[Python] C&W L2 attack - Save adversarial examples as images

Once again I need your help. I recently dipped into the realm of Machine Learning and read quite a few papers that got me curious Now I wanted to recreate/execute the C&W L2 attack. I cloned the whole repo of Nicholas Carlini https://github.com/carlini/nn_robust_attacks and started training a network with the train_models.py - only MNIST, to speed things up a bit.

Next, I executed the 'test_attack.py'. I modified the output a bit so it made a bit more sense for me (like, showing the predicted class of the adversarial example), but now I am struggling a bit. Instead of, or additionally to, having the adversarial example be shown in the console, I want to save it to a .png/.jpg file. I messed around quite a bit, but only got as far as getting a 28x28 black .png file.

My "modified" file looks like this right now:

import tensorflow as tf
import numpy as np
import time
from PIL import Image

from setup_cifar import CIFAR, CIFARModel
from setup_mnist import MNIST, MNISTModel
from setup_inception import ImageNet, InceptionModel

from l2_attack import CarliniL2

def show(img):
"""
Show MNIST digits in the console.
"""
remap = " .*#"+"#"*100
print(type(img))
img2 = img.reshape((28,28)).astype('uint8')*255
img2 = Image.fromarray(img2)
img2.save('test.png')
img = (img.flatten()+.5)*3
if len(img) != 784: return
print("START")
for i in range(28):
print("".join([remap[int(round(x))] for x in img[i*28:i*28+28]]))


def generate_data(data, samples, targeted=True, start=0, inception=False):
"""
Generate the input data to the attack algorithm.

data: the images to attack
samples: number of samples to use
targeted: if true, construct targeted attacks, otherwise untargeted attacks
start: offset into data to use
inception: if targeted and inception, randomly sample 100 targets intead of 1000
"""
inputs = []
targets = []
for i in range(samples):
if targeted:
if inception:
seq = random.sample(range(1,1001), 10)
else:
#seq = range(2)
seq = range(data.test_labels.shape[1])
print(seq)

for j in seq:
if (j == np.argmax(data.test_labels[start+i])) and (inception == False):
continue
inputs.append(data.test_data[start+i])
targets.append(np.eye(data.test_labels.shape[1])[j])
else:
inputs.append(data.test_data[start+i])
targets.append(data.test_labels[start+i])

inputs = np.array(inputs)
targets = np.array(targets)

return inputs, targets


if __name__ == "__main__":
with tf.Session() as sess:
data, model = MNIST(), MNISTModel("models/mnist", sess)
attack = CarliniL2(sess, model, batch_size=9, max_iterations=1000, confidence=1)
inputs, targets = generate_data(data, samples=1, targeted=True,
start=0, inception=False)
timestart = time.time()
adv = attack.attack(inputs, targets)
timeend = time.time()

print("Took",timeend-timestart,"seconds to run",len(inputs),"samples.")
for i in range(len(adv)):
print(len(adv))
print("Valid:")
show(inputs)
print("Adversarial:")
show(adv)

pred = model.model.predict(inputs[i:i+1])
print("Classification (orig):", pred)
print("Prediction class original:", np.argmax(pred))
advpred = model.model.predict(adv[i:i+1])
print("Classification:", model.model.predict(adv[i:i+1]))
print("Adversarial example classification: ", np.argmax(advpred))
print("Total distortion:", np.sum((adv-inputs)**2)**.5)



My questions would be:

1. Is there a way to get the images saved as .png files?
2. What exactly is the total distortion? It does not seem to be a % number. Like, I thought this would tell me how many pixels had to be changed, but I guess I am totally wrong here.
3. By default, it is always the image of a "7" that gets attacked. I have not figured out so far, how to choose by myself which number to create adversarial images for. Also, it does, by default, create an adversarial example for every class (like, one image of a 7 that gets classified as 0, another one for the 1,2,3 etc. - Is there a way I can specify the target class exactly? To only get one adversarial example, say a 7 that gets classified as a 9? Now I think that is something super simple I just don't see...
4. Since I would love to try this with CIFAR10 too (just takes ages to train on my super old Laptop, so that's gonna be an overnight action) - will there be a way to save the CIFAR adversarial examples to .img/.png too? Because as far as I can tell, the "show" function only covers the MNIST set?

Sorry if those are pretty basic questions, but I am super new to ML and not as experienced in Python as I would like to be! I googled quite a lot, but haven't seen anyone who has implemented the attack with the original source code and did what I want to do.

Continue reading...