lts4 / universal

Universal adversarial perturbations

matlab: MATLAB code to generate universal perturbations, using Caffe or MatConvNet.

python: Python code to generate universal perturbations using TensorFlow.

precomputed: Precomputed universal perturbations, for pre-trained models on ImageNet.

Reference

[1] S. Moosavi-Dezfooli*, A. Fawzi*, O. Fawzi, P. Frossard: Universal adversarial perturbations, CVPR 2017

universal's Issues

Pytorch implemtation with 30% success rate?

This is my Pytorch code:
https://github.com/Invokar/Pytorch_Universal-attack.

These days I implement your idea by pytorch. But I find that when I use the same dataset(10,000), my code can only fool 30% images in Validation set(50,000), but your code can fool 85%.I checked it many times but still couldn't find the problem.
Could you help me? thank you!

UAP for MNIST.

When finding the perturbation for MNIST dataset using 1000 samples for each pass the FOOLING_RATE doesn't increase beyond 0.002 even after 1100 passes . The fooling rate is not increasing rather oscillating between 0.0 and 0.002 . I have used 3 conv layers with batch norm one max pool and 2 fc layers. The UAP calculated after 1100 passes with fooling rate of 0.001 has a mean of >8 as most of absolute value is 10. Please I need some help as I cant understand what is wrong in my implementation. Looking forward to your reply.

Could the uap be used on onther types of data except for images?

Could the uap be used on onther types of data except for images?

the dimensions or shape of the perturbation vectors v, the minimal perturbation dr, w_k and w(gradient weights)

Dear Mr:
I am a student now. I have just studied your codes for about one weeks. I am very interested in your finished paper . I think this paper is of great value to me in the process of studying universal adversarial perturbations.But I have some questions.I will appreciate it if you can explain these problems.

Question 1:
v = v + dr in universal_pert.py(Line 67), the v is the perturbation vectors and dr is the minimal perturbation that fools the classifier. According your codes, the dr have the dimensions with the input image which has three dimensions and v is the perturbation vectors but your setting is v = 0, which means a real value. why can they be added. I wonder the dimensions of v and dr.

Question 2:
dr,iter,, = deepfool(cur_img + v, f, grads, num_classes=num_classes, overshoot=overshoot, max_iter=max_iter_df) in universal_pert.py(Line 63) in which the function deepfool() is in deepfool.py.
w = np.zeros(input_shape) (Line 27) which means the dimensions of w is same with that of input_shape which is 3.
w_k = gradients[k, :, :, :, :] - gradients[0, :, :, :, :] in deepfool.py(Line 40) which means the dimensions of w_k is 4.
w = w_k , why can w_k be assigned to w.

Thank you for taking time out of your busy schedule and look forward to hearing from you soon.
Yours faithfully,

out of memory issue when generating perturbations with VGG and ResNet?

Hi,
Thanks for your code, I learn a lot from it.

When I run the python code with inception5h model, it works very well and I can reproduce perturbation maps. However, when I try the code with VGG or ResNet models, I always get GPU memory full errors. I used the tensorflow SLIM pretrained models, and freeze them into .pb file, just like the format of inception5h model in your example. Do you have any idea to work around this issue? I use a K40C 11G Mem GPU.

Thanks!

demo_inception.py can't be used to generate a universal perturbation

In demo_inception.py:
path_train_imagenet = '/datasets2/ILSVRC2012/train'

is passed into create_imagenet_npy(). This path doesn't exist, so the rest of the function doesn't run. What is the best way to get the data so the universal perturbation vector can be created?

where is the targeted version of universal perturbation?

My concept of targeted attack means we want to set specific target class to let the attacker to make such adversarial image. Can universal perturbation do that and how?

scipy.misc.imread/imresize has been depreciated

Hi.
Please be aware that imread/imresize under scipy.misc has been removed from 1.2.0/1.3.0.
.https://docs.scipy.org/doc/scipy-1.2.1/reference/generated/scipy.misc.imread.html
Thank you for the work!

Deprecation and many Issues

First Issue: The scipy.misc module has been deprecated since Scipy version 1.0.0 and the 'imread' and 'imresize' functions are no longer available in the scipy.misc module.
Fix: In the prepare_imagenet_data.py replace the 'from scipy.misc import imread, imresize' with 'import imageio' and replace the following line 'img = imread(im_path, mode='RGB')' with 'img = imageio.imread(im_path, mode='RGB')'

Second issue: The imresize function is not available in scipy module and imageio module.
Fix: In the prepare_imagenet_data.py insert 'from skimage.transform import resize' at the start of the file along with the other packages aliases, then replace the line 'img = imresize(img, img_size)' with 'img = resize(img, img_size)'

Third Issue: In TensorFlow 2.x, the Session class has been removed, and the execution model has changed to using eager execution by default.
Fix: I have fixed this issue by updating the code of TensorFlow to 2.0 in demo_inception.py and replace the line 'persisted_sess = tf.Session()' with 'persisted_sess = tf.compat.v1.Session()' and replace 'tf.import_graph_def(graph_def, name='')' with 'tf.compat.v1.import_graph_def(graph_def, name='')'

Fourth Issue: The 'tf.GraphDef()' method is not available in TensorFlow 2.0 and make the changes in demo_inception.py and replace the line 'graph_def = tf.GraphDef()' with 'graph_def = tf.compat.v1.GraphDef()'

Fifth Issue: deprecation warning about FastGFile
Fix: In demo_inception.py replace the line 'with gfile.FastGFile(model, 'rb') as f:' with 'with tf.compat.v1.gfile.GFile(model, 'rb') as f:'

Sixth Issue: As of NumPy version 1.20.0, 'np.int' is no longer available as an alias for the built-in 'int'
Fix: In demo_inception.py replace the line 'str_label_original = labels[np.int(label_original)-1].split(',')[0]' with 'str_label_original = labels[int(label_original)-1].split(',')[0]' and replace 'str_label_perturbed = labels[np.int(label_perturbed)-1].split(',')[0]' with 'str_label_perturbed = labels[int(label_perturbed)-1].split(',')[0]'

The code should run with these changes but the issue I'm getting with running the 'python demo_inception.py -i data/test_img.png' command you get is a blank image instead of a plant pot. Please correct me if I'm wrong.

@husseinfawzi could you help me run the Universal adversarial perturbations code.

npy file

Can you provide all the 'npy' files shown in the paper, I want to use for testing , please.

Output of universal_pertubation()

Thank you very much for the code! Learned a lot from it.

The issue i am facing is that the value of 'v' after being computed is coming out to be NaN.
I am implementing this in Matlab. I have changed the value of
opts.delta = 0.5 and opts.p = 2 (random changes), but in all the cases it outputs value NaN
The new fooling rate comes around 0.99733
Kindly advice.

P.S: To be more specific the output
dr = project_boundary_polyhedron(ddf,ff(idx),Q); is turning out to be zero

Should fooling_rate exclude true_label != est_labels_pert ?

May I ask, when caculate

fooling_rate = float(np.sum(est_labels_pert != est_labels_orig) / float(num_images))

Should fooling_rate exclude sth like true_label != est_labels_pert ?
Because when true_label != est_labels_pert, we don't need to fool the network, I think.