notebooks/art-for-tensorflow-v2-callable.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# ART for TensorFlow v2 - Callable Class/Function"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This notebook demonstrates applying ART with TensorFlow v2 using callable classes or functions to define models. The code follows and extends the examples on www.tensorflow.org."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import warnings\n",
    "warnings.filterwarnings('ignore')\n",
    "import os\n",
    "os.environ['TF_CPP_MIN_LOG_LEVEL'] = '3' \n",
    "import tensorflow as tf\n",
    "from tensorflow.keras.layers import Dense, Flatten, Conv2D\n",
    "from tensorflow.keras import Model\n",
    "import numpy as np\n",
    "from matplotlib import pyplot as plt\n",
    "\n",
    "from art.estimators.classification import TensorFlowV2Classifier\n",
    "from art.attacks.evasion import FastGradientMethod, CarliniLInfMethod"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "if tf.__version__[0] != '2':\n",
    "    raise ImportError('This notebook requires TensorFlow v2.')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Load MNIST dataset"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "(x_train, y_train), (x_test, y_test) = tf.keras.datasets.mnist.load_data()\n",
    "x_train, x_test = x_train / 255.0, x_test / 255.0\n",
    "\n",
    "x_train = x_train.astype(np.float32)\n",
    "x_test = x_test.astype(np.float32)\n",
    "\n",
    "x_test = x_test[0:100]\n",
    "y_test = y_test[0:100]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Add a dimension for color channel"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "x_train = x_train[..., tf.newaxis]\n",
    "x_test = x_test[..., tf.newaxis]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create loss object and optimizer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "loss_object = tf.keras.losses.SparseCategoricalCrossentropy()\n",
    "optimizer = tf.keras.optimizers.Adam()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define metrics for training and testing"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "train_loss = tf.keras.metrics.Mean(name='train_loss')\n",
    "train_accuracy = tf.keras.metrics.SparseCategoricalAccuracy(name='train_accuracy')\n",
    "\n",
    "test_loss = tf.keras.metrics.Mean(name='test_loss')\n",
    "test_accuracy = tf.keras.metrics.SparseCategoricalAccuracy(name='test_accuracy')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# TensorFlow with callable class"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a custom model class."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [],
   "source": [
    "class KerasModel(Model):\n",
    "    def __init__(self):\n",
    "        super(KerasModel, self).__init__()\n",
    "        self.conv1 = Conv2D(filters=3, kernel_size=3, activation='relu')\n",
    "        self.flatten = Flatten()\n",
    "        self.dense1 = Dense(10, activation='softmax')\n",
    "\n",
    "    def call(self, x):\n",
    "        x = self.conv1(x)\n",
    "        x = self.flatten(x)\n",
    "        x = self.dense1(x)\n",
    "        return x"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create callable model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "model = KerasModel()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create input pipelines for training and testing"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [],
   "source": [
    "train_ds = tf.data.Dataset.from_tensor_slices((x_train, y_train)).shuffle(10000).batch(32)\n",
    "test_ds = tf.data.Dataset.from_tensor_slices((x_test, y_test)).batch(32)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define the training step."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "@tf.function\n",
    "def train_step(images, labels):\n",
    "    with tf.GradientTape() as tape:\n",
    "        predictions = model(images)\n",
    "        loss = loss_object(labels, predictions)\n",
    "    gradients = tape.gradient(loss, model.trainable_variables)\n",
    "    optimizer.apply_gradients(zip(gradients, model.trainable_variables))\n",
    "\n",
    "    train_loss(loss)\n",
    "    train_accuracy(labels, predictions)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define the testing step."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [],
   "source": [
    "@tf.function\n",
    "def test_step(images, labels):\n",
    "    predictions = model(images)\n",
    "    t_loss = loss_object(labels, predictions)\n",
    "\n",
    "    test_loss(t_loss)\n",
