageNet, InceptionModel 9 | 10 | 11 | class GenAttack2(object): 12 | def mutation_op(self, cur_pop, idx, step_noise=0.01, p=0.005): 13 | perturb_noise = tf.random_uniform(cur_pop.get_shape(), 14 | minval=-step_noise, maxval=step_noise, dtype=tf.float32) 15 | mutated_pop = perturb_noise * \ 16 | tf.cast(tf.random_uniform(cur_pop.get_shape()) 17 | < p, tf.float32) + cur_pop 18 | return mutated_pop 19 | 20 | def attack_step(self, idx, success, orig_copies, cur_noise, prev_elite, margin_log, best_win_margin, cur_plateau_count, num_plateaus): 21 | if self.resize_dim: 22 | noise_resized = tf.image.resize_bilinear( 23 | cur_noise, (self.image_dim, self.image_dim)) 24 | else: 25 | noise_resized = cur_noise 26 | noise_dim = self.resize_dim or self.image_dim 27 | cur_pop = tf.clip_by_value( 28 | noise_resized + orig_copies, self.box_min, self.box_max) 29 | pop_preds = self.model.predict(cur_pop) 30 | all_preds = tf.argmax(pop_preds, axis=1) 31 | 32 | success_pop = tf.cast(tf.equal(all_preds, self.target), tf.int32) 33 | success = tf.reduce_max(success_pop, axis=0) 34 | 35 | target_scores = tf.reduce_sum(self.tlab * pop_preds, axis=1) 36 | sum_others = tf.reduce_sum((1-self.tlab) * pop_preds, axis=1) 37 | max_others = tf.reduce_max((1-self.tlab) * pop_preds, axis=1) 38 | 39 | # the goal is to maximize this loss 40 | loss = -(tf.log(sum_others+1e-30) - tf.log(target_scores+1e-30)) 41 | 42 | win_margin = tf.reduce_max( 43 | pop_preds[:, self.target] - tf.reduce_max(pop_preds, axis=1)) 44 | 45 | new_best_win_margin, new_cur_plateau_count = tf.cond( 46 | tf.greater(win_margin, best_win_margin), 47 | false_fn=lambda: (best_win_margin, cur_plateau_count+1), 48 | true_fn=lambda: (win_margin, 0) 49 | ) 50 | plateau_threshold = tf.cond(tf.greater(win_margin, -0.40), 51 | true_fn=lambda: 100, 52 | false_fn=lambda: 300) 53 | new_num_plateaus, new_cur_plateau_count = tf.cond( 54 | tf.greater(new_cur_plateau_count, plateau_threshold), 55 | true_fn=lambda: (num_plateaus+1, 0), 56 | false_fn=lambda: (num_plateaus, new_cur_plateau_count) 57 | ) 58 | 59 | if self.adaptive: 60 | step_noise = tf.maximum(self.alpha, 61 | 0.4*tf.pow(0.9, tf.cast(new_num_plateaus, tf.float32))) 62 | step_p = tf.cond(tf.less(idx, 10), 63 | true_fn=lambda: 1.0, 64 | false_fn=lambda: tf.maximum(self.mutation_rate, 0.5*tf.pow(0.90, tf.cast(new_num_plateaus, tf.float32)))) 65 | else: 66 | step_noise = self.alpha 67 | step_p = self.mutation_rate 68 | 69 | step_temp = self.temp 70 | 71 | elite_idx = tf.cond( 72 | tf.equal(success, 1), 73 | true_fn=lambda: tf.expand_dims( 74 | tf.cast(tf.argmax(success_pop), tf.int32), axis=0), 75 | false_fn=lambda: tf.expand_dims(tf.cast(tf.argmax(loss, axis=0), tf.int32), axis=0)) 76 | 77 | elite = tf.gather(cur_noise, elite_idx) 78 | select_probs = tf.nn.softmax(tf.squeeze(loss) / step_temp) 79 | parents = tf.distributions.Categorical( 80 | probs=select_probs).sample(2*self.pop_size-2) 81 | parent1 = tf.gather(cur_noise, parents[:self.pop_size-1]) 82 | parent2 = tf.gather(cur_noise, parents[self.pop_size-1:]) 83 | pp1 = tf.gather(select_probs, parents[:self.pop_size-1]) 84 | pp2 = tf.gather(select_probs, parents[self.pop_size-1:]) 85 | pp2 = pp2 / (pp1+pp2) 86 | pp2 = tf.tile(tf.expand_dims(tf.expand_dims( 87 | tf.expand_dims(pp2, 1), 2), self.image_channels), (1, noise_dim, noise_dim, self.image_channels)) 88 | xover_prop = tf.cast(tf.random_uniform( 89 | shape=parent1.get_shape()) > pp2, tf.float32) 90 | childs = parent1 * xover_prop + parent2 * (1-xover_prop) 91 | idx = tf.Print(idx+1, [idx, tf.reduce_min(loss), 92 | win_margin, step_p, step_noise, new_cur_plateau_count]) 93 | margin_log = tf.concat([margin_log, [[win_margin]]], axis=0) 94 | mutated_childs = self.mutation_op( 95 | childs, idx=idx, step_noise=self.eps*step_noise, p=step_p) 96 | new_pop = tf.concat((mutated_childs, elite), axis=0) 97 | return idx, success, orig_copies, new_pop, tf.reshape(elite, (noise_dim, noise_dim, self.image_channels)), margin_log, new_best_win_margin, new_cur_plateau_count, new_num_plateaus 98 | 99 | def __init__(self, model, pop_size=6, mutation_rate=0.001, 100 | eps=0.15, max_steps=10000, alpha=0.20, 101 | image_dim=299, 102 | image_channels=3, 103 | num_labels=1001, 104 | temp=0.3, 105 | resize_dim=None, adaptive=False): 106 | self.eps = eps 107 | self.pop_size = pop_size 108 | self.model = model 109 | self.alpha = alpha 110 | self.temp = temp 111 | self.max_steps = max_steps 112 | self.mutation_rate = mutation_rate 113 | self.image_dim = image_dim 114 | self.resize_dim = resize_dim 115 | noise_dim = self.resize_dim or self.image_dim 116 | self.image_channels = image_channels 117 | self.num_labels = num_labels 118 | self.adaptive = adaptive 119 | self.writer = tf.summary.FileWriter(logdir='.') 120 | self.input_img = tf.Variable( 121 | np.zeros((1, self.image_dim, self.image_dim, self.image_channels), dtype=np.float32), name='x', dtype=tf.float32) 122 | # copies of original image 123 | self.pop_orig = tf.Variable(np.zeros( 124 | (self.pop_size, self.image_dim, self.image_dim, image_channels), dtype=np.float32), name='pop_orig', dtype=tf.float32) 125 | self.pop_noise = tf.Variable(np.zeros( 126 | (self.pop_size, noise_dim, noise_dim, self.image_channels), dtype=np.float32), name='pop_noise', dtype=tf.float32) 127 | 128 | self.target = tf.Variable(0, dtype=tf.int64, name='target') 129 | self.init_success = tf.Variable(0, dtype=tf.int32, name='success') 130 | self.box_min = tf.tile(tf.maximum( 131 | self.input_img-eps, -0.5), (self.pop_size, 1, 1, 1)) 132 | self.box_max = tf.tile(tf.minimum( 133 | self.input_img+eps, 0.5), (self.pop_size, 1, 1, 1)) 134 | self.margin_log = tf.Variable(initial_value=np.zeros( 135 | (1, 1), dtype=np.float32), validate_shape=False, name='margin_log', dtype=tf.float32) 136 | self.margin_log.set_shape((None, 1)) 137 | self.tlab = tf.contrib.layers.one_hot_encoding( 138 | [self.target], num_classes=self.num_labels) 139 | self.i = tf.Variable(0, dtype=tf.int64, name='step') 140 | 141 | # Variables to detect plateau 142 | self.best_win_margin = tf.Variable(-1, 143 | dtype=tf.float32, name='cur_margin') 144 | self.cur_plateau_count = tf.Variable(0, dtype=tf.int32, name='plateau') 145 | self.num_plateaus = tf.Variable(0, dtype=tf.int32, name='num_plateaus') 146 | 147 | def cond(i, success, pop_orig, pop_noise, cur_elite, margin_log, best_win_margin, cur_plateau_count, 148 | num_plateaus): return tf.logical_and(tf.less_equal(i, self.max_steps), tf.equal(success, 0)) 149 | 150 | def attack_body(i, success, pop_orig, pop_noise, cur_elite, margin_log, best_win_margin, cur_plateau_count, num_plateaus): return self.attack_step( 151 | i, success, pop_orig, pop_noise, cur_elite, margin_log, best_win_margin, cur_plateau_count, num_plateaus) 152 | 153 | self.attack_main = tf.while_loop(cond, attack_body, [self.i, self.init_success, self.pop_orig, 154 | self.pop_noise, self.pop_noise[0], self.margin_log, self.best_win_margin, self.cur_plateau_count, self.num_plateaus]) 155 | self.summary_op = tf.summary.merge_all() 156 | 157 | def initialize(self, sess, img, target): 158 | sess.run([x.initializer for x in 159 | [self.i, 160 | self.input_img, 161 | self.target, 162 | self.margin_log, 163 | self.pop_noise, 164 | self.best_win_margin, 165 | self.cur_plateau_count, 166 | self.num_plateaus, 167 | self.init_success]]) 168 | sess.run(tf.assign(self.input_img, np.expand_dims(img, axis=0))) 169 | sess.run(tf.assign(self.target, target)) 170 | orig_copies = tf.tile(self.input_img, [self.pop_size, 1, 1, 1]) 171 | sess.run(tf.assign(self.pop_orig, orig_copies)) 172 | init_noise = self.mutation_op( 173 | self.pop_noise, idx=self.i, p=self.mutation_rate, step_noise=self.eps) 174 | sess.run(tf.assign(self.margin_log, np.zeros((1, 1), dtype=np.float32))) 175 | sess.run(tf.assign(self.pop_noise, init_noise)) 176 | sess.run(tf.assign(self.best_win_margin, 177 | np.array(-1.0, dtype=np.float32))) 178 | sess.run(tf.assign(self.cur_plateau_count, np.array(0, dtype=np.int32))) 179 | sess.run(tf.assign(self.num_plateaus, 0)) 180 | print('Population initailized') 181 | 182 | def attack(self, sess, input_img, target_label): 183 | self.initialize(sess, input_img, target_label) 184 | (num_steps, success, copies, final_pop, adv_noise, 185 | log_hist, _, _, _) = sess.run(self.attack_main) 186 | if success: 187 | if self.resize_dim: 188 | adv_img = sess.run( 189 | tf.clip_by_value( 190 | np.expand_dims(input_img, axis=0)+tf.image.resize_bilinear( 191 | np.expand_dims(adv_noise, axis=0), (self.image_dim, self.image_dim)), 192 | self.box_min[0:1], self.box_max[0:1])) 193 | else: 194 | adv_img = sess.run( 195 | tf.clip_by_value(np.expand_dims(input_img, axis=0)+np.expand_dims(adv_noise, axis=0), 196 | self.box_min[0:1], self.box_max[0:1])) 197 | 198 | # Number of queries = NUM_STEPS * (POP_SIZE -1 ) + 1 199 | # We subtract 1 from pop_size, because we use elite mechanism, so one population 200 | # member is copied from previous generation and no need to re-evaluate it. 201 | # The first population is an exception, therefore we add 1 to have total sum. 202 | query_count = num_steps * (self.pop_size - 1) + 1 203 | return adv_img[0], query_count, log_hist[1:, :] 204 | else: 205 | return None 206 | -------------------------------------------------------------------------------- /imagenet_classes.txt: -------------------------------------------------------------------------------- 1 | {0: 'tench, Tinca tinca', 2 | 1: 'goldfish, Carassius auratus', 3 | 2: 'great white shark, white