BoundaryAttack cannot be used in two classes model about foolbox HOT 7 CLOSED

model which has classes instead of multiple classes

I think there is a word missing ;-)

Why not? BoundaryAttack should work with any number of classes.

from foolbox.

Hi,

I used the following code:

with tf.Session() as sess:
load(sess, FLAGS.load_model, saver_inception)
img = x_test[10]
label = y_test[10]
criterion = Misclassification()
model = TensorFlowModel(x_tensor, logits_inception, bounds=(0, 255))
attack = BoundaryAttack(model, criterion)
img_adv = attack(img, label[0], verbose=True)

But it returns warning like this:
/home/zhengwei/python2.7/local/lib/python2.7/site-packages/foolbox/attacks/blended_noise.py:37: UserWarning: BlendedUniformNoiseAttack failed to draw a random image that is adversarial.
warnings.warn('BlendedUniformNoiseAttack failed to draw a'
/home/zhengwei/python2.7/local/lib/python2.7/site-packages/foolbox/attacks/base.py:102: UserWarning: BlendedUniformNoiseAttack did not find an adversarial, maybe the model or the criterion is not supported by this attack.
warnings.warn('{} did not find an adversarial, maybe the model or the criterion is not supported by this attack.'.format(self.name())) # noqa: E501
/home/zhengwei/python2.7/local/lib/python2.7/site-packages/foolbox/attacks/boundary_attack.py:218: UserWarning: Initialization failed. If the criterion is targeted, it might be necessary to pass an explicit starting point or targeted initialization attack.
'Initialization failed. If the criterion is targeted,'
/home/zhengwei/python2.7/local/lib/python2.7/site-packages/foolbox/attacks/base.py:102: UserWarning: BoundaryAttack did not find an adversarial, maybe the model or the criterion is not supported by this attack.
warnings.warn('{} did not find an adversarial, maybe the model or the criterion is not supported by this attack.'.format(self.name())) # noqa: E501

It seems that BoundaryAttack cannot find the adversarial input for the model? Can you give me some help on this? Thanks.

from foolbox.

Well, the BoundaryAttack tries to find an initial (possibly very large) adversarial perturbation to start with (to minimize further). By default (if nothing else is specified), it does so by drawing a random input and usually that one will have the wrong class. If you only have two classes, this will only work 50% of time (or maybe even less often your classes aren't balanced, etc.).

There are many ways to fix this. For example you could manually pass a starting_point to the BoundaryAttack:

img_adv = attack(img, label[0], verbose=True, starting_point=...)

Such a starting_point should have the same format as your input image; it should basically just be an image from another class.

Before you do any of that you should however make sure that it's really necessary. The BlendedUniformNoiseAttack used as initialization tries 1000 times and in principle (if your bounds are set correctly) that should also work for two classes. Could it be that random noise images are always classified as the same class? It that case, the starting_point approach as described above should help

from foolbox.

from foolbox.

Did you check the output of fmodel.predictions(starting_point), where fmodel is the Foolbox model that wraps your model. The output should be the logits for the two classes. Could it be that the preprocessing or so are wrong?
In any case, please share the acutal code (or a minimal example that demonstrates the problem), otherwise it's hard to help.

from foolbox.

Oh, and please post the error message properly formatted (e.g. by marking it as code on GitHub; don't reply via mail).

from foolbox.

Closing because there has been no activity. Please reopen if the problem still exists.

from foolbox.