another patch from Beat to fix meminf tests

Author: TrojAISec

art/attacks/inference/attribute_inference/meminf_based.py

@@ -56,7 +56,7 @@ def __init__(
         Create an AttributeInferenceMembership attack instance.
 
         :param classifier: Target classifier.
-        :param membership_attack: The membership inference attack to use. Should be fit/callibrated in advance, and
+        :param membership_attack: The membership inference attack to use. Should be fit/calibrated in advance, and
                                   should support returning probabilities.
         :param attack_feature: The index of the feature to be attacked or a slice representing multiple indexes in
                                case of a one-hot encoded feature.
@@ -106,10 +106,10 @@ def infer(self, x: np.ndarray, y: Optional[np.ndarray] = None, **kwargs) -> np.n
 
                 predicted = self.membership_attack.infer(x_value, y, probabilities=True)
                 if first:
-                    probabilities = predicted[:, 1].reshape(-1, 1)
+                    probabilities = predicted
                     first = False
                 else:
-                    probabilities = np.hstack((probabilities, predicted[:, 1].reshape(-1, 1)))
+                    probabilities = np.hstack((probabilities, predicted))
 
             # needs to be of type float so we can later replace back the actual values
             value_indexes = np.argmax(probabilities, axis=1).astype(np.float32)
@@ -130,9 +130,9 @@ def infer(self, x: np.ndarray, y: Optional[np.ndarray] = None, **kwargs) -> np.n
 
                 predicted = self.membership_attack.infer(x_value, y, probabilities=True)
                 if first:
-                    probabilities = predicted[:, 1].reshape(-1, 1)
+                    probabilities = predicted
                 else:
-                    probabilities = np.hstack((probabilities, predicted[:, 1].reshape(-1, 1)))
+                    probabilities = np.hstack((probabilities, predicted))
                 first = False
             value_indexes = np.argmax(probabilities, axis=1).astype(np.float32)
             pred_values = np.zeros_like(probabilities)

tests/attacks/inference/attribute_inference/test_meminf_based.py

@@ -187,8 +187,8 @@ def transform_feature(x):
         inferred_train = attack.infer(x_train_for_attack, y_train_iris, values=values)
         inferred_test = attack.infer(x_test_for_attack, y_test_iris, values=values)
         # check accuracy
-        train_acc = np.sum(inferred_train == x_train_feature.reshape(1, -1)) / len(inferred_train)
-        test_acc = np.sum(inferred_test == x_test_feature.reshape(1, -1)) / len(inferred_test)
+        train_acc = np.sum(inferred_train == x_train_feature) / len(inferred_train)
+        test_acc = np.sum(inferred_test == x_test_feature) / len(inferred_test)
         assert 0.1 <= train_acc
         assert 0.1 <= test_acc
 
@@ -325,18 +325,18 @@ def transform_feature(x):
         attack_train_ratio = 0.5
         attack_train_size = int(len(x_train) * attack_train_ratio)
         attack_test_size = int(len(x_test) * attack_train_ratio)
-        # attack without callibration
+        # attack without calibration
         attack = AttributeInferenceMembership(classifier, meminf_attack, attack_feature=attack_feature)
         # infer attacked feature
         inferred_train = attack.infer(x_train_for_attack, y_train_iris, values=values)
         inferred_test = attack.infer(x_test_for_attack, y_test_iris, values=values)
         # check accuracy
-        train_acc = np.sum(inferred_train == x_train_feature.reshape(1, -1)) / len(inferred_train)
-        test_acc = np.sum(inferred_test == x_test_feature.reshape(1, -1)) / len(inferred_test)
+        train_acc = np.sum(inferred_train == x_train_feature) / len(inferred_train)
+        test_acc = np.sum(inferred_test == x_test_feature) / len(inferred_test)
         assert 0.5 <= train_acc
         assert 0.5 <= test_acc
 
-        # attack with callibration
+        # attack with calibration
         meminf_attack.calibrate_distance_threshold(
             x_train[:attack_train_size],
             y_train_iris[:attack_train_size],
@@ -349,8 +349,8 @@ def transform_feature(x):
         inferred_train = attack.infer(x_train_for_attack, y_train_iris, values=values)
         inferred_test = attack.infer(x_test_for_attack, y_test_iris, values=values)
         # check accuracy
-        train_acc = np.sum(inferred_train == x_train_feature.reshape(1, -1)) / len(inferred_train)
-        test_acc = np.sum(inferred_test == x_test_feature.reshape(1, -1)) / len(inferred_test)
+        train_acc = np.sum(inferred_train == x_train_feature) / len(inferred_train)
+        test_acc = np.sum(inferred_test == x_test_feature) / len(inferred_test)
         assert 0.1 <= train_acc
         assert 0.1 <= test_acc