shark, man-eater, man-eating shark, Carcharodon carcharias', 4 | 3: 'tiger shark, Galeocerdo cuvieri', 5 | 4: 'hammerhead, hammerhead shark', 6 | 5: 'electric ray, crampfish, numbfish, torpedo', 7 | 6: 'stingray', 8 | 7: 'cock', 9 | 8: 'hen', 10 | 9: 'ostrich, Struthio camelus', 11 | 10: 'brambling, Fringilla montifringilla', 12 | 11: 'goldfinch, Carduelis carduelis', 13 | 12: 'house finch, linnet, Carpodacus mexicanus', 14 | 13: 'junco, snowbird', 15 | 14: 'indigo bunting, indigo finch, indigo bird, Passerina cyanea', 16 | 15: 'robin, American robin, Turdus migratorius', 17 | 16: 'bulbul', 18 | 17: 'jay', 19 | 18: 'magpie', 20 | 19: 'chickadee', 21 | 20: 'water ouzel, dipper', 22 | 21: 'kite', 23 | 22: 'bald eagle, American eagle, Haliaeetus leucocephalus', 24 | 23: 'vulture', 25 | 24: 'great grey owl, great gray owl, Strix nebulosa', 26 | 25: 'European fire salamander, Salamandra salamandra', 27 | 26: 'common newt, Triturus vulgaris', 28 | 27: 'eft', 29 | 28: 'spotted salamander, Ambystoma maculatum', 30 | 29: 'axolotl, mud puppy, Ambystoma mexicanum', 31 | 30: 'bullfrog, Rana catesbeiana', 32 | 31: 'tree frog, tree-frog', 33 | 32: 'tailed frog, bell toad, ribbed toad, tailed toad, Ascaphus trui', 34 | 33: 'loggerhead, loggerhead turtle, Caretta caretta', 35 | 34: 'leatherback turtle, leatherback, leathery turtle, Dermochelys coriacea', 36 | 35: 'mud turtle', 37 | 36: 'terrapin', 38 | 37: 'box turtle, box tortoise', 39 | 38: 'banded gecko', 40 | 39: 'common iguana, iguana, Iguana iguana', 41 | 40: 'American chameleon, anole, Anolis carolinensis', 42 | 41: 'whiptail, whiptail lizard', 43 | 42: 'agama', 44 | 43: 'frilled lizard, Chlamydosaurus kingi', 45 | 44: 'alligator lizard', 46 | 45: 'Gila monster, Heloderma suspectum', 47 | 46: 'green lizard, Lacerta viridis', 48 | 47: 'African chameleon, Chamaeleo chamaeleon', 49 | 48: 'Komodo dragon, Komodo lizard, dragon lizard, giant lizard, Varanus komodoensis', 50 | 49: 'African crocodile, Nile crocodile, Crocodylus niloticus', 51 | 50: 'American alligator, Alligator mississipiensis', 52 | 51: 'triceratops', 53 | 52: 'thunder snake, worm snake, Carphophis amoenus', 54 | 53: 'ringneck snake, ring-necked snake, ring snake', 55 | 54: 'hognose snake, puff adder, sand viper', 56 | 55: 'green snake, grass snake', 57 | 56: 'king snake, kingsnake', 58 | 57: 'garter snake, grass snake', 59 | 58: 'water snake', 60 | 59: 'vine snake', 61 | 60: 'night snake, Hypsiglena torquata', 62 | 61: 'boa constrictor, Constrictor constrictor', 63 | 62: 'rock python, rock snake, Python sebae', 64 | 63: 'Indian cobra, Naja naja', 65 | 64: 'green mamba', 66 | 65: 'sea snake', 67 | 66: 'horned viper, cerastes, sand viper, horned asp, Cerastes cornutus', 68 | 67: 'diamondback, diamondback rattlesnake, Crotalus adamanteus', 69 | 68: 'sidewinder, horned rattlesnake, Crotalus cerastes', 70 | 69: 'trilobite', 71 | 70: 'harvestman, daddy longlegs, Phalangium opilio', 72 | 71: 'scorpion', 73 | 72: 'black and gold garden spider, Argiope aurantia', 74 | 73: 'barn spider, Araneus cavaticus', 75 | 74: 'garden spider, Aranea diademata', 76 | 75: 'black widow, Latrodectus mactans', 77 | 76: 'tarantula', 78 | 77: 'wolf spider, hunting spider', 79 | 78: 'tick', 80 | 79: 'centipede', 81 | 80: 'black grouse', 82 | 81: 'ptarmigan', 83 | 82: 'ruffed grouse, partridge, Bonasa umbellus', 84 | 83: 'prairie chicken, prairie grouse, prairie fowl', 85 | 84: 'peacock', 86 | 85: 'quail', 87 | 86: 'partridge', 88 | 87: 'African grey, African gray, Psittacus erithacus', 89 | 88: 'Macaw', 90 | 89: 'sulphur-crested cockatoo, Kakatoe galerita, Cacatua galerita', 91 | 90: 'lorikeet', 92 | 91: 'coucal', 93 | 92: 'bee eater', 94 | 93: 'hornbill', 95 | 94: 'hummingbird', 96 | 95: 'jacamar', 97 | 96: 'toucan', 98 | 97: 'drake', 99 | 98: 'red-breasted merganser, Mergus serrator', 100 | 99: 'goose', 101 | 100: 'black swan, Cygnus atratus', 102 | 101: 'tusker', 103 | 102: 'echidna, spiny anteater, anteater', 104 | 103: 'platypus, duckbill, duckbilled platypus, duck-billed platypus, Ornithorhynchus anatinus', 105 | 104: 'wallaby, brush kangaroo', 106 | 105: 'koala, koala bear, kangaroo bear, native bear, Phascolarctos cinereus', 107 | 106: 'wombat', 108 | 107: 'jellyfish', 109 | 108: 'sea anemone, anemone', 110 | 109: 'brain coral', 111 | 110: 'flatworm, platyhelminth', 112 | 111: 'nematode, nematode worm, roundworm', 113 | 112: 'conch', 114 | 113: 'snail', 115 | 114: 'slug', 116 | 115: 'sea slug, nudibranch', 117 | 116: 'chiton, coat-of-mail shell, sea cradle, polyplacophore', 118 | 117: 'chambered nautilus, pearly nautilus, nautilus', 119 | 118: 'Dungeness crab, Cancer magister', 120 | 119: 'rock crab, Cancer irroratus', 121 | 120: 'fiddler crab', 122 | 121: 'king crab, Alaska crab, Alaskan king crab, Alaska king crab, Paralithodes camtschatica', 123 | 122: 'American lobster, Northern lobster, Maine lobster, Homarus americanus', 124 | 123: 'spiny lobster, langouste, rock lobster, crawfish, crayfish, sea crawfish', 125 | 124: 'crayfish, crawfish, crawdad, crawdaddy', 126 | 125: 'hermit crab', 127 | 126: 'isopod', 128 | 127: 'white stork, Ciconia ciconia', 129 | 128: 'black stork, Ciconia nigra', 130 | 129: 'spoonbill', 131 | 130: 'flamingo', 132 | 131: 'little blue heron, Egretta caerulea', 133 | 132: 'American egret, great white heron, Egretta albus', 134 | 133: 'bittern', 135 | 134: 'crane', 136 | 135: 'limpkin, Aramus pictus', 137 | 136: 'European gallinule, Porphyrio porphyrio', 138 | 137: 'American coot, marsh hen, mud hen, water hen, Fulica americana', 139 | 138: 'bustard', 140 | 139: 'ruddy turnstone, Arenaria interpres', 141 | 140: 'red-backed sandpiper, dunlin, Erolia alpina', 142 | 141: 'redshank, Tringa totanus', 143 | 142: 'dowitcher', 144 | 143: 'oystercatcher, oyster catcher', 145 | 144: 'pelican', 146 | 145: 'king penguin, Aptenodytes patagonica', 147 | 146: 'albatross, mollymawk', 148 | 147: 'grey whale, gray whale, devilfish, Eschrichtius gibbosus, Eschrichtius robustus', 149 | 148: 'killer whale, killer, orca, grampus, sea wolf, Orcinus orca', 150 | 149: 'dugong, Dugong dugon', 151 | 150: 'sea lion', 152 | 151: 'Chihuahua', 153 | 152: 'Japanese spaniel', 154 | 153: 'Maltese dog, Maltese terrier, Maltese', 155 | 154: 'Pekinese, Pekingese, Peke', 156 | 155: 'Shih-Tzu', 157 | 156: 'Blenheim spaniel', 158 | 157: 'papillon', 159 | 158: 'toy terrier', 160 | 159: 'Rhodesian ridgeback', 161 | 160: 'Afghan hound, Afghan', 162 | 161: 'basset, basset hound', 163 | 162: 'beagle', 164 | 163: 'bloodhound, sleuthhound', 165 | 164: 'bluetick', 166 | 165: 'black-and-tan coonhound', 167 | 166: 'Walker hound, Walker foxhound', 168 | 167: 'English foxhound', 169 | 168: 'redbone', 170 | 169: 'borzoi, Russian wolfhound', 171 | 170: 'Irish wolfhound', 172 | 171: 'Italian greyhound', 173 | 172: 'whippet', 174 | 173: 'Ibizan hound, Ibizan Podenco', 175 | 174: 'Norwegian elkhound, elkhound', 176 | 175: 'otterhound, otter hound', 177 | 176: 'Saluki, gazelle hound', 178 | 177: 'Scottish deerhound, deerhound', 179 | 178: 'Weimaraner', 180 | 179: 'Staffordshire bullterrier, Staffordshire bull terrier', 181 | 180: 'American Staffordshire terrier, Staffordshire terrier, American pit bull terrier, pit bull terrier', 182 | 181: 'Bedlington terrier', 183 | 182: 'Border terrier', 184 | 183: 'Kerry blue terrier', 185 | 184: 'Irish terrier', 186 | 185: 'Norfolk terrier', 187 | 186: 'Norwich terrier', 188 | 187: 'Yorkshire terrier', 189 | 188: 'wire-haired fox terrier', 190 | 189: 'Lakeland terrier', 191 | 190: 'Sealyham terrier, Sealyham', 192 | 191: 'Airedale, Airedale terrier', 193 | 192: 'cairn, cairn terrier', 194 | 193: 'Australian terrier', 195 | 194: 'Dandie Dinmont, Dandie Dinmont terrier', 196 | 195: 'Boston bull, Boston terrier', 197 | 196: 'miniature schnauzer', 198 | 197: 'giant schnauzer', 199 | 198: 'standard schnauzer', 200 | 199: 'Scotch terrier, Scottish terrier, Scottie', 201 | 200: 'Tibetan terrier, chrysanthemum dog', 202 | 201: 'silky terrier, Sydney silky', 203 | 202: 'soft-coated wheaten terrier', 204 | 203: 'West Highland white terrier', 205 | 204: 'Lhasa, Lhasa apso', 206 | 205: 'flat-coated retriever', 207 | 206: 'curly-coated retriever', 208 | 207: 'golden retriever', 209 | 208: 'Labrador retriever', 210 | 209: 'Chesapeake Bay retriever', 211 | 210: 'German short-haired pointer', 212 | 211: 'vizsla, Hungarian pointer', 213 | 212: 'English setter', 214 | 213: 'Irish setter, red setter', 215 | 214: 'Gordon setter', 216 | 215: 'Brittany spaniel', 217 | 216: 'clumber, clumber spaniel', 218 | 217: 'English springer, English springer spaniel', 219 | 218: 'Welsh springer spaniel', 220 | 219: 'cocker spaniel, English cocker spaniel, cocker', 221 | 220: 'Sussex spaniel', 222 | 221: 'Irish water spaniel', 223 | 222: 'kuvasz', 224 | 223: 'schipperke', 225 | 224: 'groenendael', 226 | 225: 'malinois', 227 | 226: 'briard', 228 | 227: 'kelpie', 229 | 228: 'komondor', 230 | 229: 'Old English sheepdog, bobtail', 231 | 230: 'Shetland sheepdog, Shetland sheep dog, Shetland', 232 | 231: 'collie', 233 | 232: 'Border collie', 234 | 233: 'Bouvier des Flandres, Bouviers des Flandres', 235 | 234: 'Rottweiler', 236 | 235: 'German shepherd, German shepherd dog, German police dog, alsatian', 237 | 236: 'Doberman, Doberman pinscher', 238 | 237: 'miniature pinscher', 239 | 238: 'Greater Swiss Mountain dog', 240 | 239: 'Bernese mountain dog', 241 | 240: 'Appenzeller', 242 | 241: 'EntleBucher', 243 | 242: 'boxer', 244 | 243: 'bull mastiff', 245 | 244: 'Tibetan mastiff', 246 | 245: 'French