Merge remote-tracking branch 'origin/main' into dev_1.11.1

Author: Beat Buesser

.github/workflows/ci-legacy.yml

@@ -26,14 +26,14 @@ jobs:
       matrix:
         module: [attacks_1, attacks_2, estimators, defences, metrics, art]
         include:
-          - name: legacy (TensorFlow 2.6.0 Keras 2.6.0 PyTorch 1.10.2 scikit-learn 1.0.2 Python 3.9)
+          - name: legacy (TensorFlow 2.6.0 Keras 2.6.0 PyTorch 1.12.0 scikit-learn 1.0.2 Python 3.9)
             framework: legacy
             python: 3.9
             tensorflow: 2.6.0
             keras: 2.6.0
-            torch: 1.10.2+cpu
-            torchvision: 0.11.3+cpu
-            torchaudio: 0.10.2+cpu
+            torch: 1.12.0+cpu
+            torchvision: 0.13.0+cpu
+            torchaudio: 0.12.0+cpu
             scikit-learn: 1.0.2
 
     name: Run ${{ matrix.module }} ${{ matrix.name }} Tests

.github/workflows/ci-pytorch-object-detectors.yml

@@ -40,9 +40,9 @@ jobs:
           pip list
       - name: Pre-install torch
         run: |
-          pip install torch==1.10.2+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
-          pip install torchvision==0.11.3+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
-          pip install torchaudio==0.10.2+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
+          pip install torch==1.12.0+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
+          pip install torchvision==0.13.0+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
+          pip install torchaudio==0.12.0+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
       - name: Run Test Action - test_pytorch_object_detector
         run: pytest --cov-report=xml --cov=art --cov-append -q -vv tests/estimators/object_detection/test_pytorch_object_detector.py --framework=pytorch --durations=0
       - name: Run Test Action - test_pytorch_faster_rcnn

.github/workflows/ci-pytorch.yml

@@ -25,12 +25,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: PyTorch 1.9.1 (Python 3.8)
-            framework: pytorch
-            python: 3.8
-            torch: 1.9.1+cpu
-            torchvision: 0.10.1+cpu
-            torchaudio: 0.9.1
           - name: PyTorch 1.10.2 (Python 3.8)
             framework: pytorch
             python: 3.8
@@ -43,6 +37,12 @@ jobs:
             torch: 1.11.0+cpu
             torchvision: 0.12.0+cpu
             torchaudio: 0.11.0
+          - name: PyTorch 1.12.0 (Python 3.8)
+            framework: pytorch
+            python: 3.8
+            torch: 1.12.0+cpu
+            torchvision: 0.13.0+cpu
+            torchaudio: 0.12.0
 
     name: ${{ matrix.name }}
     steps:

art/attacks/evasion/sign_opt.py

@@ -110,9 +110,9 @@ def __init__(
         :param epsilon: A very small smoothing parameter.
         :param num_trial: A number of trials to calculate a good starting point
         :param max_iter: Maximum number of iterations.
-        Default value is for untargeted attack, increase to recommended 5000 for targeted attacks.
+            Default value is for untargeted attack, increase to recommended 5000 for targeted attacks.
         :param query_limit: Limitation for number of queries to prediction model.
-        Default value is for untargeted attack, increase to recommended 40000 for targeted attacks.
+            Default value is for untargeted attack, increase to recommended 40000 for targeted attacks.
         :param k: Number of random directions (for estimating the gradient)
         :param alpha: The step length for line search
         :param beta: The tolerance for line search

art/attacks/inference/membership_inference/shadow_models.py

@@ -71,7 +71,7 @@ def generate_shadow_dataset(
         the dataset into training and testing samples, and then training the shadow models on the result.
 
         :param x: The samples used to train the shadow models.
-        :param y: True labels for the dataset samples.
+        :param y: True labels for the dataset samples (as expected by the estimator's fit method).
         :param member_ratio: Percentage of the data that should be used to train the shadow models. Must be between 0
                              and 1.
 

art/estimators/certification/deep_z/pytorch.py

@@ -38,10 +38,8 @@
 
 class PytorchDeepZ(PyTorchClassifier, ZonoBounds):
     """
-    Implementation of DeepZ to certify neural network robustness.
-
-    We use the zonotope representation of a datapoint as it travels through the network to then verify if it can
-    have its class changed given a certain perturbation.
+    Implementation of DeepZ to certify neural network robustness. We use the zonotope representation of a datapoint as
+    it travels through the network to then verify if it can have its class changed given a certain perturbation.
 
     | Paper link: https://papers.nips.cc/paper/2018/file/f2f446980d8e971ef3da97af089481c3-Paper.pdf
     """
@@ -166,6 +164,7 @@ def forward_hook(input_module, hook_input, hook_output):
     def forward(self, cent: np.ndarray, eps: np.ndarray) -> Tuple["torch.Tensor", "torch.Tensor"]:
         """
         Do the forward pass through the NN with the given error terms and zonotope center.
+
         :param eps: Error terms of the zonotope.
         :param cent: The datapoint, representing the zonotope center.
         :return: A tuple, the first element being the zonotope center vector.

