Adversarial Patch PyTorch Help

[dominic-simon]

Hello,

I'm trying to use the PyTorch implementation of the Adversarial Patch, but am having issues producing a usable patch. All of the patches that I have produced are just black circles that don't cause the model in use to predict the image's class as the patch class. Assistance in generating a working patch using the PyTorch implementation of the Adversarial Patch would be greatly appreciated.

Here is my code:

import os
import warnings
warnings.filterwarnings('ignore')

import random
import numpy as np
from matplotlib import pyplot as plt
plt.rcParams['figure.figsize'] = [10, 10]
import imagenet_stubs
from imagenet_stubs.imagenet_2012_labels import name_to_label

from tensorflow.keras.preprocessing import image

from art.estimators.classification import PyTorchClassifier
from art.attacks.evasion import AdversarialPatchPyTorch

import torch
import torchvision.models as Models
import torchvision.transforms as Transforms

def get_labels():
    with open(os.path.join('/home/dominicsimon/Downloads/PatchAttack-master/imagenet1000_clsidx_to_labels.txt')) as file:
        lines = file.readlines()
        return [line.split("'")[1] for line in lines]

def bgr_to_rgb(x):
    return x[:, :, ::-1]

def predict_model(classifier, image, file):
    image = np.copy(image)
    image = np.expand_dims(image, axis=0)

    prediction_list = classifier.predict(image)
    prediction = np.argmax(prediction_list, axis=1)[0]

    return_name = labels_as_strings[prediction]
    file.write(f'{return_name}\n')
    return return_name

target_name = ['toaster', 'barn', 'torch', 'daisy', 'kelpie', 'bee', 'modem', 'convertible']
target_num =  [  859,      425,     862,     985,      227,    309,    662,        511]
image_shape = (3, 224, 224)
clip_values = (0, 1)
nb_classes = 1000
batch_size = 16
scale_min = 0.4
scale_max = 1.0
rotation_max = 22.5
learning_rate = 5.
max_iter = 100

ptc = PyTorchClassifier(model=Models.resnet50(pretrained=True), loss=None, input_shape=image_shape,
                        nb_classes=nb_classes, clip_values=clip_values, device_type='cpu',
                        preprocessing=(np.array([0.485, 0.456, 0.406]), np.array([0.229, 0.224, 0.225])))

images_list = list()

for image_path in imagenet_stubs.get_image_paths():
  im = image.load_img(image_path, target_size=(224, 224))
  im = image.img_to_array(im)
  im = im[:, :, ::-1].astype(np.float32) # RGB to BGR
  im = np.expand_dims(im, axis=0)
  images_list.append(im)

images = np.vstack(images_list)

ap = AdversarialPatchPyTorch(classifier=ptc, rotation_max=rotation_max, scale_min=scale_min,
                             scale_max=scale_max, learning_rate=learning_rate, max_iter=max_iter,
                             batch_size=batch_size, patch_shape=(3, 224, 224))

file = open('/home/dominicsimon/Downloads/zfinal_images/pytorch_try/predictions.txt', 'a')
labels_as_strings = get_labels()

target_index = -1
acc = 0
for i, image_path in enumerate(os.listdir('/home/dominicsimon/Downloads/PatchAttack-master/imagenet')):
    if i == 100:
        break

    if (i%10) == 0:
        target_index += 1
        label = name_to_label(target_name[target_index])
        y_one_hot = np.zeros(nb_classes)
        y_one_hot[label] = 1.0
        y_target = np.tile(y_one_hot, (images.shape[0], 1))
        patch, patch_mask = ap.generate(x=np.transpose(images,(0, 3, 1, 2)), y=y_target)

    input_path = os.path.join('/home/dominicsimon/Downloads/PatchAttack-master/imagenet', image_path)
    im = image.load_img(input_path, target_size=(224, 224))
    im = image.img_to_array(im)
    im = im[:, :, ::-1].astype(np.float32) # RGB to BGR
    im = np.expand_dims(im, axis=0)

    plt.imshow(bgr_to_rgb(np.squeeze(im).astype(np.uint8)))
    plt.show()

    patched_images = ap.apply_patch(np.transpose(im, (0, 3, 1, 2)), scale=0.4)

    plt.imshow(bgr_to_rgb(np.transpose(patched_images[0].astype(np.uint8), (1, 2, 0))))
    plt.show()

    file.write(f'{i+1}.\nTarget Class: {target_name[target_index]}\n')
    name = predict_model(ptc, patched_images[0], file)
    file.write('\n')

    if target_name[target_index] in name:
        acc += 1

file.write(f'Accuracy: {(acc / i) * 100}%')
file.close()

Here is an example of what is being produced:

Please let me know if there's anything else I need to share and I will do so ASAP. Thank you in advance for the help.

[beat-buesser]

Hi @dominic-simon Thank you for using ART! I have looked at your code. Could you please describe the reason for the if-block starting with

if (i%10) == 0:
    target_index += 1
    ...