    "    test_accuracy(labels, predictions)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Fit the model on training data and collect metrics for training and testing."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Epoch 1, Loss: 0.30, Accuracy: 91.59, Test Loss: 0.08, Test Accuracy: 97.00\n",
      "Epoch 2, Loss: 0.23, Accuracy: 93.57, Test Loss: 0.07, Test Accuracy: 97.50\n",
      "Epoch 3, Loss: 0.20, Accuracy: 94.46, Test Loss: 0.06, Test Accuracy: 98.00\n"
     ]
    }
   ],
   "source": [
    "epochs = 3\n",
    "\n",
    "for epoch in range(epochs):\n",
    "    for images, labels in train_ds:\n",
    "        train_step(images, labels)\n",
    "\n",
    "    for test_images, test_labels in test_ds:\n",
    "        test_step(test_images, test_labels)\n",
    "\n",
    "    template = 'Epoch {}, Loss: {:4.2f}, Accuracy: {:4.2f}, Test Loss: {:4.2f}, Test Accuracy: {:4.2f}'\n",
    "    print(template.format(epoch + 1,\n",
    "                          train_loss.result(),\n",
    "                          train_accuracy.result() * 100,\n",
    "                          test_loss.result(),\n",
    "                          test_accuracy.result() * 100))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate model accuracy on test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on test data: 99.00%\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(model(x_test), axis=1)\n",
    "accuracy_test = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "print('Accuracy on test data: {:4.2f}%'.format(accuracy_test * 100))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART TensorFlow v2 classifier for the TensorFlow custom model class."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "classifier = TensorFlowV2Classifier(model=model, nb_classes=10, input_shape=(28, 28, 1), loss_object=loss_object, \n",
    "                                    clip_values=(0, 1), channels_first=False)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Fast Gradient Sign Method attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART Fast Gradient Sign Method attack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_fgsm = FastGradientMethod(estimator=classifier)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Generate adversarial test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "scrolled": false
   },
   "outputs": [],
   "source": [
    "x_test_adv = attack_fgsm.generate(x_test)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate accuracy on adversarial test data and calculate average perturbation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on adversarial test data: 1.00%\n",
      "Average perturbation: 0.17\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(model(x_test_adv), axis=1)\n",
    "accuracy_test_adv = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "perturbation = np.mean(np.abs((x_test_adv - x_test)))\n",
    "print('Accuracy on adversarial test data: {:4.2f}%'.format(accuracy_test_adv * 100))\n",
    "print('Average perturbation: {:4.2f}'.format(perturbation))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Visualise the first adversarial test sample."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAQEAAAECCAYAAAD+eGJTAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjMsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+AADFEAAAPd0lEQVR4nO3dcYwc5X3G8efBdiCccbBxMA4xBVyjQhJhwgm3EEWuEKkLQoBSqrqIOk1U0xTU0NAmiP4BqlQJVYAbVQ2Via2YCKhQgAACFSwrglQFK2dDwPiS4FAHG19tjOuCrzJw9q9/3Di9wN0755udnbl7vx/Jur357e78bm7v8cy+7844IgQgX8c03QCAZhECQOYIASBzhACQOUIAyBwhAGSukRCwvcz2z2xvs31zEz2k2N5u+2XbL9rua0E/a23vsb1lxLI5ttfbfrX4Ortl/d1m+41iG75o+9IG+1tg+4e2+22/YvtrxfJWbMNEf13Zhu72PAHb0yT9XNIlknZK+rGk5RGxtauNJNjeLqk3IvY23Ysk2f68pAOS7o2ITxfL/kHSvoi4vQjS2RHxzRb1d5ukAxFxRxM9jWR7vqT5EbHZ9gmSNkm6UtKX1IJtmOjvD9WFbdjEnsAFkrZFxGsR8Z6kf5V0RQN9TBoR8aykfR9YfIWkdcXtdRp+0TRijP5aIyIGImJzcfsdSf2STlVLtmGiv65oIgROlbRjxPc71cUfeJxC0tO2N9le2XQzY5gXEQPS8ItI0skN9zOaG2y/VBwuNHa4MpLt0yWdJ2mjWrgNP9Cf1IVt2EQIeJRlbZu7fFFEfFbS70u6vtjdxdG5W9JCSYslDUi6s9l2JNszJT0k6caIeLvpfj5olP66sg2bCIGdkhaM+P6TknY10MeYImJX8XWPpEc0fAjTNruLY8kjx5R7Gu7n10TE7og4FBGHJd2jhreh7Rka/gO7LyIeLha3ZhuO1l+3tmETIfBjSYtsn2H7I5L+SNJjDfQxKts9xZszst0j6QuStqQf1YjHJK0obq+Q9GiDvXzIkT+uwlVqcBvatqQ1kvoj4q4RpVZsw7H669Y27ProgCQVQx3/KGmapLUR8fddb2IMts/U8P/+kjRd0v1N92f7AUlLJc2VtFvSrZJ+IOlBSadJel3S1RHRyJtzY/S3VMO7sSFpu6Trjhx/N9Df5yT9SNLLkg4Xi2/R8HF349sw0d9ydWEbNhICANqDGYNA5ggBIHOEAJA5QgDIHCEAZK7REGjxlFxJ9FdVm/trc29Sd/trek+g1b8I0V9Vbe6vzb1JXeyv6RAA0LBKk4VsL5P0LQ3P/PtORNyeuv/043ri2JlzfvX90MFBTT+uZ8Lrrxv9VdPm/trcm9T5/t49sE9DBwdH+/Cepk/0SYuTg/yzRpwcxPZjqZODHDtzjs657K8mukoAE7T1iVVj1qocDnByEGAKqBICk+HkIABKVAmBcZ0cxPZK2322+4YODlZYHYA6VAmBcZ0cJCJWR0RvRPS2+Y0YIFdVQqDVJwcBMD4THh2IiCHbN0h6Sv9/cpBXOtYZgK6YcAhIUkQ8KenJDvUCoAHMGAQyRwgAmSMEgMwRAkDmCAEgc4QAkLlKQ4RHa9pbgzrxe89N+PH7r/2dDnbzYVV6w9RX9+uvKewJAJkjBIDMEQJA5ggBIHOEAJA5QgDIHCEAZK6r8wQOndSj/ZeNPdba9Dj9VB0HPqLu7dv09qv755uq2489ASBzhACQOUIAyBwhAGSOEAAyRwgAmSMEgMxNqvMJoJqmx/HrVvXny/W1yZ4AkDlCAMgcIQBkjhAAMkcIAJkjBIDMEQJA5ro6T6BM28exmx5Hnurbp+mfr+n1N6VSCNjeLukdSYckDUVEbyeaAtA9ndgT+N2I2NuB5wHQAN4TADJXNQRC0tO2N9le2YmGAHRX1cOBiyJil+2TJa23/dOIeHbkHYpwWClJx+n4iqsD0GmV9gQiYlfxdY+kRyRdMMp9VkdEb0T0ztCxVVYHoAYTDgHbPbZPOHJb0hckbelUYwC6o8rhwDxJj9g+8jz3R8S/pR5Qdt2Btpvs48hl4/hVf77Jvn1yNeEQiIjXJJ3bwV4ANIAhQiBzhACQOUIAyBwhAGSOEAAyRwgAmWvVdQeaHmcuG0c/5vj0tOdffn1xsn78QCTr0w+m6x+77/lkvUzT27ftcj1fBHsCQOYIASBzhACQOUIAyBwhAGSOEAAyRwgAmWvVdQeaVjZO++bF7yXrCxfs6GQ7H3L4ywuS9b0HepL1A/3p53/1T+4+2pZ+zaJ7v1rp8XV77po7kvUl59+UrM/d5Errb3oewljYEwAyRwgAmSMEgMwRAkDmCAEgc4QAkDlCAMicI9KfYe+kWZ4TS3zxhB/f9Ofhy8Z5fd6nkvV44ZVKj3/zglnJ+v98/mCyfsYp6YtHv7ZrbrJ+5ifqvfj0u0PpaSsDb30sWT993lvV1v9P89P1E6ZVev4ydV4XYusTqzS4d8eoEx3YEwAyRwgAmSMEgMwRAkDmCAEgc4QAkDlCAMhcV88ncOikHu2/bOyxzrZ+3vqIyvMUPl3t8dP/N11feM0LyfrP1/Qm6ydu/kiyvu38eekGSpz15b5k/aMlj//o1y9M1ndd9H6y/okT307WZ/bvS6//Z9uS9aqvj9Zed8D2Wtt7bG8ZsWyO7fW2Xy2+zq63TQB1Gc/hwHclLfvAspslbYiIRZI2FN8DmIRKQyAinpX0wf2kKyStK26vk3Rlh/sC0CUTfWNwXkQMSFLx9eTOtQSgm2ofHbC90naf7b6hg4N1rw7AUZpoCOy2PV+Siq97xrpjRKyOiN6I6J1+XPpsuAC6b6Ih8JikFcXtFZIe7Uw7ALqtdJ6A7QckLZU01/ZOSbdKul3Sg7a/Iul1SVePZ2XT3hpMzgVo+nwBU91ZX0mP05dp+o2fU7+9OVl/79J0h+vPfjxZP3fZXyTrp5TMEyhT5/kCqigNgYhYPkZp4mcHAdAaTBsGMkcIAJkjBIDMEQJA5ggBIHOEAJC5rp5PYKqr+3wIuc+j+M97FyXrPz3ne8n6p567Jlmfua/ea3CU/f6amkfAngCQOUIAyBwhAGSOEAAyRwgAmSMEgMwRAkDmWjVPoOnPWze9/jJtvy5DmbLtd+lfP5OsH967P1n/zMY/TtY/+cVXkvW6tfX3x54AkDlCAMgcIQBkjhAAMkcIAJkjBIDMEQJA5hxR72eoR5rlObHEY5+pvOlx+DJV5xG0dZy4LZ7a9WKyfkn/5cn6MRfvSNabnmdSt9TPt/WJVRrcu8Oj1dgTADJHCACZIwSAzBECQOYIASBzhACQOUIAyFyrzifQtKrjvE2PE9et6jj7H3zz6WS9bB7AzmcWJOunKT1PoG5tn+cyltI9Adtrbe+xvWXEsttsv2H7xeLfpfW2CaAu4zkc+K6kZaMsXxURi4t/T3a2LQDdUhoCEfGspH1d6AVAA6q8MXiD7ZeKw4XZHesIQFdNNATulrRQ0mJJA5LuHOuOtlfa7rPd977eneDqANRlQiEQEbsj4lBEHJZ0j6QLEvddHRG9EdE7Q8dOtE8ANZlQCNieP+LbqyRtGeu+ANqtdJ6A7QckLZU01/ZOSbdKWmp7saSQtF3SdeNZ2aGTerT/ssk5lorq8yD+5fxLkvVTfmtPsn7a3/1Hsj5Zx+mbVhoCEbF8lMVraugFQAOYNgxkjhAAMkcIAJkjBIDMEQJA5ggBIHNdPZ/AtLcGk2PNTY/zTvXz0tft0NLPJutnfuaNZH392Y8n60uu/epR99QmVX//db0+2RMAMkcIAJkjBIDMEQJA5ggBIHOEAJA5QgDIXFbXHZjq4/R1+8X9i5P1bUvXVnr+Mx9Jn5ZiEb+/WrAnAGSOEAAyRwgAmSMEgMwRAkDmCAEgc4QAkLmuzhNo+roDVT+PPdXnGfzXjRcm69uWfrvS878+dCBZ//jz6f+Tmj7fxFTFngCQOUIAyBwhAGSOEAAyRwgAmSMEgMwRAkDmWnXdgTJNjxNP9usS/PeX0v3/5BvV5gGU+b0130jWZylqXT9GV7onYHuB7R/a7rf9iu2vFcvn2F5v+9Xi6+z62wXQaeM5HBiSdFNEnC3ptyVdb/scSTdL2hARiyRtKL4HMMmUhkBEDETE5uL2O5L6JZ0q6QpJ64q7rZN0ZV1NAqjPUb0xaPt0SedJ2ihpXkQMSMNBIenkTjcHoH7jDgHbMyU9JOnGiHj7KB630naf7b739e5EegRQo3GFgO0ZGg6A+yLi4WLxbtvzi/p8SXtGe2xErI6I3ojonaFjO9EzgA4az+iAJa2R1B8Rd40oPSZpRXF7haRHO98egLo5Ij02a/tzkn4k6WVJh4vFt2j4fYEHJZ0m6XVJV0fEvtRzzfKcWOKLx6w3PQ+gbm0/H8HhDQuS9fVnP56sn/XMimT9jOU/OeqeclLn63/rE6s0uHeHR6uVThaKiH+XNOqDJY39Fw1gUmDaMJA5QgDIHCEAZI4QADJHCACZIwSAzHX1fAJlysbRm55H0PZx/h1/m75uwNbr0+cLuKQ/PU9g2eXXJOtnbKp3HkDT141o+vVXF/YEgMwRAkDmCAEgc4QAkDlCAMgcIQBkjhAAMteqeQJtH4ete5y66vP/6fKnKj2+7HwBC6/982R97jlT+/c3VbEnAGSOEAAyRwgAmSMEgMwRAkDmCAEgc4QAkLlWzROY6qqOU++56FCy/jdzfpGsX9J/ebJeNk8AUxN7AkDmCAEgc4QAkDlCAMgcIQBkjhAAMkcIAJkrnSdge4GkeyWdIumwpNUR8S3bt0n6M0lvFne9JSKeTD3XoZN6tP8yPtM9UZf3vpCs1z0P4DdvfD5Z5/P6k9N4JgsNSbopIjbbPkHSJtvri9qqiLijvvYA1K00BCJiQNJAcfsd2/2STq27MQDdcVTvCdg+XdJ5kjYWi26w/ZLttbZnd7g3AF0w7hCwPVPSQ5JujIi3Jd0taaGkxRreU7hzjMettN1nu2/o4GAHWgbQSeMKAdszNBwA90XEw5IUEbsj4lBEHJZ0j6QLRntsRKyOiN6I6J1+XE+n+gbQIaUhYNuS1kjqj4i7RiyfP+JuV0na0vn2ANRtPKMDF0m6VtLLtl8slt0iabntxZJC0nZJ19XSIYBaOSK6trJZnhNLfHHX1jfVxIXnJutPf39dsn7m99M5vegvNybrZfMAyq6rgOZsjA16O/Z5tBozBoHMEQJA5ggBIHOEAJA5QgDIHCEAZI4QADLHPAH8CvMApi7mCQAYEyEAZI4QADJHCACZIwSAzBECQOYIASBzXZ0nYPtNSb8csWiupL1da+Do0V81be6vzb1Jne/vNyLi46MVuhoCH1q53RcRvY01UIL+qmlzf23uTepufxwOAJkjBIDMNR0Cqxtefxn6q6bN/bW5N6mL/TX6ngCA5jW9JwCgYYQAkDlCAMgcIQBkjhAAMvd/R7SjmtWZGnsAAAAASUVORK5CYII=\n",
      "text/plain": [
       "<Figure size 288x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.matshow(x_test_adv[0, :, :, 0])\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Carlini&Wagner Infinity-norm attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART Carlini&Wagner Infinity-norm attack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_cw = CarliniLInfMethod(classifier=classifier, eps=0.3, max_iter=100, learning_rate=0.01)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Generate adversarial test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C&W L_inf: 100%|██████████| 1/1 [00:08<00:00,  8.29s/it]\n"
     ]
    }
   ],
   "source": [
    "x_test_adv = attack_cw.generate(x_test)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate accuracy on adversarial test data and calculate average perturbation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on adversarial test data: 23.00%\n",
      "Average perturbation: 0.02\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(model(x_test_adv), axis=1)\n",
    "accuracy_test_adv = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "perturbation = np.mean(np.abs((x_test_adv - x_test)))\n",
    "print('Accuracy on adversarial test data: {:4.2f}%'.format(accuracy_test_adv * 100))\n",
    "print('Average perturbation: {:4.2f}'.format(perturbation))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Visualise the first adversarial test sample."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAQEAAAECCAYAAAD+eGJTAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjMsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+AADFEAAAODklEQVR4nO3df4xc5XXG8eeJvazjtWnsOHZcY3BDSBSSBlNtIJHbyhElJYmQQQltLNVypTSLWpCgitoiSxGW2qYU8aO0aZFMceNEhoTGUFDiprGstBSVOtiWAYNpTalLHW+9gNPaBPDP0z/2mm7J7ju7Oz/urM/3I61m5p479x5fzz773pl37zoiBCCvt9XdAIB6EQJAcoQAkBwhACRHCADJEQJAcrWEgO0rbP+L7edt31RHDyW299l+2vYu29u7oJ/1tods7x6xbK7tLbb3Vrdzuqy/tbZ/WB3DXbY/VWN/i21/3/Ye28/YvqFa3hXHsNBfR46hOz1PwPY0Sf8q6XJJ+yU9IWllRDzb0UYKbO+T1B8RL9fdiyTZ/kVJr0r6WkR8qFp2q6RDEXFLFaRzIuL3uqi/tZJejYjb6uhpJNsLJS2MiJ22Z0vaIekqSb+uLjiGhf5+RR04hnWMBC6R9HxEvBARxyR9Q9KKGvqYMiLiUUmH3rJ4haQN1f0NGn7R1GKM/rpGRAxGxM7q/hFJeyQtUpccw0J/HVFHCCyS9J8jHu9XB//B4xSSvmd7h+2BupsZw4KIGJSGX0SS5tfcz2iut/1UdbpQ2+nKSLaXSLpY0jZ14TF8S39SB45hHSHgUZZ129zlZRHxc5I+Kem6ariLiblb0vmSlkoalHR7ve1ItmdJ2iTpxog4XHc/bzVKfx05hnWEwH5Ji0c8PkfSgRr6GFNEHKhuhyQ9pOFTmG5zsDqXPH1OOVRzP/9PRByMiJMRcUrSPar5GNru0fA32MaIeLBa3DXHcLT+OnUM6wiBJyRdYPtnbJ8l6XOSHqmhj1HZ7qvenJHtPkmfkLS7/KxaPCJpdXV/taSHa+zlJ5z+5qpcrRqPoW1LulfSnoi4Y0SpK47hWP116hh2/NMBSao+6vgTSdMkrY+IP+x4E2Ow/R4N//SXpOmS7qu7P9v3S1ouaZ6kg5JulvQ3kh6QdK6kFyVdExG1vDk3Rn/LNTyMDUn7JF17+vy7hv5+XtI/Snpa0qlq8RoNn3fXfgwL/a1UB45hLSEAoHswYxBIjhAAkiMEgOQIASA5QgBIrtYQ6OIpuZLor1nd3F839yZ1tr+6RwJd/R8h+mtWN/fXzb1JHeyv7hAAULOmJgvZvkLSXRqe+feXEXFLaf2z3Bsz1Pfm4+M6qh71Tnr/7UZ/zenm/rq5N6n1/b2hH+tYHB3tl/cmHwKTuTjI2Z4bl/qySe0PwORti606HIdGDYFmTge4OAhwBmgmBKbCxUEANDC9ieeO6+Ig1UcdA5I0QzOb2B2AdmhmJDCui4NExLqI6I+I/m5+IwbIqpkQ6OqLgwAYn0mfDkTECdvXS/o7/d/FQZ5pWWcAOqKZ9wQUEZslbW5RLwBqwIxBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSm97Mk23vk3RE0klJJyKivxVNAeicpkKg8vGIeLkF2wFQA04HgOSaDYGQ9D3bO2wPtKIhAJ3V7OnAsog4YHu+pC22n4uIR0euUIXDgCTN0Mwmdweg1ZoaCUTEgep2SNJDki4ZZZ11EdEfEf096m1mdwDaYNIhYLvP9uzT9yV9QtLuVjUGoDOaOR1YIOkh26e3c19EfLclXQHomEmHQES8IOmiFvYCoAZ8RAgkRwgAyRECQHKEAJAcIQAkRwgAybXitwjTeOULHyvWz131fLH+3NCCYv3Y0Z5ifdH95frM/a8W66d2PVusIydGAkByhACQHCEAJEcIAMkRAkByhACQHCEAJMc8gQn43d+5r1j/TN+Pyhs4v8kGlpfL+068Vqzf9dLHm2xgavvB0HnFet/tP1WsT9+6o5XtdA1GAkByhACQHCEAJEcIAMkRAkByhACQHCEAJOeI6NjOzvbcuNSXdWx/rfbjz15arL/84XKmztlTPtY/+oCL9bM+/N/F+q0ferBYv/ztrxfr33ltVrH+6Znl6xU06/U4VqxvO9pXrC+fcbyp/b/3O9cW6+8beKKp7ddpW2zV4Tg06guMkQCQHCEAJEcIAMkRAkByhACQHCEAJEcIAMlxPYEJ6PvWtgb15rZ/dnNP15+9e3mx/gfLlpT3/w/lv5tw6/L3TrCjiZn++qlive+pwWL9nY9uKtZ/9qwGf7dhX7l+pmo4ErC93vaQ7d0jls21vcX23up2TnvbBNAu4zkd+KqkK96y7CZJWyPiAklbq8cApqCGIRARj0o69JbFKyRtqO5vkHRVi/sC0CGTfWNwQUQMSlJ1O791LQHopLa/MWh7QNKAJM3QzHbvDsAETXYkcND2QkmqbofGWjEi1kVEf0T096h3krsD0C6TDYFHJK2u7q+W9HBr2gHQaQ1PB2zfr+Er3s+zvV/SzZJukfSA7c9LelHSNe1sEuNz4r8OFut9m8r1kw223/etVybYUWsd/I2PFesfPKv8cr7t0PuL9SV/9UKxfqJYnboahkBErByjNHWvDgLgTUwbBpIjBIDkCAEgOUIASI4QAJIjBIDkuJ4Ausb08xYX619Z85VivcfTivW/vuuXivV3Dj5erJ+pGAkAyRECQHKEAJAcIQAkRwgAyRECQHKEAJAc8wTQNZ777UXF+kd6Xaw/c+z1Yn3us69NuKcMGAkAyRECQHKEAJAcIQAkRwgAyRECQHKEAJAc8wTQMUc//ZFifedn72ywhfJfsPrNG24o1t/+Tz9osP2cGAkAyRECQHKEAJAcIQAkRwgAyRECQHKEAJAc8wTQMS9+svwzZ5bL8wBW/vvlxfrM7z5ZrEexmlfDkYDt9baHbO8esWyt7R/a3lV9faq9bQJol/GcDnxV0hWjLL8zIpZWX5tb2xaATmkYAhHxqKRDHegFQA2aeWPwettPVacLc1rWEYCOmmwI3C3pfElLJQ1Kun2sFW0P2N5ue/txHZ3k7gC0y6RCICIORsTJiDgl6R5JlxTWXRcR/RHR39Pgt8AAdN6kQsD2whEPr5a0e6x1AXS3hvMEbN8vabmkebb3S7pZ0nLbSzX80es+Sde2sUdMEW+bPbtYX/ULjxXrh0+9UawPffk9xXrv0SeKdYyuYQhExMpRFt/bhl4A1IBpw0ByhACQHCEAJEcIAMkRAkByhACQHNcTQMvsXfvBYv3b8/6iWF+x9zPFeu9m5gG0AyMBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSY54Axu1/fu2jxfpTv/qnxfq/nTherL/6x+cU670aLNYxOYwEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjnkCeNP0RT9drN/4pW8W670uv5w+9+SqYv1df8v1AurASABIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOSYJ5CIp5f/uy/69v5i/ZpZrxTrG4/ML9YXfKn8M+dUsYp2aTgSsL3Y9vdt77H9jO0bquVzbW+xvbe6ndP+dgG02nhOB05I+mJEfEDSRyVdZ/tCSTdJ2hoRF0jaWj0GMMU0DIGIGIyIndX9I5L2SFokaYWkDdVqGyRd1a4mAbTPhN4YtL1E0sWStklaEBGD0nBQSCqfEALoSuMOAduzJG2SdGNEHJ7A8wZsb7e9/biOTqZHAG00rhCw3aPhANgYEQ9Wiw/aXljVF0oaGu25EbEuIvojor9Hva3oGUALjefTAUu6V9KeiLhjROkRSaur+6slPdz69gC023jmCSyTtErS07Z3VcvWSLpF0gO2Py/pRUnXtKdFtMxF7y+Wf3/+15va/J9/ufwSeMeTjze1fbRHwxCIiMckeYzyZa1tB0CnMW0YSI4QAJIjBIDkCAEgOUIASI4QAJLjegJnkGkXvq9YH/hGc/O5Llx/XbG+5Ov/3NT2UQ9GAkByhACQHCEAJEcIAMkRAkByhACQHCEAJMc8gTPIc79Vvur7lTPHfVW4UZ3z98fKK0Q0tX3Ug5EAkBwhACRHCADJEQJAcoQAkBwhACRHCADJMU9gCnnjykuK9a1X3t5gCzNb1wzOGIwEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIruE8AduLJX1N0rslnZK0LiLusr1W0hckvVStuiYiNrerUUgHlk0r1s+d3tw8gI1H5hfrPYfL1xPgagJT03gmC52Q9MWI2Gl7tqQdtrdUtTsj4rb2tQeg3RqGQEQMShqs7h+xvUfSonY3BqAzJvSegO0lki6WtK1adL3tp2yvt12+thWArjTuELA9S9ImSTdGxGFJd0s6X9JSDY8URp24bnvA9nbb24/raAtaBtBK4woB2z0aDoCNEfGgJEXEwYg4GRGnJN0jadTfbomIdRHRHxH9PeptVd8AWqRhCNi2pHsl7YmIO0YsXzhitasl7W59ewDabTyfDiyTtErS07Z3VcvWSFppe6mGPxnaJ+natnQIoK3G8+nAY5I8Sok5AVPMH71yYbH++C8vKdZj8OkWdoNuwYxBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSc3Twb8qf7blxqS/r2P4ADNsWW3U4Do0234eRAJAdIQAkRwgAyRECQHKEAJAcIQAkRwgAyXV0noDtlyT9x4hF8yS93LEGJo7+mtPN/XVzb1Lr+zsvIt41WqGjIfATO7e3R0R/bQ00QH/N6eb+urk3qbP9cToAJEcIAMnVHQLrat5/I/TXnG7ur5t7kzrYX63vCQCoX90jAQA1IwSA5AgBIDlCAEiOEACS+1/8tsxjstIf5QAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 288x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.matshow(x_test_adv[0, :, :, 0])\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# TensorFlow with custom function"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Reshape dataset in feature vectors because the model in this example requires feature vectors."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [],
   "source": [
    "x_train = x_train.reshape((60000, 784))\n",
    "x_test = x_test.reshape((100, 784))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create input pipelines for training and testing"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [],
   "source": [
    "train_ds = tf.data.Dataset.from_tensor_slices((x_train, y_train)).shuffle(10000).batch(32)\n",
    "test_ds = tf.data.Dataset.from_tensor_slices((x_test, y_test)).batch(32)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create variables and keep track of them"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [],
   "source": [
    "W = tf.Variable(initial_value=tf.random.normal(shape=(784, 10)), name=\"W\")\n",
    "b = tf.Variable(tf.zeros(shape=(10)), name=\"b\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define a function representing the model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [],
   "source": [
    "@tf.function\n",
    "def forward(x):\n",
    "    x = tf.matmul(x, W) + b\n",
    "    denominator = tf.expand_dims(tf.reduce_sum(tf.exp(x), axis=1), axis=1)\n",
    "    softmax = (1.0 / denominator) * tf.exp(x)\n",
    "    return softmax"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define the training step."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "@tf.function\n",
    "def train_step(images, labels):\n",
    "    with tf.GradientTape() as tape:\n",
    "        predictions = forward(images)\n",
    "        loss = loss_object(labels, predictions)\n",
    "    gradients = tape.gradient(loss, [W, b])\n",
    "    optimizer.apply_gradients(zip(gradients, [W, b]))\n",
    "\n",
    "    train_loss(loss)\n",
    "    train_accuracy(labels, predictions)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define the testing step."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "@tf.function\n",
    "def test_step(images, labels):\n",
    "    predictions = forward(images)\n",
    "    t_loss = loss_object(labels, predictions)\n",
    "\n",
    "    test_loss(t_loss)\n",
    "    test_accuracy(labels, predictions)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Fit the model on training data and collect metrics for training and testing."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Epoch 1, Loss: 0.55, Accuracy: 89.07, Test Loss: 0.17, Test Accuracy: 95.00\n",
      "Epoch 2, Loss: 0.59, Accuracy: 88.21, Test Loss: 0.21, Test Accuracy: 94.60\n",
      "Epoch 3, Loss: 0.59, Accuracy: 88.01, Test Loss: 0.22, Test Accuracy: 94.33\n"
     ]
    }
   ],
   "source": [
    "epochs = 3\n",
    "\n",
    "for epoch in range(epochs):\n",
    "    for images, labels in train_ds:\n",
    "        train_step(images, labels)\n",
    "\n",
    "    for test_images, test_labels in test_ds:\n",
    "        test_step(test_images, test_labels)\n",
    "\n",
    "    template = 'Epoch {}, Loss: {:4.2f}, Accuracy: {:4.2f}, Test Loss: {:4.2f}, Test Accuracy: {:4.2f}'\n",
    "    print(template.format(epoch + 1,\n",
    "                          train_loss.result(),\n",
    "                          train_accuracy.result() * 100,\n",
    "                          test_loss.result(),\n",
    "                          test_accuracy.result() * 100))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate model accuracy on test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on test data: 93.00%\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(forward(x_test), axis=1)\n",