bulldog', 247 | 246: 'Great Dane', 248 | 247: 'Saint Bernard, St Bernard', 249 | 248: 'Eskimo dog, husky', 250 | 249: 'malamute, malemute, Alaskan malamute', 251 | 250: 'Siberian husky', 252 | 251: 'dalmatian, coach dog, carriage dog', 253 | 252: 'affenpinscher, monkey pinscher, monkey dog', 254 | 253: 'basenji', 255 | 254: 'pug, pug-dog', 256 | 255: 'Leonberg', 257 | 256: 'Newfoundland, Newfoundland dog', 258 | 257: 'Great Pyrenees', 259 | 258: 'Samoyed, Samoyede', 260 | 259: 'Pomeranian', 261 | 260: 'chow, chow chow', 262 | 261: 'keeshond', 263 | 262: 'Brabancon griffon', 264 | 263: 'Pembroke, Pembroke Welsh corgi', 265 | 264: 'Cardigan, Cardigan Welsh corgi', 266 | 265: 'toy poodle', 267 | 266: 'miniature poodle', 268 | 267: 'standard poodle', 269 | 268: 'Mexican hairless', 270 | 269: 'timber wolf, grey wolf, gray wolf, Canis lupus', 271 | 270: 'white wolf, Arctic wolf, Canis lupus tundrarum', 272 | 271: 'red wolf, maned wolf, Canis rufus, Canis niger', 273 | 272: 'coyote, prairie wolf, brush wolf, Canis latrans', 274 | 273: 'dingo, warrigal, warragal, Canis dingo', 275 | 274: 'dhole, Cuon alpinus', 276 | 275: 'African hunting dog, hyena dog, Cape hunting dog, Lycaon pictus', 277 | 276: 'hyena, hyaena', 278 | 277: 'red fox, Vulpes vulpes', 279 | 278: 'kit fox, Vulpes macrotis', 280 | 279: 'Arctic fox, white fox, Alopex lagopus', 281 | 280: 'grey fox, gray fox, Urocyon cinereoargenteus', 282 | 281: 'tabby, tabby cat', 283 | 282: 'tiger cat', 284 | 283: 'Persian cat', 285 | 284: 'Siamese cat, Siamese', 286 | 285: 'Egyptian cat', 287 | 286: 'cougar, puma, catamount, mountain lion, painter, panther, Felis concolor', 288 | 287: 'Lynx, catamount', 289 | 288: 'leopard, Panthera pardus', 290 | 289: 'snow leopard, ounce, Panthera uncia', 291 | 290: 'jaguar, panther, Panthera onca, Felis onca', 292 | 291: 'lion, king of beasts, Panthera leo', 293 | 292: 'tiger, Panthera tigris', 294 | 293: 'cheetah, chetah, Acinonyx jubatus', 295 | 294: 'brown bear, bruin, Ursus arctos', 296 | 295: 'American black bear, black bear, Ursus americanus, Euarctos americanus', 297 | 296: 'ice bear, polar bear, Ursus Maritimus, Thalarctos maritimus', 298 | 297: 'sloth bear, Melursus ursinus, Ursus ursinus', 299 | 298: 'mongoose', 300 | 299: 'meerkat, mierkat', 301 | 300: 'tiger beetle', 302 | 301: 'ladybug, ladybeetle, lady beetle, ladybird, ladybird beetle', 303 | 302: 'ground beetle, carabid beetle', 304 | 303: 'long-horned beetle, longicorn, longicorn beetle', 305 | 304: 'leaf beetle, chrysomelid', 306 | 305: 'dung beetle', 307 | 306: 'rhinoceros beetle', 308 | 307: 'weevil', 309 | 308: 'fly', 310 | 309: 'bee', 311 | 310: 'ant, emmet, pismire', 312 | 311: 'grasshopper, hopper', 313 | 312: 'cricket', 314 | 313: 'walking stick, walkingstick, stick insect', 315 | 314: 'cockroach, roach', 316 | 315: 'mantis, mantid', 317 | 316: 'cicada, cicala', 318 | 317: 'leafhopper', 319 | 318: 'lacewing, lacewing fly', 320 | 319: 'dragonfly, darning needle', 321 | 320: 'damselfly', 322 | 321: 'admiral', 323 | 322: 'ringlet, ringlet butterfly', 324 | 323: 'monarch, monarch butterfly, milkweed butterfly, Danaus plexippus', 325 | 324: 'cabbage butterfly', 326 | 325: 'sulphur butterfly, sulfur butterfly', 327 | 326: 'lycaenid, lycaenid butterfly', 328 | 327: 'starfish, sea star', 329 | 328: 'sea urchin', 330 | 329: 'sea cucumber, holothurian', 331 | 330: 'wood rabbit, cottontail, cottontail rabbit', 332 | 331: 'hare', 333 | 332: 'Angora, Angora rabbit', 334 | 333: 'hamster', 335 | 334: 'porcupine, hedgehog', 336 | 335: 'fox squirrel, eastern fox squirrel, Sciurus niger', 337 | 336: 'marmot', 338 | 337: 'beaver', 339 | 338: 'guinea pig, Cavia cobaya', 340 | 339: 'sorrel', 341 | 340: 'zebra', 342 | 341: 'hog, pig, grunter, squealer, Sus scrofa', 343 | 342: 'wild boar, boar, Sus scrofa', 344 | 343: 'warthog', 345 | 344: 'hippopotamus, hippo, river horse, Hippopotamus amphibius', 346 | 345: 'ox', 347 | 346: 'water buffalo, water ox, Asiatic buffalo, Bubalus bubalis', 348 | 347: 'bison', 349 | 348: 'ram, tup', 350 | 349: 'bighorn, bighorn sheep, cimarron, Rocky Mountain bighorn, Rocky Mountain sheep, Ovis canadensis', 351 | 350: 'ibex, Capra ibex', 352 | 351: 'hartebeest', 353 | 352: 'impala, Aepyceros melampus', 354 | 353: 'gazelle', 355 | 354: 'Arabian camel, dromedary, Camelus dromedarius', 356 | 355: 'llama', 357 | 356: 'weasel', 358 | 357: 'mink', 359 | 358: 'polecat, fitch, foulmart, foumart, Mustela putorius', 360 | 359: 'black-footed ferret, ferret, Mustela nigripes', 361 | 360: 'otter', 362 | 361: 'skunk, polecat, wood pussy', 363 | 362: 'badger', 364 | 363: 'armadillo', 365 | 364: 'three-toed sloth, ai, Bradypus tridactylus', 366 | 365: 'orangutan, orang, orangutang, Pongo pygmaeus', 367 | 366: 'gorilla, Gorilla gorilla', 368 | 367: 'chimpanzee, chimp, Pan troglodytes', 369 | 368: 'gibbon, Hylobates lar', 370 | 369: 'siamang, Hylobates syndactylus, Symphalangus syndactylus', 371 | 370: 'guenon, guenon monkey', 372 | 371: 'patas, hussar monkey, Erythrocebus patas', 373 | 372: 'baboon', 374 | 373: 'macaque', 375 | 374: 'langur', 376 | 375: 'colobus, colobus monkey', 377 | 376: 'proboscis monkey, Nasalis larvatus', 378 | 377: 'marmoset', 379 | 378: 'capuchin, ringtail, Cebus capucinus', 380 | 379: 'howler monkey, howler', 381 | 380: 'titi, titi monkey', 382 | 381: 'spider monkey, Ateles geoffroyi', 383 | 382: 'squirrel monkey, Saimiri sciureus', 384 | 383: 'Madagascar cat, ring-tailed lemur, Lemur catta', 385 | 384: 'indri, indris, Indri indri, Indri brevicaudatus', 386 | 385: 'Indian elephant, Elephas maximus', 387 | 386: 'African elephant, Loxodonta africana', 388 | 387: 'lesser panda, red panda, panda, bear cat, cat bear, Ailurus fulgens', 389 | 388: 'giant panda, panda, panda bear, coon bear, Ailuropoda melanoleuca', 390 | 389: 'barracouta, snoek', 391 | 390: 'eel', 392 | 391: 'coho, cohoe, coho salmon, blue jack, silver salmon, Oncorhynchus kisutch', 393 | 392: 'rock beauty, Holocanthus tricolor', 394 | 393: 'anemone fish', 395 | 394: 'sturgeon', 396 | 395: 'gar, garfish, garpike, billfish, Lepisosteus osseus', 397 | 396: 'lionfish', 398 | 397: 'puffer, pufferfish, blowfish, globefish', 399 | 398: 'abacus', 400 | 399: 'abaya', 401 | 400: 'academic gown, academic robe', 402 | 401: 'accordion, piano accordion, squeeze box', 403 | 402: 'acoustic guitar', 404 | 403: 'aircraft carrier, carrier, flattop, attack aircraft carrier', 405 | 404: 'airliner', 406 | 405: 'airship, dirigible', 407 | 406: 'altar', 408 | 407: 'ambulance', 409 | 408: 'amphibian, amphibious vehicle', 410 | 409: 'analog clock', 411 | 410: 'apiary, bee house', 412 | 411: 'apron', 413 | 412: 'ashcan, trash can, garbage can, wastebin, ash bin, ash-bin, ashbin, dustbin, trash barrel, trash bin', 414 | 413: 'assault rifle, assault gun', 415 | 414: 'backpack, back pack, knapsack, packsack, rucksack, haversack', 416 | 415: 'bakery, bakeshop, bakehouse', 417 | 416: 'balance beam, beam', 418 | 417: 'balloon', 419 | 418: 'ballpoint, ballpoint pen, ballpen, Biro', 420 | 419: 'Band Aid', 421 | 420: 'banjo', 422 | 421: 'bannister, banister, balustrade, balusters, handrail', 423 | 422: 'barbell', 424 | 423: 'barber chair', 425 | 424: 'barbershop', 426 | 425: 'barn', 427 | 426: 'barometer', 428 | 427: 'barrel, cask', 429 | 428: 'barrow, garden cart, lawn cart, wheelbarrow', 430 | 429: 'baseball', 431 | 430: 'basketball', 432 | 431: 'bassinet', 433 | 432: 'bassoon', 434 | 433: 'bathing cap, swimming cap', 435 | 434: 'bath towel', 436 | 435: 'bathtub, bathing tub, bath, tub', 437 | 436: 'beach wagon, station wagon, wagon, estate car, beach waggon, station waggon, waggon', 438 | 437: 'beacon, lighthouse, beacon light, pharos', 439 | 438: 'beaker', 440 | 439: 'bearskin, busby, shako', 441 | 440: 'beer bottle', 442 | 441: 'beer glass', 443 | 442: 'bell cote, bell cot', 444 | 443: 'bib', 445 | 444: 'bicycle-built-for-two, tandem bicycle, tandem', 446 | 445: 'bikini, two-piece', 447 | 446: 'binder, ring-binder', 448 | 447: 'binoculars, field glasses, opera glasses', 449 | 448: 'birdhouse', 450 | 449: 'boathouse', 451 | 450: 'bobsled, bobsleigh, bob', 452 | 451: 'bolo tie, bolo, bola tie, bola', 453 | 452: 'bonnet, poke bonnet', 454 | 453: 'bookcase', 455 | 454: 'bookshop, bookstore, bookstall', 456 | 455: 'bottlecap', 457 | 456: 'bow', 458 | 457: 'bow tie, bow-tie, bowtie', 459 | 458: 'brass, memorial tablet, plaque', 460 | 459: 'brassiere, bra, bandeau', 461 | 460: 'breakwater, groin, groyne, mole, bulwark, seawall, jetty', 462 | 461: 'breastplate, aegis, egis', 463 | 462: 'broom', 464 | 463: 'bucket, pail', 465 | 464: 'buckle', 466 | 465: 'bulletproof vest', 467 | 466: 'bullet train, bullet', 468 | 467: 'butcher shop, meat market', 469 | 468: 'cab, hack, taxi, taxicab', 470 | 469: 'caldron, cauldron', 471 | 470: 'candle, taper, wax light', 472 | 471: 'cannon', 473 | 472: 'canoe', 474 | 473: 'can opener, tin opener', 475 | 474: 'cardigan', 476 | 475: 'car mirror', 477 | 476: 'carousel, carrousel, merry-go-round, roundabout, whirligig', 478 | 477: 'carpenters kit, tool kit', 479 | 478: 'carton', 480 | 479: 'car wheel', 481 | 480: 'cash machine, cash dispenser, automated teller machine, automatic teller machine, automated teller, automatic teller, ATM', 482 | 481: 'cassette', 483 | 482: 'cassette player', 484 | 483: 'castle', 485 | 484: 'catamaran', 486 | 485: 'CD player', 487 | 486: 'cello, violoncello', 488 | 487: 'cellular telephone, cellular phone, cellphone, cell, mobile phone', 489 | 488: 'chain', 490 | 489: 'chainlink fence', 491 | 490: 'chain mail, ring mail, mail, chain armor, chain armour, ring armor, ring armour', 492 | 491: 'chain saw, chainsaw', 493 | 492: 'chest', 494 | 493: 'chiffonier, commode', 495 | 494: 'chime, bell, gong', 496 | 495: 'china cabinet, china closet', 497 | 496: 'Christmas stocking', 498 | 497: 'church, church building', 499 | 498: 'cinema, movie theater, movie theatre, movie house, picture palace', 500 | 499: 'cleaver, meat cleaver, chopper', 501 | 500: 'cliff dwelling', 502 | 501: 'cloak', 503 | 502: 'clog, geta, patten, sabot', 504 | 503: 'cocktail shaker', 505 | 504: 'coffee mug', 506 | 505: 'coffeepot', 507 | 506: 'coil, spiral, volute, whorl, helix', 508 | 507: 'combination lock', 509 | 508: 'computer keyboard, keypad', 510 | 509: 'confectionery, confectionary, candy store', 511 | 510: 'container ship, containership, container vessel', 512 | 511: 'convertible', 513 | 512: 'corkscrew, bottle screw', 514 | 513: 'cornet, horn, trumpet, trump', 515 | 514: 'cowboy boot', 516 | 515: 'cowboy hat, ten-gallon hat', 517 | 516: 'cradle', 518 | 517: 'crane', 519 | 518: 'crash helmet', 520 | 519: 'crate', 521 | 520: 'crib, cot', 522 | 521: 'Crock Pot', 523 | 522: 'croquet ball', 524 | 523: 'crutch', 525 | 524: 'cuirass', 526 | 525: 'dam, dike, dyke', 527 | 526: 'desk', 528 | 527: 'desktop computer', 529 | 528: 'dial telephone, dial phone', 530 | 529: 'diaper, nappy, napkin', 531 | 530: 'digital clock', 532 | 531: 'digital watch', 533 | 532: 'dining table, board', 534 | 533: 'dishrag, dishcloth', 535 | 534: 'dishwasher, dish washer, dishwashing machine', 536 | 535: 'disk brake, disc brake', 537 | 536: 'dock, dockage, docking facility', 538 | 537: 'dogsled, dog sled, dog sleigh', 539 | 538: 'dome', 540 | 539: 'doormat, welcome mat', 541 | 540: 'drilling platform, offshore rig', 542 | 541: 'drum, membranophone, tympan', 543 | 542: 'drumstick', 544 | 543: 'dumbbell', 545 | 544: 'Dutch oven', 546 | 545: 'electric fan, blower', 547 | 546: 'electric guitar', 548 | 547: 'electric locomotive', 549 | 548: 'entertainment center', 550 | 549: 'envelope', 551 | 550: 'espresso maker', 552 | 551: 'face powder', 553 | 552: 'feather boa, boa', 554 | 553: 'file, file cabinet, filing cabinet', 555 | 554: 'fireboat', 556 | 555: 'fire engine, fire truck', 557 | 556: 'fire screen, fireguard', 558 | 557: 'flagpole, flagstaff', 559 | 558: 'flute, transverse flute', 560 | 559: 'folding chair', 561 | 560: 'football helmet', 562 | 561: 'forklift', 563 | 562: 'fountain', 564 | 563: 'fountain pen', 565 | 564: 'four-poster', 566 | 565: 'freight car', 567 | 566: 'French horn, horn', 568 | 567: 'frying pan, frypan, skillet', 569 | 568: 'fur coat', 570 | 569: 'garbage truck, dustcart', 571 | 570: 'gasmask, respirator, gas helmet', 572 | 571: 'gas pump, gasoline pump, petrol pump, island dispenser', 573 | 572: 'goblet', 574 | 573: 'go-kart', 575 | 574: 'golf ball', 576 | 575: 'golfcart, golf cart', 577 | 576: 'gondola', 578 | 577: 'gong, tam-tam', 579 | 578: 'gown', 580 | 579: 'grand piano, grand', 581 | 580: 'greenhouse, nursery, glasshouse', 582 | 581: 'grille, radiator grille', 583 | 582: 'grocery store, grocery, food market, market', 584 | 583: 'guillotine', 585 | 584: 'hair slide', 586 | 585: 'hair spray', 587 | 586: 'half track', 588 | 587: 'hammer', 589 | 588: 'hamper', 590 | 589: 'hand blower, blow dryer, blow drier, hair dryer, hair drier', 591 | 590: 'hand-held computer, hand-held microcomputer', 592 | 591: 'handkerchief, hankie, hanky, hankey', 593 | 592: 'hard disc, hard disk, fixed disk', 594 | 593: 'harmonica, mouth organ, harp, mouth harp', 595 | 594: 'harp', 596 | 595: 'harvester, reaper', 597 | 596: 'hatchet', 598 | 597: 'holster', 599 | 598: 'home theater, home theatre', 600 | 599: 'Honeycomb', 601 | 600: 'hook, claw', 602 | 601: 'hoopskirt, crinoline', 603 | 602: 'horizontal bar, high bar', 604 | 603: 'horse cart, horse-cart', 605 | 604: 'hourglass', 606 | 605: 'iPod', 607 | 606: 'iron, smoothing iron', 608 | 607: 'jack-o-lantern', 609 | 608: 'jean, blue jean, denim', 610 | 609: 'jeep, landrover', 611 | 610: 'jersey, T-shirt, tee shirt', 612 | 611: 'jigsaw puzzle', 613 | 612: 'jinrikisha, ricksha, rickshaw', 614 | 613: 'joystick', 615 | 614: 'kimono', 616 | 615: 'knee pad', 617 | 616: 'knot', 618 | 617: 'lab coat, laboratory coat', 619 | 618: 'ladle', 620 | 619: 'lampshade, lamp shade', 621 | 620: 'laptop, laptop computer', 622 | 621: 'lawn mower, mower', 623 | 622: 'lens cap, lens cover', 624 | 623: 'letter opener, paper knife, paperknife', 625 | 624: 'library', 626 | 625: 'lifeboat', 627 | 626: 'lighter, light, igniter, ignitor', 628 | 627: 'limousine, limo', 629 | 628: 'liner, ocean liner', 630 | 629: 'lipstick, lip rouge', 631 | 630: 'Loafer', 632 | 631: 'lotion', 633 | 632: 'loudspeaker, speaker, speaker unit, loudspeaker system, speaker system', 634 | 633: 'loupe, jewelers loupe', 635 | 634: 'lumbermill, sawmill', 636 | 635: 'magnetic compass', 637 | 636: 'mailbag, postbag', 638 | 637: 'mailbox, letter box', 639 | 638: 'maillot', 640 | 639: 'maillot, tank suit', 641 | 640: 'manhole cover', 642 | 641: 'maraca', 643 | 642: 'marimba, xylophone', 644 | 643: 'mask', 645 | 644: 'matchstick', 646 | 645: 'maypole', 647 | 646: 'maze, labyrinth', 648 | 647: 'measuring cup', 649 | 648: 'medicine chest, medicine cabinet', 650 | 649: 'megalith, megalithic structure', 651 | 650: 'microphone, mike', 652 | 651: 'microwave, microwave oven', 653 | 652: 'military uniform', 654 | 653: 'milk can', 655 | 654: 'minibus', 656 | 655: 'miniskirt, mini', 657 | 656: 'minivan', 658 | 657: 'missile', 659 | 658: 'mitten', 660 | 659: 'mixing bowl', 661 | 660: 'mobile home, manufactured home', 662 | 661: 'Model T', 663 | 662: 'modem', 664 | 663: 'monastery', 665 | 664: 'monitor', 666 | 665: 'moped', 667 | 666: 'mortar', 668 | 667: 'mortarboard', 669 | 668: 'mosque', 670 | 669: 'mosquito net', 671 | 670: 'motor scooter, scooter', 672 | 671: 'mountain bike, all-terrain bike, off-roader', 673 | 672: 'mountain tent', 674 | 673: 'mouse, computer mouse', 675 | 674: 'mousetrap', 676 | 675: 'moving van', 677 | 676: 'muzzle', 678 | 677: 'nail', 679 | 678: 'neck brace', 680 | 679: 'necklace', 681 | 680: 'nipple', 682 | 681: 'notebook, notebook computer', 683 | 682: 'obelisk', 684 | 683: 'oboe, hautboy, hautbois', 685 | 684: 'ocarina, sweet potato', 686 | 685: 'odometer, hodometer, mileometer, milometer', 687 | 686: 'oil filter', 688 | 687: 'organ, pipe organ', 689 | 688: 'oscilloscope, scope, cathode-ray oscilloscope, CRO', 690 | 689: 'overskirt', 691 | 690: 'oxcart', 692 | 691: 'oxygen mask', 693 | 692: 'packet', 694 | 693: 'paddle, boat paddle', 695 | 694: 'paddlewheel, paddle wheel', 696 | 695: 'padlock', 697 | 696: 'paintbrush', 698 | 697: 'pajama, pyjama, pjs, jammies', 699 | 698: 'palace', 700 | 699: 'panpipe, pandean pipe, syrinx', 701 | 700: 'paper towel', 702 | 701: 'parachute, chute', 703 | 702: 'parallel bars, bars', 704 | 703: 'park bench', 705 | 704: 'Parking meter', 706 | 705: 'passenger car, coach, carriage', 707 | 706: 'patio, terrace', 708 | 707: 'pay-phone, pay-station', 709 | 708: 'pedestal, plinth, footstall', 710 | 709: 'pencil box, pencil case', 711 | 710: 'pencil sharpener', 712 | 711: 'perfume, essence', 713 | 712: 'Petri dish', 714 | 713: 'photocopier', 715 | 714: 'pick, plectrum, plectron', 716 | 715: 'pickelhaube', 717 | 716: 'picket fence, paling', 718 | 717: 'pickup, pickup truck', 719 | 718: 'pier', 720 | 719: 'piggy bank, penny bank', 721 | 720: 'pill bottle', 722 | 721: 'pillow', 723 | 722: 'ping-pong ball', 724 | 723: 'pinwheel', 725 | 724: 'pirate, pirate ship', 726 | 725: 'pitcher, ewer', 727 | 726: 'plane, carpenters plane, woodworking plane', 728 | 727: 'planetarium', 729 | 728: 'plastic bag', 730 | 729: 'plate rack', 731 | 730: 'plow, plough', 732 | 731: 'plunger', 733 | 732: 'Polaroid camera, Polaroid Land camera', 734 | 733: 'pole', 735 | 734: 'police van, police wagon, paddy wagon, patrol wagon, wagon, black Maria', 736 | 735: 'poncho', 737 | 736: 'pool table, billiard table, snooker table', 738 | 737: 'pop bottle, soda bottle', 739 | 738: 'pot, flowerpot', 740 | 739: 'potters wheel', 741 | 740: 'power drill', 742 | 741: 'prayer rug, prayer mat', 743 | 742: 'printer', 744 | 743: 'prison, prison house', 745 | 744: 'projectile, missile', 746 | 745: 'projector', 747 | 746: 'puck, hockey puck', 748 | 747: 'punching bag, punch bag, punching ball, punchball', 749 | 748: 'purse', 750 | 749: 'quill, quill pen', 751 | 750: 'quilt, comforter, comfort, puff', 752 | 751: 'racer, race car, racing car', 753 | 752: 'racket, racquet', 754 | 753: 'radiator', 755 | 754: 'radio, wireless', 756 | 755: 'radio telescope, radio reflector', 757 | 756: 'rain barrel', 758 | 757: 'recreational vehicle, RV, R.V.', 759 | 758: 'reel', 760 | 759: 'reflex camera', 761 | 760: 'refrigerator, icebox', 762 | 761: 'remote control, remote', 763 | 762: 'restaurant, eating house, eating place, eatery', 764 | 763: 'revolver, six-gun, six-shooter', 765 | 764: 'rifle', 766 | 765: 'rocking chair, rocker', 767 | 766: 'rotisserie', 768 | 767: 'rubber eraser, rubber, pencil eraser', 769 | 768: 'rugby ball', 770 | 769: 'rule, ruler', 771 | 770: 'running shoe', 772 | 771: 'safe', 773 | 772: 'safety pin', 774 | 773: 'saltshaker, salt shaker', 775 | 774: 'sandal', 776 | 775: 'sarong', 777 | 776: 'sax, saxophone', 778 | 777: 'scabbard', 779 | 778: 'scale, weighing machine', 780 | 779: 'school bus', 781 | 780: 'schooner', 782 | 781: 'scoreboard', 783 | 782: 'screen, CRT screen', 784 | 783: 'screw', 785 | 784: 'screwdriver', 786 | 785: 'seat belt, seatbelt', 787 | 786: 'sewing machine', 788 | 787: 'shield, buckler', 789 | 788: 'shoe shop, shoe-shop, shoe store', 790 | 789: 'shoji', 791 | 790: 'shopping basket', 792 | 791: 'shopping cart', 793 | 792: 'shovel', 794 | 793: 'shower cap', 795 | 794: 'shower curtain', 796 | 795: 'ski', 797 | 796: 'ski mask', 798 | 797: 'sleeping bag', 799 | 798: 'slide rule, slipstick', 800 | 799: 'sliding door', 801 | 800: 'slot, one-armed bandit', 802 | 801: 'snorkel', 803 | 802: 'snowmobile', 804 | 803: 'snowplow, snowplough', 805 | 804: 'soap dispenser', 806 | 805: 'soccer ball', 807 | 806: 'sock', 808 | 807: 'solar dish, solar collector, solar furnace', 809 | 808: 'sombrero', 810 | 809: 'soup bowl', 811 | 810: 'space bar', 812 | 811: 'space heater', 813 | 812: 'space shuttle', 814 | 813: 'spatula', 815 | 814: 'speedboat', 816 | 815: 'spider web', 817 | 816: 'spindle', 818 | 817: 'sports car, sport car', 819 | 818: 'spotlight, spot', 820 | 819: 'stage', 821 | 820: 'steam locomotive', 822 | 821: 'steel arch bridge', 823 | 822: 'steel drum', 824 | 823: 'stethoscope', 825 | 824: 'stole', 826 | 825: 'stone wall', 827 | 826: 'stopwatch, stop watch', 828 | 827: 'stove', 829 | 828: 'strainer', 830 | 829: 'streetcar, tram, tramcar, trolley, trolley car', 831 | 830: 'stretcher', 832 | 831: 'studio couch, day bed', 833 | 832: 'stupa, tope', 834 | 833: 'submarine, pigboat, sub, U-boat', 835 | 834: 'suit, suit of clothes', 836 | 835: 'sundial', 837 | 836: 'sunglass', 838 | 837: 'sunglasses, dark glasses, shades', 839 | 838: 'sunscreen, sunblock, sun blocker', 840 | 839: 'suspension bridge', 841 | 840: 'swab, swob, mop', 842 | 841: 'sweatshirt', 843 | 842: 'swimming trunks, bathing trunks', 844 | 843: 'swing', 845 | 844: 'switch, electric switch, electrical switch', 846 | 845: 'syringe', 847 | 846: 'table lamp', 848 | 847: 'tank, army tank, armored combat vehicle, armoured combat vehicle', 849 | 848: 'tape player', 850 | 849: 'teapot', 851 | 850: 'teddy, teddy bear', 852 | 851: 'television, television system', 853 | 852: 'tennis ball', 854 | 853: 'thatch, thatched roof', 855 | 854: 'theater curtain, theatre curtain', 856 | 855: 'thimble', 857 | 856: 'thresher, thrasher, threshing machine', 858 | 857: 'throne', 859 | 858: 'tile roof', 860 | 859: 'toaster', 861 | 860: 'tobacco shop, tobacconist shop, tobacconist', 862 | 861: 'toilet seat', 863 | 862: 'torch', 864 | 863: 'totem pole', 865 | 864: 'tow truck, tow car, wrecker', 866 | 865: 'toyshop', 867 | 866: 'tractor', 868 | 867: 'trailer truck, tractor trailer, trucking rig, rig, articulated lorry, semi', 869 | 868: 'tray', 870 | 869: 'trench coat', 871 | 870: 'tricycle, trike, velocipede', 872 | 871: 'trimaran', 873 | 872: 'tripod', 874 | 873: 'Triumphal arch', 875 | 874: 'trolleybus, trolley coach, trackless trolley', 876 | 875: 'trombone', 877 | 876: 'tub, vat', 878 | 877: 'turnstile', 879 | 878: 'typewriter keyboard', 880 | 879: 'umbrella', 881 | 880: 'unicycle, monocycle', 882 | 881: 'upright, upright piano', 883 | 882: 'vacuum, vacuum cleaner', 884 | 883: 'vase', 885 | 884: 'vault', 886 | 885: 'velvet', 887 | 886: 'vending machine', 888 | 887: 'vestment', 889 | 888: 'viaduct', 890 | 889: 'violin, fiddle', 891 | 890: 'volleyball', 892 | 891: 'waffle iron', 893 | 892: 'wall clock', 894 | 893: 'wallet, billfold, notecase, pocketbook', 895 | 894: 'wardrobe, closet, press', 896 | 895: 'warplane, military plane', 897 | 896: 'washbasin, handbasin, washbowl, lavabo, wash-hand basin', 898 | 897: 'washer, automatic washer, washing machine', 899 | 898: 'water bottle', 900 | 899: 'water jug', 901 | 900: 'water tower', 902 | 901: 'whiskey jug', 903 | 902: 'whistle', 904 | 903: 'wig', 905 | 904: 'window screen', 906 | 905: 'window shade', 907 | 906: 'Windsor tie', 908 | 907: 'wine bottle', 909 | 908: 'wing', 910 | 909: 'wok', 911 | 910: 'wooden spoon', 912 | 911: 'wool, woolen, woollen', 913 | 912: 'worm fence, snake fence, snake-rail fence, Virginia fence', 914 | 913: 'wreck', 915 | 914: 'yawl', 916 | 915: 'yurt', 917 | 916: 'web site, website, internet site, site', 918 | 917: 'comic book', 919 | 918: 'crossword puzzle, crossword', 920 | 919: 'street sign', 921 | 920: 'traffic light, traffic signal, stoplight', 922 | 921: 'book jacket, dust cover, dust jacket, dust wrapper', 923 | 922: 'menu', 924 | 923: 'plate', 925 | 924: 'guacamole', 926 | 925: 'consomme', 927 | 926: 'hot pot, hotpot', 928 | 927: 'trifle', 929 | 928: 'ice cream, icecream', 930 | 929: 'ice lolly, lolly, lollipop, popsicle', 931 | 930: 'French loaf', 932 | 931: 'bagel, beigel', 933 | 932: 'pretzel', 934 | 933: 'cheeseburger', 935 | 934: 'hotdog, hot dog, red hot', 936 | 935: 'mashed potato', 937 | 936: 'head cabbage', 938 | 937: 'broccoli', 939 | 938: 'cauliflower', 940 | 939: 'zucchini, courgette', 941 | 940: 'spaghetti squash', 942 | 941: 'acorn squash', 943 | 942: 'butternut squash', 944 | 943: 'cucumber, cuke', 945 | 944: 'artichoke, globe artichoke', 946 | 945: 'bell pepper', 947 | 946: 'cardoon', 948 | 947: 'mushroom', 949 | 948: 'Granny Smith', 950 | 949: 'strawberry', 951 | 950: 'orange', 952 | 951: 'lemon', 953 | 952: 'fig', 954 | 953: 'pineapple, ananas', 955 | 954: 'banana', 956 | 955: 'jackfruit, jak, jack', 957 | 956: 'custard apple', 958 | 957: 'pomegranate', 959 | 958: 'hay', 960 | 959: 'carbonara', 961 | 960: 'chocolate sauce, chocolate syrup', 962 | 961: 'dough', 963 | 962: 'meat loaf, meatloaf', 964 | 963: 'pizza, pizza pie', 965 | 964: 'potpie', 966 | 965: 'burrito', 967 | 966: 'red wine', 968 | 967: 'espresso', 969 | 968: 'cup', 970 | 969: 'eggnog', 971 | 970: 'alp', 972 | 971: 'bubble', 973 | 972: 'cliff, drop, drop-off', 974 | 973: 'coral reef', 975 | 974: 'geyser', 976 | 975: 'lakeside, lakeshore', 977 | 976: 'promontory, headland, head, foreland', 978 | 977: 'sandbar, sand bar', 979 | 978: 'seashore, coast, seacoast, sea-coast', 980 | 979: 'valley, vale', 981 | 980: 'volcano', 982 | 981: 'ballplayer, baseball player', 983 | 982: 'groom, bridegroom', 984 | 983: 'scuba diver', 985 | 984: 'rapeseed', 986 | 985: 'daisy', 987 | 986: 'yellow ladys slipper, yellow lady-slipper, Cypripedium calceolus, Cypripedium parviflorum', 988 | 987: 'corn', 989 | 988: 'acorn', 990 | 989: 'hip, rose hip, rosehip', 991 | 990: 'buckeye, horse chestnut, conker', 992 | 991: 'coral fungus', 993 | 992: 'agaric', 994 | 993: 'gyromitra', 995 | 994: 'stinkhorn, carrion fungus', 996 | 995: 'earthstar', 997 | 996: 'hen-of-the-woods, hen of the woods, Polyporus frondosus, Grifola frondosa', 998 | 997: 'bolete', 999 | 998: 'ear, spike, capitulum', 1000 | 999: 'toilet tissue, toilet paper, bathroom tissue'} -------------------------------------------------------------------------------- /images/336.00049024.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/nesl/adversarial_genattack/2304cdc2a49d2c16b9f43821ad8a29d664f334d1/images/336.00049024.jpg -------------------------------------------------------------------------------- /main.py: -------------------------------------------------------------------------------- 1 | """ 2 | Author: Moustafa Alzantot (malzantot@ucla.edu) 3 | 4 | """ 5 | import time 6 | import os 7 | import sys 8 | import random 9 | import numpy as np 10 | 11 | import tensorflow as tf 12 | from setup_inception import ImageNet, InceptionModel 13 | from setup_mnist import MNIST, MNISTModel 14 | from setup_cifar import CIFAR, CIFARModel 15 | 16 | import utils 17 | from genattack_tf2 import GenAttack2 18 | 19 | flags = tf.app.flags 20 | flags.DEFINE_string('input_dir', '', 'Path for input images.') 21 | flags.DEFINE_string('output_dir', 'output', 'Path to save results.') 22 | flags.DEFINE_integer('test_size', 1, 'Number of test images.') 23 | flags.DEFINE_bool('verbose', True, 'Print logs.') 24 | flags.DEFINE_integer('test_example', default=None, help='Test only one image') 25 | 26 | flags.DEFINE_float('mutation_rate', default=0.005, help='Mutation rate') 27 | flags.DEFINE_float('eps', default=0.10, 28 | help='maximum L_inf distance threshold') 29 | flags.DEFINE_float('alpha', default=0.20, help='Step size') 30 | flags.DEFINE_float('temp', default=0.1, 31 | help='sampling temperature for selection') 32 | flags.DEFINE_integer('pop_size', default=6, help='Population size') 33 | flags.DEFINE_integer('max_steps', default=10000, 34 | help='Maximum number of iterations') 35 | flags.DEFINE_integer('resize_dim', None, 36 | 'Reduced dimension for dimensionality reduction') 37 | flags.DEFINE_bool('adaptive', True, 38 | 'Turns on the dynamic scaling of mutation prameters') 39 | flags.DEFINE_string('model', 'inception', 'model name') 40 | flags.DEFINE_integer( 41 | 'target', None, 'target class. if not provided will be random') 42 | FLAGS = flags.FLAGS 43 | 44 | if __name__ == '__main__': 45 | 46 | with tf.Session() as sess: 47 | if FLAGS.model == 'inception': 48 | assert FLAGS.input_dir is not None, 'You must provide input_dir.' 49 | dataset = ImageNet(FLAGS.input_dir) 50 | inputs, targets, reals = utils.generate_data( 51 | dataset, FLAGS.test_size) 52 | image_dim = 299 53 | image_channels = 3 54 | num_labels = 1001 55 | model = InceptionModel(sess, use_log=True) 56 | elif FLAGS.model == 'mnist': 57 | dataset = MNIST() 58 | model = MNISTModel('models/mnist', sess, use_log=True) 59 | image_dim = 28 60 | image_channels = 1 61 | num_labels = 10 62 | inputs, targets, reals = utils.generate_data( 63 | dataset, FLAGS.test_size) 64 | assert FLAGS.resize_dim is None, 'Dimensionality reduction of noise is used only