FOR NEURIPS REVIEWERS.

General requirements :

The packages used to run this are all in reqenv.yml. You should not need all of it, just get pytorch and torchvision.

Depending on what GPU you are using the default batch size will start failing after a certain model size, just lower it (or just run with batch size 1 for all). On my GPU (Tesla V100 32 GB) batch size 2-4 works for even the largest models.

You need imagenet (validation only unless fixup, for which you also need the trainset)



Running the code :

1) Resnet - holds the code for all vanilla resnets. You need to change the model (line 205, run_attack.py) and the validation directory of imagenet (line 275)

For every model change you need to correspondingly change the layer latent called by firstlayerlatent and difflayerlatent in resnetmodels.py.

The main code is in run_attack.py, modify the main function to feed in your epsilon and attack type, this is processed in lines 369-376.

The core functions for attacking are called : pgd_radial_movement_alt_final, and pgd_alt(PGD), fgsm, randomatt.

2) Transfer :

Here the loop by default will check all methods (lines 316-318). Again you need to change the model (line 181) and the firstlayerlatent(used to train the classifier) and firstlayerlatent_alt, difflayerlatent_alt (used for the radial attack) methods correspondingly if you want to change the model from Resnet18 to something else.

To run with CIFAR-10 just change all the occurrences of CIFAR100 to CIFAR10 and the classifier (downstream_classifier, line 301) used to output 10 classes.

The core functions for attacking are called : pgd_radial_movement_alt_final, and pgd_alt_transfer(PGD), randomattack - FGSM is run as a special case of pgd_alt_transfer.

For the above cases running the main .py files should be straightforward.

Next two cases are effnet and Fixup. Here, you need to add the modifications provided on top of the public repositories.

First get fixup :

https://github.com/hongyi-zhang/Fixup/tree/master/imagenet

Train the models you need, using imagenet_train.

Then open the fixup folder provided and look at imagenet_test101.py (the main file) and also the fixup_resnet_imagenet.py provided.

You need to replace the fixup_resnet_imagenet.py that you have from Fixup,

i.e. - https://github.com/hongyi-zhang/Fixup/blob/master/imagenet/models/fixup_resnet_imagenet.py

with the one provided, which has the firstlayerlatent etc. arguments to run the radial attack.

Now, back to imagenet_test101.py (put this wherever your imagenet train py from fixup is) :

You need to change the argument of arch, and also line 197 to match with whatever you trained with.

Similarly, need to change lines 218,219 to point to where your imagenet is.

Now you can run it. For benchmarking, use as-is.

For running radial attack, uncomment line 430 and comment out lines 423-428.

The core functions for attacking are called : pgd_radial_movement_alt, and pgd_alt(PGD), fgsm, randomnoise.

https://github.com/hongyi-zhang/Fixup <- check the cifar_train.py example here of how to feed the args in.

Effnet :

Get this repository :

https://github.com/lukemelas/EfficientNet-PyTorch

And download all the efficient models.

https://github.com/lukemelas/EfficientNet-PyTorch/blob/master/efficientnet_pytorch/utils.py

^ Lines 556-579 have the URLs.

Now open the provided effnet folder. The model.py in it needs to replace the model.py of the source repo to support latent extraction :

https://github.com/lukemelas/EfficientNet-PyTorch/blob/master/efficientnet_pytorch/model.py

Once you are done with this, open testrun.py.

Change layernum (line 27) and the offsets relative to layernum - lines 36,40 - to match the depths of the attack.

change line 225 to point to the correct pretrained model.

Run the testrun.py now for radial attack. The type of attack argument provided has gone unused, if you wish to change for benchmarking, change line 437 directly.

FGSM, randomatt, pgd_alt (PGD) functions will provide the benchmarks.

The radial attack function is pgd_radial_movement_alt_final.

https://github.com/lukemelas/EfficientNet-PyTorch/tree/master/examples/imagenet <- example where I started modifying from, has an example of how to feed the args in.

