Merge branch 'dev_1.5.2' into development_issue_870

Author: beat-buesser

art/attacks/evasion/simba.py

@@ -29,7 +29,7 @@
 from scipy.fftpack import idct
 
 from art.attacks.attack import EvasionAttack
-from art.estimators.estimator import BaseEstimator
+from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
 from art.estimators.classification.classifier import ClassifierMixin
 from art.config import ART_NUMPY_DTYPE
 
@@ -51,7 +51,7 @@ class SimBA(EvasionAttack):
         "batch_size",
     ]
 
-    _estimator_requirements = (BaseEstimator, ClassifierMixin)
+    _estimator_requirements = (BaseEstimator, ClassifierMixin, NeuralNetworkMixin)
 
     def __init__(
         self,

art/attacks/evasion/square_attack.py

@@ -31,7 +31,7 @@
 
 from art.config import ART_NUMPY_DTYPE
 from art.attacks.attack import EvasionAttack
-from art.estimators.estimator import BaseEstimator
+from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
 from art.estimators.classification.classifier import ClassifierMixin
 from art.utils import check_and_transform_label_format, get_labels_np_array
 
@@ -53,7 +53,7 @@ class SquareAttack(EvasionAttack):
         "verbose",
     ]
 
-    _estimator_requirements = (BaseEstimator, ClassifierMixin)
+    _estimator_requirements = (BaseEstimator, ClassifierMixin, NeuralNetworkMixin)
 
     def __init__(
         self,

art/estimators/classification/__init__.py

@@ -7,7 +7,7 @@
     ClassGradientsMixin,
 )
 
-from art.estimators.classification.blackbox import BlackBoxClassifier
+from art.estimators.classification.blackbox import BlackBoxClassifier, BlackBoxClassifierNeuralNetwork
 from art.estimators.classification.catboost import CatBoostARTClassifier
 from art.estimators.classification.detector_classifier import DetectorClassifier
 from art.estimators.classification.ensemble import EnsembleClassifier

art/estimators/classification/blackbox.py

@@ -21,11 +21,12 @@
 from __future__ import absolute_import, division, print_function, unicode_literals
 
 import logging
-from typing import Callable, List, Optional, Tuple, Union, Tuple, TYPE_CHECKING
+from typing import Callable, List, Optional, Union, Tuple, TYPE_CHECKING
 
 import numpy as np
 
-from art.estimators.classification.classifier import Classifier
+from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
+from art.estimators.classification.classifier import ClassifierMixin
 
 if TYPE_CHECKING:
     from art.utils import CLIP_VALUES_TYPE, PREPROCESSING_TYPE
@@ -35,7 +36,7 @@
 logger = logging.getLogger(__name__)
 
