How to do TARGETED Zoo attack on AdaBoostClassifier

[giladpn]

Hi, thank you for ART, it is quite amazing.

I am trying to educate myself by doing a variation of the notebook notebooks/classifier_scikitlearn_AdaBoostClassifier.ipynb

The variation is very simple. In the notebook, in the MNIST section, the ZooAttack is not targeted: targeted=False. I am trying to change this to targeted=True. I have also, of course, tried to define target labels. However, the "adversarial" examples are just unchanged from the original "good" examples. I must be missing something.

Doing a very basic example, I am trying to create targeted adversarial examples that would make all digits seem like a 1.

Here is my code, with just the relevant pieces. It's mostly copied from your notebook with just slight changes.

from sklearn.ensemble import AdaBoostClassifier
from sklearn.datasets import load_iris

import numpy as np
from matplotlib import pyplot as plt

from art.estimators.classification import SklearnClassifier
from art.attacks.evasion import ZooAttack
from art.utils import load_mnist
from art.utils import to_categorical

import warnings
warnings.filterwarnings('ignore')

# Load and transform hand-written digit dataset
# for simplicity we use MNIST digits
(x_train, y_train), (x_test, y_test), min_, max_ = load_mnist()

n_samples_train = x_train.shape[0]
n_features_train = x_train.shape[1] * x_train.shape[2] * x_train.shape[3]
n_samples_test = x_test.shape[0]
n_features_test = x_test.shape[1] * x_test.shape[2] * x_test.shape[3]

x_train = x_train.reshape(n_samples_train, n_features_train)
x_test = x_test.reshape(n_samples_test, n_features_test)

y_train = np.argmax(y_train, axis=1)
y_test = np.argmax(y_test, axis=1)

n_samples_max = 200
x_train = x_train[0:n_samples_max]
y_train = y_train[0:n_samples_max]
x_test = x_test[0:n_samples_max]
y_test = y_test[0:n_samples_max]

# **** note y_target defined here and used below ****
y_target = np.repeat(a=1, repeats=n_samples_max)
print(y_target)

# Train AdaBoostClassifier classifier
model = AdaBoostClassifier(base_estimator=None, n_estimators=50, learning_rate=0.1, algorithm='SAMME.R', 
                           random_state=None)
model.fit(X=x_train, y=y_train)

# Create and apply Zeroth Order Optimization (ZOO) Attack with ART
art_classifier = SklearnClassifier(model=model)

# *** here targeted=True ***
zoo = ZooAttack(classifier=art_classifier, confidence=0.0, targeted=True, learning_rate=1e-1, max_iter=30,
                binary_search_steps=20, initial_const=1e-3, abort_early=True, use_resize=False, 
                use_importance=False, nb_parallel=10, batch_size=1, variable_h=0.25)

# Using ZOO, we create two adversarial sets, from the original training and test sets of MNIST
# ****** Note that here we are trying to use the `y_target`  *****
x_train_adv = zoo.generate(x_train,y=y_target)
x_test_adv = zoo.generate(x_test,y=y_target)

plt.matshow(x_train[0, :].reshape((28, 28)))
plt.clim(0, 1)
prediction = model.predict(x_train[0:1, :])[0]
print("Benign Training Predicted Label: %i" % prediction)
plt.matshow(x_train_adv[0, :].reshape((28, 28)))
plt.clim(0, 1)
prediction = model.predict(x_train_adv[0:1, :])[0]
print("Adversarial Training Predicted Label: %i" % prediction)

The result of this - for an example of the digit 5 - is to print

Benign Training Predicted Label: 5
Adversarial Training Predicted Label: 5

even though I would hope that the Adversarial case would be changed so it is predicted to be a 1.
What am I doing wrong please?

Thank you

[beat-buesser]

Hi @giladpn Does your script generate perturbed samples with the untargeted attack?

[giladpn]

Hi @beat-buesser Yes it does! It works very well for *untargeted* attacks. I am trying to get it to work for the targeted ones as well. Thanks.

…

On Tue, 22 Nov 2022, 00:36 Beat Buesser, ***@***.***> wrote: Hi @giladpn <https://github.com/giladpn> Does your script generate perturbed samples with the untargeted attack? — Reply to this email directly, view it on GitHub <#1925 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOLOROAGE2VXYYOZLPGQFA3WJP2PHANCNFSM6AAAAAASE3CDMY> . You are receiving this because you were mentioned.Message ID: <Trusted-AI/adversarial-robustness-toolbox/repo-discussions/1925/comments/4199705 @github.com>

[beat-buesser]

How do your target labels look like e.g. shape of the array?

[giladpn]

Thanks for your response!

Please see in the code above the line that says

y_target = np.repeat(a=1, repeats=n_samples_max)

so this has the shape (n_samples_max). I also tried doing it as a one-shot encoded list and that did not make a difference. Either way the code sample does not produce the targeted class.

Is there a chance you could take your own code in notebooks/classifier_scikitlearn_AdaBoostClassifier.ipynb and change it from targeted=False to targeted=True? If you can get your own code to work with that setting than I would be fine copying that solution.

Many thanks

[beat-buesser]

Hi @giladpn I think you would need to run more iterations (~3000) and start with a smaller learning rate (0.01).

[giladpn]

Thank you! That helped. After trying several values, I found that for this example learning rate 0.01 and 300 iterations was enough. Thanks for pointing me in the right direction.