Awesome
Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
A TensorFlow implementation of the adversarial examples generating models described in the paper:
"Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning"
Hongge Chen*, Huan Zhang*, Pin-Yu Chen, Jinfeng Yi and Cho-Jui Hsieh
This paper is accepted by the 56th Annual Meeting of the Association for Computational Linguistics (ACL 2018). Hongge Chen and Huan Zhang contribute equally to this work.
Full text available at: https://arxiv.org/pdf/1712.02051.pdf
Introduction
The Show-and-Fool model is designed to generate adversarial examples for neural image captioning. Our model is based on Show and Tell.
For example:
Prerequisites
The following python packages are required to run this code repository:
sudo apt-get install python3-pip
sudo pip3 install --upgrade pip
sudo pip3 install pillow scipy numpy tensorflow-gpu keras
Note: Tensorflow 1.3 or later is recommended because tf.contrib.rnn.BasicLSTMCell
is used in Show and Tell model.
Getting Started
Clone this directory:
git clone https://github.com/IBM/Image-Captioning-Attack.git
Download pretrained model for Show-and-Tell:
./download_model.sh
Pretrained model will be saved to im2txt/pretrained
.
Run the Demo
To quickly try our image captioning attack, a demo script is provided. By default, this script will turn the caption of a specified image into the caption of another arbitrary target image:
./demo.sh <image_to_attack> <image_of_target_sentence> <result_output_directory> [additional options] ...
Specifically, given an image <image_to_attack>
to attack and another
irrelevant target image <image_of_target_sentence>
as our target, we first
infer the caption using Show-and-Tell model on the target image. This caption
is called the target caption. Then we try to generate an adversarial image
that looks almost identical to <image_to_attack>
but on which the neural
image captioning system will generate exactly the same caption as the target
caption. Resulting adversarial image (and some relevant information) is saved
into folder <result_output_directory>
.
We provided some example images from the COCO dataset in the examples
folder,
so you can quickly test the targeted attack by running:
./demo.sh examples/image1.jpg examples/image2.jpg result_dir
In this demo we provide 4 attack modes: targeted caption attack, untargeted
caption attack, targeted keyword attack and untargeted keyword attack.
We can pass additional parameters to demo.sh
to select an attack mode. There are
two boolean parameters to control the attack mode, use_keywords
and
targeted
. For example, --use_keywords=False
and
--targeted=True
give you targeted caption attack. If you are using
untargeted attack, <image_of_target_sentence>
is ignored.
By default, --targeted=True --use_keywords=False
.
An example of targeted keywords attack with keywords dog
and frisbee
is:
./demo.sh examples/image1.jpg examples/image2.jpg result_dir --use_keywords --input_feed="dog frisbee"
Run Multiple Attacks on MSCOCO Dataset
To run multiple attacks on MSCOCO dataset, first you need to download MSCOCO dataset (images and caption files). Please refer to the "Prepare the Training Data" section in Show and Tell's readme file (we also have a copy here in this repo as ShowAndTellREADME.md
). After you finish your download, please go to run_attack.sh
and specify 2 paths:
(i) ${CAPTION_FILE}
is the path to the validation set's caption file, in JSON format (for example ../coco-caption/annotations/captions_val2014.json)
(ii) ${IMAGE_DIRECTORY}
is the directory of MSCOCO validation set (for example ../mscoco/image/val2014/)
Then you need to do ./run_attack.sh
. It is similar to ./demo.sh
. There are 3 required parameters, OFFSET
. NUM_ATTACKS
and OUTPUT_DIR
. When we do the experiments on MSCOCO validation set, we first randomly shuffle the images. Then we pick images in this queue one by one to attack. NUM_ATTACKS
detemines the number of experiments. One experiment means attack on one image. OFFSET
is the index of the first image in the queue to be attacked. OUTPUT_DIR
is the directory in which you save the results. We also create a /fail_log
directory in the result directory to save the fail imagess' attcak results with each C. If you choose untargeted caption attack, all attempts are assumed to be fail.
We also have a parameter use_logits
for you to choose between the logits loss or log-prob loss. To use logits loss, simply add --use_logits=True
and to use log-prob loss, add --use_logits=False
. By default we use logits loss. The detailed forms of our losses can be find in our paper. There are other parameters for you to tune, such as number of iterations, initial constant C, norm (l2 or l_infinity) and beam search size. You can check run_attack_BATCH_search_C.py
for details.
Some examples:
(i) (using default parameters) ./run_attack.sh 0 100 result_dir
Attack 100 images starting from the 0th image. The attacks are targeted caption attack with 1000 iterations for each C. The attack results will be saved in /result_dir
.
(ii) ./run_attack.sh 0 100 result_dir --use_keywords=True --keywords_num=2 --iters=200
Attack 100 images starting from the 0th image. The attacks are targeted keyword attack with 2 keywords selected for each image and 200 iterations for each C. The attack results will be saved in /result_dir
.
(iii) ./run_attack.sh 0 100 result_dir --targeted=False --iters=200
Attack 100 images starting from the 0th image. The attacks are untargeted caption attack with 200 iterations for each C. The attack results will be saved in /result_dir
.