Awesome

About

TransferAttack is a pytorch framework to boost the adversarial transferability for image classification.

Devling into Adversarial Transferability on Image Classification: A Review, Benchmark and Evaluation will be released soon.

We also release a list of papers about transfer-based attacks here.

Why TransferAttack

There are a lot of reasons for TransferAttack, such as:

• A benchmark for evaluating new transfer-based attacks: TransferAttack categorizes existing transfer-based attacks into several types and fairly evaluates various transfer-based attacks under the same setting.
• Evaluate the robustness of deep models: TransferAttack provides a plug-and-play interface to verify the robustness of models, such as CNNs and ViTs.
• A summary of transfer-based attacks: TransferAttack reviews numerous transfer-based attacks, making it easy to get the whole picture of transfer-based attacks for practitioners.

Requirements

• Python >= 3.6
• PyTorch >= 1.12.1
• Torchvision >= 0.13.1
• timm >= 0.6.12

pip install -r requirements.txt

Usage

We randomly sample 1,000 images from ImageNet validate set, in which each image is from one category and can be correctly classified by the adopted models (For some categories, we cannot choose one image that is correctly classified by all the models. In this case, we select the image that receives accurate classifications from the majority of models.). Download the data from or into /path/to/data. Then you can execute the attack as follows:

python main.py --input_dir ./path/to/data --output_dir adv_data/mifgsm/resnet18 --attack mifgsm --model=resnet18
python main.py --input_dir ./path/to/data --output_dir adv_data/mifgsm/resnet18 --eval

Attacks and Models

Untargeted Attacks

Targeted Attacks

Models

To thoroughly evaluate existing attacks, we have included various popular models, including both CNNs (ResNet-18, ResNet-101, ResNeXt-50, DenseNet-121) and ViTs (ViT, PiT, Visformer, Swin). Moreover, we also adopted four defense methods, namely AT, HGD, RS, NRP. The defense models can be downloaded from Google Drive or Huggingface.

Evaluation

Untargeted Attack

Note: We adopt $\epsilon=16/255$ with the number of iterations $T=10$. The base attack for other types of attack is MI-FGSM. The defaut surrogate model is ResNet-18. For YAILA, we adopt ResNet-50 as the surrogate model. For PNA-PatchOUt, SAPR, TGR, VDC, we adopt ViT as the surrogate model. For Ensemble attacks, we use four CNNs(ResNet-18, ResNet-101, ResNeXt-50, DenseNet-121) as the ensemble model.

Targeted Attack

Note: We adopt $\epsilon=16/255, \alpha=2/255$ with the number of iterations $T=300$. The default surrogate model is ResNet-18. For each image, the target label is randomly sampled and fixed in the labels.csv.

For generation-based targeted attack, TTP and M3D, there are 10 target classes and the class to label mapping is shown below.

Class Number: Class Name
24: Great Grey Owl
99: Goose
245: French Bulldog
344: Hippopotamus
471: Cannon
555: Fire Engine
661: Model T
701: Parachute
802: Snowmobile
919: Street Sign       

Contributing to TransferAttack

Main contributors

Acknowledgement

We thank all the researchers who contribute or check the methods. See contributors for details.

Welcom more participants

We are trying to include more transfer-based attacks. We welcome suggestions and contributions! Submit an issue or pull request and we will try our best to respond in a timely manner.