# deeprobust.image.defense package

## Submodules

## deeprobust.image.defense.LIDclassifier module

This is an implementation of LID detector. Currently this implementation is under testing.

References

1

  Ma, Xingjun, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. “Characterizing adversarial subspaces using local intrinsic dimensionality.” arXiv preprint arXiv:1801.02613 (2018).

2

  Original code:t https://github.com/xingjunm/lid_adversarial_subspace_detection

Copyright (c) 2018 Xingjun Ma

`get_lid`(model, X_test, X_test_noisy, X_test_adv, k, batch_size)

  get_lid.

  Parameters

    - model – model

    - X_test – clean data

    - X_test_noisy – noisy data

    - X_test_adv – adversarial data

    - k – k

    - batch_size – batch_size

`train`(self, device, train_loader, optimizer, epoch)

  train process.

  Parameters

    - device – device(option:’cpu’, ‘cuda’)

    - train_loader – train data loader

    - optimizer – optimizer

    - epoch – epoch

## deeprobust.image.defense.TherEncoding module

This is an implementation of Thermometer Encoding.

References

1

  Buckman, Jacob, Aurko Roy, Colin Raffel, and Ian Goodfellow. “Thermometer encoding: One hot way to resist adversarial examples.” In International Conference on Learning Representations. 2018.

`Thermometer`(x, levels, flattened=False)

  Thermometer Encoding of the input.

`one_hot`(x, levels)

  One hot Encoding of the input.

`one_hot_to_thermometer`(x, levels, flattened=False)

  Convert One hot Encoding to Thermometer Encoding.

`train`(model, device, train_loader, optimizer, epoch)

  training process.

  Parameters

    - model – model

    - device – device

    - train_loader – training data loader

    - optimizer – optimizer

    - epoch – epoch

## deeprobust.image.defense.YOPO module

This is an implementation of adversarial training variant: YOPO. .. rubric:: References

1

  Zhang, D., Zhang, T., Lu, Y., Zhu, Z., & Dong, B. (2019).

You only propagate once: Painless adversarial training using maximal principle. arXiv preprint arXiv:1905.00877.

2

  Original code: https://github.com/a1600012888/YOPO-You-Only-Propagate-Once

class `CrossEntropyWithWeightPenlty`(module, DEVICE, reg_cof=0.0001)

class `Hamiltonian`(layer, reg_cof=0.0001)

`torch_accuracy`(output, target, topk=(1, )) → List[torch.Tensor]

  param output, target: should be torch Variable

`train_one_epoch`(net, batch_generator, optimizer, eps, criterion, LayerOneTrainner, K, DEVICE=torch.device, descrip_str='Training')
  Parameters

    - attack_freq – Frequencies of training with adversarial examples. -1 indicates natural training

    - AttackMethod – the attack method, None represents natural training

  Returns

    None #(clean_acc, adv_acc)

## deeprobust.image.defense.base_defense module

class `BaseDefense`(model, device)

  Defense base class.

  `adv_data`(model, data, target, **kwargs)

    Generate adversarial examples for adversarial training. Overide this function to generate customize adv examples.

    Parameters

      - model – victim model

      - data – original data

      - target – target labels

      - kwargs – parameters

  `loss`(output, target)

    Calculate training loss. Overide this function to customize loss.

    Parameters

      - output – model outputs

      - target – true labels

  `parse_params`(**kwargs)

    Parse user defined parameters

  `save_model`()

    Save model.

  `test`(test_loader)

    test.

    Parameters

      test_loader – testing data

  `train`(train_loader, optimizer, epoch)

    train.

    Parameters

      - train_loader – training data

      - optimizer – training optimizer

      - epoch – training epoch

## deeprobust.image.defense.fast module

This is an implementation of adversarial training variant: fast

References

1

  Wong, Eric, Leslie Rice, and J. Zico Kolter. “Fast is better than free: Revisiting adversarial training.” arXiv preprint arXiv:2001.03994 (2020).

class `Fast`(model, device)
  `adv_data`(data, output, ep=0.3, num_steps=40)

    Generate adversarial examples for adversarial training. Overide this function to generate customize adv examples.

    Parameters

      - model – victim model

      - data – original data

      - target – target labels

      - kwargs – parameters

  `calculate_loss`(output, target, redmode='mean')

    Calculate loss for training.

  `generate`(train_loader, test_loader, **kwargs)

    FGSM defense process:

  `parse_params`(save_dir='defense_models', save_model=True, save_name='fast_mnist_fgsmtraining_0.2.pt', epsilon=0.2, epoch_num=30, lr_train=0.005, momentum=0.1)

    Parse user defined parameters

  `test`(model, device, test_loader)

    Testing process.

  `train`(device, train_loader, optimizer, epoch)

    Training process.

## deeprobust.image.defense.fgsmtraining module

This is the implementation of fgsm training.