for ImageNet models' 65 | elif FLAGS.model == 'cifar': 66 | dataset = CIFAR() 67 | model = CIFARModel('models/cifar', sess, use_log=True) 68 | image_dim = 32 69 | image_channels = 3 70 | num_labels = 10 71 | inputs, targets, reals = utils.generate_data( 72 | dataset, FLAGS.test_size) 73 | assert FLAGS.resize_dim is None, 'Dimensionality reduction of noise is used only for ImageNet models' 74 | else: 75 | raise ValueError( 76 | 'Incorrect model name provided ({})'.format(FLAGS.model)) 77 | test_in = tf.placeholder( 78 | tf.float32, (1, image_dim, image_dim, image_channels), 'x') 79 | test_pred = tf.argmax(model.predict(test_in), axis=1) 80 | 81 | attack = GenAttack2(model=model, 82 | pop_size=FLAGS.pop_size, 83 | mutation_rate=FLAGS.mutation_rate, 84 | eps=FLAGS.eps, 85 | max_steps=FLAGS.max_steps, 86 | alpha=FLAGS.alpha, 87 | resize_dim=FLAGS.resize_dim, 88 | image_dim=image_dim, 89 | image_channels=image_channels, 90 | num_labels=num_labels, 91 | temp=FLAGS.temp, 92 | adaptive=FLAGS.adaptive) 93 | num_valid_images = len(inputs) 94 | total_count = 0 # Total number of images attempted 95 | success_count = 0 96 | logger = utils.ResultLogger(FLAGS.output_dir, FLAGS.flag_values_dict()) 97 | for ii in range(num_valid_images): 98 | if (FLAGS.test_example and FLAGS.test_example != ii): 99 | continue 100 | input_img = inputs[ii] 101 | if FLAGS.target: 102 | target_label = FLAGS.target + 1 103 | else: 104 | target_label = np.argmax(targets[ii]) 105 | real_label = reals[ii] 106 | orig_pred = sess.run(test_pred, feed_dict={ 107 | test_in: [input_img]})[0] 108 | if FLAGS.verbose: 109 | print('Real = {}, Predicted = {}, Target = {}'.format( 110 | real_label, orig_pred, target_label)) 111 | if orig_pred != real_label: 112 | if FLAGS.verbose: 113 | print('\t Skipping incorrectly classified image.') 114 | continue 115 | total_count += 1 116 | start_time = time.time() 117 | result = attack.attack(sess, input_img, target_label) 118 | end_time = time.time() 119 | attack_time = (end_time-start_time) 120 | if result is not None: 121 | adv_img, query_count, margin_log = result 122 | final_pred = sess.run(test_pred, feed_dict={ 123 | test_in: [adv_img]})[0] 124 | if (final_pred == target_label): 125 | success_count += 1 126 | print('--- SUCCEEEED ----') 127 | if image_channels == 1: 128 | input_img = input_img[:, :, 0] 129 | adv_img = adv_img[:, :, 0] 130 | logger.add_result(ii, input_img, adv_img, real_label, 131 | target_label, query_count, attack_time, margin_log) 132 | else: 133 | print('Attack failed') 134 | logger.close(num_attempts=total_count) 135 | print('Number of success = {} / {}.'.format(success_count, total_count)) 136 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | numpy==1.8.2 2 | scipy==0.19.1 3 | tensorflow-gpu==1.13.1 4 | keras==2.1.4 5 | -------------------------------------------------------------------------------- /setup_cifar.py: -------------------------------------------------------------------------------- 1 | ## setup_cifar.py -- cifar data and model loading code 2 | ## 3 | ## Copyright (C) 2016, Nicholas Carlini . 4 | ## 5 | ## This program is licenced under the BSD 2-Clause licence, 6 | ## contained in the LICENCE file in this directory. 7 | 8 | 9 | import tensorflow as tf 10 | import numpy as np 11 | import os 12 | import pickle 13 | import gzip 14 | import pickle 15 | import urllib.request 16 | 17 | from keras.models import Sequential 18 | from keras.layers import Dense, Dropout, Activation, Flatten 19 | from keras.layers import Conv2D, MaxPooling2D 20 | from keras.utils import np_utils 21 | from keras.models import load_model 22 | 23 | def load_batch(fpath, label_key='labels'): 24 | f = open(fpath, 'rb') 25 | d = pickle.load(f, encoding="bytes") 26 | for k, v in d.items(): 27 | del(d[k]) 28 | d[k.decode("utf8")] = v 29 | f.close() 30 | data = d["data"] 31 | labels = d[label_key] 32 | 33 | data = data.reshape(data.shape[0], 3, 32, 32) 34 | final = np.zeros((data.shape[0], 32, 32, 3),dtype=np.float32) 35 | final[:,:,:,0] = data[:,0,:,:] 36 | final[:,:,:,1] = data[:,1,:,:] 37 | final[:,:,:,2] = data[:,2,:,:] 38 | 39 | final /= 255 40 | final -= .5 41 | labels2 = np.zeros((len(labels), 10)) 42 | labels2[np.arange(len(labels2)), labels] = 1 43 | 44 | return final, labels 45 | 46 | def load_batch(fpath): 47 | f = open(fpath,"rb").read() 48 | size = 32*32*3+1 49 | labels = [] 50 | images = [] 51 | for i in range(10000): 52 | arr = np.fromstring(f[i*size:(i+1)*size],dtype=np.uint8) 53 | lab = np.identity(10)[arr[0]] 54 | img = arr[1:].reshape((3,32,32)).transpose((1,2,0)) 55 | 56 | labels.append(lab) 57 | images.append((img/255)-.5) 58 | return np.array(images),np.array(labels) 59 | 60 | 61 | class CIFAR: 62 | def __init__(self): 63 | train_data = [] 64 | train_labels = [] 65 | 66 | if not os.path.exists("cifar-10-batches-bin"): 67 | urllib.request.urlretrieve("https://www.cs.toronto.edu/~kriz/cifar-10-binary.tar.gz", 68 | "cifar-data.tar.gz") 69 | os.popen("tar -xzf cifar-data.tar.gz").read() 70 | 71 | 72 | for i in range(5): 73 | r,s = load_batch("cifar-10-batches-bin/data_batch_"+str(i+1)+".bin") 74 | train_data.extend(r) 75 | train_labels.extend(s) 76 | 77 | train_data = np.array(train_data,dtype=np.float32) 78 | train_labels = np.array(train_labels) 79 | 80 | self.test_data, self.test_labels = load_batch("cifar-10-batches-bin/test_batch.bin") 81 | 82 | VALIDATION_SIZE = 5000 83 | 84 | self.validation_data = train_data[:VALIDATION_SIZE, :, :, :] 85 | self.validation_labels = train_labels[:VALIDATION_SIZE] 86 | self.train_data = train_data[VALIDATION_SIZE:, :, :, :] 87 | self.train_labels = train_labels[VALIDATION_SIZE:] 88 | 89 | class CIFARModel: 90 | def __init__(self, restore=None, session=None, use_log=False): 91 | self.num_channels = 3 92 | self.image_size = 32 93 | self.num_labels = 10 94 | 95 | model = Sequential() 96 | 97 | model.add(Conv2D(64, (3, 3), 98 | input_shape=(32, 32, 3))) 99 | model.add(Activation('relu')) 100 | model.add(Conv2D(64, (3, 3))) 101 | model.add(Activation('relu')) 102 | model.add(MaxPooling2D(pool_size=(2, 2))) 103 | 104 | model.add(Conv2D(128, (3, 3))) 105 | model.add(Activation('relu')) 106 | model.add(Conv2D(128, (3, 3))) 107 | model.add(Activation('relu')) 108 | model.add(MaxPooling2D(pool_size=(2, 2))) 109 | 110 | model.add(Flatten()) 111 | model.add(Dense(256)) 112 | model.add(Activation('relu')) 113 | model.add(Dense(256)) 114 | model.add(Activation('relu')) 115 | model.add(Dense(10)) 116 | if use_log: 117 | model.add(Activation('softmax')) 118 | if restore: 119 | model.load_weights(restore) 120 | 121 | self.model = model 122 | 123 | def predict(self, data): 124 | return self.model(data) 125 | 126 | 127 | -------------------------------------------------------------------------------- /setup_inception.py: -------------------------------------------------------------------------------- 1 | ## Modified from https://github.com/IBM/ZOO-Attack 2 | ## Modified by Huan Zhang for the updated Inception-v3 model (inception_v3_2016_08_28.tar.gz) 3 | ## Modified by Nicholas Carlini to match model structure for attack code. 4 | ## Original copyright license follows. 5 | 6 | 7 | # Copyright 2015 The TensorFlow Authors. All Rights Reserved. 8 | # 9 | # Licensed under the Apache License, Version 2.0 (the "License"); 10 | # you may not use this file except in compliance with the License. 11 | # You may obtain a copy of the License at 12 | # 13 | # http://www.apache.org/licenses/LICENSE-2.0 14 | # 15 | # Unless required by applicable law or agreed to in writing, software 16 | # distributed under the License is distributed on an "AS IS" BASIS, 17 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 18 | # See the License for the specific language governing permissions and 19 | # limitations under the License. 20 | # ============================================================================== 21 | 22 | """Simple image classification with Inception. 23 | 24 | Run image classification with Inception trained on ImageNet 2012 Challenge data 25 | set. 26 | 27 | This program creates a graph from a saved GraphDef protocol buffer, 28 | and runs inference on an input JPEG image. It outputs human readable 29 | strings of the top 5 predictions along with their probabilities. 30 | 31 | Change the --image_file argument to any jpg image to compute a 32 | classification of that image. 33 | 34 | Please see the tutorial and website for a detailed description of how 35 | to use this script to perform image recognition. 36 | 37 | https://tensorflow.org/tutorials/image_recognition/ 38 | """ 39 | 40 | from __future__ import absolute_import 41 | from __future__ import division 42 | from __future__ import print_function 43 | 44 | import os.path 45 | import re 46 | import sys 47 | import random 48 | import tarfile 49 | import scipy.misc 50 | 51 | import numpy as np 52 | from six.moves import urllib 53 | import tensorflow as tf 54 | from tensorflow.contrib.slim.nets import inception 55 | slim = tf.contrib.slim 56 | 57 | FLAGS = tf.app.flags.FLAGS 58 | 59 | # classify_image_graph_def.pb: 60 | # Binary representation of the GraphDef protocol buffer. 61 | # imagenet_synset_to_human_label_map.txt: 62 | # Map from synset ID to a human readable string. 63 | # imagenet_2012_challenge_label_map_proto.pbtxt: 64 | # Text representation of a protocol buffer mapping a label to synset ID. 65 | tf.app.flags.DEFINE_string( 66 | 'model_dir', 'tmp/imagenet', 67 | """Path to classify_image_graph_def.pb, """ 68 | """imagenet_synset_to_human_label_map.txt, and """ 69 | """imagenet_2012_challenge_label_map_proto.pbtxt.""") 