src/adversarial_evasion_attacks.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Adversarial Evasion Attacks Tutorial\n",
    "\n",
    "\n",
    "---\n",
    "\n",
    "In this notebook we explore how to create a model, train it, and then attack it with adversarial evasion attacks.\n",
    "\n",
    "We are going to use PyTorch for defining a simple **Fully Connected Neural Network**,\n",
    "then we will train it to classify a simple 5-class dataset with 2 features.\n",
    "\n",
    "We will use the SecML Library for attacking the model with **Adversarial Attacks**."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Imports"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "# we use these for the model\n",
    "import torch\n",
    "from torch import nn\n",
    "from torch import optim\n",
    "from secml.ml.classifiers import CClassifierPyTorch\n",
    "from secml.ml.peval.metrics import CMetricAccuracy\n",
    "\n",
    "# these are required for the dataset and preprocessing\n",
    "from secml.data.loader import CDLRandomBlobs\n",
    "from secml.data.splitter import CTrainTestSplit\n",
    "from secml.ml.features import CNormalizerMinMax\n",
    "\n",
    "# these are used for the adversarial attacks\n",
    "from secml.optim.constraints import CConstraintL2\n",
    "from secml.array import CArray\n",
    "from secml.adv.attacks.evasion import CFoolboxPGDL2\n",
    "\n",
    "# this is for visualization\n",
    "from secml.figure import CFigure"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Dataset creation\n",
    "\n",
    "---\n",
    "\n",
    "We will create a 2D dataset, that is easy to play with and visualize."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "name": "#%% data\n"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "random_state = 999\n",
    "\n",
    "n_features = 2  # Number of features\n",
    "n_samples = 1100  # Number of samples\n",
    "centers = [[-2, 0], [2, -2], [2, 2], [0, 1], [2, 0]]  # Centers of the clusters\n",
    "cluster_std = 0.1  # Standard deviation of the clusters\n",
    "n_classes = len(centers)\n",
    "\n",
    "dataset = CDLRandomBlobs(n_features=n_features,\n",
    "                         centers=centers,\n",
    "                         cluster_std=cluster_std,\n",
    "                         n_samples=n_samples,\n",
    "                         random_state=random_state).load()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Splitting, Preprocessing, Metrics\n",
    "\n",
    "---\n",
    "\n",
    "We have to create two separate groups of data: one is for training the model, \n",
    "and the other is used for scoring its performance.\n",
    "\n",
    "Moreover, we will normalize the data in the interval [0, 1]."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "n_tr = 1000  # Number of training set samples\n",
    "n_ts = 40  # Number of test set samples\n",
    "\n",
    "# Split in training and test\n",
    "splitter = CTrainTestSplit(\n",
    "    train_size=n_tr, test_size=n_ts, random_state=random_state)\n",
    "tr, ts = splitter.split(dataset)\n",
    "\n",
    "# Normalize the data\n",
    "nmz = CNormalizerMinMax()\n",
    "tr.X = nmz.fit_transform(tr.X)\n",
    "ts.X = nmz.transform(ts.X)\n",
    "\n",
    "# Metric to use for training and performance evaluation\n",
    "metric = CMetricAccuracy()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Model creation\n",
    "\n",
    "---\n",
    "\n",
    "Now we will create a Fully Connected Neural Network. We use PyTorch for this.\n",
    "\n",
    "![fcnn](assets/nn_draw.png)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "name": "#%% model\n"
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "outputs": [],
   "source": [
    "# Creation of the multiclass classifier\n",
    "class Net(nn.Module):\n",
    "    def __init__(self, n_features, n_hidden, n_classes):\n",
    "        super(Net, self).__init__()\n",
    "        self.fc1 = nn.Linear(n_features, n_hidden)\n",
    "        self.fc2 = nn.Linear(n_hidden, n_classes)\n",
    "\n",
    "    def forward(self, x):\n",
    "        x = torch.relu(self.fc1(x))\n",
    "        x = self.fc2(x)\n",
    "        return x\n",
    "\n",
    "# torch model creation\n",
    "net = Net(n_features=n_features, n_classes=n_classes, n_hidden=100)\n",
    "\n",
    "criterion = nn.CrossEntropyLoss()\n",
    "optimizer = optim.SGD(net.parameters(),\n",
    "                      lr=0.001, momentum=0.9)\n",
    "\n",
    "# wrap torch model in CClassifierPyTorch class\n",
    "clf = CClassifierPyTorch(model=net,\n",
    "                         loss=criterion,\n",
    "                         optimizer=optimizer,\n",
    "                         input_shape=(n_features,),\n",
    "                         random_state=random_state)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Model training\n",
    "\n",
    "---\n",
    "\n",
    "SecML allows training the model with a simple utility method called `fit`.\n",
    "\n",
    "Otherwise, for training a model with PyTorch, one usually has to write a loop that performs back-propagation (outside the scope of this tutorial).\n",
    "\n",
    "Finally, we can compute the accuracy of our model on the test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "is_executing": true
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "\n",
    "# We can now fit the classifier\n",
    "clf.fit(tr.X, tr.Y)\n",
    "\n",
    "# Compute predictions on a test set\n",
    "y_pred = clf.predict(ts.X)\n",
    "\n",
    "# Evaluate the accuracy of the classifier\n",
    "acc = metric.performance_score(y_true=ts.Y, y_pred=y_pred)\n",