References

..[1]Szegedy, C., Zaremba, W., Sutskever, I., Estrach, J. B., Erhan, D., Goodfellow, I., & Fergus, R. (2014, January). Intriguing properties of neural networks.

class `FGSMtraining`(model, device)

  FGSM adversarial training.

  `adv_data`(data, output, ep=0.3, num_steps=40)

    Generate adversarial data for training.

    Parameters

      - data – data

      - output – output

      - ep – epsilon, perturbation budget.

      - num_steps – iteration steps

  `calculate_loss`(output, target, redmode='mean')

    Calculate loss for training.

  `generate`(train_loader, test_loader, **kwargs)

    FGSM adversarial training process.

    Parameters

      - train_loader – training data loader

      - test_loader – testing data loader

      - kwargs – kwargs

  `parse_params`(save_dir='defense_models', save_model=True, save_name='mnist_fgsmtraining_0.2.pt', epsilon=0.2, epoch_num=50, lr_train=0.005, momentum=0.1)

    parse_params.

    Parameters

      - save_dir – dir

      - save_model – Whether to save model

      - save_name – model name

      - epsilon – attack perturbation constraint

      - epoch_num – number of training epoch

      - lr_train – training learning rate

      - momentum – momentum for optimizor

  `test`(model, device, test_loader)

    testing process.

    Parameters

      - model – model

      - device – device

      - test_loader – testing dataloder

  `train`(device, train_loader, optimizer, epoch)

    training process.

    Parameters

      - device – device

      - train_loader – training data loader

      - optimizer – optimizer

      - epoch – training epoch

## deeprobust.image.defense.pgdtraining module

This is an implementation of pgd adversarial training. .. rubric:: References

..[1]Mądry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017). Towards Deep Learning Models Resistant to Adversarial Attacks. stat, 1050, 9.

class `PGDtraining`(model, device)

  PGD adversarial training.

  `adv_data`(data, output, ep=0.3, num_steps=10, perturb_step_size=0.01)

    Generate input(adversarial) data for training.

  `calculate_loss`(output, target, redmode='mean')

    Calculate loss for training.

  `generate`(train_loader, test_loader, **kwargs)

    Call this function to generate robust model.

    Parameters

      - train_loader – training data loader

      - test_loader – testing data loader

      - kwargs – kwargs

  `parse_params`(epoch_num=100, save_dir='./defense_models', save_name='mnist_pgdtraining_0.3', save_model=True, epsilon=0.03137254901960784, num_steps=10, perturb_step_size=0.01, lr=0.1, momentum=0.1, save_per_epoch=10)

    Parameter parser.

    Parameters

      - epoch_num (int) – epoch

      - save_dir (str) – model dir

      - save_name (str) – model name

      - save_model (bool) – Whether to save model

      - epsilon (float) – attack constraint

      - num_steps (int) – PGD attack iteration time

      - perturb_step_size (float) – perturb step size

      - lr (float) – learning rate for adversary training process

      - momentum (float) – momentum for optimizor

  `test`(model, device, test_loader)

    testing process.

    Parameters

      - model – model

      - device – device

      - test_loader – testing dataloder

  `train`(device, train_loader, optimizer, epoch)

    training process.

    Parameters

      - device – device

      - train_loader – training data loader

      - optimizer – optimizer

      - epoch – training epoch

## deeprobust.image.defense.trades module

This is an implementation of [1] .. rubric:: References

1

  Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., & Jordan, M. (2019, May).

Theoretically Principled Trade-off between Robustness and Accuracy. In International Conference on Machine Learning (pp. 7472-7482).

This implementation is based on their code: https://github.com/yaodongyu/TRADES Copyright (c) 2019 Hongyang Zhang, Yaodong Yu

class `TRADES`(model, device='cuda')

  TRADES.

  `generate`(train_loader, test_loader, **kwargs)

    generate robust model.

    Parameters

      - train_loader – train_loader

      - test_loader – test_loader

      - kwargs – kwargs

  `parse_params`(epochs=100, lr=0.01, momentum=0.9, epsilon=0.3, num_steps=40, step_size=0.01, beta=1.0, seed=1, log_interval=100, save_dir='./defense_model', save_freq=10)
    :param epochint

      - pgd training epoch

    :param save_dirstr

      - directory path to save model

    :param epsilonfloat

      - perturb constraint of pgd adversary example used to train defense model

    :param num_stepsint

      - the perturb

    :param perturb_step_sizefloat

      - step_size

    :param lrfloat

      - learning rate for adversary training process

    :param momentumfloat

      - parameter for optimizer in training process

  `test`(model, device, test_loader)

    test.

    Parameters

      test_loader – testing data

  `train`(device, train_loader, optimizer, epoch)

    train.

    Parameters

      - train_loader – training data

      - optimizer – training optimizer

      - epoch – training epoch

## Module contents