Comments (3)
Hi,
the first things that I'd try would be 1) to run the attack without rounding and then just round the final output and 2) to exclude the rounding in the backward pass so that the gradients are computed normally (in a PGD-like attack you could round the current iterate after the projection step to ensure that it belongs to the desired image domain, in the end rounding is just a particular projection).
Also, at least for Linf, Square Attack should give valid images already if eps
is an integer multiple of 1/255.
Let me know if this helps!
from auto-attack.
Hi thank you for your inputs. I've implemented a custom round function.
Here is the solution for anyone interested
import torch
class CustomRound(torch.autograd.Function):
@staticmethod
def forward(ctx, x):
return torch.round(x)
@staticmethod
def backward(ctx, g):
# send the gradient g straight-through on the backward pass.
return g, None
class ModelWrapper(torch.nn.Module):
def __init__(self, model):
super().__init__()
self.model = model.eval()
self.mean = torch.tensor([0.4914, 0.4822, 0.4465]).view(1, 3, 1, 1).to(device)
self.std = torch.tensor([0.2470, 0.2435, 0.2616]).view(1, 3, 1, 1).to(device)
self.round = CustomRound.apply
def forward(self, x):
x = x.clamp(0, 1)
x = x * 255
x = self.round(x)
x = x / 255
x = (x - self.mean) / self.std
x = self.model(x)
return x
model = ModelWrapper(resnet18(pretrained=True))
model = model.to(device).eval()
from auto-attack.
Thanks for sharing. Did you see any difference in the robustness of the model with rounding in this way?
from auto-attack.
Related Issues (20)
- Can AutoAttack be used to dense prediction task? HOT 2
- Softmax probabilities instead of logits HOT 3
- normalization with deepfool fmodel HOT 4
- About `n_iter`, to align with others HOT 4
- Question about variation in reported (clean & robust accuracy) metrics HOT 2
- eps 8./255. works fine 4./255. does not work fine. HOT 12
- Import error for pytorch version 1.10.0 HOT 3
- 4 classes model; targeted attacks are different HOT 2
- A Bug in Square Attack HOT 4
- Problem that forward output is tuple rather than tensor HOT 1
- "The connection to the C10d store has failed" on distributed evaluation HOT 2
- ensemble attack HOT 3
- max Linf perturbation is larger than the epsilon HOT 3
- gradient computation issue HOT 4
- Unable to use Python debugger HOT 4
- Unable to use in TF2 HOT 5
- Parallelized computing HOT 5
- Invalid configuration for square attack HOT 2
- Using the tool for general interval of input region HOT 3
- TF1: How do labels get modified by batch_datapoint_idcs? HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from auto-attack.