【人工智能课程】计算机科学博士作业三

来源：李宏毅2022课程第10课的作业

1 图片攻击概念

图片攻击是指故意对数字图像进行修改，以使机器学习模型产生错误的输出或者产生预期之外的结果。这种攻击是通过将微小的、通常对人类难以察觉的扰动应用于输入图像来实现的。图片攻击是对深度学习系统中的鲁棒性和安全性的一种测试，也可以用于欺骗、隐私侵犯、对抗性水印等。以下是一些常见的图片攻击的目的：

对抗样本研究：通过图片攻击，研究人员可以探索深度学习模型的鲁棒性和对抗样本的生成方法，以便改进模型的安全性和鲁棒性。
欺骗机器学习模型：攻击者可能希望通过修改图片使其被错误地分类，从而欺骗机器学习模型，例如将停车标志误识别为速限标志。
隐私攻击：通过修改图片，攻击者可以消除敏感信息，或者使图像模糊以保护隐私。
对抗性水印：攻击者可能希望通过添加微小的、难以察觉的扰动，来隐藏或改变水印，或者转移水印，以保护知识产权或者追踪盗版图片来源。

总之，图片攻击的目的可以是为了研究、测试模型的鲁棒性，也可以是出于恶意目的，比如欺骗或者损害隐私。在实际应用中，保护和提高模型的鲁棒性，并确保数据的安全与隐私是至关重要的。

2 算法

除了FGSM、IFGSM和MIFGSM之外，还有一些其他流行的图像攻击算法，包括：

DeepFool：它是一种迭代的无目标攻击算法，通过找到沿着特征空间最不相关的方向来生成对抗样本。
CW攻击（Carlini and Wagner攻击）：这个算法试图最小化一种特定的损失函数，以欺骗分类器，并在L2和L∞规范下产生对抗样本。
JSMA（Jacobian-based Saliency Map Attack）：JSMA算法通过最大化目标函数的梯度，以找到最有效的像素扰动，使图像被错误分类。
EOT（Expectation over Transformation）：EOT算法通过对输入图像进行多个随机扰动，然后对这些扰动的预期值进行优化，生成对抗样本。
One-pixel攻击：这种攻击算法仅修改图像中的几个像素，以欺骗分类器，同时尽可能减少对原始图像的影响。

3 Python实现

3.1 下载数据

# 设置环境
!pip install pytorchcv
!pip install imgaug

# 下载数据
!wget https://github.com/DanielLin94144/ML-attack-dataset/files/8167812/data.zip

# 解压
!unzip ./data.zip
!rm ./data.zip

3.2 参数设置

import torch
import torch.nn as nn

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
batch_size = 8

# 平均值和标准差是根据cifar10数据集计算的统计数据
cifar_10_mean = (0.491, 0.482, 0.447) # cifar_10 图片数据三个通道的均值
cifar_10_std = (0.202, 0.199, 0.201) # cifar_10 图片数据三个通道的标准差

# 将mean和std转换为三维张量，用于未来的运算
mean = torch.tensor(cifar_10_mean).to(device).view(3, 1, 1)
std = torch.tensor(cifar_10_std).to(device).view(3, 1, 1)

epsilon = 8/255/std

root = '/data' # 用于存储`benign images`的目录

3.3 导入数据

import os
import glob
import shutil
import numpy as np
from PIL import Image
from torchvision.transforms import transforms
from torch.utils.data import Dataset, DataLoader

transform = transforms.Compose([
    transforms.ToTensor(),
    transforms.Normalize(cifar_10_mean, cifar_10_std)
])

