Home

Awesome

Countering Adversarial Images Using Input Transformations

Overview

This package implements the experiments described in the paper Countering Adversarial Images Using Input Transformations. It contains implementations for adversarial attacks, defenses based image transformations, training, and testing convolutional networks under adversarial attacks using our defenses. We also provide pre-trained models.

If you use this code, please cite our paper:

Adversarial Defenses

The code implements the following four defenses against adversarial images, all of which are based on image transformations:

Please refer to the paper for details on these defenses. A detailed description of the original image quilting algorithm can be found here; a detailed description of our solver for total variation minimization can be found here.

Adversarial Attacks

The code implements the following four approaches to generating adversarial images:

Installation

To use this code, first install Python, PyTorch, and Faiss (to perform image quilting). We tested the code using Python 2.7, PyTorch v0.2.0, and scikit-image 0.11; your mileage may vary when using other versions.

Pytorch can be installed using the instructions here. Faiss is required to run the image quilting algorithm; it is not automatically included because faiss does not have a pip support and because it requires configuring BLAS and LAPACK flags, as described here. Please install faiss using the instructions given here.

The code uses several other external dependencies (for training Inception models, performing Bregman iteration, etc.). These dependencies are automatically downloaded and installed when you install this package via pip:

# Install from source  
cd adversarial_image_defenses
pip install .

Usage

To import the package in Python:

import adversarial

The functionality implemented in this package is demonstrated in this example. Run the example via:

python adversarial/examples/demo.py

API

The full functionality of the package is exposed via several runnable Python scripts. All these scripts require the user to specify the path to the Imagenet dataset, the path to pre-trained models, and the path to quilted images (once they are computed) in lib/path_config.json. Alternatively, the paths can be passed as input arguments into the scripts.

Generate quilting patches

index_patches.py creates a faiss index of images patches. This index can be used to perform quilting of images.

Code example:

import adversarial
from index_patches import create_faiss_patches, parse_args

args = parse_args()
# Update args if needed
args.patch_size = 5
create_faiss_patches(args)

Alternatively, run python index_patches.py. The following arguments are supported:

<a name="image_transformation"></a>

Image transformations

gen_transformed_images.py has applies an image transformation on (adversarial or non-adversarial) ImageNet images, and saves them to disk. Image transformations such as image quilting are too computationally intensive to be performed on-the-fly during network training, which is why we precompute the transformed images.

Code example:

import adversarial
from gen_transformed_images import generate_transformed_images
from lib import opts
# load default args for transformation functions
args = opts.parse_args(opts.OptType.TRANSFORMATION)
args.operation = "transformation_on_raw"
args.defenses = ["tvm"]
args.partition_size = 1  # Number of samples to generate

generate_transformed_images(args)

Alternatively, run python gen_transformed_images.py. In addition to the common arguments and adversarial arguments, the following arguments are supported:

Generate TAR data index

Many file systems perform poorly when dealing with millions of small files (such as images). Therefore, we generally TAR our image datasets (obtained by running generate_transformed_images). Next, we use gen_tar_index.py to generate a file index for the TAR file. The file index facilitates fast, random-access reading of the TAR file; it is much faster and requires less memory than untarring the data or using tarfile package.

Code example:

import adversarial
from gen_tar_index import generate_tar_index, parse_args

args = parse_args()
generate_tar_index(args)

Alternatively, run python gen_tar_index.py. The following arguments are supported:

<a name="adversarial_attack"></a>

Adversarial Attacks

gen_adversarial_images.py implements the generation of adversarial images for the ImageNet dataset.

Code example:

import adversarial
from gen_adversarial_images import generate_adversarial_images
from lib import opts
# load default args for adversary functions
args = opts.parse_args(opts.OptType.ADVERSARIAL)
args.model = "resnet50"
args.adversary_to_generate = "fgs"
args.partition_size = 1  # Number of samples to generate
args.data_type = "val"  # input dataset type
args.normalize = True  # apply normalization on input data
args.attack_type = "blackbox"  # For <whitebox> attack, use transformed models
args.pretrained = True  # Use pretrained model from model-zoo

generate_adversarial_images(args)

Alternatively, run python gen_adversarial_images.py. For a list of the supported arguments, see common arguments and adversarial arguments.

<a name="training"></a>

Training

train_model.py implements the training of convolutional networks on (transformed or non-transformed) ImageNet images.

Code example:

import adversarial
from train_model import train_model
from lib import opts
# load default args
args = opts.parse_args(opts.OptType.TRAIN)
args.defenses = None  # defense=<(raw, tvm, quilting, jpeg, quantization)>
args.model = "resnet50"
args.normalize = True  # apply normalization on input data

train_model(args)

Alternatively, run python train_model.py. In addition to the common arguments, the following arguments are supported:

<a name="classify"></a>

Testing

classify_images.py implements the testing of a training convolutional network on an dataset of (adversarial or non-adversarial / transformed or non-transformed) ImageNet images.

Code exammple:

import adversarial
from classify_images import classify_images
from lib import opts
# load default args
args = opts.parse_args(opts.OptType.CLASSIFY)

classify_images(args)

Alternatively, run python classify_images.py. In addition to the common arguments, the following arguments are supported:

<a name="pretrained"></a>

Pre-trained models

We provide pre-trained models that were trained on ImageNet images that were processed using total variation minimization (TVM) or image quilting can be downloaded from the following links (set the models_root argument to the path that contains these model model files):

<a name="common_args"></a>

Common arguments

The following arguments are used by multiple scripts, including generate_transformed_images, train_model, and classify_images:

Paths

Train/Classifier params

Tranformation params

<a name="adversarial_args"></a>

Adversarial arguments

The following arguments are used whem generating adversarial images with gen_transformed_images.py: