|
1 | 1 | import argparse |
2 | 2 | import os |
3 | 3 | import pickle |
4 | | -from taint import adversarial_attack_blackbox |
5 | | -from analysis import * |
6 | | -from train import train_model_and_save |
7 | | -import torch |
8 | 4 | import tensorflow as tf |
| 5 | +import torch |
| 6 | +from taint import adversarial_attack_blackbox |
| 7 | + |
| 8 | + |
| 9 | +def load_model(model_path): |
| 10 | + # Assumes it's a Keras model (update if using PyTorch) |
| 11 | + return tf.keras.models.load_model(model_path) |
| 12 | + |
| 13 | + |
| 14 | +def get_test_dataset(data_name): |
| 15 | + # Import here to avoid unnecessary dependencies if unused |
| 16 | + from train import get_data # Ensure get_data returns (train_ds, test_ds) |
| 17 | + |
| 18 | + train_ds, test_ds = get_data(data_name) |
| 19 | + return test_ds |
9 | 20 |
|
10 | | -def attack_model(args, model, test_ds, save_dir, num_data=10): |
11 | | - # Get the labels by iterating through a batch from the test_ds |
12 | | - first_batch = next(iter(test_ds)) # Get the first batch |
13 | | - images, labels = first_batch # Unpack the images and labels from the first batch |
14 | | - |
15 | | - # Check if labels are a TensorFlow tensor or PyTorch tensor |
16 | | - if isinstance(labels, tf.Tensor): |
17 | | - # If using TensorFlow, convert labels to class indices (from one-hot encoded) |
18 | | - labels = tf.argmax(labels, axis=1).numpy() # Get class indices from one-hot encoded labels |
19 | | - elif isinstance(labels, torch.Tensor): |
20 | | - # If using PyTorch, convert labels to class indices (from one-hot encoded) |
21 | | - labels = torch.argmax(labels, dim=1).cpu().numpy() # Get class indices from one-hot encoded labels |
22 | | - |
23 | | - # Convert labels to a set of unique outputs |
24 | | - unique_outputs = set(labels) # Convert to a Python set for unique labels |
25 | | - |
26 | | - # Continue with the rest of the attack logic |
27 | | - for output in unique_outputs: |
28 | | - instances = [i for i, label in enumerate(labels) if label == output][:num_data] # Select `num_data` instances with the current output label |
29 | | - |
30 | | - for image_index in instances: |
31 | | - # Create a subdirectory for each image_index and its original output label |
32 | | - sub_dir = os.path.join(save_dir, f'image_{image_index}_label_{output}') |
33 | | - |
34 | | - # Ensure the directory exists |
35 | | - os.makedirs(sub_dir, exist_ok=True) |
36 | | - |
37 | | - # Correct dynamic pickle filename to include the original and target class |
38 | | - pickle_filename = f'attacker_{image_index}_{output}.pkl' |
39 | | - pickle_path = os.path.join(sub_dir, pickle_filename) |
40 | | - |
41 | | - # Check if the attacker pickle already exists for this image_index and output |
42 | | - if os.path.exists(pickle_path): |
43 | | - with open(pickle_path, 'rb') as f: |
44 | | - attacker = pickle.load(f) |
45 | | - print(f"Loaded attacker for image {image_index} with label {output} from {pickle_path}") |
46 | | - else: |
47 | | - print(f"Running adversarial attack for image {image_index} with label {output}...") |
48 | | - |
49 | | - # For the current `output`, target all other classes |
50 | | - for target_output in unique_outputs: |
51 | | - if target_output != output: # We want to target all other outputs |
52 | | - for _ in range(num_data): # Attack the target output `num_data` times |
53 | | - target_sub_dir = os.path.join(sub_dir, f'target_{target_output}') |
54 | | - os.makedirs(target_sub_dir, exist_ok=True) # Create a subdir for each target class |
55 | | - |
56 | | - # Correct dynamic pickle filename to include the original and target class |
57 | | - target_pickle_filename = f'attacker_{image_index}_{output}_to_{target_output}.pkl' |
58 | | - target_pickle_path = os.path.join(target_sub_dir, target_pickle_filename) |
59 | | - |
60 | | - # Perform the adversarial attack targeting `target_output` |
61 | | - attacker = adversarial_attack_blackbox( |