class AdvDataset(Dataset):
    def __init__(self, data_dir, transform):
        self.images = []
        self.labels = []
        self.names = []
        '''
        data_dir
        ├── class_dir
        │   ├── class1.png
        │   ├── ...
        │   ├── class20.png
        '''
        for i, class_dir in enumerate(sorted(glob.glob(f'{data_dir}/*'))):
            images = sorted(glob.glob(f'{class_dir}/*'))
            self.images += images
            self.labels += ([i] * len(images))
            self.names += [os.path.relpath(imgs, data_dir) for imgs in images]
        self.transform = transform
    def __getitem__(self, idx):
        image = self.transform(Image.open(self.images[idx]))
        label = self.labels[idx]
        return image, label
    def __getname__(self):
        return self.names
    def __len__(self):
        return len(self.images)

adv_set = AdvDataset(root, transform=transform)
adv_names = adv_set.__getname__()
adv_loader = DataLoader(adv_set, batch_size=batch_size, shuffle=False)

print(f'number of images = {adv_set.__len__()}')

3.4 工具函数

（1）评估模型在良性图像上的性能

# 评估模型在良性图像上的性能
def epoch_benign(model, loader, loss_fn):
    model.eval()
    train_acc, train_loss = 0.0, 0.0
    for x, y in loader:
        x, y = x.to(device), y.to(device)
        yp = model(x)
        loss = loss_fn(yp, y)
        train_acc += (yp.argmax(dim=1) == y).sum().item()
        train_loss += loss.item() * x.shape[0]
    return train_acc / len(loader.dataset), train_loss / len(loader.dataset)

（2）

# 执行对抗性攻击 并生成对抗性示例
def gen_adv_examples(model, loader, attack, loss_fn):
    model.eval()
    adv_names = []
    train_acc, train_loss = 0.0, 0.0
    for i, (x, y) in enumerate(loader):
        x, y = x.to(device), y.to(device)
        x_adv = attack(model, x, y, loss_fn) # obtain adversarial examples
        yp = model(x_adv)
        loss = loss_fn(yp, y)
        train_acc += (yp.argmax(dim=1) == y).sum().item()
        train_loss += loss.item() * x.shape[0]
        # store adversarial examples
        adv_ex = ((x_adv) * std + mean).clamp(0, 1) # to 0-1 scale
        adv_ex = (adv_ex * 255).clamp(0, 255) # 0-255 scale
        adv_ex = adv_ex.detach().cpu().data.numpy().round() # round to remove decimal part
        adv_ex = adv_ex.transpose((0, 2, 3, 1)) # transpose (bs, C, H, W) back to (bs, H, W, C)
        adv_examples = adv_ex if i == 0 else np.r_[adv_examples, adv_ex]
    return adv_examples, train_acc / len(loader.dataset), train_loss / len(loader.dataset)

# 创建存储对抗性示例的目录
def create_dir(data_dir, adv_dir, adv_examples, adv_names):
    if os.path.exists(adv_dir) is not True:
        _ = shutil.copytree(data_dir, adv_dir)
    for example, name in zip(adv_examples, adv_names):
        im = Image.fromarray(example.astype(np.uint8)) # 图片数据需要转成 uint8
        im.save(os.path.join(adv_dir, name))

3.5 攻击算法

（1）fgsm算法

def fgsm(model, x, y, loss_fn, epsilon=epsilon):
    x_adv = x.detach().clone() # 用良性图片初始化 x_adv
    x_adv.requires_grad = True # 需要获取 x_adv 的梯度
    loss = loss_fn(model(x_adv), y) # 计算损失
    loss.backward()  
    # fgsm: 在x_adv上使用梯度上升来最大化损失
    grad = x_adv.grad.detach()
    x_adv = x_adv + epsilon * grad.sign()
    return x_adv

