Merge pull request #1855 from Trusted-AI/dev_1.12.0

Update to ART 1.12.0

Author: beat-buesser

AUTHORS

@@ -17,3 +17,5 @@
 - Johns Hopkins University
 - Troj.AI
 - VMware Inc.
+- University of Michigan
+- University of Wisconsin-Madison

art/attacks/evasion/__init__.py

@@ -23,6 +23,8 @@
 from art.attacks.evasion.feature_adversaries.feature_adversaries_pytorch import FeatureAdversariesPyTorch
 from art.attacks.evasion.feature_adversaries.feature_adversaries_tensorflow import FeatureAdversariesTensorFlowV2
 from art.attacks.evasion.geometric_decision_based_attack import GeoDA
+from art.attacks.evasion.graphite.graphite_blackbox import GRAPHITEBlackbox
+from art.attacks.evasion.graphite.graphite_whitebox_pytorch import GRAPHITEWhiteboxPyTorch
 from art.attacks.evasion.hclu import HighConfidenceLowUncertainty
 from art.attacks.evasion.hop_skip_jump import HopSkipJump
 from art.attacks.evasion.imperceptible_asr.imperceptible_asr import ImperceptibleASR

art/attacks/evasion/dpatch.py

@@ -107,7 +107,12 @@ def generate(  # pylint: disable=W0221
         Generate DPatch.
 
         :param x: Sample images.
-        :param y: Target labels for object detector.
+        :param y: True labels of type `List[Dict[np.ndarray]]` for untargeted attack, one dictionary per input image.
+                  The keys and values of the dictionary are:
+
+                  - boxes [N, 4]: the boxes in [x1, y1, x2, y2] format, with 0 <= x1 < x2 <= W and 0 <= y1 < y2 <= H.
+                  - labels [N]: the labels for each image
+                  - scores [N]: the scores or each prediction.
         :param target_label: The target label of the DPatch attack.
         :param mask: An boolean array of shape equal to the shape of a single samples (1, H, W) or the shape of `x`
                      (N, H, W) without their channel dimensions. Any features for which the mask is True can be the
@@ -134,8 +139,6 @@ def generate(  # pylint: disable=W0221
         channel_index = 1 if self.estimator.channels_first else x.ndim - 1
         if x.shape[channel_index] != self.patch_shape[channel_index - 1]:
             raise ValueError("The color channel index of the images and the patch have to be identical.")
-        if y is not None:
-            raise ValueError("The DPatch attack does not use target labels.")
         if x.ndim != 4:  # pragma: no cover
             raise ValueError("The adversarial patch can only be applied to images.")
         if target_label is not None:
@@ -160,7 +163,7 @@ def generate(  # pylint: disable=W0221
         )
         patch_target: List[Dict[str, np.ndarray]] = []
 
-        if self.target_label:
+        if self.target_label and y is None:
 
             for i_image in range(patched_images.shape[0]):
                 if isinstance(self.target_label, int):
@@ -190,7 +193,7 @@ def generate(  # pylint: disable=W0221
 
         else:
 
-            predictions = self.estimator.predict(x=patched_images, standardise_output=True)
+            predictions = y if y is not None else self.estimator.predict(x=patched_images, standardise_output=True)
 
             for i_image in range(patched_images.shape[0]):
                 target_dict = {}