62 | | - model=model, |
63 | | - dataset=test_ds, |
64 | | - image_index=image_index, |
65 | | - output_dir=target_sub_dir, |
66 | | - num_iterations=args.iterations, |
67 | | - num_particles=args.particles, |
68 | | - target_class=target_output # Specify the target class for the attack |
69 | | - ) |
70 | | - print(f"Adversarial attack completed for image {image_index} targeting class {target_output}") |
71 | | - |
72 | | - # After performing the attack, save the attacker object to a pickle file |
73 | | - with open(target_pickle_path, 'wb') as f: |
74 | | - pickle.dump(attacker, f) |
75 | | - print(f"Saved attacker for image {image_index} with label {output} targeting {target_output} to {target_pickle_path}") |
76 | 21 |
|
77 | 22 | def main(): |
78 | | - # Command-line arguments |
79 | 23 | parser = argparse.ArgumentParser() |
80 | 24 |
|
81 | | - # Data and model type arguments (to align with the ones used in the training script) |
82 | | - parser.add_argument('--data', type=str, choices=['MNIST', 'MNIST_Audio'], required=True, help='Dataset to use') |
83 | | - parser.add_argument('--model_type', type=str, choices=['normal', 'complex', 'complex_augmented'], required=True, help='Model type to use') |
| 25 | + # Required args |
| 26 | + parser.add_argument('--model_path', type=str, required=True, help='Path to saved model (.keras)') |
| 27 | + parser.add_argument('--save_dir', type=str, required=True, help='Directory to save attack results') |
| 28 | + parser.add_argument('--source_index', type=int, required=True, help='Index of image to attack') |
| 29 | + parser.add_argument('--target', type=int, required=True, help='Target class for adversarial attack') |
84 | 30 |
|
85 | | - # Attack parameters |
86 | | - parser.add_argument('--iterations', type=int, default=10, help='Number of iterations for attack') |
87 | | - parser.add_argument('--particles', type=int, default=100, help='Number of particles for attack') |
| 31 | + # Dataset config |
| 32 | + parser.add_argument('--data', type=str, choices=['MNIST', 'MNIST_Audio'], required=True, help='Dataset name') |
88 | 33 |
|
89 | | - # Folder saving argument |
90 | | - parser.add_argument('--save_dir', type=str, default='results', help='Directory to save model and results') |
| 34 | + # Attack config |
| 35 | + parser.add_argument('--iterations', type=int, default=30, help='Number of attack iterations') |
| 36 | + parser.add_argument('--particles', type=int, default=100, help='Number of swarm particles') |
91 | 37 |
|
92 | | - # Parse arguments |
93 | 38 | args = parser.parse_args() |
94 | 39 |
|
95 | | - # First, train the model and get the necessary details for attack |
96 | | - model, test_ds, save_dir, model_path = train_model_and_save(args) |
| 40 | + # Load model and dataset |
| 41 | + model = load_model(args.model_path) |
| 42 | + test_ds = get_test_dataset(args.data) |
| 43 | + |
| 44 | + # Create output directory |
| 45 | + os.makedirs(args.save_dir, exist_ok=True) |
| 46 | + |
| 47 | + # Run the blackbox adversarial attack |
| 48 | + try: |
| 49 | + attacker = adversarial_attack_blackbox( |
| 50 | + model=model, |
| 51 | + dataset=test_ds, |
| 52 | + image_index=args.source_index, |
| 53 | + output_dir=args.save_dir, |
| 54 | + num_iterations=args.iterations, |
| 55 | + num_particles=args.particles, |
| 56 | + target_class=args.target |
| 57 | + ) |
| 58 | + |
| 59 | + # Save attacker object |
| 60 | + output_path = os.path.join(args.save_dir, f'attacker_{args.source_index}_to_{args.target}.pkl') |
| 61 | + with open(output_path, 'wb') as f: |
| 62 | + pickle.dump(attacker, f) |
| 63 | + |
| 64 | + print(f"Attack complete. Saved attacker to: {output_path}") |
| 65 | + |
| 66 | + except Exception as e: |
| 67 | + print(f"Error during attack: {e}") |
97 | 68 |
|
98 | | - # Perform the adversarial attack |
99 | | - attack_model(args, model, test_ds, save_dir) |
100 | 69 |
|
101 | 70 | if __name__ == '__main__': |
102 | 71 | main() |
0 commit comments