（2）ifgsm算法

# 在“全局设置”部分中将alpha设置为步长 
# alpha和num_iter可以自己决定设定成何值
alpha = 0.8 / 255 / std
def ifgsm(model, x, y, loss_fn, epsilon=epsilon, alpha=alpha, num_iter=20):
    x_adv = x
    # num_iter 次迭代
    for i in range(num_iter):
        x_adv = fgsm(model, x_adv, y, loss_fn, alpha) # 用（ε=α）调用fgsm以获得新的x_adv
        # x_adv = x_adv.detach().clone()
        # x_adv.requires_grad = True  
        # loss = loss_fn(model(x_adv), y)  
        # loss.backward()  
        # grad = x_adv.grad.detach()
        # x_adv = x_adv + alpha * grad.sign()
        x_adv = torch.max(torch.min(x_adv, x+epsilon), x-epsilon) # x_adv 裁剪到 [x-epsilon, x+epsilon]范围
    return x_adv

（3）mifgsm算法

def mifgsm(model, x, y, loss_fn, epsilon=epsilon, alpha=alpha, num_iter=20, decay=1.0):
    x_adv = x
    # 初始化 momentum tensor
    momentum = torch.zeros_like(x).detach().to(device)
    # num_iter 次迭代
    for i in range(num_iter):
        x_adv = x_adv.detach().clone()
        x_adv.requires_grad = True  
        loss = loss_fn(model(x_adv), y)  
        loss.backward()  
        # TODO: Momentum calculation
        grad = x_adv.grad.detach() + (1 - decay) * momentum
        momentum = grad
        x_adv = x_adv + alpha * grad.sign()
        x_adv = torch.max(torch.min(x_adv, x+epsilon), x-epsilon) # x_adv 裁剪到 [x-epsilon, x+epsilon]范围
    return x_adv

（4）EOT算法

def eot_attack(model, x, y, loss_fn, epsilon= 0.03, num_samples= 10, sigma= 0.1):
    best_adv_example = None
    best_adv_loss = float('inf')
    
    for _ in range(num_samples):
        perturbation = torch.randn_like(x) * sigma
        x_adv = x + perturbation
        x_adv = torch.clamp(x_adv, 0, 1)  # 将像素值限制在合理范围内
        
        # 使用 fgsm 得到对抗样本
        x_adv = fgsm(model, x_adv, y, loss_fn, epsilon)
        
        # 计算对抗样本的损失
        adv_loss = loss_fn(model(x_adv), y).item()
        
        # 保留损失最小的对抗样本
        if adv_loss < best_adv_loss:
            best_adv_example = x_adv.detach()
            best_adv_loss = adv_loss

    return best_adv_example

3.6 算法评估

准确率越低越好，损失越大越好

（1）基准模型

from pytorchcv.model_provider import get_model as ptcv_get_model

model = ptcv_get_model('resnet110_cifar10', pretrained=True).to(device)
loss_fn = nn.CrossEntropyLoss()

benign_acc, benign_loss = epoch_benign(model, adv_loader, loss_fn)
print(f'[ Base(未Attack图片评估) ] benign_acc = {benign_acc:.5f}, benign_loss = {benign_loss:.5f}')

[ Base(未Attack图片评估) ] benign_acc = 0.95000, benign_loss = 0.22678

（2）FGSM算法

adv_examples, fgsm_acc, fgsm_loss = gen_adv_examples(model, adv_loader, fgsm, loss_fn)
print(f'[ Attack(FGSM Attack图片评估) ] fgsm_acc = {fgsm_acc:.5f}, fgsm_loss = {fgsm_loss:.5f}')

# create_dir(root, 'fgsm', adv_examples, adv_names)

[ Attack(FGSM Attack图片评估) ] fgsm_acc = 0.59000, fgsm_loss = 2.49272

（3）I-FGSM算法

adv_examples, ifgsm_acc, ifgsm_loss = gen_adv_examples(model, adv_loader, ifgsm, loss_fn)
print(f'[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = {ifgsm_acc:.5f}, ifgsm_loss = {ifgsm_loss:.5f}')

create_dir(root, 'ifgsm', adv_examples, adv_names)

[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = 0.01000, ifgsm_loss = 17.30204

（4）EOT算法

adv_examples, ifgsm_acc, ifgsm_loss = gen_adv_examples(model, adv_loader, eot_attack, loss_fn)
print(f'[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = {ifgsm_acc:.5f}, ifgsm_loss = {ifgsm_loss:.5f}')

create_dir(root, 'eot', adv_examples, adv_names)