    "\n",
    "print(\"Accuracy on test set: {:.2%}\".format(acc))\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Attack creation\n",
    "\n",
    "---\n",
    "\n",
    "Now we will select a point and perturb it in order to reach another class, i.e., to be misclassified.\n",
    "\n",
    "We use an $\\ell_2$ perturbation here, for limiting the maximum Euclidean distance of the perturbed point from the original point to $\\varepsilon$.\n",
    "\n",
    "The PGD attack uses the [cross-entropy loss](https://pytorch.org/docs/stable/generated/torch.nn.CrossEntropyLoss.html#torch.nn.CrossEntropyLoss) for creating adversarial examples.\n",
    "\n",
    "* Targeted attack: minimize CE Loss on the target class\n",
    "* Untargeted attack: maximize the CE Loss on the original class"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The Projected Gradient Descent (PGD) Attack (snapshot from the Foolbox library):\n",
    "[![pgd-loop](assets/pgd_loop.png)](https://github.com/bethgelab/foolbox/blob/ca8bc831005b516953af0616785762311f858b40/foolbox/attacks/gradient_descent_base.py#L91)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "For each iteration `i`:\n",
    "1. computes the gradient of the loss w.r.t. the sample at iteration `i`\n",
    "2. normalizes the gradient\n",
    "3. performs a step in the gradient direction\n",
    "4. projects the perturbed sample in the $\\varepsilon$-ball\n",
    "5. projects the perturbed sample in the range [0, 1] of the feature space."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "pycharm": {
     "name": "#%% md\n"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "<img src=\"assets/draw_advml.png\" width=\"1300\" height=\"900\" />"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "is_executing": true,
     "name": "#%%\n"
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "outputs": [],
   "source": [
    "x0, y0 = ts[5, :].X, ts[5, :].Y  # Initial sample\n",
    "steps = 20  # Number of iterations\n",
    "epsilon = 0.3  # Maximum perturbation\n",
    "y_target = None  # None if `error-generic`, the label of the target class for `error-specific`\n",
    "lb = tr.X.min()\n",
    "ub = tr.X.max()\n",
    "\n",
    "pgd_attack = CFoolboxPGDL2(clf, y_target,\n",
    "                           lb=lb, ub=ub,\n",
    "                           epsilons=epsilon,\n",
    "                           abs_stepsize=0.1,\n",
    "                           steps=steps,\n",
    "                           random_start=False)\n",
    "y_pred, _, adv_ds_pgd, _ = pgd_attack.run(x0, y0)\n",
    "\n",
    "print(\"Original x0 label: \", y0.item())\n",
    "print(\"Adversarial example label (PGD-L2): \", y_pred.item())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Visualization\n",
    "\n",
    "---\n",
    "\n",
    "We will plot now the objective function of the attack, along with the starting point `x0`, and the optimization path computed with the attack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "is_executing": true,
     "name": "#%%\n"
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "outputs": [],
   "source": [
    "%matplotlib inline  \n",
    "# required for visualization in notebooks\n",
    "\n",
    "fig = CFigure(width=8, height=6, markersize=12)\n",
    "constraint = CConstraintL2(center=x0, radius=epsilon)  # visualize the constraint\n",
    "\n",
    "fig.sp.plot_fun(pgd_attack.objective_function, plot_levels=False,\n",
    "                multipoint=True, n_grid_points=100)  # attack objective function\n",
    "fig.sp.plot_decision_regions(clf, plot_background=False, \n",
    "                             n_grid_points=200)  # decision boundaries\n",
    "\n",
    "# Construct an array with the original point and the adversarial example\n",
    "adv_path = x0.append(pgd_attack.x_seq, axis=0)\n",
    "\n",
    "fig.sp.plot_path(pgd_attack.x_seq)  # plots the optimization sequence\n",
    "fig.sp.plot_constraint(constraint)  # plots the constraint\n",
    "\n",
    "fig.sp.title(pgd_attack.class_type)\n",
    "fig.sp.grid(grid_on=False)\n",
    "\n",
    "fig.title(r\"Error-generic evasion attack ($\\varepsilon={:}$)\".format(epsilon))\n",
    "fig.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Security Evaluation Curve\n",
    "\n",
    "---\n",
    "\n",
    "As final exercise for this notebook, we will plot the security evaluation curve. This is the accuracy of the model on the test points perturbed with increasing amounts of perturbation.\n",
    "\n",
    "We espect that with a bigger perturbation we will get bigger error, i.e., lower accuracy.\n",
    "\n",
    "Let's test that, once more with the SecML library."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "pycharm": {
     "is_executing": true,
     "name": "#%% security-evaluation\n"
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "outputs": [],
   "source": [
    "# Perturbation levels to test\n",
    "e_vals = CArray.arange(start=0, step=0.05, stop=0.5)\n",
    "\n",
    "from secml.adv.seceval import CSecEval\n",
    "sec_eval = CSecEval(\n",
    "    attack=pgd_attack, param_name='epsilon', param_values=e_vals)\n",
    "\n",
    "# Run the security evaluation using the test set\n",
    "print(\"Running security evaluation...\")\n",
    "sec_eval.run_sec_eval(ts)\n",
    "\n",
    "fig = CFigure(height=5, width=5)\n",
    "\n",
    "# Convenience function for plotting the Security Evaluation Curve\n",
    "fig.sp.plot_sec_eval(\n",
    "    sec_eval.sec_eval_data, marker='o', label='NN', show_average=True)\n"
   ]
  }
 ],
 "metadata": {
  "celltoolbar": "Slideshow",
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 1
}