[dominic-simon]

@beat-buesser

import os
import warnings
warnings.filterwarnings('ignore')

import random
import numpy as np
from matplotlib import pyplot as plt
plt.rcParams['figure.figsize'] = [10, 10]
import imagenet_stubs
from imagenet_stubs.imagenet_2012_labels import name_to_label

from tensorflow.keras.preprocessing import image

from art.estimators.classification import PyTorchClassifier
from art.attacks.evasion import AdversarialPatchPyTorch

import torch
import torchvision.models as Models
import torchvision.transforms as Transforms

def get_labels():
    with open(os.path.join('/home/dominicsimon/Downloads/PatchAttack-master/imagenet1000_clsidx_to_labels.txt')) as file:
        lines = file.readlines()
        return [line.split("'")[1] for line in lines]

def predict_model(classifier, image, file):
    image = np.expand_dims(image, axis=0)

    prediction_list = classifier.predict(image)
    prediction = np.argmax(prediction_list, axis=1)[0]

    to_tensor = Transforms.ToTensor()
    image = to_tensor(np.squeeze(image))
    image = image.unsqueeze(0)
    image = np.transpose(image, (0, 2, 1, 3))
    model = Models.resnet50(pretrained=True).cuda().eval()
    with torch.no_grad():
      no_patch_output = model(image.cuda()).argmax(dim=1).item()

    return_name = labels_as_strings[prediction]
    pn = labels_as_strings[no_patch_output]
    file.write(f'{return_name}\n')

    print(f'ART : {return_name}\nPyTorch :{pn}\n')

    return return_name

target_name = ['toaster', 'barn', 'torch', 'daisy', 'kelpie', 'bee', 'modem', 'convertible']
target_num =  [  859,      425,     862,     985,      227,    309,    662,        511]
image_shape = (3, 224, 224)
clip_values = (0, 1)
nb_classes = 1000
batch_size = 16
scale_min = 0.4
scale_max = 1.0
rotation_max = 22.5
learning_rate = 0.01
max_iter = 250

ptc = PyTorchClassifier(model=Models.resnet50(pretrained=True).eval(), loss=None, input_shape=image_shape,
                        nb_classes=nb_classes, clip_values=clip_values, device_type='cpu',
                        preprocessing=(np.array([0.485, 0.456, 0.406]), np.array([0.229, 0.224, 0.225])))

images_list = list()

for image_path in imagenet_stubs.get_image_paths():
  im = image.load_img(image_path, target_size=(224, 224))
  im = image.img_to_array(im)
  im = im.astype(np.float32) # RGB to BGR
  im = np.expand_dims(im, axis=0)
  images_list.append(im)

images = np.vstack(images_list)

for i, img in enumerate(images):
    img /= 255
    images[i] = img

ap = AdversarialPatchPyTorch(classifier=ptc, rotation_max=rotation_max, scale_min=scale_min,
                             scale_max=scale_max, learning_rate=learning_rate, max_iter=max_iter,
                             batch_size=batch_size, patch_shape=(3, 224, 224))

file = open('/home/dominicsimon/Downloads/zfinal_images/t/predictions.txt', 'a')
labels_as_strings = get_labels()

target_index = -1
acc = 0
for i, image_path in enumerate(os.listdir('/home/dominicsimon/Downloads/PatchAttack-master/imagenet')):
    if i == 80:
        break

    if (i%10) == 0:
        target_index += 1
        label = name_to_label(target_name[target_index])
        y_one_hot = np.zeros(nb_classes)
        y_one_hot[label] = 1.0
        y_target = np.tile(y_one_hot, (images.shape[0], 1))
        ap.reset_patch()
        patch, patch_mask = ap.generate(x=np.transpose(images,(0, 3, 1, 2)), y=y_target)

    input_path = os.path.join('/home/dominicsimon/Downloads/PatchAttack-master/imagenet', image_path)
    im = image.load_img(input_path, target_size=(224, 224))
    im = image.img_to_array(im)
    im = im.astype(np.float32) # RGB to BGR
    im = np.expand_dims(im, axis=0)
    im /= 255

    plt.imshow(np.squeeze(im*255).astype(np.uint8))
    plt.savefig(f'/home/dominicsimon/Downloads/zfinal_images/t/{i}_regular.png')

    patched_images = ap.apply_patch(np.transpose(im, (0, 3, 1, 2)), scale=0.4)

    plt.imshow(np.transpose((patched_images[0]*255).astype(np.uint8), (1, 2, 0)))
    plt.savefig(f'/home/dominicsimon/Downloads/zfinal_images/t/{i}_patched.png')

    file.write(f'{i+1}.\nTarget Class: {target_name[target_index]}\n')
    name = predict_model(ptc, patched_images[0], file)
    file.write('\n')

    if target_name[target_index] in name:
        acc += 1

file.write(f'Accuracy: {(acc / 80) * 100}%')
file.close()

[dominic-simon]

@beat-buesser To be clear, though, I don't need this script specifically to work, I just need to know how to get the PyTorch Adversarial Patch working with a good attack success rate.

[beat-buesser]

@dominic-simon So far I have not found a bug. You probably already noticed, in the most recent script, the tensor image provided to evaluate model in predict_model would have to be normalised for correct predictions. I was able to easily overfit the patch on a single image with limited sampling ranges. I think using more training images, smaller sampling ranges, and larger batch size should result in better convergence. AdversarialPatchPyTorch supports ART's summary writer (https://github.com/Trusted-AI/adversarial-robustness-toolbox/wiki/ART-Summary-Writer) since 1.9, it allows you to collect for example the evolution of the loss to examine its behaviour with TensorBoard.

[dominic-simon]

@beat-buesser I will try all that. My only question is, what do you mean by sampling ranges?

Also, thank you so much for all your help.

[beat-buesser]

@dominic-simon I mean the arguments like scale_min, scale_max, rotation_max, etc. During training the patch is transformed for each training image and iteration with a different randomly sampled value for scale, rotation, shift, etc. Less randomness by reducing these ranges to zero makes it easier to converge on the loss optimisation, but makes the final patch less robust against these transformation in its application.