[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = 0.21000, ifgsm_loss = 5.35198

（5）基于Ensemble 模型的IFGSM算法

class ensembleNet(nn.Module):
    def __init__(self, model_names):
        super().__init__()
        self.models = nn.ModuleList([ptcv_get_model(name, pretrained=True) for name in model_names])
        self.softmax = nn.Softmax(dim=1)
    def forward(self, x):
        ensemble_logits = 0
        for i, m in enumerate(self.models):
            ensemble_logits += m(x)
        return ensemble_logits/len(self.models)
model_names = [
    'nin_cifar10',
    'resnet20_cifar10',
    'preresnet20_cifar10'
]
ensemble_model = ensembleNet(model_names).to(device)
loss_fn = nn.CrossEntropyLoss()

adv_examples, ifgsm_acc, ifgsm_loss = gen_adv_examples(ensemble_model, adv_loader, ifgsm, loss_fn)
print(f'[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = {ifgsm_acc:.5f}, ifgsm_loss = {ifgsm_loss:.5f}')

# create_dir(root, 'ensemble_model_ifgsm', adv_examples, adv_names)

[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = 0.00000, ifgsm_loss = 13.37727

（6）基于Ensemble 模型的EOT算法

class ensembleNet(nn.Module):
    def __init__(self, model_names):
        super().__init__()
        self.models = nn.ModuleList([ptcv_get_model(name, pretrained=True) for name in model_names])
        self.softmax = nn.Softmax(dim=1)
    def forward(self, x):
        ensemble_logits = 0
        for i, m in enumerate(self.models):
            ensemble_logits += m(x)
        return ensemble_logits/len(self.models)
model_names = [
    'nin_cifar10',
    'resnet20_cifar10',
    'preresnet20_cifar10'
]
ensemble_model = ensembleNet(model_names).to(device)
loss_fn = nn.CrossEntropyLoss()

adv_examples, ifgsm_acc, ifgsm_loss = gen_adv_examples(ensemble_model, adv_loader, eot_attack, loss_fn)
print(f'[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = {ifgsm_acc:.5f}, ifgsm_loss = {ifgsm_loss:.5f}')

create_dir(root, 'ensemble_model_eot', adv_examples, adv_names)

[ Attack(I-FGSM Attack图片评估) ] ifgsm_acc = 0.08000, ifgsm_loss = 3.68992

3.7 可视化

import matplotlib.pyplot as plt

classes = ['airplane', 'automobile', 'bird', 'cat', 'deer', 'dog', 'frog', 'horse', 'ship', 'truck']

plt.figure(figsize=(10, 20))
cnt = 0
for i, cls_name in enumerate(classes):
    path = f'{cls_name}/{cls_name}1.png'
    # 未Attack图片（benign image）
    cnt += 1
    plt.subplot(len(classes), 4, cnt)
    im = Image.open(f'./data/{path}')
    logit = model(transform(im).unsqueeze(0).to(device))[0]
    predict = logit.argmax(-1).item()
    prob = logit.softmax(-1)[predict].item()
    plt.title(f'benign: {cls_name}1.png\n{classes[predict]}: {prob:.2%}')
    plt.axis('off')
    plt.imshow(np.array(im))
    # Attack后图片（adversarial image）
    cnt += 1
    plt.subplot(len(classes), 4, cnt)
    im = Image.open(f'./ensemble_model_ifgsm/{path}')
    logit = model(transform(im).unsqueeze(0).to(device))[0]
    predict = logit.argmax(-1).item()
    prob = logit.softmax(-1)[predict].item()
    plt.title(f'adversarial: {cls_name}1.png\n{classes[predict]}: {prob:.2%}')
    plt.axis('off')
    plt.imshow(np.array(im))
plt.tight_layout()
plt.show()