Return worse result from num_iter runs, in addition to average.

Signed-off-by: abigailt <[email protected]>

Author: abigailgold

art/metrics/privacy/membership_leakage.py

@@ -19,7 +19,7 @@
 This module implements membership leakage metrics.
 """
 from __future__ import absolute_import, division, print_function, unicode_literals
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING, Optional, Tuple
 
 import numpy as np
 import scipy
@@ -37,7 +37,7 @@ def PDTP(  # pylint: disable=C0103
     y: np.ndarray,
     indexes: Optional[np.ndarray] = None,
     num_iter: Optional[int] = 10,
-) -> np.ndarray:
+) -> Tuple[np.ndarray, np.ndarray]:
     """
     Compute the pointwise differential training privacy metric for the given classifier and training set.
 
@@ -52,8 +52,8 @@ def PDTP(  # pylint: disable=C0103
                     computed for all samples in `x`.
     :param num_iter: the number of iterations of PDTP computation to run for each sample. If not supplied,
                      defaults to 10. The result is the average across iterations.
-    :return: an array containing the average PDTP value for each sample in the training set. The higher the value,
-             the higher the privacy leakage for that sample.
+    :return: A tuple of two arrays, containing the average (worse) PDTP value for each sample in the training set
+             respectively. The higher the value, the higher the privacy leakage for that sample.
     """
     from art.estimators.classification.pytorch import PyTorchClassifier
     from art.estimators.classification.tensorflow import TensorFlowV2Classifier
@@ -120,6 +120,7 @@ def PDTP(  # pylint: disable=C0103
     # We now have a list of list, internal lists represent an iteration. We need to transpose and get averages.
     per_sample = list(map(list, zip(*results)))
     avg_per_sample = np.array([sum(val) / len(val) for val in per_sample])
+    worse_per_sample = np.max(per_sample, axis=1)
 
-    # return leakage per sample
-    return avg_per_sample
+    # return avg+worse leakage per sample
+    return avg_per_sample, worse_per_sample

tests/metrics/privacy/test_membership_leakage.py

@@ -35,12 +35,14 @@ def test_membership_leakage_decision_tree(art_warning, decision_tree_estimator,
         extra_classifier = decision_tree_estimator()
         (x_train, y_train), _ = get_iris_dataset
         prev = classifier.model.tree_
-        leakage = PDTP(classifier, extra_classifier, x_train, y_train)
-        logger.info("Average PDTP leakage: %.2f", (np.average(leakage)))
-        logger.info("Max PDTP leakage: %.2f", (np.max(leakage)))
+        avg_leakage, worse_leakage = PDTP(classifier, extra_classifier, x_train, y_train)
+        logger.info("Average PDTP leakage: %.2f", (np.average(avg_leakage)))
+        logger.info("Max PDTP leakage: %.2f", (np.max(avg_leakage)))
         assert classifier.model.tree_ == prev
-        assert np.all(leakage >= 1.0)
-        assert leakage.shape[0] == x_train.shape[0]
+        assert np.all(avg_leakage >= 1.0)
+        assert np.all(worse_leakage >= avg_leakage)
+        assert avg_leakage.shape[0] == x_train.shape[0]
+        assert worse_leakage.shape[0] == x_train.shape[0]
     except ARTTestException as e:
         art_warning(e)
 
@@ -51,11 +53,13 @@ def test_membership_leakage_tabular(art_warning, tabular_dl_estimator, get_iris_
         classifier = tabular_dl_estimator()
         extra_classifier = tabular_dl_estimator()
         (x_train, y_train), _ = get_iris_dataset
-        leakage = PDTP(classifier, extra_classifier, x_train, y_train)
-        logger.info("Average PDTP leakage: %.2f", (np.average(leakage)))
-        logger.info("Max PDTP leakage: %.2f", (np.max(leakage)))
-        assert np.all(leakage >= 1.0)
-        assert leakage.shape[0] == x_train.shape[0]
+        avg_leakage, worse_leakage = PDTP(classifier, extra_classifier, x_train, y_train)
+        logger.info("Average PDTP leakage: %.2f", (np.average(avg_leakage)))
+        logger.info("Max PDTP leakage: %.2f", (np.max(avg_leakage)))
+        assert np.all(avg_leakage >= 1.0)
+        assert np.all(worse_leakage >= avg_leakage)
+        assert avg_leakage.shape[0] == x_train.shape[0]
+        assert worse_leakage.shape[0] == x_train.shape[0]
     except ARTTestException as e:
         art_warning(e)
 
@@ -67,11 +71,13 @@ def test_membership_leakage_image(art_warning, image_dl_estimator, get_default_m
         extra_classifier, _ = image_dl_estimator()
         (x_train, y_train), _ = get_default_mnist_subset
         indexes = random.sample(range(x_train.shape[0]), 100)
-        leakage = PDTP(classifier, extra_classifier, x_train, y_train, indexes=indexes, num_iter=1)
-        logger.info("Average PDTP leakage: %.2f", (np.average(leakage)))
-        logger.info("Max PDTP leakage: %.2f", (np.max(leakage)))
-        assert np.all(leakage >= 1.0)
-        assert leakage.shape[0] == len(indexes)
+        avg_leakage, worse_leakage = PDTP(classifier, extra_classifier, x_train, y_train, indexes=indexes, num_iter=1)
+        logger.info("Average PDTP leakage: %.2f", (np.average(avg_leakage)))
+        logger.info("Max PDTP leakage: %.2f", (np.max(avg_leakage)))
+        assert np.all(avg_leakage >= 1.0)
+        assert np.all(worse_leakage >= avg_leakage)
+        assert avg_leakage.shape[0] == x_train.shape[0]
+        assert worse_leakage.shape[0] == x_train.shape[0]
     except ARTTestException as e:
         art_warning(e)