    "accuracy_test = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "print('Accuracy on test data: {:4.2f}%'.format(accuracy_test * 100))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART TensorFlow v2 classifier for the TensorFlow custom model function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [],
   "source": [
    "classifier = TensorFlowV2Classifier(model=forward, nb_classes=10, input_shape=(28, 28, 1),\n",
    "                                    loss_object=loss_object, clip_values=(0, 1), channels_first=False)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Fast Gradient Sign Method attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART Fast Gradient Sign Method attack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_fgsm = FastGradientMethod(estimator=classifier)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Generate adversarial test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {
    "scrolled": false
   },
   "outputs": [],
   "source": [
    "x_test_adv = attack_fgsm.generate(x_test)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate accuracy on adversarial test data and calculate average perturbation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on adversarial test data: 8.00%\n",
      "Average perturbation: 0.16\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(forward(x_test_adv), axis=1)\n",
    "accuracy_test_adv = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "perturbation = np.mean(np.abs((x_test_adv - x_test)))\n",
    "print('Accuracy on adversarial test data: {:4.2f}%'.format(accuracy_test_adv * 100))\n",
    "print('Average perturbation: {:4.2f}'.format(perturbation))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Visualise the first adversarial test sample."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAQEAAAECCAYAAAD+eGJTAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjMsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+AADFEAAAQgUlEQVR4nO3db4xc5XXH8d+J/zYLtDYGY6gd/sS00EqYZosptBWR44QEJcALqvKCuiWtCQEForwA0UhYVSNZVYCmVUtkgouJCBUKBIxMRFwrEo1IXAwYMN4UE+QYY9eOcYmNFTt4ffpir+lidp47O3fufe5yvh8J7eycmbln7g4/35nnmeeauwtAXB/K3QCAvAgBIDhCAAiOEACCIwSA4AgBILgsIWBml5rZf5vZq2Z2a44eUsxsq5m9ZGYbzWxDC/pZaWa7zWzTqOtmmtlaM9tS/JzRsv6WmdkbxT7caGafydjfXDP7oZkNmdnLZnZTcX0r9mGiv0b2oTU9T8DMJkl6RdJiSdslPSPpanff3GgjCWa2VdKgu+/J3YskmdmfSnpb0v3u/vvFdf8gaa+7Ly+CdIa739Ki/pZJetvdv56jp9HMbI6kOe7+nJkdL+lZSVdI+ku1YB8m+vszNbAPcxwJXCDpVXd/zd1/LenfJV2eoY8Jw92fkrT3mKsvl7SquLxKIy+aLDr01xruvtPdnysu75c0JOk0tWQfJvprRI4QOE3S66N+364Gn3CXXNIPzOxZM1uau5kOZrv7TmnkRSTp5Mz9jOVGM3uxeLuQ7e3KaGZ2uqTzJa1XC/fhMf1JDezDHCFgY1zXtrnLF7v7H0j6tKQbisNdjM/dks6StEDSTkl35G1HMrPjJD0s6WZ335e7n2ON0V8j+zBHCGyXNHfU778taUeGPjpy9x3Fz92SvqeRtzBts6t4L3n0PeXuzP28h7vvcvdhdz8i6R5l3odmNkUj/4M94O6PFFe3Zh+O1V9T+zBHCDwjab6ZnWFmUyX9uaTVGfoYk5kNFB/OyMwGJH1S0qb0vbJYLWlJcXmJpMcy9vI+R//nKlypjPvQzEzSvZKG3P3OUaVW7MNO/TW1DxsfHZCkYqjjHyVNkrTS3b/WeBMdmNmZGvnXX5ImS/pO7v7M7EFJl0iaJWmXpNslPSrpIUnzJG2TdJW7Z/lwrkN/l2jkMNYlbZV03dH33xn6+2NJ/ynpJUlHiqtv08j77uz7MNHf1WpgH2YJAQDtwYxBIDhCAAiOEACCIwSA4AgBILisIdDiKbmS6K+qNvfX5t6kZvvLfSTQ6j+E6K+qNvfX5t6kBvvLHQIAMqs0WcjMLpX0DY3M/PuWuy9P3X6qTfPpGnj393d0SFM07d3fh08cGOtufTPpzQPjun2/+xvv9o917PYPHzygydPr3Wfjcezza/rvOx5t23fSe/ffsfuuG6n9e+jtvTp88MBYX97T5HFtZZRicZB/0ajFQcxsdWpxkOka0EJb1PEx37rsj3ptpyu/9e0fV7p/1f5yb79uZc+v7f3nVufrY/OauzrWqrwdYHEQ4AOgSghMhMVBAJTo+e2AulwcpBjqWCpJ0/XhCpsDUIcqRwJdLQ7i7ivcfdDdB8f7QQeA+lUJgVYvDgKgOz2/HXD3w2Z2o6Qn9f+Lg7xcpZnST5evSX+6XPf9q356W7fc/ZXt3zKVPx2v+fVRJvf+T21/kncenq7ymYDc/QlJT1R5DAB5MWMQCI4QAIIjBIDgCAEgOEIACI4QAIKrNEQ40dQ9jpt7HkPd6n5+ucfp656nkNPwmp90rHEkAARHCADBEQJAcIQAEBwhAARHCADBEQJAcJWWHB+vgVlz/dzLvtyxPtHHaev+vjqqyb1eRZk6+1vv67TP94655DhHAkBwhAAQHCEABEcIAMERAkBwhAAQHCEABNeq9QRyf58+9zh/7u1H1/Z5BGVSj896AgA6IgSA4AgBIDhCAAiOEACCIwSA4AgBILhWzROY6OO0dcu9f9r+ffoybf/71zlPZpIf6FirFAJmtlXSfknDkg67+2CVxwPQvH4cCXzc3ff04XEAZMBnAkBwVUPAJf3AzJ41s6X9aAhAs6q+HbjY3XeY2cmS1prZT939qdE3KMJhqSRNHZhRcXMA+q3SkYC77yh+7pb0PUkXjHGbFe4+6O6Dk6cPVNkcgBr0HAJmNmBmxx+9LOmTkjb1qzEAzej5vANmdqZG/vWXRt5WfMfdv5a6T9l5B3LLPQ5eJvc4ftvVPQ+ibnW+vlLnHej5MwF3f03Seb3eH0A7MEQIBEcIAMERAkBwhAAQHCEABEcIAMH1PE+gFyfYTF9oizrW2z6OPfPhF5L177/6dLK+8dChZP0LX70pWf/NBzqvHS9J25ZdlKzPW5bur+3nVcg9DyL39sv0Ok+AIwEgOEIACI4QAIIjBIDgCAEgOEIACI4QAIKbUOcdKFP3OHPZPIAyC6ZNS9aPv/aNZP3ItXOT9elv703WX1uefn5b/uLuZH3+/dcn62XW79hY8vjp/qref2DHmMPk75r9T9X+vhN1PQOOBIDgCAEgOEIACI4QAIIjBIDgCAEgOEIACK7ReQLDJw7orcvq+8513eO0Z3z8r5P13/nnXyXr/vzLyfqcH/8yWX/5vt9L1p+/PT3Ov/i4zybrZU7/w+3J+tpzHq/0+HPO/59K9y+b57B4KP38f7XtfSfQeo/fePS/kvW65wFUWa9geE3ntSg4EgCCIwSA4AgBIDhCAAiOEACCIwSA4AgBILhWnXcgt7Z+37tbu76UPu9A1e/Lv7JyMFk/+9oNlR6/qidL1hso87ktlybru751RrJe9+ujyjyBzWvu0oE9r/d23gEzW2lmu81s06jrZprZWjPbUvyc0XN3ALLq5u3AfZKOjchbJa1z9/mS1hW/A