70 | tf.app.flags.DEFINE_string('image_file', '', 71 | """Absolute path to image file.""") 72 | tf.app.flags.DEFINE_integer('num_top_predictions', 5, 73 | """Display this many predictions.""") 74 | 75 | # pylint: disable=line-too-long 76 | DATA_URL = 'http://jaina.cs.ucdavis.edu/datasets/adv/imagenet/inception_v3_2016_08_28_frozen.tar.gz' 77 | # pylint: enable=line-too-long 78 | 79 | 80 | class NodeLookup(object): 81 | """Converts integer node ID's to human readable labels.""" 82 | 83 | def __init__(self, 84 | label_lookup_path=None): 85 | if not label_lookup_path: 86 | label_lookup_path = os.path.join( 87 | FLAGS.model_dir, 'labels.txt') 88 | self.node_lookup = self.load(label_lookup_path) 89 | 90 | def load(self, label_lookup_path): 91 | """Loads a human readable English name for each softmax node. 92 | 93 | Args: 94 | label_lookup_path: string UID to integer node ID. 95 | uid_lookup_path: string UID to human-readable string. 96 | 97 | Returns: 98 | dict from integer node ID to human-readable string. 99 | """ 100 | if not tf.gfile.Exists(label_lookup_path): 101 | tf.logging.fatal('File does not exist %s', label_lookup_path) 102 | 103 | # Loads mapping from string UID to integer node ID. 104 | node_id_to_name = {} 105 | proto_as_ascii = tf.gfile.GFile(label_lookup_path).readlines() 106 | for line in proto_as_ascii: 107 | if line: 108 | words = line.split(':') 109 | target_class = int(words[0]) 110 | name = words[1] 111 | node_id_to_name[target_class] = name 112 | 113 | return node_id_to_name 114 | 115 | def id_to_string(self, node_id): 116 | if node_id not in self.node_lookup: 117 | return '' 118 | return self.node_lookup[node_id] 119 | 120 | 121 | def create_graph(): 122 | """Creates a graph from saved GraphDef file and returns a saver.""" 123 | # Creates graph from saved graph_def.pb. 124 | with tf.gfile.FastGFile(os.path.join( 125 | # FLAGS.model_dir, 'classify_image_graph_def.pb'), 'rb') as f: 126 | FLAGS.model_dir, 'frozen_inception_v3.pb'), 'rb') as f: 127 | graph_def = tf.GraphDef() 128 | graph_def.ParseFromString(f.read()) 129 | #for line in repr(graph_def).split("\n"): 130 | # if "tensor_content" not in line: 131 | # print(line) 132 | _ = tf.import_graph_def(graph_def, name='') 133 | 134 | 135 | def run_inference_on_image(image): 136 | """Runs inference on an image. (Not updated, not working for inception v3 20160828) 137 | 138 | Args: 139 | image: Image file name. 140 | 141 | Returns: 142 | Nothing 143 | """ 144 | if not tf.gfile.Exists(image): 145 | tf.logging.fatal('File does not exist %s', image) 146 | image_data = tf.gfile.FastGFile(image, 'rb').read() 147 | 148 | # Creates graph from saved GraphDef. 149 | create_graph() 150 | 151 | with tf.Session() as sess: 152 | # Some useful tensors: 153 | # 'softmax:0': A tensor containing the normalized prediction across 154 | # 1000 labels. 155 | # 'pool_3:0': A tensor containing the next-to-last layer containing 2048 156 | # float description of the image. 157 | # 'DecodeJpeg/contents:0': A tensor containing a string providing JPEG 158 | # encoding of the image. 159 | # Runs the softmax tensor by feeding the image_data as input to the graph. 160 | #softmax_tensor = sess.graph.get_tensor_by_name('softmax:0') 161 | img = tf.placeholder(tf.uint8, (299,299,3)) 162 | softmax_tensor = tf.import_graph_def( 163 | sess.graph.as_graph_def(), 164 | input_map={'DecodeJpeg:0': tf.reshape(img,((299,299,3)))}, 165 | return_elements=['softmax/logits:0']) 166 | 167 | dat = scipy.misc.imresize(scipy.misc.imread(image),(299,299)) 168 | predictions = sess.run(softmax_tensor, 169 | {img: dat}) 170 | 171 | predictions = np.squeeze(predictions) 172 | 173 | # Creates node ID --> English string lookup. 174 | node_lookup = NodeLookup() 175 | 176 | top_k = predictions.argsort()#[-FLAGS.num_top_predictions:][::-1] 177 | for node_id in top_k: 178 | print('id',node_id) 179 | human_string = node_lookup.id_to_string(node_id) 180 | score = predictions[node_id] 181 | print('%s (score = %.5f)' % (human_string, score)) 182 | 183 | class InceptionModelPrediction: 184 | def __init__(self, sess, use_log = True): 185 | self.sess = sess 186 | self.use_log = use_log 187 | if self.use_log: 188 | output_name = 'InceptionV3/Predictions/Softmax:0' 189 | else: 190 | output_name = 'InceptionV3/Predictions/Reshape:0' 191 | self.img = tf.placeholder(tf.float32, (None, 299,299,3)) 192 | self.softmax_tensor = tf.import_graph_def( 193 | sess.graph.as_graph_def(), 194 | input_map={'input:0': self.img}, 195 | return_elements=[output_name]) 196 | def predict(self, dat): 197 | dat = np.squeeze(dat) 198 | # scaled = (0.5 + dat) * 255 199 | scaled = dat.reshape((1,) + dat.shape) 200 | # print(scaled.shape) 201 | predictions = self.sess.run(self.softmax_tensor, 202 | {self.img: scaled}) 203 | predictions = np.squeeze(predictions) 204 | return predictions 205 | # Creates node ID --> English string lookup. 206 | node_lookup = NodeLookup() 207 | top_k = predictions.argsort()#[-FLAGS.num_top_predictions:][::-1] 208 | for node_id in top_k: 209 | print('id',node_id) 210 | human_string = node_lookup.id_to_string(node_id) 211 | score = predictions[node_id] 212 | print('%s (score = %.5f)' % (human_string, score)) 213 | return top_k[-1] 214 | 215 | 216 | CREATED_GRAPH = False 217 | class InceptionModel: 218 | image_size = 299 219 | num_labels = 1001 220 | num_channels = 3 221 | def __init__(self, sess, use_log = True): 222 | global CREATED_GRAPH 223 | self.sess = sess 224 | self.use_log = use_log 225 | if not CREATED_GRAPH: 226 | create_graph() 227 | CREATED_GRAPH = True 228 | self.model = InceptionModelPrediction(sess, use_log) 229 | 230 | def predict(self, img): 231 | if self.use_log: 232 | output_name = 'InceptionV3/Predictions/Softmax:0' 233 | else: 234 | output_name = 'InceptionV3/Predictions/Reshape:0' 235 | # scaled = (0.5+tf.reshape(img,((299,299,3))))*255 236 | # scaled = (0.5+img)*255 237 | if img.shape.as_list()[0]: 238 | # check if a shape has been specified explicitly 239 | shape = (int(img.shape[0]), 1001) 240 | softmax_tensor = tf.import_graph_def( 241 | self.sess.graph.as_graph_def(), 242 | input_map={'input:0': img, 'InceptionV3/Predictions/Shape:0': shape}, 243 | return_elements=[output_name]) 244 | else: 245 | # placeholder shape 246 | softmax_tensor = tf.import_graph_def( 247 | self.sess.graph.as_graph_def(), 248 | input_map={'input:0': img}, 249 | return_elements=[output_name]) 250 | return softmax_tensor[0] 251 | 252 | 253 | def maybe_download_and_extract(): 254 | """Download and extract model tar file.""" 255 | dest_directory = FLAGS.model_dir 256 | if not os.path.exists(dest_directory): 257 | os.makedirs(dest_directory) 258 | filename = DATA_URL.split('/')[-1] 259 | filepath = os.path.join(dest_directory, filename) 260 | if not os.path.exists(filepath): 261 | def _progress(count, block_size, total_size): 262 | sys.stdout.write('\r>> Downloading %s %.1f%%' % ( 263 | filename, float(count * block_size) / float(total_size) * 100.0)) 264 | sys.stdout.flush() 265 | filepath, _ = urllib.request.urlretrieve(DATA_URL, filepath, _progress) 266 | print() 267 | statinfo = os.stat(filepath) 268 | print('Succesfully downloaded', filename, statinfo.st_size, 'bytes.') 269 | tarfile.open(filepath, 'r:gz').extractall(dest_directory) 270 | 271 | 272 | def main(_): 273 | maybe_download_and_extract() 274 | image = (FLAGS.image_file if FLAGS.image_file else 275 | os.path.join(FLAGS.model_dir, 'cropped_panda.jpg')) 276 | # run_inference_on_image(image) 277 | create_graph() 278 | with tf.Session() as sess: 279 | dat = np.array(scipy.misc.imresize(scipy.misc.imread(image),(299,299)), dtype = np.float32) 280 | dat /= 255.0 281 | dat -= 0.5 282 | # print(dat) 283 | model = InceptionModelPrediction(sess, True) 284 | predictions = model.predict(dat) 285 | # Creates node ID --> English string lookup. 286 | node_lookup = NodeLookup() 287 | top_k = predictions.argsort()#[-FLAGS.num_top_predictions:][::-1] 288 | for node_id in top_k: 289 | print('id',node_id) 290 | human_string = node_lookup.id_to_string(node_id) 291 | score = predictions[node_id] 292 | print('%s (score = %.5f)' % (human_string, score)) 293 | 294 | 295 | def readimg(ff, path): 296 | #f = "../imagenetdata/imgs/"+ff 297 | f = os.path.join(path, ff) 298 | img = scipy.misc.imread(f) 299 | # skip small images (image should be at least 299x299) 300 | if img.shape[0] < 299 or img.shape[1] < 299: 301 | return None 302 | img = np.array(scipy.misc.imresize(img,(299,299)),dtype=np.float32)/255-.5 303 | if img.shape != (299, 299, 3): 304 | return None 305 | return [img, int(ff.split(".")[0]), f] 306 | 307 | class ImageNet: 308 | def __init__(self, path='images'): 309 | #from multiprocessing import Pool 310 | #pool = Pool(8) 311 | file_list = sorted(os.listdir(path)) 312 | random.shuffle(file_list) 313 | read_img_fn = lambda x: readimg(x, path) 314 | 315 | r = [read_img_fn(x) for x in file_list[:200]] 316 | # print(file_list[:200]) 317 | r = [x for x in r if x != None] 318 | test_data, test_labels, test_paths = zip(*r) 319 | self.test_data = np.array(test_data) 320 | self.test_labels = np.zeros((len(test_labels), 1001)) 321 | self.test_labels[np.arange(len(test_labels)), test_labels] = 1 322 | self.test_paths = test_paths 323 | 324 | 325 | 326 | 327 | if __name__ == '__main__': 328 | tf.app.run() 329 | -------------------------------------------------------------------------------- /setup_mnist.py: -------------------------------------------------------------------------------- 1 | ## setup_mnist.py -- mnist data and model loading code 2 | ## 3 | ## Copyright (C) 2016, Nicholas Carlini . 