adversarial-library
adversarial-library copied to clipboard
jeromerony
Library containing PyTorch implementations of various adversarial attacks and resources
Adversarial Library
This library contains various resources related to adversarial attacks implemented in PyTorch. It is aimed towards researchers looking for implementations of state-of-the-art attacks.
The code was written to maximize efficiency (e.g. by preferring low level functions from PyTorch) while retaining simplicity (e.g. by avoiding abstractions). As a consequence, most of the library, and especially the attacks, is implemented using pure functions (whenever possible).
While focused on attacks, this library also provides several utilities related to adversarial attacks: distances (SSIM, CIEDE2000, LPIPS), visdom callback, projections, losses and helper functions. Most notably the function run_attack from utils/attack_utils.py performs an attack on a model given the inputs and labels, with fixed batch size, and reports complexity related metrics (run-time and forward/backward propagations).
Dependencies
The goal of this library is to be up-to-date with newer versions of PyTorch so the dependencies are expected to be updated regularly (possibly resulting in breaking changes).
- pytorch>=1.8.0
- torchvision>=0.9.0
- tqdm>=4.48.0
- visdom>=0.1.8
Installation
You can either install using:
pip install git+https://github.com/jeromerony/adversarial-library
Or you can clone the repo and run:
python setup.py install
Alternatively, you can install (after cloning) the library in editable mode:
pip install -e .
Example
For an example on how to use this library, you can look at this repo: https://github.com/jeromerony/augmented_lagrangian_adversarial_attacks
Contents
Attacks
Currently the following attacks are implemented in the adv_lib.attacks module:
| Name | Knowledge | Type | Distance(s) | ArXiv Link |
|---|---|---|---|---|
| Carlini and Wagner (C&W) | White-box | Minimal | L2, L∞ | 1608.04644 |
| Projected Gradient Descent (PGD) | White-box | Budget | L∞ | 1706.06083 |
| Structured Adversarial Attack (StrAttack) | White-box | Minimal | L2 + group-sparsity | 1808.01664 |
| Decoupled Direction and Norm (DDN) | White-box | Minimal | L2 | 1811.09600 |
| Trust Region (TR) | White-box | Minimal | L2, L∞ | 1812.06371 |
| Fast Adaptive Boundary (FAB) | White-box | Minimal | L1, L2, L∞ | 1907.02044 |
| Perceptual Color distance Alternating Loss (PerC-AL) | White-box | Minimal | CIEDE2000 | 1911.02466 |
| Auto-PGD (APGD) | White-box | Budget | L1, L2, L∞ | 2003.01690 2103.01208 |
| Augmented Lagrangian Method for Adversarial (ALMA) | White-box | Minimal | L1, L2, SSIM, CIEDE2000, LPIPS, ... | 2011.11857 |
| Folded Gaussian Attack (FGA) Voting Folded Gaussian Attack (VFGA) |
White-box | Minimal | L0 | 2011.12423 |
| Fast Minimum-Norm (FMN) | White-box | Minimal | L0, L1, L2, L∞ | 2102.12827 |
| Primal-Dual Gradient Descent (PDGD) Primal-Dual Proximal Gradient Descent (PDPGD) |
White-box | Minimal | L2 L0, L1, L2, L∞ |
2106.01538 |
Bold means that this repository contains the official implementation.
Type refers to the goal of the attack:
- Minimal attacks aim to find the smallest adversarial perturbation w.r.t. a given distance;
- Budget attacks aim to find an adversarial perturbation within a distance budget (and often to maximize a loss as well).
Distances
The following distances are available in the utils adv_lib.distances module:
- Lp-norms
- SSIM https://ece.uwaterloo.ca/~z70wang/research/ssim/
- MS-SSIM https://ece.uwaterloo.ca/~z70wang/publications/msssim.html
- CIEDE2000 color difference http://www2.ece.rochester.edu/~gsharma/ciede2000/ciede2000noteCRNA.pdf
- LPIPS https://arxiv.org/abs/1801.03924
Contributions
Suggestions and contributions are welcome :)
Citation
If this library has been useful for your research, you can cite it using the "Cite this repository" button in the "About" section.
Metadata
Owner
jeromerony
Metadata
Library containing PyTorch implementations of various adversarial attacks and resources