5iASkPA3Z+SdOy6VZdLWlVcXiXpij73BaAhvX4wONvdd0pS8fPk/rUEoEm1f4HIzJZKWipJ0/XhujcHYJx6PRLYZWZzJKn4ubvTDd19hbsPuvvgFKVX2wXQvF5DYLWkJcXlJZIe6087AJpW+nbAzB6UdImkWWa2XdLtkpZLesjMPi9pm6Sr6myyKbnnAVQ9v/20/60256Ns+2dfW229hjJl+3/7w+n1FBZtnpesrzt3dbL+80fOTNZP+XZ6nkXdz78upSHg7ld3KLV31g+ArjFtGAiOEACCIwSA4AgBIDhCAAiOEACCm1DnHah73faq5y0oU/b4uecp1K3q8xseTv+bNdmOJOufPvPCZH36VdXmWVR9/eR6fXIkAARHCADBEQJAcIQAEBwhAARHCADBEQJAcI3OE5j05oHkWGfd46hV5R7HrzpPoe3bv+iFXyfrR/a8lazv2HdCsn7qwe3Jet3zUNqKIwEgOEIACI4QAIIjBIDgCAEgOEIACI4QAIJrdJ5AVVXHcds+Dlz386t7PYSqj3/7SZvTNyipf+rUBcl63fNMqu6fuvdvJxwJAMERAkBwhAAQHCEABEcIAMERAkBwhAAQ3IQ670Du72vXPc+g6vNr+/75xKb9lR7/nG9+MVmfp6eT9Yk6jl+30iMBM1tpZrvNbNOo65aZ2RtmtrH47zP1tgmgLt28HbhP0qVjXH+Xuy8o/nuiv20BaEppCLj7U5L2NtALgAyqfDB4o5m9WLxdmNG3jgA0qtcQuFvSWZIWSNop6Y5ONzSzpWa2wcw2HD54oMfNAahLTyHg7rvcfdjdj0i6R9IFiduucPdBdx+cPH2g1z4B1KSnEDCzOaN+vVLSpk63BdBupfMEzOxBSZdImmVm2yXdLukSM1sgySVtlXRdNxuret6BMrnXC6h7nLnu51d3f9/8j8XJ+qO/e16yPu/v0vMA6vZBnUdQGgLufvUYV99bQy8AMmDaMBAcIQAERwgAwRECQHCEABAcIQAEZ+7e2MYGZs31cy/7csd67nH0MrnH2XM//zIfe/5Isv7M3o8k62vPeTxZX3jL9ePuabTc80hynhdiva/TPt9rY9U4EgCCIwSA4AgBIDhCAAiOEACCIwSA4AgBILhWzRMok3scve3j9LnXY3hyx8ZK9//UqQsq3b+t39fvVp2vb+YJAOiIEACCIwSA4AgBIDhCAAiOEACCIwSA4EqXHO+nsvMOlMm97nvu9QJye+XfPlZyi/Q8gfP//ovJ+tRrqs1ZyT0PZKL+/TkSAIIjBIDgCAEgOEIACI4QAIIjBIDgCAEguEbnCZRp+zhr1cdv+zyFn91xYbL+0XlvJOtlDp6Urk/dn663fR5IVXXOcxhe85OOtdIjATOba2Y/NLMhM3vZzG4qrp9pZmvNbEvxc0YvjQPIq5u3A4clfcXdz5F0oaQbzOxcSbdKWufu8yWtK34HMMGUhoC773T354rL+yUNSTpN0uWSVhU3WyXpirqaBFCfcX0waGanSzpf0npJs919pzQSFJJO7ndzAOrXdQiY2XGSHpZ0s7vvG8f9lprZBjPb8I4O9dIjgBp1FQJmNkUjAfCAuz9SXL3LzOYU9TmSdo91X3df4e6D7j44RdP60TOAPupmdMAk3StpyN3vHFVaLWlJcXmJpMf63x6AunUzT+BiSddIesnMjn5h/DZJyyU9ZGafl7RN0lVVm8m9bn/b1X3egzMWVJsHUHbegBNK1gvIPU6fe55Brtd/aQi4+48kjXnSAkmL+tsOgKYxbRgIjhAAgiMEgOAIASA4QgAIjhAAgmt0PYHhEwf01mWdx0pzjxO3fV35ssd//W8vStY33/CvJVtInzfgr7b9SbK+o+TR65b771f3PIAqjz/JD3SscSQABEcIAMERAkBwhAAQHCEABEcIAMERAkBwjc4TmPTmgVavGVD3OG/dz332s+9Uuv/ioc8m6x9a9Hqlxy+Tex5GVbn7q+28AwA+2AgBIDhCAAiOEACCIwSA4AgBIDhCAAjO3NNrwffTCTbTF1rnVcrb/H3sbu5fVdXn9+SO9HoAZfMA1p7zeLJ+1kNfSNY/enPnsWip/eP4VbX1vAKStN7XaZ/vHfPUARwJAMERAkBwhAAQHCEABEcIAMERAkBwhAAQXOk8ATObK+l+SadIOiJphbt/w8yWSfobSb8obnqbuz+Reqyq8wTK1D2PoOr2qz7+wps2JOtDvzyl0uO/unV2sj5155Rk/fSvfrDH4XPPM6ny/FLzBLpZVOSwpK+4+3NmdrykZ81sbVG7y92/3nNnALIrDQF33ylpZ3F5v5kNSTqt7sYANGNcnwmY2emSzpe0vrjqRjN70cxWmtmMPvcGoAFdh4CZHSfpYUk3u/s+SXdLOkvSAo0cKdzR4X5LzWyDmW14R4f60DKAfuoqBMxsikYC4AF3f0SS3H2Xuw+7+xFJ90i6YKz7uvsKdx9098EpmtavvgH0SWkImJlJulfSkLvfOer6OaNudqWkTf1vD0DduhkduFjSNZJeMrOj31W9TdLVZrZAkkvaKum6WjoEUKtuRgd+JGms8cXknIA6tH0eQFVlj//Tn52XrK/97qpk/czvpnP67C+tT9bL9l/d4+h1379uOV+/nHcAQEeEABAcIQAERwgAwRECQHCEABAcIQAE181kocbkHocvk3sc2p5+IVlfeMv1yfr8iv21+fvy/bh/7vMi5MKRABAcIQAERwgAwRECQHCEABAcIQAERwgAwZWed6CvGzP7haSfj7pqlqQ9jTUwfvRXTZv7a3NvUv/7+4i7nzRWodEQeN/GzTa4+2C2BkrQXzVt7q/NvUnN9sfbASA4QgAILncIrMi8/TL0V02b+2tzb1KD/WX9TABAfrmPBABkRggAwRECQHCEABAcIQAE939XIAmvHTADIQAAAABJRU5ErkJggg==\n",
      "text/plain": [
       "<Figure size 288x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.matshow(x_test_adv[0, :].reshape((28, 28)))\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Carlini&Wagner Infinity-norm attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a ART Carlini&Wagner Infinity-norm attack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_cw = CarliniLInfMethod(classifier=classifier, eps=0.3, max_iter=100, learning_rate=0.01)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Generate adversarial test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%capture\n",
    "x_test_adv = attack_cw.generate(x_test);"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Evaluate accuracy on adversarial test data and calculate average perturbation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy on adversarial test data: 33.00%\n",
      "Average perturbation: 0.007617\n"
     ]
    }
   ],
   "source": [
    "y_test_pred = np.argmax(forward(x_test_adv), axis=1)\n",
    "accuracy_test_adv = np.sum(y_test_pred == y_test) / y_test.shape[0]\n",
    "perturbation = np.mean(np.abs((x_test_adv - x_test)))\n",
    "print('Accuracy on adversarial test data: {:4.2f}%'.format(accuracy_test_adv * 100))\n",