art/estimators/certification/derandomized_smoothing/tensorflow.py

@@ -26,7 +26,6 @@
 from typing import Callable, List, Optional, Tuple, Union, TYPE_CHECKING
 
 import numpy as np
-import tensorflow as tf
 from tqdm import tqdm
 
 from art.estimators.classification.tensorflow import TensorFlowV2Classifier
@@ -35,6 +34,7 @@
 
 if TYPE_CHECKING:
     # pylint: disable=C0412
+    import tensorflow as tf
 
     from art.utils import CLIP_VALUES_TYPE, PREPROCESSING_TYPE
     from art.defences.preprocessor import Preprocessor
@@ -119,6 +119,8 @@ def __init__(
         )
 
     def _predict_classifier(self, x: np.ndarray, batch_size: int, training_mode: bool, **kwargs) -> np.ndarray:
+        import tensorflow as tf  # lgtm [py/repeated-import]
+
         outputs = TensorFlowV2Classifier.predict(
             self, x=x, batch_size=batch_size, training_mode=training_mode, **kwargs
         )

docs/modules/estimators/gan.rst

@@ -2,9 +2,9 @@
 =========================
 .. automodule:: art.estimators.gan
 
-TensorFlow2 GAN
----------------
-.. autoclass:: TensorFlow2GAN
+TensorFlowV2 GAN
+----------------
+.. autoclass:: TensorFlowV2GAN
    :members:
    :special-members: __init__
    :inherited-members:

notebooks/README.md

@@ -240,7 +240,7 @@ demonstrates working Poison Frog (Feature Collision) poisoning attack implemente
 [poisoning_attack_feature_collision-pytorch.ipynb](poisoning_attack_feature_collision-pytorch.ipynb) [[on nbviewer](https://nbviewer.jupyter.org/github/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/poisoning_attack_feature_collision-pytorch.ipynb)]
 demonstrates working Poison Frog (Feature Collision) poisoning attack implemented in PyTorch Framework on CIFAR10 dataset as per the ([paper](https://arxiv.org/pdf/1804.00792.pdf)). This is a targeted clean label attack, which do not require the attacker to have any control over the labeling of training data and control the behavior of the classifier on a specific test instance without degrading overall classifier performance.
 
-[poisoning_attack_sleeper_agent_pytorch.ipynb](poisoning_attack_sleeper_agent_pytorch.ipynb) [[on nbviewer](https://nbviewer.jupyter.org/github/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/poisoning_attack_sleeper_agent+pytorch.ipynb)]
+[poisoning_attack_sleeper_agent_pytorch.ipynb](poisoning_attack_sleeper_agent_pytorch.ipynb) [[on nbviewer](https://nbviewer.jupyter.org/github/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/poisoning_attack_sleeper_agent_pytorch.ipynb)]
 demonstrates working Sleeper Agent poisoning attack implemented in PyTorch Framework on CIFAR10 dataset as per the ([paper](https://arxiv.org/pdf/2106.08970.pdf)). A new hidden trigger attack, Sleeper Agent,
 which employs gradient matching, data selection, and target model re-training during the crafting process. Sleeper
 Agent is the first hidden trigger backdoor attack to be effective against neural networks trained from scratch.

notebooks/attack_attribute_inference.ipynb

@@ -45,7 +45,7 @@
     "\n",
     "from art.utils import load_nursery\n",
     "\n",
-    "(x_train, y_train), (x_test, y_test), _, _ = load_nursery(test_set=0.2, transform_social=True)"
+    "(x_train, y_train), (x_test, y_test), _, _ = load_nursery(test_set=0.5, transform_social=True)"
    ]
   },
   {
@@ -64,7 +64,7 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "Base model accuracy:  0.9791666666666666\n"
+      "Base model accuracy:  0.9705155912318617\n"
      ]
     }
    ],
@@ -100,6 +100,7 @@
     "\n",
     "attack_train_ratio = 0.5\n",
     "attack_train_size = int(len(x_train) * attack_train_ratio)\n",
+    "attack_test_size = int(len(x_train) * attack_train_ratio)\n",
     "attack_x_train = x_train[:attack_train_size]\n",
     "attack_y_train = y_train[:attack_train_size]\n",
     "attack_x_test = x_train[attack_train_size:]\n",
@@ -136,7 +137,7 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "0.5937861829409494\n"
+      "0.5998765050941649\n"
      ]
     }
    ],
@@ -174,7 +175,7 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "0.6227325357005017\n"
+      "0.6288978079654214\n"
      ]
     }
    ],
@@ -209,7 +210,7 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "0.7001157854110382\n"
+      "0.7005248533497993\n"
      ]
     }
    ],
@@ -244,9 +245,9 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "(0.3501577287066246, 0.2573913043478261)\n",
-      "(0.34417344173441733, 0.1472463768115942)\n",
-      "(0.6309341500765697, 0.23884057971014494)\n"
+      "(0.34232954545454547, 0.22439478584729983)\n",
+      "(0.32320441988950277, 0.10893854748603352)\n",
+      "(0.652046783625731, 0.20763500931098697)\n"
      ]
     }
    ],
@@ -299,7 +300,7 @@
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "0.5372443072172907\n"
+      "0.5433775856745909\n"
      ]
     }
    ],
@@ -344,7 +345,7 @@
     "\n",
     "mem_attack = MembershipInferenceBlackBox(art_classifier)\n",
     "\n",
-    "mem_attack.fit(x_train[:attack_train_size], y_train[:attack_train_size], x_test, y_test)"
+    "mem_attack.fit(x_train[:attack_train_size], y_train[:attack_train_size], x_test[:attack_test_size], y_test[:attack_test_size])"
    ]
   },
   {
@@ -356,14 +357,14 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 10,
+   "execution_count": 11,
    "metadata": {},
    "outputs": [
     {
      "name": "stdout",
      "output_type": "stream",
      "text": [
-      "0.6358548822848321\n"
+      "0.6335288669342389\n"
      ]
     }
    ],