 
-class BlackBoxClassifier(Classifier):
+class BlackBoxClassifier(ClassifierMixin, BaseEstimator):
     """
     Wrapper class for black-box classifiers.
     """
@@ -138,3 +139,138 @@ def save(self, filename: str, path: Optional[str] = None) -> None:
         :raises `NotImplementedException`: This method is not supported for black-box classifiers.
         """
         raise NotImplementedError
+
+
+class BlackBoxClassifierNeuralNetwork(NeuralNetworkMixin, ClassifierMixin, BaseEstimator):
+    """
+    Wrapper class for black-box neural network classifiers.
+    """
+
+    def __init__(
+        self,
+        predict: Callable,
+        input_shape: Tuple[int, ...],
+        nb_classes: int,
+        channels_first: bool = True,
+        clip_values: Optional["CLIP_VALUES_TYPE"] = None,
+        preprocessing_defences: Union["Preprocessor", List["Preprocessor"], None] = None,
+        postprocessing_defences: Union["Postprocessor", List["Postprocessor"], None] = None,
+        preprocessing: "PREPROCESSING_TYPE" = (0, 1),
+    ):
+        """
+        Create a `Classifier` instance for a black-box model.
+
+        :param predict: Function that takes in one input of the data and returns the one-hot encoded predicted class.
+        :param input_shape: Size of input.
+        :param nb_classes: Number of prediction classes.
+        :param channels_first: Set channels first or last.
+        :param clip_values: Tuple of the form `(min, max)` of floats or `np.ndarray` representing the minimum and
+               maximum values allowed for features. If floats are provided, these will be used as the range of all
+               features. If arrays are provided, each value will be considered the bound for a feature, thus
+               the shape of clip values needs to match the total number of features.
+        :param preprocessing_defences: Preprocessing defence(s) to be applied by the classifier.
+        :param postprocessing_defences: Postprocessing defence(s) to be applied by the classifier.
+        :param preprocessing: Tuple of the form `(subtrahend, divisor)` of floats or `np.ndarray` of values to be
+               used for data preprocessing. The first value will be subtracted from the input. The input will then
+               be divided by the second one.
+        """
+        super().__init__(
+            model=None,
+            channels_first=channels_first,
+            clip_values=clip_values,
+            preprocessing_defences=preprocessing_defences,
+            postprocessing_defences=postprocessing_defences,
+            preprocessing=preprocessing,
+        )
+
+        self._predictions = predict
+        self._input_shape = input_shape
+        self._nb_classes = nb_classes
+        self._learning_phase = None
+        self._layer_names = None
+
+    @property
+    def input_shape(self) -> Tuple[int, ...]:
+        """
+        Return the shape of one input sample.
+
+        :return: Shape of one input sample.
+        """
+        return self._input_shape  # type: ignore
+
+    def predict(self, x: np.ndarray, batch_size: int = 128, **kwargs):
+        """
+        Perform prediction for a batch of inputs.
+
+        :param x: Test set.
+        :param batch_size: Size of batches.
+        :return: Array of predictions of shape `(nb_inputs, nb_classes)`.
+        """
+        from art.config import ART_NUMPY_DTYPE
+
+        # Apply preprocessing
+        x_preprocessed, _ = self._apply_preprocessing(x, y=None, fit=False)
+
+        # Run predictions with batching
+        predictions = np.zeros((x_preprocessed.shape[0], self.nb_classes), dtype=ART_NUMPY_DTYPE)
+        for batch_index in range(int(np.ceil(x_preprocessed.shape[0] / float(batch_size)))):
+            begin, end = (
+                batch_index * batch_size,
+                min((batch_index + 1) * batch_size, x_preprocessed.shape[0]),
+            )
+            predictions[begin:end] = self._predictions(x_preprocessed[begin:end])
+
+        # Apply postprocessing
+        predictions = self._apply_postprocessing(preds=predictions, fit=False)
+
+        return predictions
+
+    def fit(self, x: np.ndarray, y, batch_size: int = 128, nb_epochs: int = 20, **kwargs) -> None:
+        """
+        Fit the model of the estimator on the training data `x` and `y`.
+
+        :param x: Samples of shape (nb_samples, nb_features) or (nb_samples, nb_pixels_1, nb_pixels_2,
+                  nb_channels) or (nb_samples, nb_channels, nb_pixels_1, nb_pixels_2).
+        :param y: Target values.
+        :type y: Format as expected by the `model`
+        :param batch_size: Batch size.
+        :param nb_epochs: Number of training epochs.
+        """
+        raise NotImplementedError
+
+    def get_activations(
+        self, x: np.ndarray, layer: Union[int, str], batch_size: int, framework: bool = False
+    ) -> np.ndarray:
+        """
+        Return the output of a specific layer for samples `x` where `layer` is the index of the layer between 0 and
+        `nb_layers - 1 or the name of the layer. The number of layers can be determined by counting the results
+        returned by calling `layer_names`.
+
+        :param x: Samples
+        :param layer: Index or name of the layer.
+        :param batch_size: Batch size.
+        :param framework: If true, return the intermediate tensor representation of the activation.
+        :return: The output of `layer`, where the first dimension is the batch size corresponding to `x`.
+        """
+        raise NotImplementedError
+
+    def set_learning_phase(self, train: bool) -> None:
+        """
+        Set the learning phase for the backend framework.
+
+        :param train: `True` if the learning phase is training, otherwise `False`.
+        """
+        raise NotImplementedError
+
+    def loss(self, x: np.ndarray, y: np.ndarray, **kwargs) -> np.ndarray:
+        """
+        Compute the loss of the neural network for samples `x`.
+
+        :param x: Samples of shape (nb_samples, nb_features) or (nb_samples, nb_pixels_1, nb_pixels_2,
+                  nb_channels) or (nb_samples, nb_channels, nb_pixels_1, nb_pixels_2).
+        :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices
+                  of shape `(nb_samples,)`.
+        :return: Loss values.
+        :rtype: Format as expected by the `model`
+        """
+        raise NotImplementedError

docs/modules/estimators/classification.rst

@@ -19,6 +19,13 @@ BlackBox Classifier
    :special-members: __init__
    :inherited-members:
 
+BlackBox Classifier NeuralNetwork
+---------------------------------
+.. autoclass:: BlackBoxClassifierNeuralNetwork
+   :members:
+   :special-members: __init__
+   :inherited-members:
+
 Keras Classifier
 ----------------
 .. autoclass:: KerasClassifier

tests/attacks/evasion/test_square_attack.py

@@ -21,7 +21,7 @@
 import numpy as np
 
 from art.attacks.evasion import SquareAttack
-from art.estimators.estimator import BaseEstimator
+from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
 from art.estimators.classification.classifier import ClassifierMixin
 
 from tests.attacks.utils import backend_test_classifier_type_check_fail
@@ -66,6 +66,6 @@ def test_generate(art_warning, fix_get_mnist_subset, image_dl_estimator_for_atta
 @pytest.mark.framework_agnostic
 def test_classifier_type_check_fail(art_warning):
     try:
-        backend_test_classifier_type_check_fail(SquareAttack, [BaseEstimator, ClassifierMixin])
+        backend_test_classifier_type_check_fail(SquareAttack, [BaseEstimator, ClassifierMixin, NeuralNetworkMixin])
     except ARTTestException as e:
         art_warning(e)

tests/attacks/test_simba.py

@@ -23,7 +23,7 @@
 import numpy as np
 
 from art.attacks.evasion.simba import SimBA
-from art.estimators.estimator import BaseEstimator
+from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
 from art.estimators.classification.classifier import ClassifierMixin
 from art.utils import get_labels_np_array
 
@@ -146,7 +146,7 @@ def _test_attack(self, classifier, x_test, y_test, targeted):
         self.assertAlmostEqual(float(np.max(np.abs(x_test_original - x_test))), 0.0, delta=0.00001)
 
     def test_1_classifier_type_check_fail(self):
-        backend_test_classifier_type_check_fail(SimBA, (BaseEstimator, ClassifierMixin))
+        backend_test_classifier_type_check_fail(SimBA, (BaseEstimator, ClassifierMixin, NeuralNetworkMixin))
 
 
 if __name__ == "__main__":