    "print('Average perturbation: {:4.6f}'.format(perturbation))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Visualise the first adversarial test sample."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAQEAAAECCAYAAAD+eGJTAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4xLjMsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+AADFEAAAN3ElEQVR4nO3dbYxU53nG8esyrCF+IYJgMKIQv5SkSSsFkhW27KilonadfIjtD45qVS6RkuA2tmJLUVXLjWRUpZVV+SVRqjrCBRlHjisrtmNXIi8EWXLSJNQLJjYYJ7gRcTAEYiEVaArG7N0Pe0i3ZPeZ3Xk5Z3bv/09CM3PuOefcHNhrnzPzzBlHhADkdU7TDQBoFiEAJEcIAMkRAkByhACQHCEAJNdICNi+zvZPbL9m+64meiixvc/2y7Z32h7qg3422j5se9eoZfNsb7G9t7qd22f9rbP9RnUMd9r+aIP9LbH9nO09tnfbvqNa3hfHsNBfLcfQdc8TsD1D0k8lXSNpv6QXJN0cEa/U2kiB7X2SBiPizaZ7kSTbfyjpuKRHI+IPqmX/KOlIRNxbBenciPibPupvnaTjEXFfEz2NZnuRpEURscP2hZK2S7pB0ifUB8ew0N/HVcMxbGIksFLSaxHxs4h4S9K/Srq+gT6mjIh4XtKRsxZfL2lTdX+TRv7TNGKc/vpGRByMiB3V/WOS9kharD45hoX+atFECCyW9ItRj/erxr/wBIWk79jebntt082MY2FEHJRG/hNJWtBwP2O53fZL1elCY6cro9m+RNIKSdvUh8fwrP6kGo5hEyHgMZb129zlqyPig5I+Ium2ariLyXlI0uWSlks6KOn+ZtuRbF8g6UlJd0bE0ab7OdsY/dVyDJsIgf2Slox6/DuSDjTQx7gi4kB1e1jS0xo5hek3h6pzyTPnlIcb7uf/iYhDEXE6IoYlPayGj6HtAY38gD0WEU9Vi/vmGI7VX13HsIkQeEHSMtuX2j5X0p9JeraBPsZk+/zqxRnZPl/StZJ2lddqxLOS1lT310h6psFefsuZH67KjWrwGNq2pA2S9kTEA6NKfXEMx+uvrmNY+7sDklS91fFFSTMkbYyIv6+9iXHYvkwjv/0laaakrzXdn+3HJa2SNF/SIUn3SPqGpCckLZX0uqSbIqKRF+fG6W+VRoaxIWmfpFvPnH830N+HJX1P0suShqvFd2vkvLvxY1jo72bVcAwbCQEA/YMZg0ByhACQHCEAJEcIAMkRAkByjYZAH0/JlUR/nern/vq5N6ne/poeCfT1P4Tor1P93F8/9ybV2F/TIQCgYR1NFrJ9naQvaWTm379ExL2l55/rWTFb5//m8Smd1IBmtb3/XqO/zvRzf/3cm9T9/k7ov/VWnBzrw3vth0A7FweZ43lxhVe3tT8A7dsWW3U0jowZAp2cDnBxEGAa6CQEpsLFQQC0MLODdSd0cZDqrY61kjRb53WwOwC90MlIYEIXB4mI9RExGBGD/fxCDJBVJyHQ1xcHATAxbZ8ORMTbtm+X9G3938VBdnetMwC16OQ1AUXEZkmbu9QLgAYwYxBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjhAAkiMEgORmdrKy7X2Sjkk6LentiBjsRlMA6tNRCFT+OCLe7MJ2ADSA0wEguU5DICR9x/Z222u70RCAenV6OnB1RBywvUDSFtuvRsTzo59QhcNaSZqt8zrcHYBu62gkEBEHqtvDkp6WtHKM56yPiMGIGBzQrE52B6AH2g4B2+fbvvDMfUnXStrVrcYA1KOT04GFkp62fWY7X4uIb3WlKwC1aTsEIuJnkj7QxV4ANIC3CIHkCAEgOUIASI4QAJIjBIDkCAEguW58ijCNc84rT3v+5ms/KNZ3njxZrP/l5+8o1t/52I+K9dfXXVWsL11X7g85MRIAkiMEgOQIASA5QgBIjhAAkiMEgOQIASA5R0RtO5vjeXGFV9e2v2779oGdPd3+qTjd0forh/68WD++Z26xvvcvHirWlz36V5PuaVLb/2p5+3tv6ay/geMu1pd8YfrOo9gWW3U0jox5ABgJAMkRAkByhACQHCEAJEcIAMkRAkByhACQHNcTmIRLv/WpYv29X/6fYj1e3F2sL/zhnGJ99yO/X6y/eE/5ffTjHzpRrEuzi9VXbvmnYn3AM1psv2zVqpc6Wr/VPIRW8zBW7yrPM3jHN/5j0j1NBYwEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjusJTCNx9fJi3f/e2fUQfrphsFh/zyeHOtp+pzq93sPH9l5XrJ/8o192tP0mdXQ9AdsbbR+2vWvUsnm2t9jeW92Wr1YBoG9N5HTgEUlnR+RdkrZGxDJJW6vHAKagliEQEc9LOnLW4uslbarub5J0Q5f7AlCTdl8YXBgRByWpul3QvZYA1KnnHyCyvVbSWkmarfIXegKoX7sjgUO2F0lSdXt4vCdGxPqIGIyIwQHNanN3AHql3RB4VtKa6v4aSc90px0AdWt5OmD7cUmrJM23vV/SPZLulfSE7U9Kel3STb1sEhPT6TyAVpqeB7D/yfL1FP5r+IfF+jvPeUex/vOnLivWL9bUnSdQ0jIEIuLmcUrM+gGmAaYNA8kRAkByhACQHCEAJEcIAMkRAkByfO8ApozTp8u/s1rNA/jIZVcW6xef+MGke5oOGAkAyRECQHKEAJAcIQAkRwgAyRECQHKEAJAc8wTQN6768VvF+ub5m4r1Dw6N96n3ERed+Mmke8qAkQCQHCEAJEcIAMkRAkByhACQHCEAJEcIAMkxTwB94/PzdxXrM1z+nXXRx5gH0A5GAkByhACQHCEAJEcIAMkRAkByhACQHCEAJMc8AdTmT3YdK9ZbzQN431c+U6wvVc7vDehUy5GA7Y22D9veNWrZOttv2N5Z/flob9sE0CsTOR14RNJ1Yyx/MCKWV382d7ctAHVpGQIR8bykIzX0AqABnbwweLvtl6rThbld6whArdoNgYckXS5puaSDku4f74m219oesj10Sifb3B2AXmkrBCLiUEScjohhSQ9LWll47vqIGIyIwQHNardPAD3SVgjYXjTq4Y2Syp8BBdC3Ws4TsP24pFWS5tveL+keSatsL5cUkvZJurWHPWKa+Mp3rynWn/m9DxTrS/+OeQC90DIEImKsb3TY0INeADSAacNAcoQAkBwhACRHCADJEQJAcoQAkBzXE0DXfOjF4WL9kXfdV6wvmnlBsf6nWj7pntAaIwEgOUIASI4QAJIjBIDkCAEgOUIASI4QAJJjngAmbOa7lxTr/7Dw31psocU8gMUrWqwfLepoByMBIDlCAEiOEACSIwSA5AgBIDlCAEiOEACSY54AJuyVdQs6Wn/FFz5TrC8IvlegCYwEgOQIASA5QgBIjhAAkiMEgOQIASA5QgBIjnkC+I3/vP/KYv3Va79crP96uPx5/xMXTbol1KDlSMD2EtvP2d5je7ftO6rl82xvsb23up3b+3YBdNtETgfelvS5iHifpCsl3Wb7/ZLukrQ1IpZJ2lo9BjDFtAyBiDgYETuq+8ck7ZG0WNL1kjZVT9sk6YZeNQmgdyb1wqDtSyStkLRN0sKIOCiNBIWkziaWA2jEhEPA9gWSnpR0Z0QcncR6a20P2R46pZPt9AighyYUArYHNBIAj0XEU9XiQ7YXVfVFkg6PtW5ErI+IwYgYHNCsbvQMoIsm8u6AJW2QtCciHhhVelbSmur+GknPdL89AL3miPJ7u7Y/LOl7kl6WdOYL6O/WyOsCT0haKul1STdFxJHStuZ4Xlzh1Z32jB7Z/MaOYn33qbeK9b++pDzPAM3ZFlt1NI54rFrLyUIR8X1JY64siZ9oYIpj2jCQHCEAJEcIAMkRAkByhACQHCEAJMf1BKaRX/ztVcX6K7f9c4stlH8nPPjLa1qsf6xFHf2IkQCQHCEAJEcIAMkRAkByhACQHCEAJEcIAMkxT2AaWbj9VEfrn47hYv3AlcwDmI4YCQDJEQJAcoQAkBwhACRHCADJEQJAcoQAkBzzBKYSj3fl9xHPbXy4WP/1cPl7A84759xi/bUvlr9X4Hfv/FGxjv7ESABIjhAAkiMEgOQIASA5QgBIjhAAkiMEgORazhOwvUTSo5IuljQsaX1EfMn2OkmflvSr6ql3R8TmXjUK6b0vlP+5Wl0PYMAzivVLv/mpYv3c4+V5CpiaJjJZ6G1Jn4uIHbYvlLTd9paq9mBE3Ne79gD0WssQiIiDkg5W94/Z3iNpca8bA1CPSb0mYPsSSSskbasW3W77Jdsbbc/tcm8AajDhELB9gaQnJd0ZEUclPSTpcknLNTJSuH+c9dbaHrI9dEonu9AygG6aUAjYHtBIADwWEU9JUkQciojTETEs6WFJK8daNyLWR8RgRAwOaFa3+gbQJS1DwLYlbZC0JyIeGLV80ain3ShpV/fbA9BrE3l34GpJt0h62fbOatndkm62vVxSSNon6daedAigpyby7sD3JY31BjFzAmr26mffX6zP+PoLxfqyr5dz+j2f3VasY3pixiCQHCEAJEcIAMkRAkByhACQHCEAJEcIAMk5Imrb2RzPiyu8urb9ARixLbbqaBwZ84IQjASA5AgBIDlCAEiOEACSIwSA5AgBIDlCAEiu1nkCtn8l6eejFs2X9GZtDUwe/XWmn/vr596k7vf37oi4aKxCrSHwWzu3hyJisLEGWqC/zvRzf/3cm1Rvf5wOAMkRAkByTYfA+ob33wr9daaf++vn3qQa+2v0NQEAzWt6JACgYYQAkBwhACRHCADJEQJAcv8LgtXiv0td9i4AAAAASUVORK5CYII=\n",
      "text/plain": [
       "<Figure size 288x288 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.matshow(x_test_adv[0, :].reshape((28, 28)))\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}