4 | ## 5 | ## This program is licenced under the BSD 2-Clause licence, 6 | ## contained in the LICENCE file in this directory. 7 | 8 | import tensorflow as tf 9 | import numpy as np 10 | import os 11 | import pickle 12 | import gzip 13 | import urllib.request 14 | 15 | from keras.models import Sequential 16 | from keras.layers import Dense, Dropout, Activation, Flatten 17 | from keras.layers import Conv2D, MaxPooling2D 18 | from keras.utils import np_utils 19 | from keras.models import load_model 20 | 21 | def extract_data(filename, num_images): 22 | with gzip.open(filename) as bytestream: 23 | bytestream.read(16) 24 | buf = bytestream.read(num_images*28*28) 25 | data = np.frombuffer(buf, dtype=np.uint8).astype(np.float32) 26 | data = (data / 255) - 0.5 27 | data = data.reshape(num_images, 28, 28, 1) 28 | return data 29 | 30 | def extract_labels(filename, num_images): 31 | with gzip.open(filename) as bytestream: 32 | bytestream.read(8) 33 | buf = bytestream.read(1 * num_images) 34 | labels = np.frombuffer(buf, dtype=np.uint8) 35 | return (np.arange(10) == labels[:, None]).astype(np.float32) 36 | 37 | class MNIST: 38 | def __init__(self): 39 | if not os.path.exists("data"): 40 | os.mkdir("data") 41 | files = ["train-images-idx3-ubyte.gz", 42 | "t10k-images-idx3-ubyte.gz", 43 | "train-labels-idx1-ubyte.gz", 44 | "t10k-labels-idx1-ubyte.gz"] 45 | for name in files: 46 | 47 | urllib.request.urlretrieve('http://yann.lecun.com/exdb/mnist/' + name, "data/"+name) 48 | 49 | train_data = extract_data("data/train-images-idx3-ubyte.gz", 60000) 50 | train_labels = extract_labels("data/train-labels-idx1-ubyte.gz", 60000) 51 | self.test_data = extract_data("data/t10k-images-idx3-ubyte.gz", 10000) 52 | self.test_labels = extract_labels("data/t10k-labels-idx1-ubyte.gz", 10000) 53 | 54 | VALIDATION_SIZE = 5000 55 | 56 | self.validation_data = train_data[:VALIDATION_SIZE, :, :, :] 57 | self.validation_labels = train_labels[:VALIDATION_SIZE] 58 | self.train_data = train_data[VALIDATION_SIZE:, :, :, :] 59 | self.train_labels = train_labels[VALIDATION_SIZE:] 60 | 61 | 62 | class MNISTModel: 63 | def __init__(self, restore = None, session=None, use_log=False): 64 | self.num_channels = 1 65 | self.image_size = 28 66 | self.num_labels = 10 67 | 68 | model = Sequential() 69 | 70 | model.add(Conv2D(32, (3, 3), 71 | input_shape=(28, 28, 1))) 72 | model.add(Activation('relu')) 73 | model.add(Conv2D(32, (3, 3))) 74 | model.add(Activation('relu')) 75 | model.add(MaxPooling2D(pool_size=(2, 2))) 76 | 77 | model.add(Conv2D(64, (3, 3))) 78 | model.add(Activation('relu')) 79 | model.add(Conv2D(64, (3, 3))) 80 | model.add(Activation('relu')) 81 | model.add(MaxPooling2D(pool_size=(2, 2))) 82 | 83 | model.add(Flatten()) 84 | model.add(Dense(200)) 85 | model.add(Activation('relu')) 86 | model.add(Dense(200)) 87 | model.add(Activation('relu')) 88 | model.add(Dense(10)) 89 | # output log probability, used for black-box attack 90 | if use_log: 91 | model.add(Activation('softmax')) 92 | if restore: 93 | model.load_weights(restore) 94 | 95 | self.model = model 96 | 97 | def predict(self, data): 98 | return self.model(data) 99 | -------------------------------------------------------------------------------- /train_models.py: -------------------------------------------------------------------------------- 1 | 2 | ## train_models.py -- train the neural network models for attacking 3 | ## 4 | ## Copyright (C) 2016, Nicholas Carlini . 5 | ## 6 | ## This program is licenced under the BSD 2-Clause licence, 7 | ## contained in the LICENCE file in this directory. 8 | 9 | ## Modified by Moustafa Alzantot (malzantot@ucla.edu) 10 | 11 | import numpy as np 12 | from keras.models import Sequential 13 | from keras.layers import Dense, Dropout, Activation, Flatten 14 | from keras.layers import Conv2D, MaxPooling2D 15 | from keras.optimizers import SGD 16 | 17 | import tensorflow as tf 18 | from setup_mnist import MNIST 19 | from setup_cifar import CIFAR 20 | import os 21 | 22 | def train(data, file_name, params, num_epochs=50, batch_size=128, train_temp=1, init=None): 23 | """ 24 | Standard neural network training procedure. 25 | """ 26 | model = Sequential() 27 | 28 | print(data.train_data.shape) 29 | 30 | model.add(Conv2D(params[0], (3, 3), 31 | input_shape=data.train_data.shape[1:])) 32 | model.add(Activation('relu')) 33 | model.add(Conv2D(params[1], (3, 3))) 34 | model.add(Activation('relu')) 35 | model.add(MaxPooling2D(pool_size=(2, 2))) 36 | 37 | model.add(Conv2D(params[2], (3, 3))) 38 | model.add(Activation('relu')) 39 | model.add(Conv2D(params[3], (3, 3))) 40 | model.add(Activation('relu')) 41 | model.add(MaxPooling2D(pool_size=(2, 2))) 42 | 43 | model.add(Flatten()) 44 | model.add(Dense(params[4])) 45 | model.add(Activation('relu')) 46 | model.add(Dropout(0.5)) 47 | model.add(Dense(params[5])) 48 | model.add(Activation('relu')) 49 | model.add(Dense(10)) 50 | 51 | if init != None: 52 | model.load_weights(init) 53 | 54 | def fn(correct, predicted): 55 | return tf.nn.softmax_cross_entropy_with_logits(labels=correct, 56 | logits=predicted/train_temp) 57 | 58 | sgd = SGD(lr=0.01, decay=1e-6, momentum=0.9, nesterov=True) 59 | 60 | model.compile(loss=fn, 61 | optimizer=sgd, 62 | metrics=['accuracy']) 63 | 64 | model.fit(data.train_data, data.train_labels, 65 | batch_size=batch_size, 66 | validation_data=(data.validation_data, data.validation_labels), 67 | nb_epoch=num_epochs, 68 | shuffle=True) 69 | 70 | 71 | if file_name != None: 72 | model.save(file_name) 73 | 74 | return model 75 | 76 | 77 | if not os.path.isdir('models'): 78 | os.makedirs('models') 79 | 80 | train(CIFAR(), "models/cifar", [64, 64, 128, 128, 256, 256], num_epochs=50) 81 | train(MNIST(), "models/mnist", [32, 32, 64, 64, 200, 200], num_epochs=50) 82 | 83 | -------------------------------------------------------------------------------- /utils.py: -------------------------------------------------------------------------------- 1 | 2 | import os 3 | import numpy as np 4 | from scipy.misc import imsave 5 | 6 | 7 | def generate_data(data, size=1000): 8 | inputs, targets, reals = [], [], [] 9 | num_labels = data.test_labels.shape[1] 10 | i = 0 11 | while i < size and i < len(data.test_data): 12 | inputs.append(data.test_data[i].astype(np.float32)) 13 | reals.append(np.argmax(data.test_labels[i])) 14 | other_labels = [x for x in range( 15 | num_labels) if data.test_labels[i][x] == 0] 16 | random_target = [0 for _ in range(num_labels)] 17 | random_target[np.random.choice(other_labels)] = 1 18 | targets.append(random_target) 19 | i += 1 20 | inputs = np.array(inputs) 21 | targets = np.array(targets) 22 | return inputs, targets, reals 23 | 24 | 25 | def l_inf_dist(orig_img, new_img): 26 | return np.max(np.abs(orig_img.ravel() - new_img.ravel())) 27 | 28 | 29 | def l_2_dist(orig_img, new_img): 30 | return np.sqrt(np.sum((orig_img.ravel()-new_img.ravel())**2)) 31 | 32 | 33 | def l_0_dist(orig_img, new_img): 34 | return np.sum((orig_img.ravel() - new_img.ravel()) != 0) 35 | 36 | 37 | def save_image(img, path): 38 | imsave(path, (img+0.5)) 39 | 40 | 41 | class ResultLogger(object): 42 | def __init__(self, path, flags): 43 | assert path is not None, 'You must give an output results dir.' 44 | self.path = path 45 | if not os.path.exists(path): 46 | os.mkdir(path) 47 | if flags is not None: 48 | config_fh = open(os.path.join(self.path, 'config.txt'), 'w') 49 | config_fh.write(str(flags)) 50 | config_fh.close() 51 | self.results_fh = open(os.path.join(self.path, 'results.csv'), 'w') 52 | self.results_fh.write( 53 | 'index, real, target, queries, l_0, l_2, l_inf, time\n') 54 | self.time_total = 0.0 55 | self.queries_total = 0.0 56 | self.query_list = [] 57 | self.l2_total = 0.0 58 | self.num_success = 0.0 59 | 60 | def add_result(self, idx, src_img, adv_img, real, target, queries, attack_time, margin_log): 61 | save_image(src_img, 62 | os.path.join(self.path, 'orig_{}.jpg'.format(idx))) 63 | save_image(adv_img, 64 | os.path.join(self.path, 'adv_{}.jpg'.format(idx))) 65 | np.save(os.path.join(self.path, 'log_{}.npy'.format(idx)), margin_log) 66 | attack_l2 = l_2_dist(src_img, adv_img) 67 | self.results_fh.write('{}, {}, {}, {}, {}, {}, {}, {}\n'.format( 68 | idx, real, target, queries, 69 | l_0_dist(src_img, adv_img), 70 | attack_l2, 71 | l_inf_dist(src_img, adv_img), 72 | attack_time 73 | )) 74 | 75 | self.num_success += 1 76 | self.time_total += attack_time 77 | self.queries_total += queries 78 | self.query_list.append(queries) 79 | self.l2_total += attack_l2 80 | self.results_fh.flush() 81 | 82 | def close(self, num_attempts): 83 | self.results_fh.close() 84 | stats_fh = open(os.path.join(self.path, 'stats.txt'), 'w') 85 | stats_fh.write('Success rate = {}/{} ({} %%)\n'.format(int(self.num_success), 86 | num_attempts, 100*self.num_success/num_attempts)) 87 | stats_fh.write('Mean queries count = {}.\n'.format( 88 | self.queries_total / self.num_success 89 | )) 90 | stats_fh.write('median queries count = {}.\n'.format( 91 | np.median(self.query_list) 92 | )) 93 | stats_fh.write('Mean l2 distance = {}.\n'.format( 94 | self.l2_total / self.num_success 95 | )) 96 | stats_fh.write('Mean attack time = {} seconds.\n'.format( 97 | self.time_total / self.num_success 98 | )) 99 | stats_fh.close() 100 | --------------------------------------------------------------------------------